A few weeks ago, I was asked to check the car's radio that had an issue with power on. It was the Blaupunkt Bremen 975, which is one of those radios with Android. The initial check and measurements showed that, from the perspective of electronics, everything looked fine. I assumed that must be something with operating systems. So, I have tried to find a way to enter recovery mode or an option which wipes the cache partition. After a few attempts, I found that pressing the HOME button at the power stage enters some kind of recovery mode, but instead of the classical option to choose, it immediately tried to update with a fail message.
This was just a recovery update option. Additionally, while checking the main board, I found at the bottom of the radio a connector. I assumed that could be UART. I have connected a logic analyzer to check if this assumption is correct and if there is any output there.
Successfully, the assumption was true. It was UART with enabled output information. Thanks to that, I confirmed that the device has problems with the system. Based on the logs, there was information that it was not possible to start system init scripts. Unfortunately, the entry to the bootloader was not possible and, due to the broken system, it was possible to only use UART in read mode. But I have started exploring the recovery upgrade mode. This recovery mode was handled at the bootloader level. The bootloader was U-Boot. Based on logs, I found that this recovery mode, as the first stage, reads a file (it was specified filename) and tries to execute its content as U-Boot commands. I have not found any signature or cryptographic verification of this file. So, I have created that file on an SD card with some commands, e.g. help, and entered into the recovery upgrade mode. By this way, it was possible to list all available U-boot commands and execute, e.g. recovery from local partition.
Unfortunately, the attempt to recover from the local partition failed also. I have searched for a similar case on the internet and found this: https://xdaforums.com/t/firmware-upgrade-blaupunkt-capetown-940.3698825/, which confirmed me that the assumption with recovery upgrade mode was correct. I have used the internet archive to check the official Blaupunkt page, and there were available recovery upgrade packages, but unfortunately they were not archived (only manuals). On the current page, there was no information about firmware for those legacy devices. The only way was to contact support to get that recovery package.