How to read the engineering password from the software update files

[N-Pass.Granted]

Hello woNderful people,

I am an IT guy more than a car guy so I was naturally frustrated when trying to google for which code to use to access engineering mode of the infotainment system.
You just get a list of random codes and none of them work so what do you do?
well.. you read the codes yourself!
How? from the update files, of course.

I will try to simplify and guide you through what Radoslav Gerganov already explained here https://xakcop.com/post/hyundai-hack/

So Basically what you want to do is download the latest software update here: https://update.hyundai.com/EU/DE/navigationUpdate

after downloading the installer, you can download the software update package on the computer and then move it to a sd card or usb drive, depending on your car model.
You want to first install the software update on your car and then, in order to extract the engineering-mode passwords, you need to follow these steps:

1) Extract the update.zip file inside of update_package.zip file found under \eur\pden\update\system (at least in my case. just search for a ".zip" file, it should be the only one)
update.zip is password protected, so this is the biggest challenge for this procedure.
you can either try one of the password listed here xdaforums or try and hack it yourself using bkcrack.
for me, it was 5FF4FAE90578448FE5DE1E106D91

2) extract system.ext4 in a folder and, if you're on Windows, open the file using Ext2Read

3) Open the "app" folder and search for HKMC_EngineerMode.apk then right click -> save (now save the file in a folder)

4) Using jadx-GUI open the extracted apk file and use ctrl+f to search for "pswd" (Make sure you set the check on "resources")



there are your engineering passwords!

<string name="eng\_pswd\_0">2519</string>
<string name="eng\_pswd\_1">2611</string>
<string name="eng\_pswd\_2">2621</string>
<string name="eng\_pswd\_3">0031</string>
<string name="eng\_pswd\_4">0044</string>
<string name="eng\_pswd\_5">0755</string>
<string name="eng\_pswd\_6">0567</string>
<string name="eng\_pswd\_7">1278</string>
<string name="eng\_pswd\_8">0986</string>
<string name="eng\_pswd\_9">2590</string>

Consider that the number you see after pswd_ has to match the last number of year of the current date of the infotainment system.
For instance, for 2024 the code would be 0044.

Happy hacking!

Thanks again to @rgerganov, he's the man!

 

[jeroenvde]

Awesome!

I have tried the bkcrack methode last year but failed terrible at converting to msdos time format
Thank you for sharing this information with us.

Now you have opened this treasure chest, will you be making modifications to the apps?
Oil temps would be nice to add to the N app for the pre-facelift models. Not sure how easy this will be to communicate with the Micom canbus chip...


Keep us updated on your discoveries!

 

[N-Pass.Granted]

Awesome!

I have tried the bkcrack methode last year but failed terrible at converting to msdos time format
Thank you for sharing this information with us.

Now you have opened this treasure chest, will you be making modifications to the apps?
Oil temps would be nice to add to the N app for the pre-facelift models. Not sure how easy this will be to communicate with the Micom canbus chip...


Keep us updated on your discoveries!

I actually just really wanted wireless CarPlay tbh.. I don’t know if I want to tamper with the apks too much but that oil temp thing really caught my attention.

 

[jeroenvde]

Yes you do want to tamper with it
I have a spare unit to experiment on. Sadly I'm nowhere near a programmer.
Some extra apps would be great like locus maps to follow a GPX file

 

[Felix]

I actually just really wanted wireless CarPlay tbh.. I don’t know if I want to tamper with the apks too much but that oil temp thing really caught my attention.

Did you get it to work with the latest software version?

 

[N-Pass.Granted]

Did you get it to work with the latest software version?

No but in working on it..

 

[DirkPitt]

Did you get it to work with the latest software version?

Checking in, any luck getting wireless carplay to work?

 

[Gabby]

Hello woNderful people,

I am an IT guy more than a car guy so I was naturally frustrated when trying to google for which code to use to access engineering mode of the infotainment system.
You just get a list of random codes and none of them work so what do you do?
well.. you read the codes yourself!
How? from the update files, of course.

I will try to simplify and guide you through what Radoslav Gerganov already explained here https://xakcop.com/post/hyundai-hack/

So Basically what you want to do is download the latest software update here: https://update.hyundai.com/EU/DE/navigationUpdate

after downloading the installer, you can download the software update package on the computer and then move it to a sd card or usb drive, depending on your car model.
You want to first install the software update on your car and then, in order to extract the engineering-mode passwords, you need to follow these steps:

1) Extract the update.zip file inside of update_package.zip file found under \eur\pden\update\system (at least in my case. just search for a ".zip" file, it should be the only one)
update.zip is password protected, so this is the biggest challenge for this procedure.
you can either try one of the password listed here xdaforums or try and hack it yourself using bkcrack.
for me, it was 5FF4FAE90578448FE5DE1E106D91

2) extract system.ext4 in a folder and, if you're on Windows, open the file using Ext2Read

3) Open the "app" folder and search for HKMC_EngineerMode.apk then right click -> save (now save the file in a folder)

4) Using jadx-GUI open the extracted apk file and use ctrl+f to search for "pswd" (Make sure you set the check on "resources")

View attachment 24386

there are your engineering passwords!

<string name="eng\_pswd\_0">2519</string>
<string name="eng\_pswd\_1">2611</string>
<string name="eng\_pswd\_2">2621</string>
<string name="eng\_pswd\_3">0031</string>
<string name="eng\_pswd\_4">0044</string>
<string name="eng\_pswd\_5">0755</string>
<string name="eng\_pswd\_6">0567</string>
<string name="eng\_pswd\_7">1278</string>
<string name="eng\_pswd\_8">0986</string>
<string name="eng\_pswd\_9">2590</string>

Consider that the number you see after pswd_ has to match the last number of year of the current date of the infotainment system.
For instance, for 2024 the code would be 0044.

Happy hacking!

Thanks again to @rgerganov, he's the man!

I have Elantra 2021 limited and i did an update on it but everything gone bad afterwards it keeps freezing I can’t do anything and I managed to get the engineering mode but am stuck with password i cant get in to uninstall the update please help

 

[Gabby]

I actually just really wanted wireless CarPlay tbh.. I don’t know if I want to tamper with the apks too much but that oil temp thing really caught my attention.

Please kindly help me with my Elantra 2021 limited i have tried to get into the dealer mode but all the password i try is not working.

 

[abudagga]

Hello woNderful people,

I am an IT guy more than a car guy so I was naturally frustrated when trying to google for which code to use to access engineering mode of the infotainment system.
You just get a list of random codes and none of them work so what do you do?
well.. you read the codes yourself!
How? from the update files, of course.

I will try to simplify and guide you through what Radoslav Gerganov already explained here https://xakcop.com/post/hyundai-hack/

So Basically what you want to do is download the latest software update here: https://update.hyundai.com/EU/DE/navigationUpdate

after downloading the installer, you can download the software update package on the computer and then move it to a sd card or usb drive, depending on your car model.
You want to first install the software update on your car and then, in order to extract the engineering-mode passwords, you need to follow these steps:

1) Extract the update.zip file inside of update_package.zip file found under \eur\pden\update\system (at least in my case. just search for a ".zip" file, it should be the only one)
update.zip is password protected, so this is the biggest challenge for this procedure.
you can either try one of the password listed here xdaforums or try and hack it yourself using bkcrack.
for me, it was 5FF4FAE90578448FE5DE1E106D91

2) extract system.ext4 in a folder and, if you're on Windows, open the file using Ext2Read

3) Open the "app" folder and search for HKMC_EngineerMode.apk then right click -> save (now save the file in a folder)

4) Using jadx-GUI open the extracted apk file and use ctrl+f to search for "pswd" (Make sure you set the check on "resources")

View attachment 24386

there are your engineering passwords!

<string name="eng\_pswd\_0">2519</string>
<string name="eng\_pswd\_1">2611</string>
<string name="eng\_pswd\_2">2621</string>
<string name="eng\_pswd\_3">0031</string>
<string name="eng\_pswd\_4">0044</string>
<string name="eng\_pswd\_5">0755</string>
<string name="eng\_pswd\_6">0567</string>
<string name="eng\_pswd\_7">1278</string>
<string name="eng\_pswd\_8">0986</string>
<string name="eng\_pswd\_9">2590</string>

Consider that the number you see after pswd_ has to match the last number of year of the current date of the infotainment system.
For instance, for 2024 the code would be 0044.

Happy hacking!

Thanks again to @rgerganov, he's the man!

Can u check for genesis g70 2018 model I tried all the passwords but it's not working

 

[natesc0tt]

No but in working on it..

any update with eng mode/nav mods/wireless AA/carplay?

 

[Lemming]

I got all excited but realised you’ve got the N so I’ll be dealing with a completely different package. I’ve got ye olde i30 2019 model with the Gen5 head unit. Do you think your method would be applicable? There isn’t a zip file in the update package I downloaded. Does that only get created after installation?

 

[rahil]

hey i have kia seltos with this version SP2i.IND.0000.156.001,230417 in enginerring mode it shows 8 digit password help me out

​

 

[i30n_carbon]

Hi everyone,

I’m currently exploring the Engineering Mode app for Hyundai vehicles, and I noticed something intriguing with the latest version of the software. In older versions, the passwords for accessing the Engineering Mode were often stored in plain text within the app. However, with the current software version, it seems Hyundai has added a layer of obfuscation or encryption.

Here’s what I’ve found so far:

• The app defines several password-related variables in the code (e.g., eng_pswd_default, eng_pswd_0, eng_pswd_1, etc.), but instead of plain text, they are represented as integer resource IDs (e.g., 0x7f08073b).
• These resource IDs typically refer to entries in the strings.xml file or other resource files within the app, but in this case, they don’t seem to directly map to visible passwords.
• I’ve decompiled the app and analyzed its resources, but I haven’t been able to locate the actual password values.

I suspect the passwords might now be dynamically generated, hidden within the compiled code (e.g., in the smali files), or obfuscated in a way that’s not immediately apparent.

Here’s a screenshot of the current findings:




Has anyone else encountered this issue? Is there a way to uncover these passwords in the new version of the app? Or could they now be encrypted or hashed in a different part of the software?

Any insights or suggestions would be greatly appreciated. Thank you in advance for your help!

 

[IvanV]

View attachment 26186

Hi everyone,

I’m currently exploring the Engineering Mode app for Hyundai vehicles, and I noticed something intriguing with the latest version of the software. In older versions, the passwords for accessing the Engineering Mode were often stored in plain text within the app. However, with the current software version, it seems Hyundai has added a layer of obfuscation or encryption.

Here’s what I’ve found so far:

• The app defines several password-related variables in the code (e.g., eng_pswd_default, eng_pswd_0, eng_pswd_1, etc.), but instead of plain text, they are represented as integer resource IDs (e.g., 0x7f08073b).
• These resource IDs typically refer to entries in the strings.xml file or other resource files within the app, but in this case, they don’t seem to directly map to visible passwords.
• I’ve decompiled the app and analyzed its resources, but I haven’t been able to locate the actual password values.

I suspect the passwords might now be dynamically generated, hidden within the compiled code (e.g., in the smali files), or obfuscated in a way that’s not immediately apparent.

Here’s a screenshot of the current findings:




Has anyone else encountered this issue? Is there a way to uncover these passwords in the new version of the app? Or could they now be encrypted or hashed in a different part of the software?

Any insights or suggestions would be greatly appreciated. Thank you in advance for your help!

Do not decompile the odex file, load apk directly and you will find it in strings.xml. Odex file doesn't have that directly visible.
For everyone else who needs password for the zip file. 5FF4FAE90578448FE5DE1E106D91 will work probably only in EU and UK as password is derived from build.prop where one of the parameters is region. For EU an UK, region code is GB. So if you are from Australia or USA, password will be probably different. Also there is product name, for EU it's pden_eu, I assume different for USA/Aus. If you want to find a password for different regions, I've created a small python script where you can just play with values and see, if the password for the zip works:

hyundai-firmware/zip_passwd.py at main · IvanVojtko/hyundai-firmware

Contribute to IvanVojtko/hyundai-firmware development by creating an account on GitHub.

github.com

I managed to find a loophole even in the latest firmware, so now I'm able to install modified firmware into my car. I also managed to brick my HU a few times, but I was able to recover so far I will write a blog post probably about it, if anyone is interested.

For people who are expecting wireless AA/Carplay. That functionality is not there at all. Only wired one. There is an app called HKMC_GPM (if I remember correctly) and that takes care of phone projection. It has no wireless functionality.

There could be a possibility how to add it. If we find a firmware which contains this functionality, we could extract it and put into ours and it might work. Anyone knows about any car with Gen5 or Gen5W HU which has wireless AA enabled?

 

[Akiles]

Do you know how to change the car picture of screen to one of a I30n?

 

[IvanV]

What exactly do you mean? Could you be more specific?

 

[The1Nonly]

I wish I could change the color of the i30 N that‘s shown in the menu screens

 

[aNXiETY]

Do not decompile the odex file, load apk directly and you will find it in strings.xml. Odex file doesn't have that directly visible.
For everyone else who needs password for the zip file. 5FF4FAE90578448FE5DE1E106D91 will work probably only in EU and UK as password is derived from build.prop where one of the parameters is region. For EU an UK, region code is GB. So if you are from Australia or USA, password will be probably different. Also there is product name, for EU it's pden_eu, I assume different for USA/Aus. If you want to find a password for different regions, I've created a small python script where you can just play with values and see, if the password for the zip works:

hyundai-firmware/zip_passwd.py at main · IvanVojtko/hyundai-firmware

Contribute to IvanVojtko/hyundai-firmware development by creating an account on GitHub.

github.com

I managed to find a loophole even in the latest firmware, so now I'm able to install modified firmware into my car. I also managed to brick my HU a few times, but I was able to recover so far I will write a blog post probably about it, if anyone is interested.

For people who are expecting wireless AA/Carplay. That functionality is not there at all. Only wired one. There is an app called HKMC_GPM (if I remember correctly) and that takes care of phone projection. It has no wireless functionality.

There could be a possibility how to add it. If we find a firmware which contains this functionality, we could extract it and put into ours and it might work. Anyone knows about any car with Gen5 or Gen5W HU which has wireless AA enabled?

I know, that it was possible with old firmware. You were able to choose a different CPU Config which led to wireless AA / Carplay working. Maybe the key is the old firmware. Cool infos tho! If you don't mind please do a full thread on it. I would be very interested how it's possible to modify that kind of stuff, and i am probably not alone with that.

 

[IvanV]

I know, that it was possible with old firmware. You were able to choose a different CPU Config which led to wireless AA / Carplay working. Maybe the key is the old firmware. Cool infos tho! If you don't mind please do a full thread on it. I would be very interested how it's possible to modify that kind of stuff, and i am probably not alone with that.

I have very old firmware available, and it's not possible. I think it was possible in regular i30, not the N one. If we could get firmware from old i30 where it was possible, maybe we could get it into N firmware. In general those firmwares are the same, they just produce different package based on car equipment, location, type... I found feature flags for pandora, soundcloud, baidu and more, but even if I enable it, nothing will happen as APKs for it are not available in our (mine) firmware.