This is an old revision of the document!
Table of Contents
Entertainment & Information Systems
Basically, this page documents EOPs for those screens that you see in many cars made recently. To be specific, this means the screens that show you music, GPS, little “apps”, fuel stats, and so on. Some of the older ones are based off some custom OS or QNX, while newer ones are almost universally Android Auto/Apple CarPlay based. When it comes to CPU architectures, older ones typically are based off of MIPS, and newer ones are almost always ARM or x86.
Bosch LCN2kai
Operating Systems
Rooted Linux
2015 Xterra,[…]should be the same for other[…]Nissans[…]the Rogue, Sentra, Altima, Frontier
Found in many Nissan vehicles, including the Xterra, Rogue, Sentra, Altima, and other models from 2015 onward. It is possible to root these head units by probing ports, installing firmware through a USB drive, and using a USB to Ethernet adapter to actually interface with it. Further EOP functions are unknown, but may benefit from further probing and research.
https://github.com/ea/bosch_headunit_root
https://hackaday.com/2021/01/30/nissan-gives-up-root-shell-thanks-to-hacked-usb-drive/
Hyundai Tuscon 2016
Operating Systems
Windows CE access + Media
This one doesn't run Android Auto. Linked video demonstrates a movie playing on the Tuscon's entertainment system, apparently on the “WolfNCU” movie player.
Hyundai Veloster 2013, 2015
Operating Systems
Windows CE 6.0 (2013)
The method used here is very similar to the 2015 Veloster method. One can access the Windows CE 6.0 underlying shell with some dealer code inputted to a secret entry field.
Windows CE (2015; +DOOM, emulators)
If you know how to enter the dealer's debug mode (unique for different models)
While it varies for each Hyundai, it is possible to enter a Windows CE shell on the infotainment systems built in. This redditor demonstrated this for his Veloster, showing off Windows CE’s solitaire, DOOM, and a Game Boy emulator. Presumably, other things are possible within the preexisting CE environment, which appears to be CE Embedded 6.0 as in the 2013 Velosters.
https://www.reddit.com/r/itrunsdoom/comments/6xtda1/doom_on_a_hyundai_attempt_1/
https://www.reddit.com/r/itrunsdoom/comments/6xtda1/doom_on_a_hyundai_attempt_1/dmiamea/
Kia Sportage IV
Operating Systems
Windows CE access
Another example of “developer” codes/combinations used to access the underlying WinCE shell of a car's CE-based entertainment system. In this case, the system runs Windows Embedded Compact 7, with a mysterious “demo apps” folder visible on the desktop.
Mercedes-Benz (mid 00s)
Other
Doom (on custom Android)
The video below is on a custom infotainment system, rather than the stock system included in the Mercedes (to my understanding); not sure as to how much was altered, but this is ultimately Android Doom running on a Benz infotainment system, albeit a non-stock one.
Pioneer series
Operating Systems
Android ROM hack
The hack involves a whole lot of delicate steps
Some of these Pioneer units are able to accept custom ROMs with more proper functions of an Android tablet, but this is circa 2016. It may not apply now to units which are currently sold new.
https://hackaday.com/2016/12/13/pioneer-avic-infotainment-units-hacked-to-load-custom-roms/
Tesla Model 3
Operating Systems (Intel Atom E3950)
Ubuntu chroot
4GB of (DDR4 I think) RAM, and a 64GB eMMC for storage
While requiring some disabling of certain Intel safeguards relating to the vehicle, it is possible to run a fully featured Ubuntu instance on the little console within a Tesla Model 3, plus potentially the Model S and Xs. The Model 3’s Intel MCU is known to be a lot more locked down, so this being done is somewhat of an achievement compared to other Tesla systems.