Hacking the Nav/MFD - Technical Information

Ingineer said:

. If you really want to speed things up, I'm still on the lookout for some assistance (Paid, of course) with the LEAFSCAN's housing and injection molding work, both actual production and the CAD work for the design and tooling. (email me if you have some ideas)
-Phil

Click to expand...

I know a guy that can do this. He's a LinkedIn contact and we used to work together at OptiSolar. He designed solar module junction boxes. I will contact him and see if he's interested. We CAN get this done (no pun intended).

Ingineer said:

I've done a lot of projects like this, and I can tell you it's not easy. Anyone who uses words like "simple" and "easy" is disillusioned.

Click to expand...

Maybe delusional? i.e., on drugs.
At a high level, everything seems easy

lemketron said:

TEG said:

...It might be better to simply look forward to future cars that will (hopefully) have a more "open" platform for additional apps. Sounds a lot like what we went through in the phone space, though clearly some platforms are more "open" (and hackable) than others...

Click to expand...

Click to expand...

Tesla has been saying that the Model S touch-screen will have a provision for 3rd party apps to be installed.

Phil, do you see yourself jumping over to the Tesla world someday?
(Nice to have you here working on LEAF mods while it lasts.)

Reverse engineering is not only a lot of work, but mods made could be totally "undone" by any Nissan "Upgrade". The modifications (or even the car) could become non-functional ... or worse.

So, the best way to "instrument" the car, and avoid warranty issues is to monitor passively. Some writing to any CAN bus can provide some wonderful functions, but it becomes difficult to insure that one does not (or has not) upset the normal operations and "warnings" of the car.

If one resets some "Engine Warning" code, and the Nissan-expected "normal" (usually dealer) service on the car is delayed, it is not clear that you are entitled to the full warranty coverage.

Likewise, changing operational parameters that make the car operate in a manner not provided (or approved) by Nissan ... might also reduce one's full warranty coverage.

Anybody who has Carwings signed an agreement ... basically to not reverse-engineer the car (and possibly more, I do not recall).

I hope that LEAFSCAN has a "non-intursive" mode (where it CANNOT (more than "does not") write to any CAN bus) as default.

garygid said:

Reverse engineering is not only a lot of work, but mods made could be totally "undone" by any Nissan "Upgrade". The modifications (or even the car) could become non-functional ... or worse.

So, the best way to "instrument" the car, and avoid warranty issues is to monitor passively. Some writing to any CAN bus can provide some wonderful functions, but it becomes difficult to insure that one does not (or has not) upset the normal operations and "warnings" of the car.

If one resets some "Engine Warning" code, and the Nissan-expected "normal" (usually dealer) service on the car is delayed, it is not clear that you are entitled to the full warranty coverage.

Likewise, changing operational parameters that make the car operate in a manner not provided (or approved) by Nissan ... might also reduce one's full warranty coverage.

Anybody who has Carwings signed an agreement ... basically to not reverse-engineer the car (and possibly more, I do not recall).

I hope that LEAFSCAN has a "non-intursive" mode (where it CANNOT (more than "does not") write to any CAN bus) as default.

Click to expand...

Gary, simply by connecting to the DLC3 connector, you technically risk disabling or altering of the car's function. The CAN bus is no longer a bus once you tap it for any purpose, as the stub of your cabling creates a standing wave. Luckily the CAN hardware layer is robust and will tolerate this in most cases. Any products I build for sale will be extremely well tested to avoid any possible malfunction. Worse-case is something like a damaged cable, which could indeed disable the car. If that were to happen, all that would be needed to get the car going would be to simply unplug it. I can also say with certainty that using LEAFSCAN will not void the warranty and does not constitute reverse-engineering or violation of any agreements you may have made with Nissan.

Any hacking/patching of the Nav or any other systems is simply talk at this point and has nothing to do with LEAFSCAN, nor will it.

-Phil

TEG said:

Phil, do you see yourself jumping over to the Tesla world someday?
(Nice to have you here working on LEAF mods while it lasts.)

Click to expand...

I can't afford a Tesla anytime soon, so it's unlikely I'll ever be offering much for Tesla owners. Who knows what the future holds though!

-Phil

Ingineer said:

TEG said:

Phil, do you see yourself jumping over to the Tesla world someday?
(Nice to have you here working on LEAF mods while it lasts.)

Click to expand...

I can't afford a Tesla anytime soon, so it's unlikely I'll ever be offering much for Tesla owners. Who knows what the future holds though!

-Phil

Click to expand...

Sounds like a large bribe (in the form of a Tesla) might get Phil doing something :lol:

evnow said:

Now I'm fairly sure either Ingineer is not one person or he has lot more than 24 hours a day :lol:

Click to expand...

He built himself a clock that adds and extra 8 hours to every day. The clock is an automatic override for the current space/time continuum that also allows him to place winning bets on football games after the game has been played.

So here's a thought.......

I've been fiddling around with an in-dash PC to replace my dash nav unit. The part that I've kinda let trail off is handling most of the car's funcitons... The think that made me kinda lose steam on doing it is all the interconnects. I absolutely don't want to chop up a bunch of car wires, and I can't find any source for the other end of the connectors.....

But looking at this, it occured to me that maybe there's another way.

I know programming an ENTIRE system with OS, UI, and handlers for all the different interfaces is ... daunting doesn't even scratch the surface.

But what about a raw data interpreter? Could the stock unit be programmed to simply be a "dumb" data handler, interpreting info from all the car interfaces, then with its USB working as a device (instead of host), transmitting relevant info probably via virtual serial mode to a USB host in-dash PC?

There would still be the difficulty of relocating the unit (probably have to take up some glovebox space maybe?), but does the Renesas devkit include everything that would be needed for that? (and is the devkit publicly available, for that matter?)

Hm... probably wouldn't be enough bandwidth in serial mode to handle vid signal, so we'd still have to interface with the backup camera wires... But other high-bandwith things like bluetooth, nav, and audio would simply be replaced altogether by the new unit, so no need there... Most of what would need transfer would be can signals (selectively), button signals, cc settings/temps, maybe steering signal if you wanted to be hardcore...

This could probably all be answered on the site, I just haven't looked yet - will do when I get home - just saw this and got excited

kubel said:

Since this is (presumably) a WinCE device, it would be nice if we could figure out how to break out of the Nissan application to the WinCE desktop. What we need are some Nissan service manuals. I know of at least one LEAF technician on the forums.

On a number of older Clarion WinCE sat navs, the password to access map and software update menu items is 200802, though I doubt this will help. I don't have my LEAF yet, so I have no way to dig into the menus and see if there's an option to enter a password. I'm sure Nissan isn't using stock Clarion software.

Click to expand...

Doesn't look like this is WinCE - looks like it has its own custom OS. At least, if I'm finding the right parts references:


http://www.renesas.com/request?SCREEN_ID=ViewGRSDownloadSearch&EXECUTE_ACTION=search#" onclick="window.open(this.href);return false;

follow the drop-downs -> MPU&MCU -> SuperH RISC Family -> SH7780 Series -> SH7722

And it lists the OS, IDE, compiler, sample source code, etc. Some of it requires passwords, some of it is evaluation, no clue yet what's needed to do what (and how much it costs..)


*EDIT* probably better tool link?
http://www.renesas.com/products/mpumcu/superh/sh7780/sh7722/soft_tools_index.jsp" onclick="window.open(this.href);return false;

defiancecp said:

kubel said:

Since this is (presumably) a WinCE device, it would be nice if we could figure out how to break out of the Nissan application to the WinCE desktop. What we need are some Nissan service manuals. I know of at least one LEAF technician on the forums.

On a number of older Clarion WinCE sat navs, the password to access map and software update menu items is 200802, though I doubt this will help. I don't have my LEAF yet, so I have no way to dig into the menus and see if there's an option to enter a password. I'm sure Nissan isn't using stock Clarion software.

Click to expand...

Doesn't look like this is WinCE - looks like it has its own custom OS. At least, if I'm finding the right parts references:

Click to expand...

http://www.microsoft.com/en-us/news/features/2010/oct10/10-19windowsembeddedautomotive7.aspx" onclick="window.open(this.href);return false;
http://www.microsoft.com/windowsembedded/en-us/evaluate/history-of-windows-embedded-automotive-7.aspx" onclick="window.open(this.href);return false;

ksnogas2112 said:

He built himself a clock that adds and extra 8 hours to every day. The clock is an automatic override for the current space/time continuum that also allows him to place winning bets on football games after the game has been played.

Click to expand...

I wish! (If only I didn't need to sleep...) :lol:

-Phil

Ingineer said:

My first (and so far only) Hack is to add a small microcontroller circuit to "fake" the OK button press as soon as the unit powers up:

Click to expand...

I had thought about doing this. But, I haven't even dragged the o-scope out to the car to look at the connection between the touch screen and the rest of the unit. Would you be willing to share any details of what you did? Physical and/or logical protocols in place in the Clarion? Which microcontroller you used? Etc.

Even the smallest hints would be a huge jump start.

Thanks!

Danal said:

Ingineer said:

My first (and so far only) Hack is to add a small microcontroller circuit to "fake" the OK button press as soon as the unit powers up:

Click to expand...

I had thought about doing this. But, I haven't even dragged the o-scope out to the car to look at the connection between the touch screen and the rest of the unit. Would you be willing to share any details of what you did? Physical and/or logical protocols in place in the Clarion? Which microcontroller you used? Etc.

Even the smallest hints would be a huge jump start.

Thanks!

Click to expand...

I would also like to hear more about this!

Bonzo said:

Danal said:

Ingineer said:

My first (and so far only) Hack is to add a small microcontroller circuit to "fake" the OK button press as soon as the unit powers up:

Click to expand...

I had thought about doing this. But, I haven't even dragged the o-scope out to the car to look at the connection between the touch screen and the rest of the unit. Would you be willing to share any details of what you did? Physical and/or logical protocols in place in the Clarion? Which microcontroller you used? Etc.

Even the smallest hints would be a huge jump start.

Thanks!

Click to expand...

I would also like to hear more about this!

Click to expand...

+5

I noticed that the schematics on the first page doesn't reflect how the touch screen is connected.
Does it use the I2C, the GPIO or some other method completely?

And a question directly to Ingineer; did your microcontroller fake a touch screen input or did you send the command in some other way?

I would like to know as well. Im planning on adding in an extra USB, to connect the old SSD from my MacBook Air and another power outlet. I would love to roll all the mods into one day of work.

Can you tell me more about how the Around View cameras are hooked up? Are we talking about 4 analog video connections (RCA/S-Video)?

I'm working on installing 2 dashcams, but might opt for a larger DVR solution if it's easy to grab a copy of the around view camera video.

lion said:

Can you tell me more about how the Around View cameras are hooked up? Are we talking about 4 analog video connections (RCA/S-Video)?

I'm working on installing 2 dashcams, but might opt for a larger DVR solution if it's easy to grab a copy of the around view camera video.

Click to expand...

All the cameras are connected to a separate module that combines and "stitches" the four images together. That combines signal is then sent to the A/V control unit up front.

I have looked into adding a video input for the unit but the only device I can find is over $700.
Would it be possible to add an aux video in to the unit for less?

I want to use the video to connect my Android phone so I can use the new mimicsx2 device to control the phone from the nav screen.

Thanks

Why don't you use one of video switchers (http://www.alldatasheet.net/datasheet-pdf/pdf/7397/NJRC/NJM2533D.html" onclick="window.open(this.href);return false to combine an back camera input + your's unit ?