MG4 Secret Menu Mode...

[leonkernan]

Ok, so progress.

The engineering second level password is a number. (In my case, 8 digits)

The problem is it appears to be calculated from your cars serial number, so it's different for everybody. I haven't sat down to figure out how they convert the serial number into the code yet.

The way I got it was:

• Bring up the password box and try something, which will be wrong.
• Export the HU logs to a USB stick
• Open the dmesg files for that session in a text editor app on a PC and search for "password".

No kidding, when they compare what you enter to the password, they put the actual password in the Android logs!!!!

it looks something like this:

A9_Diag_V1.0.0.58_P: [MainMenuModel] getRightPassword
PasswordFactory: getPassword origin sn - xxxxxxxxxxxxxx
PasswordFactory: getPassword ---> str_sn - xxxxxxxxxxxxxxx
PasswordFactory: getPassword ---> pwd = 12345678

Behind that password box a couple of extra buttons open up: "Tools" and "Disable Version Check"
In Tools:

• Reboot
• Factory Reset
• Switch to OTG (changes to Switch to Host when pressed)
• Disable AA (Android Auto)
• Disable CP (Carplay)

For those people wanting to disable features / etc, this isn't for you. The main purpose for the moment is to allow people with Android coding experience to get into the system and start poking around.

 

[Coulomb]

No kidding, when they compare what you enter to the password, they put the actual password in the Android logs!!!!

I can almost understand it; they sometimes need to understand the hashing of the VIN or serial number. But there is a slight security issue... ?

 

[leonkernan]

Haven't been able to get OTG or ADB to do anything interesting yet.
Disabling AA and CP does have an effect though, the dashboard gets a big settings button in their place!

 

[tsedge]

Ok, so progress.

The engineering second level password is a number. (In my case, 8 digits)

The problem is it appears to be calculated from your cars serial number, so it's different for everybody. I haven't sat down to figure out how they convert the serial number into the code yet.

The way I got it was:

• Bring up the password box and try something, which will be wrong.
• Export the HU logs to a USB stick
• Open the dmesg files for that session in a text editor app on a PC and search for "password".

No kidding, when they compare what you enter to the password, they put the actual password in the Android logs!!!!

it looks something like this:

A9_Diag_V1.0.0.58_P: [MainMenuModel] getRightPassword
PasswordFactory: getPassword origin sn - xxxxxxxxxxxxxx
PasswordFactory: getPassword ---> str_sn - xxxxxxxxxxxxxxx
PasswordFactory: getPassword ---> pwd = 12345678

Behind that password box a couple of extra buttons open up: "Tools" and "Disable Version Check"
In Tools:

• Reboot
• Factory Reset
• Switch to OTG (changes to Switch to Host when pressed)
• Disable AA (Android Auto)
• Disable CP (Carplay)

For those people wanting to disable features / etc, this isn't for you. The main purpose for the moment is to allow people with Android coding experience to get into the system and start poking around.

Does Reboot reboot the whole car or just infotainment? If it does a whole car reboot it would be very useful to have access to it.

 

[the happy bunny]

Hello

I‘ve delved deeper into the SE engineering menu (still on R21 here).



While in the USB Update menu, I tapped on the right “Update USB”, revealing another sub-menu, in chinese!

My proficiency in Chinese is limited to some mispronounced greetings, but luckily Apple Translate proved helpful…

I dared to press these commands, but i was met with the message “no mobile devices”

Same results with a Bluetooth phone connected, with data enabled, with AA/CP enabled.

 

[Diggsy]

You guys are doing some great work! Looking forward to seeing what you uncover next!

 

[hojnikb]

I'd be great for someone to figure out how to sideload apps, so even base spec could have things like navigation and stuff. No need to always have phone connected.

 

[the happy bunny]

Yep, but the app would need to access GPS data, access network and probably be able to use gApps for major GPS applications such as Waze or Google maps… and you would also need an alternate launcher.

The infotainment system is running on android but is by no means a phone or a tablet. It’s theoretically possible but I’d bet it won’t happen. (And I didn’t even mention warranty issues and the risk of bricking the car while tinkering).

The best option currently is Android Auto or CarPlay, and if you want it to work wirelessly, you may want to purchase a CarLinkIt adapter.

 

[hojnikb]

Yep, but the app would need to access GPS data, access network and probably be able to use gApps for major GPS applications such as Waze or Google maps… and you would also need an alternate launcher.

The infotainment system is running on android but is by no means a phone or a tablet. It’s theoretically possible but I’d bet it won’t happen. (And I didn’t even mention warranty issues and the risk of bricking the car while tinkering).

The best option currently is Android Auto or CarPlay, and if you want it to work wirelessly, you may want to purchase a CarLinkIt adapter.

Unless it's a specialized and heavily modified version of android, I'm sure something could be done. network GPS and stuff is really just a matter of permissions. It's not like Chinese went ahead and created new APIs to access those. Google Apps could be solved by sideloading microG.

I'd say integrating app into the stock launcher might be harder, but I'm sure if someone ripped apart the underlying launcher, something could be done, I'd wager.

 

[the happy bunny]

In theory, nothing is impossible…

However, in practical terms, with no documentation provided and a system designed exclusively for updates by MG, I sincerely doubt it's feasible.

It’s not as straightforward as sideloading apps!

It would probably require at least gaining root access (on an unknown system), disassembling the launcher (again with no documentation) and modifying it to allow access to an external application… pretty substantial undertaking!

The base system is Android, but this is not a phone. It might well be an outdated version, and we don't even know if the infotainment system is powerful enough to run smoothly Waze or even a standalone GPS.

Car manufacturers often use a base android system (as a low level operating system), often an old version (my 2018 Kia Soul EV was boasting Android 2.3!!!!) but the entire user interface is usually fully integrated in a proprietary launcher (the operating environment), that they are free to develop.

 

[leonkernan]

Does Reboot reboot the whole car or just infotainment? If it does a whole car reboot it would be very useful to have access to it.

Just infotainment.

 

[richlove]

Voice commands? You don't need to use the screen for most things.... allegedly. Have fun trying them. Still trying different ways to say Turn ***** LKA off, but doesnt seem to work... ye t

Radio
Play Radio / Play FM Radio
Play 106.5 FM (Station Frequency)
Play favourite radio station
Save this station as favourite
Remove this station from favourite
Pause radio
Next station
Previous station

System
Make screen the maximum level of brightness
Make screen brighter
Lower brightness
Make screen the darkest
Increase the volume
Volume Down
Volume maximum
Volume minimum
Mute
Unmute
First page
Last page
Previous page
Next page
Go to page 2
Pause radio
Resume
AC on
AC off
Temperature up
Temperature down
Maximum temperature
Minimum temperature
Raise temperature by 2 degrees
Lower temperature by 2 degrees
Set temperature to 22 degrees
Increase fan speed
Decrease fan speed
Highest fan speed
Lowest fan speed
Find charging station
Check remaining range
what is the remaining charge
Open settings
Help

Media
Pause music
Resume music
Next song
Previous song
Loop all
Repeat all
Single loop
Repeat song
Shuffle

Navigation
Open map
Zoom in the map
Zoom out the map
Switch to navigation
Find (hospital, restaurant, petrol station)
Set home address
Set office address
Go home
Go to office
Zoom in the map to maximum
Reset map zoom level
Where am I
Cancel route
Switch to fastest route
Switch to avoiding tollway route

Phone
Call 04XX XXX XXX
Call Dad (contact)
Call back
Redial

Is there a way to activate the voice prompt readiness via a voice command ('OK Google', 'Alexa' style) or is the only way through the voice button on the steering wheel?

 

[WonkoTheSaneUK]

Is there a way to activate the voice prompt readiness via a voice command ('OK Google', 'Alexa' style) or is the only way through the voice button on the steering wheel?

I've found it wakes up if it hears you say anything that sounds like "MG".
EDIT - There is a setting in the menus that makes it only react the the button, if you prefer.

 

[Martinonline]

Particularly when you see some idiotic driving and you say 'O M G'.

 

[siteguru]

I've never noticed voice commands work in the SE. (Other than Hey Google via Android Auto). ?‍

 

[richlove]

I've never noticed voice commands work in the SE. (Other than Hey Google via Android Auto). ?‍

So, maybe they don't work in the SE. I tried a variety of 'MG' commands which didn't do anything.

Pressing the steering wheel voice button activates Google Assistant, so not sure how you activate the MG assistant?

 

[siteguru]

I've never tried doing a single tap in mine - I've always instinctively pressed and held for a couple of seconds to launch the Google Assistant. ?‍

 

[Rolfe]

I need to find out how to do these things.

 

[siteguru]

When you have your phone connected to the car (e.g. to use Google maps) and you've selected the Android Auto button (if AA hasn't come up automatically), press and hold the Voice button (top left on the steering wheel) and wait for the "bidly-bing" sound from AA and a visual prompt at the bottom of the screen. Then say (for example) "call <contact name>" and Google should place the call. (You should see text representing what you've just said in that visual prompt). If that person has more than one number in the contact card in your phone then it should prompt you to select which one. Alternatively say "call <contact name> mobile" (for example) and it should dial their mobile number.

 

[richlove]

It has some nice other features, for example if you're using an app like TuneIn radio, you can just say 'Hey Google, play Magic' (not even worrying about the button) and it will figure it out. Saves a bit of screen faff