I am a computer engineering senior and have a few quick questions i couldn't find any hits about online. I know just enough to get myself into trouble.
Note: I have no specialized tools just a DMM and a raspberry pi. I have experience writing ARM instructions and reverse engineering software. I will most likely wait until i have better tools to attempt this. Just wondering about the approach at the moment.
Backstory: I bought a newer car to replace my 25 year old car. Long story short: the OE headunit has issues and it is very difficult to go aftermarket on this newer car. This got me thinking about what could be done with the stock headunit hardware. I have found datasheets for each IC. I see it has JTAG pins for debugging, serial for talking to a controller on the video board, and a USB connection for flashing firmware updates / uploading image files to flash memory (likely in video board).
Specifics:
- Renesas SH7267 series microcontroller (no internal flash)
- NXP SAF7741HV DSP
- Micron M25P16 flash (SPI)
- Renesas R32C CAN / HID + 1MB flash internal
Objective: To access data so i can convert it to assembly and examine / modify it. The modifications at minimum would be to change some values for sound shaping via DSP. At maximum it would be UI elements to add a customize-EQ option.
Questions:
What is the best attack vector for something like this?
Will the Micron SPI accessible flash be where the entirety of data is stored? If not, where is most common?