4 ms·

Rooting Bosch lcn2kai Headunit for a car infotainment system

75 points by gaius_baltar 6y ago

gaius_baltar 6y ago
Notice that I added "for a car infotainment system" to the original title because I don't think "lcn2kai" would give enough context for readers.
mmastrac 6y ago
I'm pretty sure my Nissan Versa has one of these and I'm going to give it a shot tomorrow I think.
- DoingIsLearning 6y ago
  This is a really good reverse engineering exercise but as a cautionary note: If you are doing this in your real car most of the trim on the dashboard is secured by plastic clips. You need specialized car trim tools (similar to the phone case ones but well bigger) to remove them along the edges without denting the outer plastic edges. Also most of them are meant to clip-on once. So if you take them apart too many times you might start seeing gaps on the trim and things not properly fitting. Again it might not be something you care about but just thought I would mention. Ideally you would be better off getting one of these from after-sales or 2nd hand from scrap parts and working on a bench top with a 12V line.
  - TheSpiceIsLife 6y ago
    Very good advice. If you're still game, a set of trim tools and replacement clips of all sorts are usually available from your favourite large online retailer. I recently bought a set of trim tools for $AU28 and am assortment of trim clips and roof liner clips for a few more tens of dollars. Definitely worth watching a couple how to videos on YouTube too. Having said that: don't be surprised when you break something.
  - ficklepickle 6y ago
    The exploit doesn't require removing the unit. Simply inserting a prepared flash drive is all that is required.
    - DoingIsLearning 6y ago
      They also explore using a serial connection at the bottom of the chassis. It is specifically that part of accessing the bottom of the chassis that I was advising some caution.
fowl2 6y ago
Super interesting! I somehow wouldn't have thought about "just buying another headunit" to play around with. Anyone have an links to anything similar for Hyundai systems? I know the Mazda system "MZD" has quite the active community, for example: https://mazdatweaks.com/ https://mazdatweaks.com/
johnwalkr 6y ago
This reminded me of the time I installed a computer in my car, in 2005. There was a whole community built around making a windows interface suitable for a touchsreen in your dash. Surprisingly my build thread is still online: https://www.vwvortex.com/threads/mp3.2194412/ https://www.vwvortex.com/threads/mp3.2194412/
headunit123 6y ago
Posting under a throwaway for obvious reasons, but I am sure all of these head units are all insecure. There’s a major manufacturer that had a head unit flaw+backed issue that allowed for the remote unlocking and starting of any car..
DoingIsLearning 6y ago
If the author is reading this, the version info screen shot[0] includes a unit serial number that can absolutely be traced back to you. [0] https://github.com/ea/bosch_headunit_root/blob/main/images/02_version_info.bmp https://github.com/ea/bosch_headunit_root/blob/main/images/0...
- dsr_ 6y ago
  I believe that's from the spare head unit that they bought second-hand so it could be taken apart.
flas9sd 6y ago
very instructional how you can use properties of external drives and filesystems to expolit mountpath variables for path traversal.
- Jermaine_Jabi 6y ago
  Indeed, I can see that being useful on many systems
exabrial 6y ago
Hilariously, I would pay GM for a software upgrade on my headunit for improved UI and features/bugfixes. It even has a software update function but I've never seen one available.
rjsw 6y ago
I did some work on a programmable head unit in 2000, it ran a JVM written by the author of Drupal [1] and had a colour LCD with touchscreen, GSM modem, GPS, CAN interface. [1] https://en.wikipedia.org/wiki/Dries_Buytaert https://en.wikipedia.org/wiki/Dries_Buytaert
numpad0 6y ago
Looks like the unit is based on something called “GENIVI Platform” used widely by Renault and Nissan and supplied by Bosch. “Kai” is probably 改, roughly translates to “Modified” or “Upgraded”.
donkeyhot 6y ago
I have Nissan Rogue 2016. I used to receive phone calls and mails from Nissan Connect enticing me into subscribing for different bundles at roughly 20$ a month. I did not want their entertainment. I was ready to pay for live traffic updates only. That was not an option. Though this project will not let me display live traffic updates it enables custom software running on a headunit. I hope other projects will spring into existence. I will be making a trip for USB-ethernet dongle. Thank you for posting it here.

75 points by gaius_baltar 6y ago

Notice that I added "for a car infotainment system" to the original title because I don't think "lcn2kai" would give enough context for readers.

mmastrac 6y ago

I'm pretty sure my Nissan Versa has one of these and I'm going to give it a shot tomorrow I think.

DoingIsLearning 6y ago
This is a really good reverse engineering exercise but as a cautionary note: If you are doing this in your real car most of the trim on the dashboard is secured by plastic clips. You need specialized car trim tools (similar to the phone case ones but well bigger) to remove them along the edges without denting the outer plastic edges. Also most of them are meant to clip-on once. So if you take them apart too many times you might start seeing gaps on the trim and things not properly fitting. Again it might not be something you care about but just thought I would mention. Ideally you would be better off getting one of these from after-sales or 2nd hand from scrap parts and working on a bench top with a 12V line.
- TheSpiceIsLife 6y ago
  Very good advice. If you're still game, a set of trim tools and replacement clips of all sorts are usually available from your favourite large online retailer. I recently bought a set of trim tools for $AU28 and am assortment of trim clips and roof liner clips for a few more tens of dollars. Definitely worth watching a couple how to videos on YouTube too. Having said that: don't be surprised when you break something.
- ficklepickle 6y ago
  The exploit doesn't require removing the unit. Simply inserting a prepared flash drive is all that is required.
  - DoingIsLearning 6y ago
    They also explore using a serial connection at the bottom of the chassis. It is specifically that part of accessing the bottom of the chassis that I was advising some caution.

fowl2 6y ago

Super interesting! I somehow wouldn't have thought about "just buying another headunit" to play around with. Anyone have an links to anything similar for Hyundai systems? I know the Mazda system "MZD" has quite the active community, for example: https://mazdatweaks.com/ https://mazdatweaks.com/

johnwalkr 6y ago

This reminded me of the time I installed a computer in my car, in 2005. There was a whole community built around making a windows interface suitable for a touchsreen in your dash. Surprisingly my build thread is still online: https://www.vwvortex.com/threads/mp3.2194412/ https://www.vwvortex.com/threads/mp3.2194412/

headunit123 6y ago

Posting under a throwaway for obvious reasons, but I am sure all of these head units are all insecure. There’s a major manufacturer that had a head unit flaw+backed issue that allowed for the remote unlocking and starting of any car..

DoingIsLearning 6y ago

If the author is reading this, the version info screen shot[0] includes a unit serial number that can absolutely be traced back to you. [0] https://github.com/ea/bosch_headunit_root/blob/main/images/02_version_info.bmp https://github.com/ea/bosch_headunit_root/blob/main/images/0...

dsr_ 6y ago
I believe that's from the spare head unit that they bought second-hand so it could be taken apart.

flas9sd 6y ago

very instructional how you can use properties of external drives and filesystems to expolit mountpath variables for path traversal.

Jermaine_Jabi 6y ago
Indeed, I can see that being useful on many systems

exabrial 6y ago

Hilariously, I would pay GM for a software upgrade on my headunit for improved UI and features/bugfixes. It even has a software update function but I've never seen one available.

rjsw 6y ago

I did some work on a programmable head unit in 2000, it ran a JVM written by the author of Drupal [1] and had a colour LCD with touchscreen, GSM modem, GPS, CAN interface. [1] https://en.wikipedia.org/wiki/Dries_Buytaert https://en.wikipedia.org/wiki/Dries_Buytaert

numpad0 6y ago

Looks like the unit is based on something called “GENIVI Platform” used widely by Renault and Nissan and supplied by Bosch. “Kai” is probably 改, roughly translates to “Modified” or “Upgraded”.

donkeyhot 6y ago

I have Nissan Rogue 2016. I used to receive phone calls and mails from Nissan Connect enticing me into subscribing for different bundles at roughly 20$ a month. I did not want their entertainment. I was ready to pay for live traffic updates only. That was not an option. Though this project will not let me display live traffic updates it enables custom software running on a headunit. I hope other projects will spring into existence. I will be making a trip for USB-ethernet dongle. Thank you for posting it here.