UART Fun

Go To Last Post
47 posts / 0 new
Author
Message
#1
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Howdy,

 

Hoping someone might be able to point me in the right direction here.

 

I've been battling for a few weeks trying to get UART access to my car's head unit (who doesn't get excited at hidden debug interfaces??).

 

After getting the LA out I realised I was getting a few erroneous spikes - not enough to generate frame errors or misinterpreted breaks but enough to throw off any of my adapters.

 

So I whipped out my opto isolated (adum3201) ft232rl and happily receives correctly (so assuming ground loop/noise with my non isolated adapter):

XTP_Cache( )
XTP_DramBank( )
XTP_DramAddr( )
XTP_DramBit( )
XTP_DramRef( )
XTP_RamBacc( )
XTP_RamWacc( )
XTP_RamBacc2( )
XTP_MMU( )
XTP_FLASH( )
XTP_FLASHRom3( )
XTP_WD1( )
XTP_WD2( )

XTP_INT( )
XTP_SCU( )


 Hit any key:

 

Downside being that it seemingly doesn't want to respond to me when I hit any key.

Unfortunately I'm really not much of an EE (although slowly trying to learn!)

 

I can't quite get my head around the diagram and what the transistors are actually doing TX side - "PC_IT" > "PC_CPU".

 

Any help understanding where I could be going wrong would be greatly appreciated!

 

Thanks,

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

With the base shorted to the emitter, the left xistor is off, my guess is they did not need the left xsistor in the package but did not want it's pins floating, so made sure it was disabled.

 

Welcome to AVRFreaks!

I hope your not driving while playing with the ecm at the same time!

 

Jim

 

 

(Possum Lodge oath) Quando omni flunkus, moritati.

"I thought growing old would take longer"

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

When cpu_pc goes low it turns on q2305 & q2304, pulling

 

IT_PC low (assuming black line going to far right is a gnd line).  When this is not the case ZD2303 may clamp (through 220) the voltage depending if  IT_PC has some sort of pullup.

 

When PC_IT goes high, it pules PC_CPU low.  (It has to go pretty high, due to the 2.2/15 divider===>12.8%)...sounds like a 12V signal.

 

What part of the car is this, you don't mention it.

When in the dark remember-the future looks brighter than ever.   I look forward to being able to predict the future!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Thank you for the warm welcome :) 

heh thankfully not still in the car - far too little room to play there; it's sat in the far more sensible location of my coffee table with my bench power supply and and some test leads hanging out of the back of it !

 

It's a vehicle head unit / sat nav.

 

From what you're saying @avrcandies, it sounds like it's actually RS232 operating at 12v rather than 3.3v uart which the receiving IC operates at.

And yep, thick black line is the ground line.

 

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

So my max232 arrived; and no joy - only seems to output +/- 9vdc despite specs indicating it *should* do +/- 12vdc.

 

Any ideas?

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Nominal

MAX220–MAX249 - +5V-Powered, Multichannel RS-232 Drivers/Receivers

[page 4]

Typical Operating Characteristics

...

OUTPUT VOLTAGE vs. LOAD CURRENT

via MAX232A +5V-Powered, Multichannel RS-232 Drivers/Receivers - Maxim Integrated

 

"Dare to be naïve." - Buckminster Fuller

Last Edited: Sat. Oct 10, 2020 - 07:56 PM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Clearly I didn't read that quite so well... *sigh*

 

Is anyone aware of any drivers with charge-pumps capable of outputting ±12vdc ?

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Whiterat wrote:
From what you're saying @avrcandies, it sounds like it's actually RS232 operating at 12v rather than 3.3v uart which the receiving IC operates at.

 

No, not at all and using the MAX232 might damage something. as there is no negative rail from what I see.  Also, considering the noise in a car, 232 is the last protocol I would expect to use.  485 twisted pair is ideal, but no tin your case.

 

If you look at the signals.  IT_PC and PC_IT are your comms.  With that Darlington pair I would think that if you put a scope on that line you will see the signal transition from 0v and +12v for the IT_PC connection.

 

For the PC_IT connection a scope will tell teh tale as to what you will see, but again I will bet its transitioning between 0v and +12vdc.

 

DO oyu have a scope or even a multimeter that can show you whats going on?

 

JIm

I would rather attempt something great and fail, than attempt nothing and succeed - Fortune Cookie

 

"The critical shortage here is not stuff, but time." - Johan Ekdahl

 

"Step N is required before you can do step N+1!" - ka7ehk

 

"If you want a career with a known path - become an undertaker. Dead people don't sue!" - Kartman

"Why is there a "Highway to Hell" and only a "Stairway to Heaven"? A prediction of the expected traffic load?"  - Lee "theusch"

 

Speak sweetly. It makes your words easier to digest when at a later date you have to eat them ;-)  - Source Unknown

Please Read: Code-of-Conduct

Atmel Studio6.2/AS7, DipTrace, Quartus, MPLAB, RSLogix user

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

The MAX232 is not the correct solution here. For the most part you simply want to replicate the original circuitry. If you want an integrated solution, then look at LIN interfaces.

 

With your initial tests, the isolated RS232 interface would receive the data correctly but sending the data would've upset the system as RS232 actively drives the signal whereas the circuit you've shown is 'open-collector' and it only pulls the signal low. This is what the LIN interface does as well.

 

The 0.001uF caps are for ESD protection as are the zener diodes.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

It is a test/debug interface which I imagine ordinarily is only used on a production line / service centre.

A service manual for a different unit from the same manufacturer is what got me this far as it explained the "test bits" seen on the schematic, certain combinations pulled down evoke certain modes. (eval mode or debug mode).

In that manual they connect these units into a mystery box ("dengen" which simply means power in Japanese - apparently) which emulates some of the inputs the unit is expecting to see and presents a serial port for the engineer to connect to.

 

No scope unfortunately, just an LA but I do have a dmm - bizarrely even when recording min/peak on IT_PC to ground I don't see anything higher than 0.3v.... 

 

Given that with an LA it decodes perfectly with the uart protocol decoder then LIN seems somewhat unlikely as from what I've seen the framing is totally different ?

 

Edit:

Here's the LA dump if anyone is interested.

uart.sr

Last Edited: Sat. Oct 10, 2020 - 11:23 PM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

There's two parts to LIN - the hardware interface (which is the point of interest) and the protocol side.

 

Something like this:

http://ww1.microchip.com/downloa...

 

The problem is LIN is half duplex - receive and transmit is on the one wire, so you'd need two chips. Personally I'd just use the transistor circuit.

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Still a little confused how it could be LIN or why LIN would be used on a debug terminal that isn't connected when it's in the car?

And schematics clearly mark it as a 2 wire system and goes back to the Renesas SH7750 tx3/rx3 pins which would be 3.3v uart :/

 

I do apologise, I know this probably isn't the best place for someone with as little EE as me...

 

Thoroughly appreciating the help !

 

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

First up, where are you connecting into the system? At the connector IT_PC / PC_IT? If this is the case, I gather you want to make an interface to this.

 

In terms of hardware, the LIN interface is very similar to what is implemented in the circuit you've shown. Regardless of the name LIN or the protocol, at the hardware level they are similar. In comparison, RS232 is a hardware spec, not a protocol spec and in hardware terms is not what is really needed. 

 

 

However, RS232 may be able to be coaxed into a quick and dirty interface. It depends on what your goals are.

 

 

As for your .sr files - what is used to view these?

 

 

 

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Yep, terminal connectors on the rear of the unit (what would be the vehicle harness in the schematic).

Firstly looking to make a down and dirty adapter to see what options are available in there and then assuming anything useful, document what I find and perhaps look for a more refined solution.

Ahh, sorry. My misunderstanding there.

Sr opens with PulseView (sigrok)

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

For quick n dirty, I'd be putting a series resistor in the tx from the RS232 interface of, say 1k.

Then on the Rx side, this needs a pullup resistor of 10k thereabouts from the rx to something with +5V or so - maybe one of the RS232 control lines RTS/CTS/DCD/DTR? This should give it a healthier voltage swing  

 

 

Man, your avatar is disrespectin the colonel!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Quick and dirty - just as the Colonel likes ;) 

 

So gave that a go and no joy with USB<>RS232. DMM shows IT_PC drop to ~4.3v from 5v when it's transmitting, so not low enough to register. 

 

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

The DMM will lie to you as it is a pulse. DMMs average the voltage.
 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Kartman wrote:
DMMs average the voltage.

 

On teh bottom of my Fluke DMM I have a fast response analog bar graph display that is usually fast enough if set properly to get pulse readings.  Not narrow width pulses, but I can usually see the leading edge.

 

Jim

I would rather attempt something great and fail, than attempt nothing and succeed - Fortune Cookie

 

"The critical shortage here is not stuff, but time." - Johan Ekdahl

 

"Step N is required before you can do step N+1!" - ka7ehk

 

"If you want a career with a known path - become an undertaker. Dead people don't sue!" - Kartman

"Why is there a "Highway to Hell" and only a "Stairway to Heaven"? A prediction of the expected traffic load?"  - Lee "theusch"

 

Speak sweetly. It makes your words easier to digest when at a later date you have to eat them ;-)  - Source Unknown

Please Read: Code-of-Conduct

Atmel Studio6.2/AS7, DipTrace, Quartus, MPLAB, RSLogix user

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

My brymen has the same; not sure what the sample rate is on that though.

 

Anywho - still a bit confused as to the next route to try, I feel quite out of my depth here 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

fyi

AVR Butterfly circuit is similar to #1.

STK500 has a MAX202 though with RC (current-limiting, slew-limiting, ESD tolerance)

 

AVR Butterfly Evaluation Kit - User Guide

[page 23, bottom]

3.7 Connect to PC

[page 36 for that schematic]

AVR STK500 User Guide

[page 15]

Figure 3-10. Schematic of UART Pin Connections

MAX202 +5V, RS-232 Transceivers with 0.1µF External Capacitors - Maxim Integrated

 

"Dare to be naïve." - Buckminster Fuller

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Certainly does look similar - that seems to imply that circuit is providing level shifting from UART > RS232 ?

Quote:
The STK500 includes two RS-232 ports. One RS-232 port is used for communicating with AVR Studio. The other RS-232 can be used for communicating between the target AVR microcontroller in the socket and a PC serial port connected to the RS-232. To use the RS-232, the UART pins of the AVR need to be physically connected to the RS-232. The 2-pin header marked “RS232 SPARE” can be used for connecting the RS-232 converter to the UART pins on the target AVR microcontroller in the socket. Use the 2-wire cable to connect the UART pins to the RS-232. The connection is shown in Figure 3-9. The block schematic of the RS-232 connection is shown in Figure 3-10

 

The STK500 user guide with the MAX202 appears to be for connecting the onboard UART back to RS232 ?

Quote:
The STK500 includes two RS-232 ports. One RS-232 port is used for communicating with AVR Studio. The other RS-232 can be used for communicating between the target AVR microcontroller in the socket and a PC serial port connected to the RS-232. To use the RS-232, the UART pins of the AVR need to be physically connected to the RS-232. The 2-pin header marked “RS232 SPARE” can be used for connecting the RS-232 converter to the UART pins on the target AVR microcontroller in the socket. Use the 2-wire cable to connect the UART pins to the RS-232. The connection is shown in Figure 3-9. The block schematic of the RS-232 connection is shown in Figure 3-10

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

yes and yes

AVR Butterfly doesn't reach RS232 extents (reduced noise margin) though is still functional.

 

"Dare to be naïve." - Buckminster Fuller

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Thanks for sticking with me on this one, appreciate it.

 

This leads me back to being somewhat confused again since the Butterfly guide says that it can be directly connected to it's RS232 port without anything additional - which is not my case.

The only output I can still ever get is via the optocoupled uart adapter; even my optocoupled rs232 adapter (inverted or not) does not play ball.

 

I feel a little blind without any oscilloscope so might pick up a cheap hantek as it would come in handy in the future I'm sure.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

You could try a cheapy logic analyser - these won't appreciate anything over 5V on the input but you could sniff the logic levels of the micro controller if you have access to them.

Google saleae logic cone. They're around $8-10USD. Buy a couple in case you blow one up. It won't solve the external circuitry problems, but at least you'll be able to see what is coming in and out.

 

There's also using your PC sound card as an oscilloscope - no good for DC voltage levels though. Again, Google.

 

Last Edited: Wed. Oct 14, 2020 - 01:42 AM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

You're welcome.

 

Your logic analyzer may sample fast enough and is more likely to have a UART decoder though an oscilloscope may be more intuitive for one.

Suggest a good scope? | AVR Freaks

 

"Dare to be naïve." - Buckminster Fuller

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Post #10 has the sigrok dump from my saleae clone - which reads nice enough in pulseview with the uart decoder, no errors.

I've also got a dslogic which will sample at a higher rate (the saleae seems to struggle much over 12-16).

 

Having done a bit of reading the Hantek 6022be seems like a cheap and reasonable start albeit somewhat limited in it's sampling.

I'd love a decent bench scope and dmm but sadly just don't have the space at the moment.

 

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Whiterat wrote:
Having done a bit of reading the Hantek 6022be seems like a cheap and reasonable start albeit somewhat limited in it's sampling.
For that bandwidth, consider USB Oscilloscope and Logic Analyzer - Digilent Analog Discovery 2 for multiple instruments in one.

Analog Discovery 2 [Reference.Digilentinc]

 

 

"Dare to be naïve." - Buckminster Fuller

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Unfortunately $399 is too much just for a lowly hobbyist such as myself; the Hantek can be had for ~$55 which is far more justifiable.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Yes, after I posted I re-read your posts regarding the LA :(  

 

Nevertheless, you should be able to determine how well the circuitry works but comparing what you feed in/get out vs what the logic analyser sees on the 3V3 signals to the processor. Clearly, if the input to PC_IT then what you see on PC_CPU doesn't look right, then there's work to be done. Similarly on IT_PC/CPU_PC

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Whiterat wrote:
So I whipped out my opto isolated (adum3201) ft232rl ...
fyi, MAX14932 into a FT231X :

muArt USB-UART Converter

 

μArt Schematics

MAX14932 4-Channel, 1kVRMS, 2.75kVRMS, and 3.75kVRMS Digital Isolators - Maxim Integrated

FT231X

 

"Dare to be naïve." - Buckminster Fuller

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

@Kartman:

That's certainly one way to do it; although there's no test points on that side of the circuit - and this thing is a mother to disassemble to get to that board, but as plan Z it might well be the only option.

I was hoping given that I've got the full schematic of the unit this wouldn't be necessary. 

 

@gchapman:

That's pretty cool; Although it's about 2x more than I'd pay for a uart adaptor it would eliminate my box of ~5-6 different adaptors!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Hi All :)

 

Quick update - I had to put the headunit back into my car, but managed to source another from from a scrap yard to continue the effort!

 

So with 10K pull-up to 3.3v on IT_PC it does receive cleanly on any of my standard uart adapters - so that's that bit sorted.

 

For PC_IT still no luck. DMM shows a solid 3.3v from the uart adapter which dips on transmit as you'd expect but DMM on the 2nd collector leg of Q2306 (pin 3) shows a steady 3.3v, no dips at all when transmitting.

I dug further into the schematics and found that there's a 10K pull-up to 3.3v on PC_CPU after Q2306 before going into RX3 on the MCU.

 

 

 

 

Going back to @avrcandies comment:

When PC_IT goes high, it pules PC_CPU low.  (It has to go pretty high, due to the 2.2/15 divider===>12.8%)...sounds like a 12V signal.

 

Thoughts?

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I'm thinking you need to find a scope to check these out (as mentioned in post #8).

David

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I've read through this a couple of times now and really confused. 

 

The original question was :-

I can't quite get my head around the diagram and what the transistors are actually doing TX side - "PC_IT" > "PC_CPU".

 

Right, Q2306 -  One transistor is not used the other is used to switch PC_CPU to ground with a logic 1 emanating from PC_IT via some basic filtering (capacitor C2307) and over voltage protection (Zener ZD2306 is it).

 

Whilst the two resistor do form a voltage divider if PC_IT is high, R2324 is also a pull down resistor for the base of the transistor ensuring is at GND potential and not floating and thus ensuring the transistor remains off.  I would assume there would be a voltage on PC_CPU from an external circuit which is then 'low side switched' via Q2306

 

We don't know what voltage is on this NPNs collector because it is not stated on the diagram. Where does all the talk of RS232 etc come from?

 

If you think there is a signal on this then a cheap Logic analyser (£10) running Sigrok could be used as a basic oscilloscope (mine does) or buy an equally cheap chinesium one from our favourite auction site or a quick search gave me this (New 2.4" LCD Display £15).  Don't even think of using a DMM for signals other than DC they don't react quickly enough.

 

I highly doubt it would be RS232 in an automotive environment - looking at just that snippet of a circuit diagram supplied, I would assume this circuit is just for some basic buffering and clipping of bidirectional on/off signals (to indicate a condition). Unless proven otherwise via a scope. Data would use a balanced line driver IC.

 

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Thoughts?

 

Takes a 12V signal & produces an inverted logic level (3.3V swing) output .  The 16V zener is just along for the ride.

 

Have you tried applying 12V?

When in the dark remember-the future looks brighter than ever.   I look forward to being able to predict the future!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Went with the super rough and sketchy approach of "tapping" 12v on PC_IT whilst disconnected from the uart adapter.

Low and behold it works !

 

Would I be right in thinking the correct approach now would be to use an N-channel mosfet and some pullups as a level shifter ?

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Would I be right in thinking the correct approach now would be to use an N-channel mosfet and some pullups as a level shifter ?

 

Not sure what you mean...don't you want the 12v wave to come from your car/auto?     Yes a mosfet/pullup would be fine (use 1k or 2K pullup), but then you turn around and  take that and send to the 3.3V transistor inversion circuit?

 

If you don't have a 12V signal (such as if you are providing your own 3.3v wave), why not  bypass the transistor entirely & pipe your 3.3V wave it into PC_CPU 

 

Maybe you need a block diagram describing what setup you are trying to set up

When in the dark remember-the future looks brighter than ever.   I look forward to being able to predict the future!

Last Edited: Sat. Nov 14, 2020 - 09:13 PM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

These are "service" or "debug" terminals that aren't connected to anything normally.

Essentially just trying to make my own super-secret clarion service tech only cable, because who doesn't enjoy rummaging around their own tech?

 

So currently it's sat on my coffee table with my bench power supply providing 12v to power up the unit itself and then a usb > uart adapter on the end of PC_IT and IT_PC with IT_PC pulled up (10k) to 3.3v provided by the uart adapter vcc.

 

The uart adapter can be set to invert the tx pin (idle low instead of high); just not sure it would be entirely happy to see 12v if I just use a pullup.

 

Would prefer to make this as plug and play as possible and since PC_IT and IT_PC are exposed on the unit's connectors it seems rude not to use them.

(and thanks for the responses!)

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

 just not sure it would be entirely happy to see 12v if I just use a pullup.

Be sure...--absolutely not...grab the fet. No need to blow out your adapter.

When in the dark remember-the future looks brighter than ever.   I look forward to being able to predict the future!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0


Waiting for some fets in the post.

 

But impatience does have the better of me...

 

On hand at the moment I've just got a collection of BJTs (bc337, 2n2222, 2n3904, 2n3906) and a mixed bag of zeners and resistors.

 

Was hoping to pull something like this off but with 2n3904 :

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Of course that is fine.   The 10 k pullup is somewhat weak, but prob usable with the load pulldown (only need a base volt>0.7)  

When in the dark remember-the future looks brighter than ever.   I look forward to being able to predict the future!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 1

Success!!

 

XTP_Cache( )
XTP_DramBank( )
XTP_DramAddr( )
XTP_DramBit( )
XTP_DramRef( )
XTP_RamBacc( )
XTP_RamWacc( )
XTP_RamBacc2( )
XTP_MMU( )
XTP_FLASH( )
XTP_FLASHRom3( )
XTP_WD1( )
XTP_WD2( )

XTP_INT( )
XTP_SCU( )


 Hit any key:



xanavi>verall
 0(                     ): WRITTEN  <X1E30006>
 3(                     ): WRITTEN  <10200a00>
 4(                     ): WRITTEN  <111>
66(                     ): WRITTEN  <16>

xanavi>ls

usag : ls [para] [mode]
 ---------------------------------------------------
   para  1: HDD partition 1.
   para  2: HDD partition 2.
   para  3: HDD partition 3.
   para  4: HDD partition 4.
 ---------------------------------------------------
   mode  0: Normal search(default).
   para  1: Read only attribute cancel.

 ---------------------------------------------------

xanavi>

xanavi>devs
drv name
  0 /null
  1 /tyCo/0
  3 /TIMER0
  4 /SUBCPU
  5 /TEL_CTRL
  5 /GPS
  4 /AUDIO
  4 /FDISPLAY
  6 /SPEED
  7 /MCAN_SWPRI
  7 /MCAN_SWSTR
  7 /MCAN_SWR
  7 /MCAN_RC
  7 /MCAN_RC2
  8 /ADC
  9 /SSI1
  9 /SSI0
 10 voice
  9 /SSI3
 11 music
 12 /ECHO_CAN
 13 /REMOCON
 14 /SIGNAL
 15 /Bluetooth/hci/0
 16 /dev1
 16 /dev2
 16 /dev3
 16 /dev4
  4 /DVD
 17 /DSP

I can't thank you all enough for your help :)

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Can you explain what does all of this does, or what can it do?  Perhaps unlock some hidden features?
 

When in the dark remember-the future looks brighter than ever.   I look forward to being able to predict the future!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Hidden features for one!

It allows access to edit the vehicle configuration section which for example allows enabling additional cameras (side view), changing region/language, etc.

Also allows "pairing" of hard drive to the unit which is something that a service centre would charge $100s for or if to visit car dealer, a whole replacement unit ($1000s).

 

There's some 230 commands I've found so far from the firmware (vxworks image I've spent some weeks reverse engineering in Ghidra)

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Just out of interest what make/model of car is this? Most cars these days have security keys that would prevent access to anything like this!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

My guess is a Nissan Pathfinder. The data log tells all - X61B, Nissan

 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Mine is from my Nissan GT-R; but this unit was from a scrap yard - I was told it was from a Nissan Navara D40.

They're the same unit save for the audio board which includes a built in amp on the navara unit. Same service manual even.

 

Just felt more comfortable messing around with a £65 unit rather than a £500 one initially !

This should work with any Xanavi-based Clarion unit which I believe are also used in some Fords, but predominantly Nissan/Infiniti.

 

Bearing in mind this is only the navigation unit, I can't see that anyone could do any real mischief with this.