I took a similar approach to this article on the MMI software for my 2021 Q5.

partial emulation of the user space on a near equivalent kernel. java backend w/ angular frontend for the UI.

I was exploring ripping out this terrible workflow of not being able to change the user profile unless the car is started, which means I'm often stuck craming myself into my wife's seat preset to star the car lol.

the f/w uses dm-verity however so I'm not sure what flashing would entail. I'm also afraid to try.

I'd rather try to get privilege escalation on the car itself.

this was maybe a few hours one evening.