3

I am a computer engineering senior and have a few quick questions i couldn't find any hits about online. I know just enough to get myself into trouble.

Note: I have no specialized tools just a DMM and a raspberry pi. I have experience writing ARM instructions and reverse engineering software. I will most likely wait until i have better tools to attempt this. Just wondering about the approach at the moment.

Backstory: I bought a newer car to replace my 25 year old car. Long story short: the OE headunit has issues and it is very difficult to go aftermarket on this newer car. This got me thinking about what could be done with the stock headunit hardware. I have found datasheets for each IC. I see it has JTAG pins for debugging, serial for talking to a controller on the video board, and a USB connection for flashing firmware updates / uploading image files to flash memory (likely in video board).

Specifics:

  • Renesas SH7267 series microcontroller (no internal flash)
  • NXP SAF7741HV DSP
  • Micron M25P16 flash (SPI)
  • Renesas R32C CAN / HID + 1MB flash internal

Objective: To access data so i can convert it to assembly and examine / modify it. The modifications at minimum would be to change some values for sound shaping via DSP. At maximum it would be UI elements to add a customize-EQ option.

Questions:

  1. What is the best attack vector for something like this?

  2. Will the Micron SPI accessible flash be where the entirety of data is stored? If not, where is most common?

Improve this question
2
  • 1
    Most headunits have a (hidden) serial port so you could look for TX,RX,GND. Some units eg VW MIB have telnet and/or ssh access via certain USB to ethernet dongles. What kind of unit are you dealing with?
    – Remko
    Jan 27, 2021 at 19:40
  • May also help to mention the make of the car.
    – 0xC0000022L ♦
    Oct 23, 2021 at 21:56

1 Answer 1

Reset to default
1

Dumping the flash is probably the quickest way to start. You can then inspect the dump for any code, images, or data tables. If that fails you may have to dump the internal flash of the chips or try JTAG but first try the simplest thing, it may well be enough.

Improve this answer
1
  • So basically follow a work flow of "easiest / most convenient first"? Seems reasonable enough. I've read that JTAG could be disabled for counter-reverse-engineering reasons. I'll get a SPI 8-pin reader/programmer ordered. Thanks!
    – DaCoder
    Jan 26, 2021 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.