Reverse Engineered Media Controller From Car Is Best Friends With Android

The CAN bus is a rich vein to mine for a hacker: allowing the electronic elements of most current vehicles to be re-purposed and controlled with ease. [MikrocontrollerProjekte] has reverse engineered a CAN bus media and navigation controller and connected it to an STM32F746G-Discovery board. The STM32 is in turn connected to an Android phone, and allows the media controller to trigger a large number of functions on the phone, including music playback, maps, and general Android navigation.

When reverse engineering the controller, [MikrocontrollerProjekte] employed a variety of approaches. A small amount of information was found online, some fuzzing was done with random CAN bus IDs and messages, as well as some data logging with the device inside the car to identify message data to the relevant IDs on the bus.

The STM32F746G-Discovery board acts as a Human Interface Device (HID), emulating a mouse and keyboard connected to the Android phone via USB OTG. The LCD screen shows the output of the keystrokes and touchpad area. We’re not sure how useful the mouse-emulation would be, given that the phone has a touchscreen, but the media functions work really well, and would also make a really snazzy music controller for a PC.

We’ve covered plenty of other cool CAN bus hacks, like reverse-engineering this Peugeot 207, or this general purpose CAN sniffer.

17 thoughts on “Reverse Engineered Media Controller From Car Is Best Friends With Android

  1. I like the elegant test bench. I can’t say enough about the importance of cleanliness and organization when testing and prototyping. Its something I only got in to after many years and wish i would of learned it sooner.

  2. Meh…cool hack but no documentation to find whatsoever. And he actually said in one of his commends on a previous video that he has not published anything and “You will find some info on the internet. Or poke around yourself and find things out.”

  3. That’s so awesome. With the amount of work put into those controllers, the quality of plastics and switches, plus the availability in local scrapyards this looks like a great source of HID for projects. Just imagine a DIY BT speaker with such a controller.

    1. +1.

      It seems this guy mainly thinks about earning money via YT and patreon instead of contributing to anything himself. But there is not even any mention if he is willing to give out info to patreon supporters, not even talking about average Joe. Then again, there doesn’t seem to be any reason to support him via patreon, if you ask me.

      I wonder how much open source code he got off the net for this which he doesn’t tell about.

      1. I’ve made things for myself, and my family without flinging code all over the internet as well, that’s not inherently a bad thing.
        And using open source code in a personal project is also not a bad thing. As has been pointed out, this isn’t a commercial project.

        1. but he is asking for patreon support for his showing off, and highly likely his showing off is using open source software to create his “show”. so does he then pass a percentage of his patreon earnings to the folks who created any libraries used?

          basically it’s just poor form and doesn’t deserve a spotlight.

  4. Why not be clear about where this thing comes from? (A lot of different models of a certain Bavarian motorcar works ;) . This also included a certain modern reproduction of an english classic built by said company)

    1. Wasn’t it easier just to say it was a BMW iDrive module instead of a bigass link?

      With that being said… Thanks for that, I was wondering where it came from, it looked similar.

  5. hi I have bought bmw idrive control unit 6582 9350723-03 .I supplided its connecter as :1=12v, 2=gnd, 3=can H, 4=can L .also I connected neoVIfire can_bus diognastic tool to drive idrive but there is no any signal or activation on the canbus when I checked with oscilosscope. what can be the problem. Is there any special key/command that I should send ?sserdener@gmail.com.
    +90532 685 40 18 for whatsapp.

Leave a Reply to ChrisCancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.