Rooting Bosch lcn2kai Headunit for a car infotainment system | Hacker News Reader

Rooting Bosch lcn2kai Headunit for a car infotainment system

github.com

75 pointsgaius_baltar17 comments

Notice that I added "for a car infotainment system" to the original title because I don't think "lcn2kai" would give enough context for readers.

Super interesting! I somehow wouldn't have thought about "just buying another headunit" to play around with.

Anyone have an links to anything similar for Hyundai systems?

I know the Mazda system "MZD" has quite the active community, for example: https://mazdatweaks.com/

Looks like the unit is based on something called “GENIVI Platform” used widely by Renault and Nissan and supplied by Bosch.

“Kai” is probably 改, roughly translates to “Modified” or “Upgraded”.

This reminded me of the time I installed a computer in my car, in 2005. There was a whole community built around making a windows interface suitable for a touchsreen in your dash. Surprisingly my build thread is still online: https://www.vwvortex.com/threads/mp3.2194412/

If the author is reading this, the version info screen shot[0] includes a unit serial number that can absolutely be traced back to you.

[0] https://github.com/ea/bosch_headunit_root/blob/main/images/0...

I believe that's from the spare head unit that they bought second-hand so it could be taken apart.

I did some work on a programmable head unit in 2000, it ran a JVM written by the author of Drupal [1] and had a colour LCD with touchscreen, GSM modem, GPS, CAN interface.

[1] https://en.wikipedia.org/wiki/Dries_Buytaert

Posting under a throwaway for obvious reasons, but I am sure all of these head units are all insecure. There’s a major manufacturer that had a head unit flaw+backed issue that allowed for the remote unlocking and starting of any car..

I have Nissan Rogue 2016. I used to receive phone calls and mails from Nissan Connect enticing me into subscribing for different bundles at roughly 20$ a month. I did not want their entertainment. I was ready to pay for live traffic updates only. That was not an option. Though this project will not let me display live traffic updates it enables custom software running on a headunit. I hope other projects will spring into existence. I will be making a trip for USB-ethernet dongle. Thank you for posting it here.

I'm pretty sure my Nissan Versa has one of these and I'm going to give it a shot tomorrow I think.

This is a really good reverse engineering exercise but as a cautionary note:

If you are doing this in your real car most of the trim on the dashboard is secured by plastic clips. You need specialized car trim tools (similar to the phone case ones but well bigger) to remove them along the edges without denting the outer plastic edges.

Also most of them are meant to clip-on once. So if you take them apart too many times you might start seeing gaps on the trim and things not properly fitting.

Again it might not be something you care about but just thought I would mention. Ideally you would be better off getting one of these from after-sales or 2nd hand from scrap parts and working on a bench top with a 12V line.

Very good advice.

If you're still game, a set of trim tools and replacement clips of all sorts are usually available from your favourite large online retailer.

I recently bought a set of trim tools for $AU28 and am assortment of trim clips and roof liner clips for a few more tens of dollars.

Definitely worth watching a couple how to videos on YouTube too.

Having said that: don't be surprised when you break something.

The exploit doesn't require removing the unit. Simply inserting a prepared flash drive is all that is required.

They also explore using a serial connection at the bottom of the chassis. It is specifically that part of accessing the bottom of the chassis that I was advising some caution.

Hilariously, I would pay GM for a software upgrade on my headunit for improved UI and features/bugfixes. It even has a software update function but I've never seen one available.

very instructional how you can use properties of external drives and filesystems to expolit mountpath variables for path traversal.

Indeed, I can see that being useful on many systems

Reply on news.ycombinator.com