Honda Headunit Reverse Engineering, And The Dismal State Of Infotainment Systems

These days the dozen or so ECUs in an average car are joined by an infotainment system of some type, which are typically a large touch screen on the dashboard (the headunit) and possibly a couple of auxiliary units for the rear seats. These infotainment systems run anything from QNX to (Yocto) Linux or more commonly these days some version of Android. As [Eric McDonald] discovered with his 2021 Honda Civic, its headunit runs an archaic Android dating back to roughly 2012.

While this offers intriguing options with gaining root access via decade-old exploits that the car manufacturer never fixed, as [Eric] notes, this is an advantage that anyone who can gain access to the car’s CAN buses via e.g. the headlights, a wireless access point, or even inject an exploit via ADB radio can use to their advantage. Essentially, these infotainment systems are massive attack surfaces with all of their wired and wireless interfaces, combined with outdated software that you as the vehicle owner are forbidden to meddle with by the manufacturer.

Naturally taking this ‘no’ as a challenge as any civilized citizen would, [Eric] set out to not only root the glorified Android tablet that Honda seeks to pass off as a ‘modern infotainment system’, but also reverse-engineer the system as far as possible and documenting the findings on GitHub. As [Eric] also explains in a Hacker News discussion, his dream is to not only have documentation available for infotainment systems in general as a community effort, but also provide open source alternatives that can be inspected by security researchers rather than being expected to lean on the ‘trust me bro’ security practices of the average car manufacturer.

Although a big ask considering how secretive car manufacturers are, this would seem to be an issue that we should tackle sooner rather than later, as more and more older cars turn into driving security exploits just waiting to happen.

Hackaday Links Column Banner

Hackaday Links: August 29, 2021

If you thought that COVID-19 couldn’t possibly impact space travel, think again. The ongoing pandemic is having unexpected consequences for companies like SpaceX, who are worried about liquid oxygen shortages due to increased demand for medical oxygen. Massive amounts of liquid oxygen are used as the oxidizer for each rocket launch, of course, as well as in hospitals, which have giant tanks of liquid oxygen somewhere on site. Whether destined for space or for patient care, liquid oxygen comes from cryogenic separation plants, and SpaceX fears that they would have to delay or even cancel launches if manufacturers can’t keep up with demand and have to prioritize their healthcare customers. We’re actually not sure if this is a concern, though, since there are usually separate supply chains for medical and industrial gasses. Then again, we’d suspect a rocket engine might prefer to breathe ultra-pure LOX too.

Speaking of space, if you want to be an astronaut, perhaps the first skill you need to develop is patience. Not only might your ride not be ready to go when you are, but at least in the EU, you’ve got a long line of applicants in front of you. The European Space Agency announced this week that they’re working through a backlog of 23,000 applications for astronaut positions. About 20% of those will apparently be dropped in the pre-screening process, but the rest will (eventually) get an invitation to a full-day test at one of the ESA’s facilities. We imagine the attrition rate from there increases dramatically; either that or the ESA intends to hire a lot of astronauts.

Back here on Earth, Google this week did what it seems to do a lot of, and killed off one of its popular apps. This time the victim is the Android Auto phone app, although we have to admit the whole thing is confusing. The app allows you to connect your phone to the infotainment system in a compatible late-model car, letting you access all your apps without having to fiddle with your phone while driving. But Google also had an app that offered the same experience directly on the phone, for cars without a compatible display. As far as we can tell, the on-phone app is the only thing that’s going away in Android 12; the app for in-car displays will continue to be supported. Former users of the phone-only app are being encouraged to migrate to Google Assistant’s Driving Mode. Or, you know, you could just drive the car instead.

So your brand-new video card is running hot, and you can’t figure out why. At your wit’s end, you crack open the card’s cover and find the reason — a somewhat suspicious-looking foreign object. That’s what happened to Antony ter Horst and his Nvidia RTX 3090, which had a finger cot wedged inside it. It would appear to have slipped off the finger of some assembly worker, and it was clearly interfering with heat flow inside the card. Antony posted the pictures on reddit, which of course found much humor in the finger cot’s resemblance to another latex object. For our part, it put us in mind of some other stories of foreign objects found in common products — there’s a reason why we always check a loaf of bread before using it.

And finally, in a lot of ways YouTube has become the new “vast wasteland” of useless content. But like television before it, there are occasional gems to be found, especially to those of us who love to learn a little something as we watch. And so when we stumbled upon a video with the title “Hot Tap and Stopple Bypass at Smoky Lake” we had to check it out just to find out what each of those words meant. It turned out to be a great video on pipeline construction methods. The “hot tap” refers to cutting into the pipeline, containing high-pressure diluted bitumen from the shale oil fields near Smoky Lake, Alberta, without interrupting the flow of product. The “stopple” is a device that can be threaded into the pipe to permanently seal it, diverting the flow to a newly installed bypass. The whole process is fascinating, so we thought we’d share. Enjoy.

Continue reading “Hackaday Links: August 29, 2021”

Raspberry Pi Takes Over Volvo’s Integrated LCD

As [Luuk Esselbrugge] explains in a recent blog post, his 2002 Volvo S60 had an optional GPS navigation system and backup camera that used a motorized display that would rise out of the dashboard when needed. His particular car didn’t come with the hardware installed, but after getting his hands on a display module and doing some research, he figured out how he could drive it with the Raspberry Pi and a couple of microcontrollers.

Given the age of the display, you probably won’t be surprised to hear that it uses composite video. Not exactly high resolution, but in the demonstration after the break, we have to admit it looks more than up to the task. [Luuk] is running Android Auto on the Raspberry Pi 3 through the openauto project, which gives him a nice big display and access to all the navigation and media applications you’d expect. The display doesn’t support touch, but thanks to an ESP32 plugged into the CAN bus, he’s able to control the software by reading the buttons built into the Volvo’s steering wheel.

Composite video sources are switched with a simple relay.

To actually raise and lower the display, [Luuk] found you just need to fire a few bytes down the 1,200 baud serial bus that’s built into the display’s wiring harness. The ESP32 handles this duty as well, at least partly because it’s already plugged into the CAN bus and can tell when the vehicle is in reverse. This lets it bring up the screen to show the video feed from the newly installed backup camera in the event that the Pi hadn’t already asked to raise the display. Incidentally plugging in the phone normally triggers the system to wake up and raise the screen, and disconnecting it will command the screen to lower back into the stowed position.

The attentive reader or Volvo aficionado may be wondering how [Luuk] got the audio working. Since his car’s sound system doesn’t feature an auxiliary input, he’s using an Arduino to spoof the existence of a CD changer, which allows him to inject an audio signal into one of the pins on the back of the radio. Eventually he wants to move this task over to the ESP32, but he says a big change like that will have to wait until warmer weather.

This isn’t the first time we’ve seen the Raspberry Pi used to add enhanced features to a somewhat older vehicle. While some bemoan the increased complexity of modern vehicles, it seems some hackers can’t get enough of it.

Continue reading “Raspberry Pi Takes Over Volvo’s Integrated LCD”

Macros For A Mazda

[Arik Yavilevich] recently upgraded his second-gen Mazda’s control console, going from the stock busy box to an Android head unit that does it all on a nice big touchscreen. It can also take input from the handy steering wheel buttons — these are a great option for keeping your eyes on the road and occasionally startling your unsuspecting passengers when the radio station suddenly changes.

The only problem is that [Arik]’s stock steering wheel doesn’t have any media-specific buttons on it. After a short trip to the junkyard, [Arik] had a fancier wheel to go along with the new head unit.

[Arik] doesn’t use cruise control, and those particular buttons can’t be hooked up with reprogramming the car’s computer, so he made them into macro buttons that control the head unit over Bluetooth, using an STM32 black pill board stashed in the glove box.

[Arik] found out that the cruise control buttons don’t ride the CAN bus — they use a resistor ladder/voltage divider and go directly into the ECU. After that it was mostly a matter of finding the right wires and then cutting and re-routing them to make the buttons work on the ACC setting as well as ON. A brief demo video is idling after the break.

Have an old smart phone lying around? Of course you do. Why not make your own head unit?

Continue reading “Macros For A Mazda”

Crankshaft: Open Source Car Computer

Modern cars and head units are pretty fancy gadget-wise. But what if your car still has an 8-track? No problem. Just pick up a Raspberry Pi 3 and a seven-inch touchscreen, and use Crankshaft to turn it into an Android Auto setup.

The open source project is based on OpenAuto which, in turn, leverages aasdk. The advantage to Crankshaft is it is a plug-and-play distribution. However, if you prefer, you can build it all yourself from GitHub.

Continue reading “Crankshaft: Open Source Car Computer”

Pioneer AVIC Infotainment Units Hacked To Load Custom ROMs

Pioneer’s flagship AVIC line of in-car multimedia systems is compatible with both Android Auto and Apple Car Play, and offers all manner of multimedia features to the driver of today. What’s more, these in-dash wonders have spawned their own community, dedicated to hacking the units. The ultimate infotainment hack is to develop custom ROMs for these devices.

What this means is that owners of Pioneer AVIC units will eventually be able to flash a custom ROM onto their in-car device, allowing it to operate more like any other generic Android tablet on the market. The potential is there for installing custom applications, extra hardware (such as OBD II readers), or pretty much anything else you can do with an Android device.

The hack involves a whole lot of delicate steps, beginning with using a USB stick with a special image to boot the device into a test mode. This allows the internal SD card to be backed up, then overwritten with a new image itself.

Mostly, the hack has been used to allow map files to be updated on the internal SD card — inability to update maps has been a long festering thorn in the side of in-dash navigation systems. Users have been customizing this to suit their requirements, also adding speed camera locations and other features. But overall this hack is a great example of hacking something to get full control over the things you own. At the least, this will allow drivers to ditch the phones suction-cupped to the windshield and run common apps like Waze, Uber, and Lyft directly on the infotainment screen (assuming you can rig up an Internet connection).

Check out another great Android ROM hack — using a cheap old smartphone as a low-cost ARM platform.