4

I have a VW Radio which has the possibility to upgrade software via USB. Unfortunately I am not able to find any updates, nor any information regarding the current Software version on the whole internet. So I decided to try to dump the files directly from the unit. My question is how can I perform the dump without physically removing the EEPROM from the board. Is there any possibility to access something through the USB port?

Its market name is RCD 320 on european Market and RCN 210 on Asian market. I do not know what is inside of the unit - as far as I have seen searching the internet, some VW units are using ARM processors and Linux 3.0.5, but this is everything I know so far, as there is no information about these units (neither regarding the SW, nor the HW).

Any guidance would be appreciated as I am a new in this domain, but I have some electronic skills and also programming skills.

Improve this question
3
  • Hi and welcome to RE.SE. I am myself analyzing a software for the entertainment system of my car. First of all you should widen your scope. VW Group owns a number of brands. It seems worthwhile to me to look at SEAT and Škoda who offer similar car models as the VW brand and are thus likely based on the same "platform". There's a chance you will be more successful in finding information under a different brand name. In my case I also found a lot of information in forums about my car brand. Last but not least: befriend a car dealer ;) – 0xC0000022L♦ Jan 9 '19 at 10:52
  • 1
    (cont.) Seriously, there's a chance that a car dealer (with repair shop) will be willing to give you whatever firmware update package they use in the form of a file/archive. So that would be an excellent starting point for an RCE effort. Also, it's likely that the firmware is in some NAND or even on a microSD. In case of a microSD you could simply dump the contents. In general opening it up will typically reveal text on the PCB and on the components soldered onto it. These may give you further clues as to the creator or how to tackle dumping the firmware on your own. – 0xC0000022L♦ Jan 9 '19 at 11:12
  • On another note: for PSA there are "cheat codes" you can enter in the head unit, which trigger the firmware to be dumped on a FAT32-formatted USB key. There's also a variation that only dumps some configuration files. Also, a port scan could help, in case your unit allows to connect to a WiFi. – 0xC0000022L♦ Feb 5 '20 at 9:55
1

It is a bit of a chicken and egg issue here. While it may be possible that there is some custom USB command to dump the firmware, you’re unlikely to discover it by chance without analyzing actually running firmware.

About the only possibility I can think of is DFU (Device Firmware Update) which is a semi-standard protocol for updating firmware of USB devices. If there is a known process for putting the device into update mode, you can try using dfu-util to see if it can communicate with the device.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.