Rooting Your Ride: Jailbreaking A Subaru QNX

A modern car still drives in the same way as the one you would have bought thirty years ago, it still has a steering wheel and all the other controls. What has changed in the cabin lies mostly beneath the dash, where enough computing power to launch several Moon shots takes care of everything from air-conditioning to entertainment. As you might expect these systems attract the curiosity of security researchers, and through their work we gain an insight into their operation.

[Scott Gayou] has a Subaru, a car that has an all-in-one entertainment system head unit that is typical of what you’d find across a host of manufacturers. His account of jailbreaking it is a lengthy essay and a fascinating read for anyone. He starts with a serial port, then an SSH prompt for a root password, and a bit of searching to find it was made by Harman and that it runs the closed-source realtime OS QNX. From there he finds an official Subaru update, from which he can slowly peel away the layers and deduce the security mechanism. The write-up lays bare his techniques, for example at one point isolating the ARM assembler for a particular function and transplanting it bodily into his own code for investigation.

Eventually he could penetrate the filesystem of the update, and from there he could find that while the root user had a password there were two other accounts that while heavily locked down, had none. The discovery came that files on USB drives plugged into the system were given user-level execute permissions, at which point under the locked-down user he could execute arbitrary code from USB drives. He could then create and modify copies of the device’s filesystem which he could flash onto it, and thus place a modified password validation function into it and gain root access.

Some Hackaday readers will be accomplished in security work such as this, but many of us are hardware specialists for whom it remains something of a dark art. A comprehensive and accessible write-up such as this one is therefore invaluable, because it gives us an insight into the techniques used and perhaps more importantly, into some of the security pitfalls a hardware engineer might unwittingly introduce into their creations.

QNX is a real-time operating system with a long history of appearances in industrial and automotive applications. Readers with long memories may recall their demo floppies from the 1990s which packed a fully functional GUI, Internet connectivity, and modern (for the time) web browser onto a single 1.44Mb floppy disk. We’ve talked about it in the past in a little detail, as when someone made a desktop OS using it.

Tricking an Ancient Protocol To Play Tunes

A lot of technological milestones were reached in 2007. The first iPhone, for example, was released that January, and New Horizons passed Jupiter later on that year. But even with all of these amazing achievements, Volvo still wasn’t putting auxiliary inputs on the stereo systems in their cars. They did have antiquated ports in their head units though, and [Kalle] went about engineering this connector to accommodate an auxiliary input.

The connector in question is an 8-pin DIN in the back, which in the days of yore (almost eight years ago) would have been used for a CD changer. Since CDs are old news now, [Kalle] made use of this feature for the hack. The first hurdle was that the CD changer isn’t selectable from the menu unless the head unit confirms that there’s something there. [Kalle] used an Arduino Nano to fool the head unit by simulating the protocol that the CD changer would have used. From there, the left and right audio pins on the same connector were used to connect the auxiliary cable.

If you have a nearly-antique Volvo like [Kalle] that doesn’t have an aux input and you want to try something like this, the source code for the Arduino is available on the project page. Of course, if you don’t have a Volvo, there are many other ways to go about hacking an auxiliary input into various other devices, like an 80s boombox or the ribbon cable on a regular CD player. Things don’t always go smoothly, though, so there are a few nonstandard options as well.

Arduino Translates Signals Between Steering Wheel Buttons and Aftermarket Head Unit

There is no question that steering wheel mounted controls are super convenient. Reaching all the way over to the dashboard to change a radio station is so 1990’s. An ever-increasing percentage of new cars are coming equipped with steering wheel controls for the stereo, however, you’ll lose the button control if you change out the stock head unit to something a little higher in quality. Sure, there may be an adapter readily available for your car/stereo combination, but there also may not be. [Ronnied] took the DIY road and made his own adapter.

The first obstacle for [Ronnied] was to figure out the wiring on the steering wheel controls. After some poking around he found that there were only two wires used for all of the control buttons, each button only changing the resistance between the two wires. The button states could easily be read by using an Arduino’s analog input. A Pro Mini model was chosen for its small size as it could be housed in the radio compartment of the dash.

The next step was getting the Arduino to control the aftermarket head unit. [Ronnied] did some research regarding JVC’s Stalk digital control interface but came to the conclusion that it would be easier to direct wiring the Arduino outputs to the appropriate spot on the head unit’s circuit board. To do this the button for each function that would also be represented on the steering wheel was traced out to find a common point on the circuit board. Jumper wires soldered to the circuit board simply allow the Arduino to emulate button pushes. To ensure that the head unit buttons still work in conjunction with the steering wheel buttons, the Arduino would have to keep the pins as inputs until a steering wheel button was pushed, the pin changed to an output, the signal sent and the pin changed back to an input. This feature was easily created in the Arduino sketch.

Video below.

Continue reading “Arduino Translates Signals Between Steering Wheel Buttons and Aftermarket Head Unit”

Repairing a VFD driver on a car stereo

We love seeing repairs and always marvel at the ability to track down the problem. [Todd] seems to have a knack for this. He was met with a lot of adversity when trying to get the Vacuum Fluorescent Display working on his car stereo. A lot of persistence, and a little bit of taking the easier way out let him accomplish his goal.

The head unit is out of his 1994 Jeep. He knew the radio functionality still worked, but the display was completely dark. After getting it out of the dashboard he connected it to a bench supply and started probing around. He established that the data lines were still working by setting the radio to auto scan mode and testing with a multimeter. When he went to measure the cathode pins he didn’t get any reading. It seems the driver which supplies that signal is burnt out.

One easy fix would be to replace the parts from a scavenged unit. [Todd] hit the junkyard and picked up one from a Jeep that was just one model year apart from his. Alas, they weren’t exactly the same, and although he swapped out a chip (using a neat heated solder sucker) it didn’t work. In the end he simply dropped in a power resistor to use the 12V rail as a 1V at 0.1A source for the filament.

You can see his repair extravaganza in the video after the break. If you’re looking for tips on scavenging these types of displays check out this post.

Continue reading “Repairing a VFD driver on a car stereo”

Galaxy SIII hack puts Android in your dashboard

Here’s how you can have a hands-free, no worries about the battery, Android experience while you drive. [Steve] removed the head unit from his car and replaced it with a Samsung Galaxy SIII Android phone. The look is pretty nice, but we do have a few suggested improvements if you try this one for yourself.

It started simply by removing the factory stereo which left a double-height opening in the dashboard. [Steve] cut a piece of wood to fit the gaping hole, painting it a grey that would compliment the interior colors of the car. The phone is mounted on this plate, with plenty of room for the USB and audio cables. From there it is finished up with another wooden plate which has a cutout for the touch screen. See the final project, as well as glimpses of the installation, in the video after the break.

[Steve] demonstrates using the GPS features and playing music. We’d improve this in a couple of ways. First off, using something like the IOIO board you could add a physical volume knob, which we’re not interested in giving up for a touch screen quite yet. If you were willing to go the extra mile, a CAN-BUS chip could be added too that would monitor button presses from the steering wheel music controls.

Continue reading “Galaxy SIII hack puts Android in your dashboard”

Turn your old Bluetooth headphones into a DIY car audio receiver


[Tim] drives a 1995 Mitsubishi TS Magna, which is equipped with a less than stellar accessory package he lovingly calls a “poverty pack”. He outfitted his ride with an aftermarket head unit that can support the Bluetooth A2DP profile, provided he buys the ridiculously overpriced kit sold by Pioneer. Reluctant to shell out more money on an audio kit than his car is worth, he whipped up his own Bluetooth kit for far less than Pioneer’s asking price.

He had a set of Nokia Bluetooth headphones that he was willing to part with, so he disassembled them to see how he might interface with his car stereo. Connecting the headset to his head unit was a relatively easy task, but he had to work a bit harder to get his Bluetooth receiver powered properly.

After both undervolting and then nearly cooking his wireless audio rig, [Tim] managed to get things operating to his liking. He says that the audio is a touch quieter than he would like at the moment, so he will likely be revising his design in the near future. For now however, he can stream tunes from his phone while he cruises around town.

Building a custom interface for surplus HF radios

[PRC148] picked up a Motorola Micom radio from eBay. These are US State Department surplus, but apparently the 125 Watt HF units are top-of-the-line at a tenth of the sticker price. The one hangup is that they’re headless; you can’t control them without additional hardware. But the Internets are often kind to the hobbyists, and this is no exception. You can get software to run the radio from a PC thanks to the Micom Yahoo Group. [PRC148] took that software as an example and built his own stand-alone interface. [Cached version of the page]

The head unit is an Arduino driving a four-line LCD display and a rather large array of buttons. The forum thread linked above shows his humble beginnings on a breadboard. During the project [PRC148] learned a lot of skills to end up with what you see above. Hiding behind the reused bezel is a PCB he designed in Eagle CAD and etched himself. It allowed him to cram the tactile switches close enough to work with the button overlay on this keypad.

UPDATE: The traffic from this feature took down the forum hosting the content. They requested that we do not link to them because of this. A cached version without images can be found above thanks to [Termm].