I got manual battery preconditioning working with a rooted headunit with NEMESIS. should work on all 22-24 IONIQ 5s, probably other IONIQ models as well. No hardware mod needed!
Managed to gather enough parts from totaled cars on eBay to put together my CCNC development test bench. Got a head unit from a K4, a wiring harness from a K5, and a screen from an EV6. About $600 total for all of it.
Now I can make more progress on my openCCNC exploit and hopefully find another way of rooting the newest version. Been a lot of stuff I want to test that I was too afraid to do on my car lol.
Even the AI is giving up on me 😫 I live nowhere near Washington btw.
Been going through all my grandma‘s things after she passed and found this hidden away buried in the corner of a room. I vaguely remember playing on this when I was like 5, had no clue she kept it all that time.
I’m amazed it still works! Half of the games are still in their wrappers as well, but they have seen better days.
Unfortunately there is quite a few empty boxes with the cartridges nowhere to be found also (The 2 stacks at the top left with the Marios). Hoping they are somewhere else in the house.
We have had roughly 600 8851s deployed for about 3 years now with no issues at first, but as of recently we have been getting an increasing amount of failing phones, at least 2-3 a week now.
A few dozen have failed / failing screens with flickering backlights or LCDs.
A few of them are no longer able to render text properly and the text on the screen slowly get replaced with random symbols and black boxes after a few mins of being on (HOW?? Even a firmware reflash didn't fix this)
Some of them will no longer connect unless I force the switch interface down to 100meg. At 1 gig it just spins forever on "Verify your network Connection"
About a dozen have bad hookswitches that will randomly go off hook while the phone is on the receiver or hang up while in use.
And several are just flat out dead with nothing but an endless red mute button when powered on.
Luckily refurbs are available like crazy now and we have plenty of spares on hand, but what gives? I would have expected $700 phones (at the time) to last more than 3 years. Is anyone else seeing this? How often are you replacing your desk phones?
We are debating if we want to try the new 9800 series phones, or go with a different vendor so we don't run into this same fate in another 3 years...
Slowly managed to work my way up to the rail for this performance and it was totally worth it!
Follow up post to my last one here
https://www.reddit.com/r/KiaEV6/comments/1sjy38q/i_too_have_hacked_my_head_unit/
After I gained arbitrary code execution on my HU and dumped the firmware I have been tearing the system apart nonstop to see what I can do and am finally ready to share the details.
First thing to get out of the way, good news and bad news.
The bad news is that Mobius apparently realized the exploit at about the same time we did, and unfortunately patched it around November of last year for most builds and the latest versions available in the USB updater are no longer vulnerable. So, if you are on a build newer than that, this will not work for you... UNLESS
The good news is that the massive delay in firmware updates for the US last year seems to have caused US builds to desync with the rest of the world, and the latest US builds of FULL CCNC available in the USB updater for Hyundai / Kia vehicles (as of 6/2/26) ARE STILL VULNERABLE, including the 260113 build for the Sorento (but probably not for much longer now that I have posted this...)
What is confirmed possible
- Spawning an SSH server with root login that listens on the built-in hotspot (or if your car doesn't have it, the wireless CarPlay network)
- Engineering Mode access for Variant programming and bunch of other mostly useless functions
- Region change by changing part number via Engineering Mode to the desired region and then initiating a USB update with that region's firmware
- Permanently blocking OTA updates until a factory reset is performed by manipulating json files. Only requires getting root once and it sticks!
- Decrypt and extract USB update files by abusing the updater process (Keys are GLOBAL. Any vehicle can decrypt any firmware from any region)
- Complete control of ambient lighting system via python scripts, allowing for custom effects and patterns
- Take screenshots with a hidden engineering mode function and save them to the USB
- Take stealthy 360 pictures via Python script, without the hazards and headlights coming on
- TAKE 360 VIDEO! All the code is there and fully functional to take a 10s 360 video, there's just no way to access it via a GUI. It can be trigged via DBUS calls.
- Automatically save 360 pics, videos, and screenshots to USB
- All Kia Connect store themes for free, as well as region exclusive themes
- CUSTOM themes via bind mounts (These can only apply when in a rooted state)
- Hyundai GUI on Kia and vis versa. This can stack with custom themes.
- Custom Welcome and Exit animations
- Show all apps on home screen (There are extra steps needed to make them actually run though. And some just don't)
- Open front windows via Python script (not the backs for some reason. It takes the command, but nothing happens)
- Skipping the user agreement screen timer if code execution is achieved before it appears
- Spawning an "Admin Menu" when the favorites button is pressed instead of the intended action.
What is confirmed NOT possible
- Extracting Engineering mode access codes. They are not plaintext like G5W, they are SHA hashes with multiple rounds, making them brute force resistant.
- Built-In Dashcam. This requires quite a bit of extra hardware that is obviously not present on the US models.
- Walk-Away lock. This one was the most disappointing, as the code is there but the BCM rejects the command to enable it...
- Pet Mode. I originally thought this WAS possible as I got the app to launch, but it doesn't actually enable. Apparently, there is a hardware module for this??
- Custom Welcome and Exit sound effects. This is, oddly, entirely controlled by the instrument cluster, not the head unit
- Anything to do with the Cluster or HUD really. Totally separate systems. May be able to display custom text, but that's about it.
- Custom themes in an unrooted state. Themes are periodically sig checked after install, so modifications are detected and the system deletes the theme.
- Custom VESS sounds. Sorry, but no fart or Nyan cat sounds as you drive around :(
- Headlight and taillight control. Different bus not write accessible by the HU.
What MIGHT be possible, but untested
- Enabling SVM in motion. This is obviously possible, but I have not managed to find the check yet to patch this.
- Custom implementation of Walk Away Lock. On the G5W HU, it was possible to send a lock / unlock CAN command. I have not found how to do this yet, if it is possible. But if it is, you could easily have the HU just send a lock command shortly after the doors close and the key has left the vehicle.
- Taking 360 Pics and Videos while driving. This should be possible, but like the first point, I have not figured out how to patch this check yet..
- Using the built in SIM for unlimited data. The way the unit handles this is very odd and requests to download updates or themes seems to be sent over a separate bus to the modem which then responds, so the HU does not have internet access directly. If this can be hijacked, idk. But this has a very high chance of getting your modem blacklisted, and is also ILLEGAL, so I haven't tried.
- Connecting the HU to Wi-Fi instead of using cellular. The engineering mode process does have the code to do this, but no GUI option. I could not get it functional, but did not spend much time on it either. Attempting to switch the HU wireless card out of AP mode manually causes it to panic and reboot.
- GPS spoofing. The Navi app has code for "Location Simulation", but I have not attempted to use it yet.
- HDA EVERYWHERE! This is controlled by the Navi app telling the rest of the car which roads are highways based on its map database. Can it be manipulated? Probably. But unknown how.
- Closing the windows all the way. I can open the front windows all the way via a Python script, but attempting to close them the same way results in it stopping 2 inches from the top and the BCM rejecting the command to keep going... wtf??
- Hyundai store themes on Kia instrument cluster and vis versa? It may be possible to apply official themes not made for your vehicle as long as the sig is valid. Have not tested.
If you are looking for more info or would like to contribute, you can join our Discord here:
And we need your help! After release, my next target is the instrument cluster. I have boot and kernel logs from the CLU, however, I have been unable to get ahold of any cluster files. If you know where we can get ahold of CLU updates or real car image files, OR if you just have any old builds of CCNC firmware that were available from the USB updater around mid 2025 still saved that you would be willing to share, it would be of great use.
Unfortunately, this post has also hit the character limit. I have shared more info about the hack here
https://www.kiaevforums.com/threads/root-access-achieved-to-ccnc-infotainment-systems.16595/
I have shared a tour of CCNC Engineering Mode here:
I fucking love Subway but lately it just hasn’t seemed like it’s worth it. I’ve seen more meat on a $5 gas station sandwich lmao.
I have a bunch of firmware files for Kia / Hyundai vehicles that I have been archiving from their USB updater tool. They remove the downloads for old versions from their website once a new one comes out.
I am looking to upload these old versions, but trying to find a way to organize them that makes sense. The files for each vehicle look like this.
The main .enc files are the same for all models and have identical hashes across ~10 vehicles for the USA region, but the MAINCONFIG file is different and cryptographically signed. You must have the appropriate MAINCONFIG file for your vehicle in order for it to accept the firmware files.
What would be the best way of organizing all of these into folders by vehicle for easy download? I don't want to reupload the same files 10 times per version for a folder for each vehicle.
This is how I have it organized on my PC currently. Is something like this possible on IA?
USA Firmware Build 251126 Files
- CCNC_SYSTEM_ALL_XX
- CCNC_MCU_ALL_XX
2025_EV6_USA_251126:
- Vehicle Specific MAINCONFIG
- Symbolic links to USA Firmware Build 251126 Files
2025_Carnival_Hybrid_USA_251126:
- Vehicle Specific MAINCONFIG
- Symbolic links to USA Firmware Build 251126 Files
I was at the indoor stage Sunday afternoon (no idea what it was called) and watched some dude spill almost an entire thing of chicken and rice all over the middle of the floor near the rail. He sat there for a second I guess contemplating his life choices and proceeded to scoop it all back up and continue eating it...
I have seen some nasty shit at these but that absolutely takes the cake. That was disgusting.
