Show HN: Honda Civic Infotainment Reverse-Engineering • Hacker News Board

Re: Show HN: Honda Civic Infotainment Reverse-Engineering

#41

Post by at_a_remove » Thu, May 25, 2023, 3:01 AM UTC

expertentipp wrote: post #39

at_a_remove wrote: post #26

I have a Toyota RAV4, about 2016, with the built-in system. It's silly amounts of awful when it comes to bad UX. Enough so that I am considering buying a head unit. Bafflingly, I can't find head units that recognize and obey MP3 playlists. I would have thought that functionality would be a given.

> units that recognize and obey MP3 playlists My limited experience says it's mostly about lengths of filenames, non alphabetic characters in filenames, and nested directories. Try flat directory structure and maybe random filenames of 6-8 characters. Simply one more obfuscation step before feeding it into a car system. If lucky, the system might read correctly the ID3 tags.

Oh, no, I tried with very simple setups. Believe me. Down to a playlist of a single song consisting of a single word. No love.

In a rather similar fashion, I managed to reverse engineer the Roku's very, uh, idiosyncratic interpretation of the, well, was it ever a standard? In any case, Roku's Media Player app had, charmingly, decided to simply ignore the order of the songs in the playlist and -- this was fun to figure out -- grab the metadata of the songs and do it by a regular sort of the track number. It's brilliantly stupid, because it'd work just fine if you had a playlist of a single album. There, it makes perfect sense. Nowhere else.

Re: Show HN: Honda Civic Infotainment Reverse-Engineering

#42

Post by dom96 » Thu, May 25, 2023, 10:38 AM UTC

librick wrote: post #27

dom96 wrote: post #20

Earlier quoted context omitted.

What would be really nice is to use the rear camera as a dash cam when driving.

The apparent jankiness of the rear camera was one of the first reasons I started hacking on the car tbh. It was weird to me that the yellow guidelines/overlay don't appear on the camera feed until a little while after the camera feed first shows up. I've confirmed that it's a two stage process controlled in part by the /sbin/earlyrvc binary and later accessed via an Android service. But I'm not sure why the Honda dev…

Ahh, didn't realise some Civics have side cameras. My 2020 Civic only has a rear camera. FWIW I haven't noticed much jerkiness from it so far.

I wonder if I could write a little binary that would continuously record the rear camera, at least the last minute or so, and then hook it up to some button in the UI to store the last recording.

How tough is it to root the head unit and work with it?

Re: Show HN: Honda Civic Infotainment Reverse-Engineering

#43

Post by slackwaredragon » Thu, May 25, 2023, 1:14 PM UTC

It's actually probably running Android Automotive 4.2.2 (as opposed to straight android auto). I encountered this in my journey in to the Pioneer AVH-W4500nex after the internal SDcard failed (here's my post http://avic411.com/index.php?/topic/90861-fix-sdcard-failed-...)

You should have no problem using one of the available rootkits for 4.2.2. That's how I got root on my pioneer. You can find out a lot of interesting stuff binwalking the firmware. Stuff like diag menus and such, at least in the Pioneer stuff.

Yes, you can run your own launcher and apps on it. Probably stable once you figure out what customizations they made.

Re: Show HN: Honda Civic Infotainment Reverse-Engineering

#44

Post by KomoD » Sun, May 28, 2023, 1:06 AM UTC

librick wrote: post #30

ignormies wrote: post #3

Cool project! How much time have you spent sitting in your car with a laptop, or did you excise the headunit from the car?

Thanks :) My friends and I have made a few jokes about hacking my literal "daily driver". TLDR; didn't excise, mostly sat in my car. I originally rooted the car using Honda Hack via http://www.autohack.org/ . A paid service that afaik uses a webkit exploit and probably an old Android kernel exploit to gain root. Part of the motivation for this project was to encourage others to release open-source rooting tools so th…

> Part of the motivation for this project was to encourage others to release open-source rooting tools so they don't have to shell out the $25 for the "pro" version that I did.

I took a quick look at it, someone could easily remove the license check, unlock the pro features and set up an easy to use site for it

Re: Show HN: Honda Civic Infotainment Reverse-Engineering

#45

Post by librick » Fri, Jun 02, 2023, 2:23 PM UTC

dom96 wrote: post #42

librick wrote: post #27

Earlier quoted context omitted.

The apparent jankiness of the rear camera was one of the first reasons I started hacking on the car tbh. It was weird to me that the yellow guidelines/overlay don't appear on the camera feed until a little while after the camera feed first shows up. I've confirmed that it's a two stage process controlled in part by the /sbin/earlyrvc binary and later accessed via an Android service. But I'm not sure why the Honda dev…

Ahh, didn't realise some Civics have side cameras. My 2020 Civic only has a rear camera. FWIW I haven't noticed much jerkiness from it so far. I wonder if I could write a little binary that would continuously record the rear camera, at least the last minute or so, and then hook it up to some button in the UI to store the last recording. How tough is it to root the head unit and work with it?

*Jankiness, not jerkiness. I could have clarified that better; what I mean is that it was strange to me that the backup camera had two stages. The camera video feed comes up first, then the yellow overlay lines are rendered on top later. Which makes sense, that way the user doesn't have to wait for Android to boot up completely before they can view the backup camera.

I want to look more into rear camera viewing/recording too. The binary /sbin/earlyrvc in the repo (in the boot recovery image directory) is what displays the camera on boot. After that there's a few Honda-specific APKs that handle backup camera access for the rest of Android. I had some luck using Ghidra for static analysis of /sbin/earlyrvc. But the biggest hurdle I ran into is a lack of documentation on NVIDIA kernel drivers and the graphics pipeline.

As for rooting, I used a paid ($25) service. You sign up on this sketchy site, pay the $25 to get a unique code (a UUID), and then visit a specific website from the headunit's web browser. AFAIK, whoever runs that service is basically just using a WebKit exploit chained to some other Android exploit(s) to achieve root. It worked for me. I've added some more info on this to the README. But one of my goals is to make rooting easier/free/open source to lower the barrier-to-entry for headunit hacking. It'd be great to see a PR for that