Sync Connect Retrofit (in any Ford).
03-12-2021, 08:34 PM
#3581
Junior Member
@jm061 I have an idea I was wondering if you could test since you have a bench setup.
I was thinking about how the TCU might become authorized. If certain VINs are actively blocked, what's to stop one of us from temporarily spoofing a VIN in the Ford Pass account and in the vehicle? I'm curious if it's possible to take a VIN of a 2020 Platinum F150, create an account with it and temporarily change the VIN on the user's end in-vehicle to force authenticate an otherwise incompatible model.
I'm nearly certain VIN info isn't in the gateway, but it is located at the addresses listed below. I assume the TCU verifies the VIN between Ford's server and the end user BCM or FCIM, because I can't think of how else the authentication passes
I was thinking about how the TCU might become authorized. If certain VINs are actively blocked, what's to stop one of us from temporarily spoofing a VIN in the Ford Pass account and in the vehicle? I'm curious if it's possible to take a VIN of a 2020 Platinum F150, create an account with it and temporarily change the VIN on the user's end in-vehicle to force authenticate an otherwise incompatible model.
I'm nearly certain VIN info isn't in the gateway, but it is located at the addresses listed below. I assume the TCU verifies the VIN between Ford's server and the end user BCM or FCIM, because I can't think of how else the authentication passes
I was thinking something along those lines too, though I'm hesitant to change the VIN in some of my AsBuilts. I was going to watch and see if the handshake between the car and TCU included my VIN being announced. I'm sure when the TCU connects to Ford, it says "hi, I'm esn xxxyyy. I'm installed in vin xyzzzzzz...."
When you do an authorize attempt there's only 4 messages being broadcast from the TCU, repeated twice. Three of the four are just your name it looks like, but trying to manually broadcast all 4 didn't bring up the prompt again.
since my account isn't old enough to list the tcu in the classified, I'll have some time to play with it. I was going to use the VIN from the salvage car the tcu came out of.
Luckily on the Flex, i-can is pins 1/9 on the obdii port. Nice and easy to access. Bonus, 3D printed a little piece to hold Dupont leads in place, rather than order the proper connector.
Last edited by XirallicBolts; 03-12-2021 at 08:41 PM.
03-12-2021, 08:48 PM
#3582
It's my first day
Thread Starter
The only thing stopping me from testing it now is that I have Sync Connect from the factory which works perfect. The XLT I stuffed the retrofit into is 3000 miles away. I can understand your hesitancy of changing your as built vin info. I think testing a borrowed VIN in the FCIM & BCM is the likely place to try. Changing the VIN in the RCM or ABS module could be dangerous for a few reasons, which is why a bench setup is best for this kind of thing.
Last edited by Airborne_Ape; 03-12-2021 at 09:06 PM.
03-13-2021, 12:17 AM
#3583
The only thing stopping me from testing it now is that I have Sync Connect from the factory which works perfect. The XLT I stuffed the retrofit into is 3000 miles away. I can understand your hesitancy of changing your as built vin info. I think testing a borrowed VIN in the FCIM & BCM is the likely place to try. Changing the VIN in the RCM or ABS module could be dangerous for a few reasons, which is why a bench setup is best for this kind of thing.
03-14-2021, 08:57 AM
#3585
Junior Member
The furthest I'd be willing to go is attempt a man-in-the-middle with the canbus messages, isolating the TCU. Monitor every message coming in to the tcu and if it contains my vin, modify it to a different model
03-15-2021, 02:21 PM
#3587
Just so everyone is aware this user ^ is awesome!
He’s busy building his own open source autopilot system for Ford vehicles but messaged me regarding an open source python repository that exists which can essentially be used to build an app that replaces Ford Pass for all of us.
Keep in mind Ford Pass is just a shell with an entirely web based api. The purpose of Ford Pass is just a GUI that does this:
Get
https://fcis.ice.ibmcloud.com/v1.0/e.../default/token
Verify
clientId: 9fb503e0-715b-47e8-adfd-ad4b7770f73b
applicationId: 71A3AD0A-CF46-4CCF-B473-FC7FE5BC4592
Vin
User Name
Password
Get dictionary from URL
Get value for access token
Get https://usapi.cv.ford.com/api/vehicles/v4/VIN/status
Unfortunately, the only thing the Ford Pass app actually exists for (its Graphical Interface), is broken as we all know. So I was wondering if anyone might be interested in contracting some grad student for $5 to build a working app to bypass Ford Pass entirely and permanently.
User roxasthenobody98 mentioned he’s already looking into it but has no timeline and may require donations to support such a project.
He’s busy building his own open source autopilot system for Ford vehicles but messaged me regarding an open source python repository that exists which can essentially be used to build an app that replaces Ford Pass for all of us.
Keep in mind Ford Pass is just a shell with an entirely web based api. The purpose of Ford Pass is just a GUI that does this:
Get
https://fcis.ice.ibmcloud.com/v1.0/e.../default/token
Verify
clientId: 9fb503e0-715b-47e8-adfd-ad4b7770f73b
applicationId: 71A3AD0A-CF46-4CCF-B473-FC7FE5BC4592
Vin
User Name
Password
Get dictionary from URL
Get value for access token
Get https://usapi.cv.ford.com/api/vehicles/v4/VIN/status
Unfortunately, the only thing the Ford Pass app actually exists for (its Graphical Interface), is broken as we all know. So I was wondering if anyone might be interested in contracting some grad student for $5 to build a working app to bypass Ford Pass entirely and permanently.
User roxasthenobody98 mentioned he’s already looking into it but has no timeline and may require donations to support such a project.
Some of you may know me as @crazy8baller. I've made a few posts here on the forum about modifications that I've done to my truck such as add BLIS, Sync Connect, power fold mirrors, etc. I like many of you have been frustrated as of late with the Ford Pass application not working on my iPhone.
By trade, I am a software engineer, and overtime working with my truck (2019 F-150) I discovered I wanted to learn how Ford uses their internal APIs to connect and control their vehicles. So I decided to do some research/reverse engineering and build an open-source Python project that works programmatically with Sync Connect APIs. You are able to start, stop, unlock, lock, authorize, unauthorize, get information about your vehicle, and much much more. There's a lot of functionality built-in under the hood that Ford doesn't include in their app by default.
This is still in the beta stages, but I've gotten to a point where I am ready for the first initial release and I would love for you all to check it out. See my Github link here. I've included information on how to install, examples to get started, and documentation about everything that you can do to control your Ford vehicle with Python.
I would definitely be interested in developing an app that bypasses Ford Pass if there is enough want/interest for something like that.
(If any of you do decide to try my SDK out and find issues please report them!)
The following users liked this post:
Airborne_Ape (03-18-2021)
03-15-2021, 02:33 PM
#3588
Hey everyone,
I haven't been following this thread closely the last few months but it looks as though some things have changed with this Fordpass mod. I had successfully installed this mod into my 2018 STX that I have since traded. I removed (before I traded) and still have all of the hardware. Does this mean I cannot now just install into my brother ln law's truck and set it up?I hadn't messed with it due to truck availability.
Sorry if this is a dumb question that's been answered before.
thx
I haven't been following this thread closely the last few months but it looks as though some things have changed with this Fordpass mod. I had successfully installed this mod into my 2018 STX that I have since traded. I removed (before I traded) and still have all of the hardware. Does this mean I cannot now just install into my brother ln law's truck and set it up?I hadn't messed with it due to truck availability.
Sorry if this is a dumb question that's been answered before.
thx
03-16-2021, 12:08 PM
#3590
