Group Actions
Engagement
  • Author Author: kk99
  • Date Created: Date Created
  • Views 218 views
  • Likes 8 likes
  • Comments 6 comments
Related
Recommended

The car radio issue

kk99

image

A few weeks ago, I was asked to check the car's radio that had an issue with power on. It was the Blaupunkt Bremen 975, which is one of those radios with Android. The initial check and measurements showed that, from the perspective of electronics, everything looked fine. I assumed that must be something with operating systems. So, I have tried to find a way to enter recovery mode or an option which wipes the cache partition. After a few attempts, I found that pressing the HOME button at the power stage enters some kind of recovery mode, but instead of the classical option to choose, it immediately tried to update with a fail message.
image

This was just a recovery update option. Additionally, while checking the main board, I found at the bottom of the radio a connector. I assumed that could be UART. I have connected a logic analyzer to check if this assumption is correct and if there is any output there.

image

image

Successfully, the assumption was true. It was UART with enabled output information. Thanks to that, I confirmed that the device has problems with the system. Based on the logs, there was information that it was not possible to start system init scripts. Unfortunately, the entry to the bootloader was not possible and, due to the broken system, it was possible to only use UART in read mode. But I have started exploring the recovery upgrade mode. This recovery mode was handled at the bootloader level. The bootloader was U-Boot. Based on logs, I found that this recovery mode, as the first stage, reads a file (it was specified filename) and tries to execute its content as U-Boot commands. I have not found any signature or cryptographic verification of this file. So, I have created that file on an SD card with some commands, e.g. help, and entered into the recovery upgrade mode. By this way, it was possible to list all available U-boot commands and execute, e.g. recovery from local partition.
image

Unfortunately, the attempt to recover from the local partition failed also. I have searched for a similar case on the internet and found this: https://xdaforums.com/t/firmware-upgrade-blaupunkt-capetown-940.3698825/, which confirmed me that the assumption with recovery upgrade mode was correct. I have used the internet archive to check the official Blaupunkt page, and there were available recovery upgrade packages, but unfortunately they were not archived (only manuals). On the current page, there was no information about firmware for those legacy devices. The only way was to contact support to get that recovery package.

  • in reply to colporteur

    I think that there is a lot of business around it in different areas: tuning, service and diagnostics etc. For example, there is often a scenario where a given manufacturer uses a single engine, which is available in different horsepower variants. The differences are only in software in ECU. So, in the simplest 'upgrade' you could change software in ECU from the highest version. The next state is to individually modify the maps in software, to get HP above the standard limit (a lot of engines have a large reserve for such modifications, e.g. 2JZ or G16E-GTS). In motor sport there are mostly standalone ECUs, where you have a lot of companies which do it, e.g. MoTec, MaxECU, EcuTek or Ecumaster. The same is with the automatic gearbox. But as far as I know, there was a good improvement in security in the case of protection for the kind of modification in the newest cars (but often it is a question of time or popularity of a given brand). In the case of diagnostics or service, there are also procedures, e.g. after replacing of oil or the oil filter is required to reset oil inspection, which requires a special interface (sometimes it is possible to do it from dashboard by magic combinations). In the case of replacing brake pads in some types, it is required to use the computer interface to retract the brake pistons to put the new ones. Sometimes there are people who do not like the ecological systems in their cars and want to remove particle filters, e.g. DPF or GPF. Of course, there are also bad, dangerous or illegal things in the case of safety, e.g. cheating on mileage, or cheating some car systems, e.g. by not installing a proper airbag in the steering wheel or the proper part, to integration into immo or keyless systems.

  • in reply to kk99

    I've heard there is a whole sub-culture for people that want to tweak the engine configuration on vehicles that are controlled by a microprocessor. The manufacture disclaimer says this is verboten.

    I work in a rural area and farmers are frustrated that they can't change a fan belt or replace the oil on their new farm equipment without the vendor. Do so and they void the warranty. Worst yet the vehicle won't start after the oil and filter change.

    I suspect there is a group somewhere that is looking under the hood of the vehicle console. Since the device controls more than the just the radio you could render the vehicle into a brick because you made a change to the screen colour.

    The garages I have used for my vehicle have little to no knowledge on the vehicle IT. They only do what the manufacture manual says, even when you explain to them it won't work. "That is all we are allowed to do, is the response."

  • in reply to DAB

    There is one lesson from this case, that is worth archiving firmware and other support information when they are available on the manufacturer's page. Especially for devices with operating systems, there is a high possibility that something will become corrupted.

  • in reply to colporteur

    Thank you. The main purpose was to restore the original firmware, but I think it should be possible to find reference or alternative (newer) firmware for this platform. At least it should be possible to load it from the level of U-boot.

  • I agree, nice attempt.

    Now days they just want you to replace devices, not fix them.