I'm new to hardware hacking and I'm not to sure where to go with what I'm doing, any advice or feedback is greatly appreciated. I've been working on a project with the hope of downloading images that are stored in Subaru's eyesight collision avoidance camera system. In the eyesight handbook it details that several images are recorded leading up to and after an "event", but that you have to contact Subaru to get them downloaded. Multiple companies have systems similar with the known and publicly available way to download images off of Toyota's.

Another person in my industry witnessed a Subaru tech download images, and said they plugged directly into the camera system mounted on the inside of the roof. I was able to purchase a complete camera assembly off of ebay to tinker with. The assembly i have is from a 2016 forester, the same vehicle I own. Using my car I was able to get the voltages I need to power up the assembly externally to tinker with.

enter image description here

In my image, the left most white connector is the only connection between the cameras and car, that's what I got the voltages of. 2 pins at 12V, 1 at 2.3V, 1 at 2.6V, and two grounds. Two other pins had wires but no voltages, could possibly be for the CAN network?

As for the other two connectors on the board, the small white on near the top center is covered by a sticker when installed, there is no access to it without removing the sticker or disassembling the system, I would be led to believe this is for programming the module during assembly? I don't know if that's a reasonable assumption or not, but if so I would imagine its a possible angle of attack. For the gray connector, that one is exposed once the module is accessible in the vehicle. I would assume this is the port used by Subaru to download images so this might be the best possible route of attack.

While doing research on hardware hacking, I've come across JTAG and UART as common attack angles, unfortunately I have been unable to locate any such pinouts on the board. Looking at the data sheets for some of the chips, however, i was able to locate JTAG pins on some of the chips. With an integrated system like this, I'm not sure how accessing JTAG pins on a single component would help. Possible the images are all stored on one chip and other chips are used for processing data and handling the collision avoidance system?

Again, thanks for anything you guys have to say, any help is greatly appreciated.

  • Maybe "The Car Hacker's Handbook" would be worth reading?
    – 0xC0000022L
    Jun 24 '20 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.