Esoteric Devices Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Head Units (Entertainment/Info Systems) ======

This page documents EOPs for those screens that you see in many cars made recently, which are generally called head units. To be specific, this means the screens that show you music, GPS, little "apps", fuel stats, and so on. Some of the older ones are based off some custom OS or QNX, while newer ones are almost universally running either Android Auto/Apple CarPlay. When it comes to CPU architectures, older ones typically feature MIPS CPUs, and newer ones can be ARM, x86 (like in Teslas), or MIPS like in older cars.

===== Bosch LCN2kai =====

==== Operating Systems ====

=== Rooted Linux ===

>2015 Xterra,[...]should be the same for other[...]Nissans[...]the Rogue, Sentra, Altima, Frontier

This can be used in many Nissan vehicles, including the Xterra, Rogue, Sentra, Altima, and other such models from 2015 onward. It is possible to root the head units found in these cars by probing ports, installing firmware through a USB drive, and using a USB to Ethernet adapter to actually interface with the now-rooted Linux instance. Further EOP functions are unknown, but knowledge of potential EOPs may improve from further probing and research. The linked pages are primarily a documentation of experimenting on a head unit.

https://github.com/ea/bosch_headunit_root

https://hackaday.com/2021/01/30/nissan-gives-up-root-shell-thanks-to-hacked-usb-drive/



===== Hyundai Tuscon 2016 =====

==== Operating Systems ====

=== Windows CE access + Media ===

One of many cars featuring a head unit that runs Windows CE. There are a variety of rituals and procedures required to gain access to the Windows CE sublayer of the head unit, but it can be done. Many Hyundai cars from this era run the same sort of software and presumably can all be "victims" of this sort of exploit.

https://www.youtube.com/watch?v=J9ai6cvOR9c

https://www.hyundai-forums.com/threads/how-to-get-to-windows-ce-desktop.304426/

===== Hyundai Veloster 2013, 2015 =====

==== Operating Systems ====

=== Windows CE 6.0 (2013) ===

The method used here is very similar to the 2015 Veloster method. One can access the Windows CE 6.0 instance the head unit runs off of by inputting a dealer code into a field found within a debug menu. The code for this model, according to the video description, is 73148320.

https://www.youtube.com/watch?v=StVa9jTgFcY



=== Windows CE (2015; +DOOM, emulators) ===

>If you know how to enter the dealer's debug mode (unique for different models)

While it varies for each Hyundai, it is possible to enter a Windows CE shell on the infotainment systems built in. This redditor demonstrated this for his Veloster by showing off Windows CE’s solitaire, DOOM, and a Game Boy emulator for Windows CE. Presumably, other things are possible within the preexisting CE environment, which appears to be CE Embedded 6.0 much like the 2013 Velosters.

https://www.reddit.com/r/itrunsdoom/comments/6xtda1/doom_on_a_hyundai_attempt_1/

https://www.reddit.com/r/itrunsdoom/comments/6xtda1/doom_on_a_hyundai_attempt_1/dmiamea/



===== Kia Sportage IV =====

==== Operating Systems ====

=== Windows Embedded access ===

Another example of developer codes and combinations being used to access an underlying Windows shell of a car's embedded entertainment system. In this case, the system runs Windows Embedded Compact 7, with a mysterious "demo apps" folder visible on the desktop. One has to wonder what sort of apps are in that folder... although realistically, it's probably something for the dealerships.

https://www.youtube.com/watch?v=ul4P6RExCNQ



===== Mercedes-Benz (mid 00s) =====

==== Other ====

=== Doom (on custom Android) ===

The example here is a stretch, as the head unit being used here is an aftermarket head unit, which presumably runs some flavor of Android Auto which this person subsequently hacked. Nonetheless, it is a very interesting Doom port that actually uses the controls of the car itself to move the Doom guy around. Don't play this while driving...

https://github.com/rnd-ash/mercedes-hacking-docs

https://www.youtube.com/watch?v=5mmiPT2avrY



===== Pioneer series =====

==== Operating Systems ====

=== Android ROM hack ===

>The hack involves a whole lot of delicate steps

While the writers of this article do not fully delve into it, it appears possible to mess with the Android system that powers the Pioneer AVID head units, circa 2016. Whether more has happened with this project is unknown, but it is intriguing. 

https://hackaday.com/2016/12/13/pioneer-avic-infotainment-units-hacked-to-load-custom-roms/



===== Tesla Model 3 =====

==== Operating Systems (Intel Atom E3950) ====

=== Ubuntu chroot ===

>4GB of (DDR4 I think) RAM, and a 64GB eMMC for storage

While this hack does require the disabling of certain Intel safeguards relating to the vehicle, it is possible to run a fully featured Ubuntu instance on the little console within a Tesla Model 3. This could potentially also work on the Model S and Xs. The Model 3’s Intel MCU is known to be a lot more locked down, so this may mean that doing this hack on the other Tesla models will be easier.

https://www.reddit.com/r/teslamotors/comments/a1fln4/rooted_tesla_model_3_running_ubuntu_and_youtube/