smeg hack via telnet

You should make on your mobile phone app JuiceSSH, android device preferred. Put to your USB in car empty pendrive.

Details are on the russian forum:

http://www.c4-sedan.ru/forum/viewtopic.php?f=61&t=3349

Via this method, you can activate a lot of functions, for example, buttons, rear camera etc, without diagbox and tokens.

Run SMEG, go to bluetooth pairing and edit profile of your phone - select internet sharing via bluetooth.
Also on your mobile phone you should enable internet sharing via bluetooth.
After that, your car should put information, that internet connection is enabled.

Now, run JuiceSSH or any different telnet/ssh client on your phone and make Quick connection (thunderstorm icon), type of connection: local device, click OK.

Then put in console command:

ip neighbor

you should see a list of connected devices. Remember address IP of bluetooth connection (in my case, address of smeg was 192.168.44.200 or 192.168.44.2).

Then, simply telnet to this address

telnet 192.168.44.200

Connection should be done.

Now, you are logged in to your SMEG
You need to copy files from SMEG to your usb device.

put this command:

cp "/USER_DATA/user_data/sqlite/*","/bd0"

this command will copy all relevant data to your USB stick.

Next, go to your PC. You will see some sqlite files and inf files.
open sqlite file via 7zip and unpack file. Then, open it in, for example, DB Browser - its an editor for SQLite DB.

Themes are stored in up_config.sqlite

For 308 T9, you have only 4 available themes:

Section Name Type Idx IntValue
"display" "Harm_1" "2" "0" "0"
"display" "Harm_2" "2" "0" "0"
"display" "Harm_3" "2" "0" "0"
"display" "Harm_4" "2" "0" "1"
"display" "Harm_5" "2" "0" "0"
"display" "Harm_6" "2" "0" "1"
"display" "Harm_7" "2" "0" "0"
"display" "Harm_8" "2" "0" "0"
"display" "Harm_9" "2" "0" "0"
"display" "Harm_10" "2" "0" "0"
"display" "Harm_11" "2" "0" "0"
"display" "Harm_12" "2" "0" "0"

4 and 6 are standard themes. If you need to have a GTI style theme - red one, please activate it:

"display" "Harm_8" "2" "0" "1"

As I know, for 308 also Harm_9 can be used (so, in summary, we have 4 themes for 308).

save your file and now, you should make a checksum of your modified file. Other themes comes from Citroen, so, if you enable it, you can have some troubles (non exist buttons etc - be careful).

You should use for it RTXcrc.exe and put them to inf file. Open in file editor up_config.sqlite.inf

You will see something like below:

914a0000
CRC_UNCOMPRESSED:28a7
USIZE:33792
SIZE:0

First:
generated with command:
RTXcrc.exe -v up_config.sqlite

in result you will see 4 digits and put the result in:
CRC_UNCOMPRESSED:


second:
please generate it with command:
RTXcrc.exe -v -i up_config.sqlite
in result you will see 4 digits - replace 914a with this digits.



USIZE is a size of file. Please check it and replace if is different.

Now, please create gzip archive of your file and change the name of file to up_config.sqlite

Copy your new file to usb stick, go to car, connect it like on step one (enable internet), open juicessh, connect via telnet to your car, connect usb stick, and put command:

cp "/bd0/*","/USER_DATA/user_data/sqlite"

if everything is OK, on your mobile phone, you will see a list of copied files.

Now, put "reboot" command. Your SMEG will be rebooted.
If checksums are OK, new config will be available.


What can be changed with this method- depends on smeg version - for example:
- bluetooth name of car
- themes
- you can add rear camera and configure lines
- add buttons for example tire pressure control (of course, if you dont have module it will not work but button will be active on your SMEG)
- activation of carplay/mirror
- deactivation of AM radio
- activation of DAB
- many more features.

What is not possible:
- vin change - is stored in two form - one is a ascii notation, second one is encrypted. If you change it in ascii, after some restarts, old vin will be loaded again.
- this method is not working, if you have SMEG +I / IV2 with firmware 6.2 or higher - option internet sharing via bluetooth is disabled.


There are some rules:
1. BACKUP YOUR FIRST INITIAL CONFIG!
2. ALL STEPS YOU ARE DOING AT YOUR RISK!
3. DO NOT EDIT BLUETOOTH PARAMETERS (only name of bluetooth can be edited). IF YOU EDIT THEM, BLUETOOTH CAN BE DAMAGED.


If you have any question, please ask me.

For example, in SMEG + (without navi), there are only 8 themes.