Hyundai Is Doomed: Porting The 1993 Classic To A Hyundai Head Unit

June 11, 2023 by 6 Comments

In the natural order of the world, porting DOOM to any newly unlocked computing system is an absolute given. This a rule which [greenluigi1] understands all too well, leading to presumably the first Hyundai to be equipped with this all-time classic on its infotainment system. This follows hot on the trail of re-hacking said infotainment system and a gaggle of basic apps being developed for and run on said head unit (being the part of the infotainment system on the front dashboard). Although it is a Linux-based system, this doesn’t mean that you can just recompile DOOM for it, mostly because of the rather proprietary system environment.

To make life easy, [greenluigi1] picked doomgeneric as the version to port. The main selling point of this project is that it only requires the developer to implement five functions to support a new platform, which then ‘just’ left figuring out how to do this on a head unit. Two of these (DG_SleepMs() and DG_GetTicksMS()) could be copied verbatim from the X11/xlib port, but the remaining three required a bit of sleuthing.

Where things go sideways is with keeping the head unit’s Helix window manager happy, and stick to the limited ways a GUI application can be launched, including the way arguments are passed. For the PoC, it was decided to just hardcode these arguments and only register the game with Helix using an .appconf configuration file. When it came to drawing pretty graphics on the screen, this was decidedly easier since the system uses Qt5 and thus offers the usual ways to draw to a QPixmap, which in this case maps to the framebuffer.

After a few playful sessions with the head unit’s watchdog timer, [greenluigi1] found himself staring at a blank screen, despite everything appearing to work. This turned out to be due to the alpha channel value of 0 that was being set by default, along with the need for an explicit refresh of the QPixmap. Up popped DOOM, which left just the implementation of the controls.

In order to start the game, you have to literally buckle up, and the steering wheel plus media control buttons are your inputs, which makes for a creative way to play, and perhaps wear some bald spots onto your tires if you’re not careful. If you’d like to give it a shot on your own ride, you can get the project files on GitHub.

Continue reading “Hyundai Is Doomed: Porting The 1993 Classic To A Hyundai Head Unit” →

Photo of the head unit , with "Hacked by greenluigi1" in the center of the UI

Hacking A Hyundai Ioniq’s Infotainment System Again After Security Fixes

June 8, 2023 by 15 Comments

These days modern cars are nothing if not a grouping of networked software held together by bits of hardware. This is reflected not only in the rapidly increasing number of ECUs, but also infotainment systems and all-glass cockpits. For better or worse, this offers many exciting hacking possibilities, which [greenluigi1] was more than happy to explore with their new 2021 Hyundai Ioniq SEL last year. Naturally, Hyundai then proceeded to ‘fix’ these vulnerabilities, offering the exciting chance to test the Hyundai engineers’ homework, and proceed to bypass it again.

When we last left off in [greenluigi1]’s adventures, the Hyundai D-Audio 2V Linux-based infotainment system (formally called in-vehicle entertainment, or IVI) in question had been convinced to run custom applications after a fair bit of effort to get root access via the Engineering Menu and some firmware image hacking. Joyous hacking and exploration of the car’s CAN network and RPC messaging system ensued. Then Hyundai released a new firmware image, after months of silence and all old firmware images pulled from the download page.

In this new firmware image, big changes were visible right off the bat, with two different ZIP files instead of the single one from before. One of these ZIP files also couldn’t be decrypted any more with the old key. Unfortunately for Hyundai, the curse of backwards compatibility with older IVIs meant that the ZIP targeting headunits running the older firmware also contained the key for the new ZIP file.

Other changes included some further obfuscation to this key and the public key used for firmware hash verification, which also involved using a Micom RPC call via the CAN bus to obtain some vehicle specific information. Unfortunately, this is where Hyundai’s engineers seemed to have stopped copying reference code samples, and used a unique RSA private key to sign firmware images with. Fortunately, they did not bother to check whether the updater actually always verifies the signature, allowing for unsigned code to be installed.

All in all, a fascinating bit of reverse-engineering and sheer stubborn persistence, just so that the IVI that’s in your car can run the applications which you developed. We’re looking forward to the next installments in this series as the ball is once again firmly in Hyundai’s court.

Hyundai To Lead US Market For Hydrogen Fuel Cell Trucks

December 13, 2022 by 96 Comments

Hydrogen has long been touted as a potential fuel of the future. While it’s failed to catch on in cars as batteries have taken a strong lead, it still holds great promise for larger vehicles like trucks.

Hyundai have been working diligently in this space over the last few years, with its Xcient line of fuel-cell powered trucks. It’s set to dominate the world of hydrogen trucking in the US as it brings a fleet of vehicles to California next year.

Continue reading “Hyundai To Lead US Market For Hydrogen Fuel Cell Trucks” →

Photo of the head unit , with "Hacked by greenluigi1" in the center of the UI

Hacker Liberates Hyundai Head Unit, Writes Custom Apps

July 18, 2022 by 39 Comments

[greenluigi1] bought a Hyundai Ioniq car, and then, to our astonishment, absolutely demolished the Linux-based head unit firmware. By that, we mean that he bypassed all of the firmware update authentication mechanisms, reverse-engineered the firmware updates, and created subversive update files that gave him a root shell on his own unit. Then, he reverse-engineered the app framework running the dash and created his own app. Not just for show – after hooking into the APIs available to the dash and accessible through header files, he was able to monitor car state from his app, and even lock/unlock doors. In the end, the dash got completely conquered – and he even wrote a tutorial showing how anyone can compile their own apps for the Hyundai Ionic D-Audio 2V dash.

In this series of write-ups [greenluigi1] put together for us, he walks us through the entire hacking process — and they’re a real treat to read. He covers a wide variety of things: breaking encryption of .zip files, reprogramming efused MAC addresses on USB-Ethernet dongles, locating keys for encrypted firmware files, carefully placing backdoors into a Linux system, fighting cryptic C++ compilation errors and flag combinations while cross-compiling the software for the head unit, making plugins for proprietary undocumented frameworks; and many other reverse-engineering aspects that we will encounter when domesticating consumer hardware.

This marks a hacker’s victory over yet another computer in our life that we aren’t meant to modify, and a meticulously documented victory at that — helping each one of us fight back against “unmodifiable” gadgets like these. After reading these tutorials, you’ll leave with a good few new techniques under your belt. We’ve covered head units hacks like these before, for instance, for Subaru and Nissan, and each time it was a journey to behold.

Hyundai Mini 45 EV Is A Small Car With Grand Ambitions

December 23, 2020 by 20 Comments

One of Hyundai’s recent concept cars was an electric vehicle named “45” in honor of its inspiration, another concept car from 45 years ago. When footage of a child-sized “Mini 45” surfaced, it was easy to conclude the car was a motorized toy for children. But Jalopnik got more information from Hyundai about this project, where we learned that was not nearly the whole picture.

The video (embedded below) explained this little vehicle is a concept car in its own right, and most of the video is a scripted performance illustrating their concept: using technology to help calm young patients in a hospital, reducing their anxiety as they faced treatment procedures. Mini 45 packs a lot more equipment than the toy cars available at our local store. The little driver’s heartbeat and breathing rate are monitored, and a camera analyzes facial expressions to gauge emotional stress. The onboard computer has an animated avatar who will try to connect with the patient, armed with tools like colorful animations, happy music, candy scent dispenser, and a bubble-blowing machine.

Continue reading “Hyundai Mini 45 EV Is A Small Car With Grand Ambitions” →

Hyundai Makes Push Towards Fuel Cell Trucking

July 16, 2020 by 102 Comments

Hyundai has begun shipping fuel-cell based heavy duty trucks to face off against battery-electric trucks in the commercial hauling market.

Battery electric vehicles, more commonly known as electric cars, have finally begun to take on the world in real numbers. However, they’re not the only game in town when it comes to green transportation. Fuel cells that use tanks of hydrogen to generate electricity with H2O as the main byproduct have long promised to take the pollution out of getting around, without the frustrating charge times. Thus far though, they’ve failed to make a major impact. Hyundai still think there’s value in the idea, however, and have developed their XCIENT Fuel Cell truck to further the cause. Continue reading “Hyundai Makes Push Towards Fuel Cell Trucking” →

The Folly Of Adding An Auxiliary Audio Input To A Hyundai Sonata

November 4, 2011 by 48 Comments

Why auxiliary audio inputs haven’t been standard on automotive head units for decades is beyond us. But you can bet that if you’re looking at a low-priced sedan you’ll need to buy an entire upgrade package just to get an audio jack on the dash. [Jon W’s] Hyundai Sonata didn’t have that bells-and-whistles upgrade so he decided to pop his stereo out and add his own aux port.

A big portion of this hack is just getting the head unit out of the dash. This is made difficult on purpose as an anti-theft feature, but [Jon’s] judicious use of a butter knife seemed to do the trick. He lost some small bits along the way which were recovered with a Shish Kebab skewer with double-stick tape on the end.

With the head unit out, he opened the case and plied his professional Electrical Engineering skills to adding the input. Well, he meant to, but it turns out there’s no magic bullet here. The setup inside the unit offered no easy way to solder up an input that would work. Having done all of the disassembly he wasn’t going to let it go to waste. [Jon] grabbed a nice FM transmitter setup. He wired it up inside the dash and mounted the interface parts in the glove box as seen here.

It’s nice to know we’re not the only ones who sometimes fail at achieving our seemingly simple hacking goals. At least [Jon] was able to rally and end up with the functionality he was looking for.