Infotainment Hacks
1 - 20 of 45 Posts
Joined
·
18,942 Posts
Speed restriction, as far as TomTom is concerned, was built in by Mazda and hard-wired.
There was ONE member who joined here claiming he snipped a certain wire and removed that restriction, but he never proved it and we haven't heard from him since.
For the available mods you can see my rantings here:
http://forum.mazda6club.com/electri...-customizing-your-2014-navigation-scheme.html
and here
http://forum.mazda6club.com/3rd-gen/265065-nb1-navigation-system-safety-lock.html
But that pertains to the 2014 models - The 2016 I do not know how to customize, sorry.
There was ONE member who joined here claiming he snipped a certain wire and removed that restriction, but he never proved it and we haven't heard from him since.
For the available mods you can see my rantings here:
http://forum.mazda6club.com/electri...-customizing-your-2014-navigation-scheme.html
and here
http://forum.mazda6club.com/3rd-gen/265065-nb1-navigation-system-safety-lock.html
But that pertains to the 2014 models - The 2016 I do not know how to customize, sorry.
I feel like this thread is mislabeled. It should be called TomTom/Navigation hacks - not Infotainment hacks.
Byakuya, great tips on modifying the Navigation system. I'll definitely be playing around with those.
However, what I am interested in is hacking the Infotainment system. Changing themes to the default Mazda Radio/Phone/messages etc screen as it looks like it's made by a blind 5 year old. [attached image]
Currently investigating.
Byakuya, great tips on modifying the Navigation system. I'll definitely be playing around with those.
However, what I am interested in is hacking the Infotainment system. Changing themes to the default Mazda Radio/Phone/messages etc screen as it looks like it's made by a blind 5 year old. [attached image]
Currently investigating.
Attachments
Joined
·
113 Posts
Hi all! I successfully disabled the safety lock for the TomTom navigation unit on my 2014 Touring. It is as simple as cutting one wire. Here is the original thread that discusses it:
http://forum.mazda6club.com/3rd-gen/329249-navi-safety-lock-disable.html
If anyone has any questions about it, I would be glad to answer. I'm not on here every day, so I might not get back to you immediately.
Joined
·
18,942 Posts
Thank you for confirming it. I was hesitant because only a single person in that thread claimed to have done it. This is big news for all of us if it's confirmed. Maybe I'll try my hand at cutting this wire and be the final confirmation. I'm not worried about messing with electronics
@NickA - I've done a bit of research into hacking the TomTom and it's not going to be easy. As far as any GPS hacking websites are concerned, no one has bothered with the NB1 because it's so few and far between. I wanted to tear into one a bit and do some digging around, but I didn't have a spare around to brick and I didn't want to rip mine out to experiment on. Let us know if you find out anything useful
Joined
·
113 Posts
There were a few things that helped me. The OP from the link above spurred me on to do it. I checked the wiring diagram for the 2014 Mazda 6, and everything he described seemed to check out. I found a Youtube video which showed me exactly how to pull the navi unit from the dash.Thank you for confirming it. I was hesitant because only a single person in that thread claimed to have done it. This is big news for all of us if it's confirmed. Maybe I'll try my hand at cutting this wire and be the final confirmation. I'm not worried about messing with electronics
https://www.youtube.com/watch?v=aoncFAELsDQ
You do NOT have to remove the glove box as this video shows. Just use a plastic pry tool and you can pry that dash trim off starting at the right corner and working from right to left. I saw a different video where a guy did it this way and it is faster.
Once the head unit is pulled out, you have to do a little more investigative work to find the correct wire in the harness because it is tightly wrapped with loom. You have to cut that loom back a little bit to gain access to the correct wire. There are some other wires that look similar, so be careful to make sure you cut the correct one.
I'm sorry that I didn't take any pictures. I was in a hurry to get it done before leaving town for a trip.
Boy it is sweet to have that safety lock disabled!
:grin2:
Joined
·
561 Posts
> @NickA - I've done a bit of research into hacking the TomTom
The 2016 (at least, my 2016) doesn't have TomTom, it has some generic(?) Navteq thing that's kind of a pain to use. I guess I got spoiled with my (portable) Garmin Nuvi. Among other issues, the Navteq UI doesn't make logical sense, the live traffic doesn't seem be integrated into the routes or show up on the normal navigation map, and it has no idea what the voice command "Navigate home" means.
Love the new car, hate the integrated nav system -- and it was one the things I was really looking forward to coming from the portable nav on the windshield. Now all I can think is about ways I could replace the nav unit.
The 2016 (at least, my 2016) doesn't have TomTom, it has some generic(?) Navteq thing that's kind of a pain to use. I guess I got spoiled with my (portable) Garmin Nuvi. Among other issues, the Navteq UI doesn't make logical sense, the live traffic doesn't seem be integrated into the routes or show up on the normal navigation map, and it has no idea what the voice command "Navigate home" means.
Love the new car, hate the integrated nav system -- and it was one the things I was really looking forward to coming from the portable nav on the windshield. Now all I can think is about ways I could replace the nav unit.
2016 Mazda6 GT owner, and software developer here. You absolutely do not need to snip any wires to disable the speed restrictions on a 2016 Mazda6. What you do need is a way to SSH into the computer. The items needed to gain access are as follows:
- USB ethernet adaptor
- cat5/6 cable
- network router
- laptop with ssh (PuTTY if you're on windows)
- recommended: power inverter car capable of supplying power to router
Quick Steps:
1. plug usb ethernet adaptor into car's usb
2. run ethernet cable from usb adaptor to router
3. plug router into power inverter
4. plug power inverter into the slot in center console (it continues to supply power after engine is turned off)
5. turn on car
6. connect laptop to router (wireless is fine)
7. confirm that the car is establishing a connection with the router.
8. obtain ip address of car.
9. ssh into car with username of root.
10. password should be jci
11. once in, mount drive in write mode with "mount -o rw,remount /"
12. edit /jci/scripts/set_lvds_speed_restriction_config.sh with vi
13. comment out the line that calls enable_speed_restriction (for me its line 19)
14. save file
15. edit /jci/scripts/set_speed_restriction_config.sh with vi
16. comment out the line that calls enable_speed_restriction (for me its line 19)
17. save file
18. reboot infotainment (command is literally "reboot")
Expanding:
7. confirm that the car is establishing a connection with the router.
Usually a light on the router that represents the port the cable is plugged into will be on. I did this while sitting in the parking lot at nearest best buy, ended up exchanging twice, third one (and cheapest) worked.
8. obtain ip address of car.
There are a few different ways this can be done. Most common methods are either ip scans, logging into the router via web browser and checking dhcp tables, or even simply trying to guess by ping. IIRC the dhcp tables will have a blank name for the car. Chances are the car will have an ip address of 192.168.1.X where X is 100 or slightly higher.
9. ssh into car with username of root.
With car ip of 192.168.1.101, on mac and linux, command would be "ssh [email protected]". I don't remember how PuTTY does it, but I think you provide username and ip address in separate fields.
12 & 15 editing
vi (yes, that is the name of the program) is the only editor on the disk. It's not as easy to use as vim (vi improved). A real simplified description of vi would be: it has two modes; command, and edit. vi starts off by default in command mode.
- To exit command mode, and enter edit mode, hit i.
- To exit edit mode and return to command mode, hit escape.
The following can be performed from command mode:
- To undo, hit u.
- To save, type :w<enter>
- To quit without saving, type :q!
- To quit with saving, type :wq
Use google for vi tutorials if you need more info.
In order to disable speed restrictions, still need to comment out the line that enables it. In the files, you should see something along the lines of
File set_lvds_speed_restriction_config.sh:
if [ "$1" == "enable" ]; then
echo "Setting Speed Restriction Configuration to 'enable'"
enable_speed_restriction
and
File set_speed_restriction_config.sh:
if [ "$1" == "enable" ]; then
echo "Setting BUS_BCM Speed Restriction Configuration to 'enable'"
enable_speed_restriction
Those need to changed into
File set_lvds_speed_restriction_config.sh:
if [ "$1" == "enable" ]; then
echo "Setting Speed Restriction Configuration to 'enable'"
# enable_speed_restriction
and
File set_speed_restriction_config.sh:
if [ "$1" == "enable" ]; then
echo "Setting BUS_BCM Speed Restriction Configuration to 'enable'"
# enable_speed_restriction
The only difference is the # before enable_speed_restriction. Make sure to save (from command line, type :wq<enter>).
At this point, any calls that the computer attempts to enable speed restrictions will be disabled. Might need to reboot infotainment (or turn car on/off) if not.
- USB ethernet adaptor
- cat5/6 cable
- network router
- laptop with ssh (PuTTY if you're on windows)
- recommended: power inverter car capable of supplying power to router
Quick Steps:
1. plug usb ethernet adaptor into car's usb
2. run ethernet cable from usb adaptor to router
3. plug router into power inverter
4. plug power inverter into the slot in center console (it continues to supply power after engine is turned off)
5. turn on car
6. connect laptop to router (wireless is fine)
7. confirm that the car is establishing a connection with the router.
8. obtain ip address of car.
9. ssh into car with username of root.
10. password should be jci
11. once in, mount drive in write mode with "mount -o rw,remount /"
12. edit /jci/scripts/set_lvds_speed_restriction_config.sh with vi
13. comment out the line that calls enable_speed_restriction (for me its line 19)
14. save file
15. edit /jci/scripts/set_speed_restriction_config.sh with vi
16. comment out the line that calls enable_speed_restriction (for me its line 19)
17. save file
18. reboot infotainment (command is literally "reboot")
Expanding:
7. confirm that the car is establishing a connection with the router.
Usually a light on the router that represents the port the cable is plugged into will be on. I did this while sitting in the parking lot at nearest best buy, ended up exchanging twice, third one (and cheapest) worked.
8. obtain ip address of car.
There are a few different ways this can be done. Most common methods are either ip scans, logging into the router via web browser and checking dhcp tables, or even simply trying to guess by ping. IIRC the dhcp tables will have a blank name for the car. Chances are the car will have an ip address of 192.168.1.X where X is 100 or slightly higher.
9. ssh into car with username of root.
With car ip of 192.168.1.101, on mac and linux, command would be "ssh [email protected]". I don't remember how PuTTY does it, but I think you provide username and ip address in separate fields.
12 & 15 editing
vi (yes, that is the name of the program) is the only editor on the disk. It's not as easy to use as vim (vi improved). A real simplified description of vi would be: it has two modes; command, and edit. vi starts off by default in command mode.
- To exit command mode, and enter edit mode, hit i.
- To exit edit mode and return to command mode, hit escape.
The following can be performed from command mode:
- To undo, hit u.
- To save, type :w<enter>
- To quit without saving, type :q!
- To quit with saving, type :wq
Use google for vi tutorials if you need more info.
In order to disable speed restrictions, still need to comment out the line that enables it. In the files, you should see something along the lines of
File set_lvds_speed_restriction_config.sh:
if [ "$1" == "enable" ]; then
echo "Setting Speed Restriction Configuration to 'enable'"
enable_speed_restriction
and
File set_speed_restriction_config.sh:
if [ "$1" == "enable" ]; then
echo "Setting BUS_BCM Speed Restriction Configuration to 'enable'"
enable_speed_restriction
Those need to changed into
File set_lvds_speed_restriction_config.sh:
if [ "$1" == "enable" ]; then
echo "Setting Speed Restriction Configuration to 'enable'"
# enable_speed_restriction
and
File set_speed_restriction_config.sh:
if [ "$1" == "enable" ]; then
echo "Setting BUS_BCM Speed Restriction Configuration to 'enable'"
# enable_speed_restriction
The only difference is the # before enable_speed_restriction. Make sure to save (from command line, type :wq<enter>).
At this point, any calls that the computer attempts to enable speed restrictions will be disabled. Might need to reboot infotainment (or turn car on/off) if not.
Joined
·
561 Posts
> What you do need is a way to SSH into the computer.
If true, holy crap that's awesome and kind of terrifying
> - USB ethernet adaptor
What brand/chipset is the adapter you have? Traditionally, those types of devices only work with a certain subset of chipsets without additional drivers. Adding hardware drivers to the vehicle OS obviously is out.
> - network router
It sounds like you're describing the car looking for a DHCP server to get an IP address.
The router isn't necessary if you're using a Mac (or a Linux box and you fire up a DHCP server). When you set up Internet Sharing on a Mac, it automatically starts a DHCP server on the port you shared your internet connection "to computers using" (usually the "Wired Connection"). I can't reproduce the exact instructions from memory.
If true, holy crap that's awesome and kind of terrifying
> - USB ethernet adaptor
What brand/chipset is the adapter you have? Traditionally, those types of devices only work with a certain subset of chipsets without additional drivers. Adding hardware drivers to the vehicle OS obviously is out.
> - network router
It sounds like you're describing the car looking for a DHCP server to get an IP address.
The router isn't necessary if you're using a Mac (or a Linux box and you fire up a DHCP server). When you set up Internet Sharing on a Mac, it automatically starts a DHCP server on the port you shared your internet connection "to computers using" (usually the "Wired Connection"). I can't reproduce the exact instructions from memory.
That might be, but the laptop I have does not have an ethernet port. I find it easier to just setup a router that has both wifi and wired connections. I also live on third floor of an apartment on side away from parking lot, so running ethernet cable to car is out of the question. This isn't really a huge priority for me, as the setup works fine for me.
I have found scripts that supposedly allow the car to to work as an access point, but any attempts to join the network (it does connect), have been unsuccessful thus far. As mentioned, not a huge priority to get it to work.
I've had the car for about a month now, and have been working on this outside of work a few nights a week for the past two weeks. I have managed to get the car's user interface running in chrome (the UI tries to force using opera, but fuck that noise), and sending/receiving events to/from the services running on the car. Last night (before typing up my original response) I took the car out for a drive to capture some data to work with, but so far nothing looks interesting. The data would definitely help in recreating another user interface, since you have to be able to connect to the services to switch the screen into interface mode, but that's about it.
I have pulled copies of as many files I could backup. I think total size is around 5gb. I have been trying to organize some notes on what's available to use, and how to use it. Unfortunately, most of the services are compiled, and any attempts to find source code or contact any developers have been unsuccessful. From what I can tell, the architecture is ARM, which I have not worked with before, so potential for more learning opportunities there.
My next strategies are to just bypass the services altogether and get the data by other means.
Joined
·
561 Posts
I'm a tinkerer (a Linux admin by day), plus I want to find out how to fix or replace some of the stupid in the infotainment system. It is great to find out about all this. Like you, I got my car about 2 months ago. I've been tempted, but I'm not quite to the stage yet where I want to physically start taking things apart to see what's where
I don't know if you're familiar with CAN, but based on what I've been able to read I'm fairly certain we have two CAN buses - one for the engine/body, and one for the infotainment system. They obviously interface at some point because the SBCS, wiper, etc settings are in the UI.
If you're looking for data and communication, the CAN bus might be a place to target. You can get to the engine CAN through the OBD-II port, but I don't know where the infotainment bus might be accessible. Shoot, since you found access to the filesystem of [something?], the data might be available through a device in /dev.
I am not familiar with CAN. I will have to research it.
As for the "other means", dumping streams from /dev is what I had in mind.
There is a script that starts up several services. The UI (html, js, and css ran in opera) interacts with these services via websockets. There are three websockets that are opened, 2700, 2766?, and 2800. Chrome can provide the streams, but I've not found an easy way to extract the stream information using the data chrome provides. I obtained it via inserting console.logs in the send/receive functions.
The UI is located in /jci/gui. Copy this to laptop, disable car's firewall (IIRC it was "/jci/bin/jci-fw.sh disable"), and edit some config options for the UI, and it will connect and display the interface.
Other than the purpose of trying to improve/redo the interface itself, my main goals have been to remove the speed restriction and to figure out why the damn navigation on the HUD doesnt work.
I'm at work atm, but will get the chip info for ethernet adaptor when I can.
As for the "other means", dumping streams from /dev is what I had in mind.
There is a script that starts up several services. The UI (html, js, and css ran in opera) interacts with these services via websockets. There are three websockets that are opened, 2700, 2766?, and 2800. Chrome can provide the streams, but I've not found an easy way to extract the stream information using the data chrome provides. I obtained it via inserting console.logs in the send/receive functions.
The UI is located in /jci/gui. Copy this to laptop, disable car's firewall (IIRC it was "/jci/bin/jci-fw.sh disable"), and edit some config options for the UI, and it will connect and display the interface.
Other than the purpose of trying to improve/redo the interface itself, my main goals have been to remove the speed restriction and to figure out why the damn navigation on the HUD doesnt work.
I'm at work atm, but will get the chip info for ethernet adaptor when I can.
Joined
·
561 Posts
I found a really old Netgear adapter I used to use for my TiVo S2. For reference, it is a model FA120. It's only a 10Mb/s adapter, so not fast enough to copy everything, but fast enough for ssh.
You were right about the ARM architecture. It's a surprisingly recent kernel version as well:
Linux cmu 3.0.35 #9 SMP PREEMPT Sat Oct 25 16:40:22 EDT 2014 armv7l GNU/Linux
I have some exploring to do.
Joined
·
561 Posts
I've found a bunch of things poking around in the filesystem, but a few of the more interesting things that jumped out at me which might facilitate additional exploration -
* The string 'jci' is everywhere - it appears to mean 'Johnson Controls International'. I made the connection after finding their logo in an image file. That might help when trying to understand how some of the compiled libraries work, or getting more information from outside sources.
* In /data is a symlink, debug_options.ini, to /jci/nng/NNG_debugging_OFF.ini. The more interesting file is /jci/nng/NNG_debugging_ON.ini, which contains gems like the following:
;## Turns on or off logging of the CAN and GPS information. Information is logged in /data/save/profiles/01.
[jci.debug]
log_sensors=1
;## Turns on or off the logging of the socket communication between CMU and NNG as NNG sees the data. We also have the ability to turn on socket logging on CMU side but it outputs a lot of SCI traffic. Information is logged in /data/save/profiles/01.
[dr_socket]
log_network=1
It looks like this can be set/unset using /jci/scripts/set_nng_debug.sh
NNG is the manufacturer of the nav/GPS system, and perhaps other components[1]. CMU is referring to the hostname (as it were) of this Linux system. I don't know what 'SCI' means.
I plugged a generic flash drive into the second USB port while I was testing, and it is automatically mounted r/o, but you can remount it r/w. This may be useful in terms of capturing the above logs without risking filling up the internal filesystem.
* There's a significant amount of output going to the /var/log/messages equivalent (can't remember what it is called from memory and didn't note it) which seems to indicate activity like queries for settings coming into the system and replies going back out.
* In /jci/scripts are a bunch of shell scripts, one is called 'developer_mode.sh' which takes an argument of 'on' or 'off'.
* Just for fun, in /jci/resources are the images/animations used in the splash screens. 'ivf' is indeo video format.
I haven't tried to change anything yet, still exploring.
[1] NNG - Leading navigation solutions
Joined
·
561 Posts
Found an insanely long thread (120+ pages) over at the M3 forums. Have barely scratched the surface of the thread, but sounds so far like they're looking at a nearly identical underlying system we are, and have already discovered much of what we're after:
The Infotainment Project - Page 22 - 2004 to 2014 Mazda 3 Forum and Mazdaspeed 3 Forums
This appears to be a summary of things they've learned so far (updated in August, so very recent), with links:
Index for Infotainment Project - 2004 to 2014 Mazda 3 Forum and Mazdaspeed 3 Forums
The Infotainment Project - Page 22 - 2004 to 2014 Mazda 3 Forum and Mazdaspeed 3 Forums
This appears to be a summary of things they've learned so far (updated in August, so very recent), with links:
Index for Infotainment Project - 2004 to 2014 Mazda 3 Forum and Mazdaspeed 3 Forums
I have managed to gather quite a bit of data for what's being sent to/from the UI. As mentioned earlier, unfortunately, nothing interesting comes from it. The UI seems to be heavily dependent on the services, much more so than initially thought. Almost every call ends up hitting the services, and the services appear to be keeping track of state, which would make working with it very difficult, but not impossible.
That said, I'm fairly certain that /jci/sm/sm is the service manager. It contains configs for several services, and it looks like /jci/sm/smctrl allows CLI interaction with /jci/sm/sm. I think if there is any hope in creating a better "Infotainment" experience, then either replacing /jci/sm/sm or improving (via adding services) would be the way to go.
Adding services might be difficult without code/headers. My next plan is to look into the appsdk, which initially I believed was only for the gui. I hope that it will provide some help in creating additional services.
That said, I'm fairly certain that /jci/sm/sm is the service manager. It contains configs for several services, and it looks like /jci/sm/smctrl allows CLI interaction with /jci/sm/sm. I think if there is any hope in creating a better "Infotainment" experience, then either replacing /jci/sm/sm or improving (via adding services) would be the way to go.
Adding services might be difficult without code/headers. My next plan is to look into the appsdk, which initially I believed was only for the gui. I hope that it will provide some help in creating additional services.
Not nearly identical. Exactly identical >
. I have upgraded the infotainment system to the latest firmware (from mazda3revolution.com) on my North American 2016 Mazda 6 Sport. Everything works perfectly.I have tried out NNG debug on and nearly filled out all available space :grin2: .. It is very detailed.. I have been trying to change the NNG binary to turn on traffic.
Joined
·
1 Posts
I followed your instructions using a Belkin F5D5055 gigabit USB-->Ethernet adaptor and it worked great. The first adaptor I tried didn't work at all.
The only thing I did different was that instead of find the file and commenting out the speed restriction I ran the script from the Mazda 3 forum How to disable speed limitations on infotainment - 2004 to 2014 Mazda 3 Forum and Mazdaspeed 3 Forums
it worked perfect!!!
1 - 20 of 45 Posts
