Another OEM NAVI Features Hack Thread - Progress and Documents

[turbo427]

turbo427,

 

Listen to sublo. It WILL work.

Add "subaru NAV" to the query

 

Have you used a burned disc I know how to find them I have made ISO in both windows and Unix and had no luck get them to work in the DVD-ROM

[Origtopcat]

Have you used a burned disc I know how to find them I have made ISO in both windows and Unix and had no luck get them to work in the DVD-ROM

 

I read on another thread that someone tried this already. It seems that there is a special encoding that the Nav DVD's use.

[2006Specb122]

What's the going rate on the latest disc?

Any new features benefits?

Updated maps would be nice...but some said in the last release that new developments were still lacking....

OH the day when everything will be connected to the internet and your car will update nightly.....

 

but until then let's get some info on the latest DVD...thanks

[rallysquirrel]

no special encoding that I'm aware of. Where did you hear this?

[djsauce]

It works - no encoding - just burn it. The End.

[TwinkE]

Have you used a burned disc I know how to find them I have made ISO in both windows and Unix and had no luck get them to work in the DVD-ROM

 

You are aware that it's a dual layer dvd, right? I just burned two copies of my 2.0 disc last night and they both worked fine.

[pegleg]

Here's the obligatory "Any progress on the nav/boost gauge?" question, which I fear will never be achieved.

[Gator GT]

Here's the obligatory "Any progress on the nav/boost gauge?" question, which I fear will never be achieved.

 

 

I've given up on that hope....I went for a standalone gauge.

[SubLo]

I've given up on that hope....I went for a standalone gauge.

 

I wouldn't say it's impossible cause it's not. This is what I really want most out of this whole thread. What needs to be done really is for a friendly Electrical Engineer (read: ex-Denso tech running around CA [there are a couple of them] with the development environment) to lend us a helping hand . So far, that hasn't happened. Sigh.

 

Perhaps another genius college electrical engineering tech could be so kind as to figure out how where this stuff lives on which IC or .KWI file, if it's EEPROM or otherwise re-programmable, if it's C++ or Pearl, decompile and add the features. I'll gladly pay green money.

 

http://www.longislandsubaruclub.com/forums/images/smilies/secret.gif

 

That said, the Cadillac/Vette forum guys (also Denso sourced NAV units) are in the same boat and want some of the same things. These links may give our eager EE's a heads up...

 

Decompiler: http://www.datarescue.com/idabase/idaproc.htm

 

Vette Thread: http://forums.corvetteforum.com/showthread.php?t=1204336&page=12

[SubLo]

Some useful tidbits for our EE's should they embark on such a project (in case the site disappears). Orignal posting from: http://ian.blenke.com/projects/densonav/

Reading the DENSO NAV DVD

This article disappeared from my site for a while.. restoring..

The DENSO NAV system uses a DVD which you can find in a Prius so equipped by sliding the driver seat forward, prying off the plastic cover panel, sliding the eject button lock over, and hitting the eject button while the car is in aux power but not yet “On”.

If you put the DVD in your home computer, you will see an ISO9660 filesystem representation of the KIWI data files used by the NAV computer. Check out the KIWI Documents for the actual data format of these files; I’m actively trying to write something to decode them now. Mapmaster appears to be Toyota’s navigation division.

This is a full 8G DVD, you will need a dual-layer burner to make a copy.

The files are just pointers into the actual KIWI datasets.

VERSION.TXT - The version of the data on this DVD (ver.04.2 for a DENSO NAV 4.2 DVD)

ALLDATA.KWI - A file that represents all of the KIWI MAP data (I think). - This is the biggest file on the root of the filesystem at 2.8G

COVERAGE.TXT - Text file listing all files in the COVERAGE/ directory

COVERAGE/ - Directory full of BMP images showing the coverage area of this DVD as a raster image. This would be the easiest thing to hack with your own graphics.

INDEXDAT.KWI - Lists the IDX/ directory files.

IDX/ - Directory full if Index files. My guess is for searching and/or quick access for names/addresses/phonenumbers etc, as that is what they appear to contain. - This is the biggest directory on the DVD (5G)

METADATA.KWI - Metadata. Contains this string:

 

LANG::=US English,UK English,German,French,Spanish,Italian,Dutch,Swedish,Danish ; CHCD ::=ISO 8859-1 ; COOR::=WGS84 ;

SPEC.KWI - Specification file. Contains this string:

 

SUPERMETA::=AFUS:2.47, AGUS:2.47 ;

LOADING.KWI - Loading Module Management File. - At 520M, including strings like “/HDD/slot1/passwd.osg”, the first thing that I think of when I see this file is “this is the code that the NAV computer boots”. - “I Agree” is in this file. Removing that initial nag screen may be as simple as a binary patch to this file! Woo!

DICVCE56.KWI - From the strings, it looks like a group list of Points of Interest (not the actual points, just the general groups). This is a small file.

VIRTUAL0.DAT VIRTUAL1.DAT - No idea what these are for. They appear to be full of NULLs.

I’ll be updating this node as I figure things out.

I’ve created a quick little perl script based solely on the KIWI “All Data Management Frame” document 0500122e.pdf. The script, alldata.pl is a very rudimentary parser of the data structures, based entirely on a hash tree of the schema information gleaned from this document. Hey, it’s a start.

Update: KAMIYA Satosi has restored his Ruby KIWI Voice scripts!

More to come…

 

 

projects/densonav/kiwi/denso/nav/hack | 4 trackbacks

 

 

 

There is also a company CoastalTech that has a commercial "LockPick" product for Denso units in in other vehicles: http://www.coastaletech.com/LOCKPICK_MAIN.htm

[SubLo]

For the ultra EE's/developers, you can find the official technical construct of .Kwi files from the consortium here: http://www.kiwi-w.org/index_eng.html

 

Click on documents. It's very long-winded.

 

It looks like Denso actually licenses the technology from Zenrin.Who knew?

 

There is much frustration with this system on the Cadillac, Corvette, Tundra, Prius, and Lexus forums as well. The good thing about that is the exposure.

 

I'm officially offering/pledging a $200 personal bounty/reward to whomever can come up with a solution to hack this ridiculously proprietary system. The key, BTW, seems to be in the loading.kwi file.

 

[Gator GT]

For the ultra EE's/developers, you can find the official technical construct of .Kwi files from the consortium here: http://www.kiwi-w.org/index_eng.html

 

Click on documents. It's very long-winded.

 

It looks like Denso actually licenses the technology from Zenrin.Who knew?

 

There is much frustration with this system on the Cadillac, Corvette, Tundra, Prius, and Lexus forums as well. The good thing about that is the exposure.

 

I'm officially offering/pledging a $200 personal bounty/reward to whomever can come up with a solution to hack this ridiculously proprietary system. The key, BTW, seems to be in the loading.kwi file.

 

 

Well sublo, that is a hefty donation to the cause!!!

 

Before anyone agrees to attempt this (and I'm by no means inferring that I am) do you want to spell out your "exact" goals once they do hack it...and what are the parameters of "hack"?

[SubLo]

Well sublo, that is a hefty donation to the cause!!!

 

Before anyone agrees to attempt this (and I'm by no means inferring that I am) do you want to spell out your "exact" goals once they do hack it...and what are the parameters of "hack"?

 

Realistically? I don't expect anyone to program me gauges - that's another project once the "know how" is unlocked.

 

I'd like:

1. Disable EULA
   
2. Enter Destinations While Moving (I know, I know. I've done the grounding hack)
   
3. The ability to view other readings and potentially program gauge (boost, egt.etc.)
   1. 
      
   2. HP/TQ are possible as these are simply (roughly) weight/speed/acceleration calculations.
      
   3. Boost and EGT possibly being sent there by OBDII???

That's all!!! $$$

[sylvainsf]

I'll up Subio's offer by another $200, so you can collect $200 from me as well as Subio.

[SubLo]

I'll up Subio's offer by another $200, so you can collect $200 from me as well as Subio.

 

Great to hear! I'm sure some whiz kid can bang this out and collect the ante!

 

On a side note, being kind of OCD about certain things, I've been browsing, searching, researching exhaustively for the holy grail . Tundra, Vette, Caddy, LR, Audi, blaa blaa....

 

I believe I may have found a functioning .kwi editor here: http://www.naviedit.de/

 

Translated the page using Google Toolbar and downloaded. Luckily, the tool is in Engrish . I don't have the Nav discs with me here at work. I'll try this tonight or tomorrow on my loading.kwi.

[dmiller5]

This is more of a CE or CS project than an EE project.

[XiiiXiii]

I've said it before and I'll say it again! THERE IS NO WAY TO GET STOCK BOOST GAUGE IN THE SCREEN

 

Let me disprove some of your ideas:

 

Hacking Navigation DVD to get gauges -

 

Won't happen ever, reason why : GPS Nav has nothing to do with car's sensor's reading (Other than speed sensor, reverse sensor, illumination signal. Don't believe me? Look at the wireing diagrams. And you'll see whats plugged into the Nav system under your seat.

 

Hypothetically lets say you did hack the nav disc. You disassembled it, your rewrote it, you did some magic voodoo on it. Okay, good. Now tell me how are you going to have the program read signals that it isn't even physically wired up with?

 

This all leads back to my original statement : There is no way to add gauges through the Navigation DISC

 

Myth #2 : The JDM STi has boost gauge on their screen, we should be able to unlock it too.

 

Good observation but you're comparing apples to oranges. STi screen = Pioneer, Legacy screen = Kenwood. Two totally different systems that share nothing alike. <If you can prove to me of a JDM Legacy using the same Kenwood Screen with subaru programed boost gauges I will gladly admit I'm wrong>

 

Cliff notes of how the Legacy system works:

 

You have two independent systems. You have A) The Navigation GPS system (the unit under the car) and you have B) The video screen in the center of the dash. THEY ARE INDEPENDENT of each other. Which is why my first point stands true that you cannot hack a navigation disc to output something it know absolutely nothing about. The only thing the unit under your seat does is calculates your position using GPS and cross references it to the maps on your DISC and outputs the display to the screen through RGB wires (once again if you don't believe me, study the tech manuals). Only thing talked between the screen and the nav unit is what pixles to illuminate on the screen and what coordinates you've pushed on the touch panel.

 

Now for the screen: It is its own video processor and is the unit that displays the Legacy's data like your car's speed, mpg, mileage, etc etc through the INFO menus. The video processor takes care of what to display on the screen, whether it be the NAV map, Aux input video, Rear view cam, Legacy's INFO menu/data. Its similar to how your tv has different inputs for cable,dvd,vcr,video 2,3,4,etc etc. Which brings me up to another point, You cannot disable the agree annoyance screen through a NAV Disc Hack. The systems are: thats right, independent of each other. I know for a fact that this is true because I've done live testing. Unplug your Navigation unit under your seat. Your screen will still work, it will still come on with the nag screen, it will still run the legacy gauges, aux input, rearview. It will not however show anything for the map, destination, menu because that system is off (unplugged).

 

So obviously the next logical thing is to ask : "Why not hack the screen's programing". I'll agree to this as being a possible route to get rid of annoyance screen and even a boost screen however there are some issues with that.

 

1) Who knows the micro code in the Screen that handles the annoyance screen or even the fuel economy gauges?

2) Say you even did know how to code for it, well who a EEProm burner to save the "hacked" code onto the screen's EEProm? And while we're at it, who's going to desolder that chip from one of the circuit boards of the screen?

3) Okay say you can handle all of point #2, now tell me this: Who knows how to code to get items such as boost readings from the CAN system of the Legacy's ECU? If you want to program in a boost gauge you need to be able to interface with the network system setup in the car. How does your screen already know all the things like MPG/Throttle position/Outside temperature? It does it off of a two wire system on the CAN bus. Don't believe me, look at the wiring diagrams of whats fed into the back of the screen.

 

So yeah maybe there is a way to get a boost gauge up, but do you know anyone that can handle all of those items I just mentioned? Is it feasible for everyone to get done? So you get Bob the super programer/Electrical Engineer/Automotive Engineer to do all that for you, well how are you going to get it onto everyday Joe's microchip for his NAV screen?

 

Flame me all you want, but at least I've spent the time to study the system out. I've already discovered the simple hack for input data while in motion after spending weeks tracing the tech diagrams. I know a lot about how/what the system has to offer from doing that. I've taken the CS/CE/EE approach and laid out exactly what you need done and I know that it's beyond my knowledge set to go further, and don't think you'll find someone that is willing to tackle it much further. You're dealing with a lot of propriety stuff which if you did have the expertise to even program for it you probably wouldn't be spending the days and days of time needed to basically reverse engineer a whole system for what? a boost gauge? Bob the super programmer who can probably do it probably gets paid more per hour doing a real job then spending his hours reprogramming a Kenwood screen.

 

Like I said, flame me if you want but at least I've spent the time analyzing to realize what realistic and whats not.

 

 

PS- I've disassembled the screen and found a nice data ribbon to steal signal of the touch panel for my possible analog way to get rid of the annoyance screen. Little more research on touch panel signals and I'll be ready to build and wire up a prototype.

[SubLo]

This is all well and good with decent factual points but sorry... is also full of propaganda not proven or disproven facts no offense. You can do anything if you put your mind to it including ditching the EULA whether it's on an IC (more likely) or simply loaded into RAM from a KWI file. Can't do gauges? What are you talking about? Have you disassembled the Nav discs and actually seen what's on them? No.

 

"No way to add gauges through discs" Perhaps not if it's on an IC - it does live somewhere my fellog LGT'er. More accurately you can't do gauges if you don't have the know how. It may involve flashing an potential EEPROM or even replacing an IC. Someone programmed the TPS and other gauges. We are unsure which signals are being fed to the Nav other then those which are already displayed. Boost & EGT could or couldn't be - point is: we don't know.

 

Look... it was made, programmed by man. This means it can be remade. Just because the method to do so hasn't been devised, doesn't mean it's impossible. You're right about it hasn't been proven -yet. Maybe it will never be but it's far from impossible.

[poopy]

well it can't do egt on 07-08 models, cuz there isn't an egt sensor. now i am not a computer nerd. but i bet if a cable was made like the tactrix, thats runs from the obd2 and plugs into the back of the nav. it could display all ecu read outs. in fact i bet you make a link from the AP to the nav. there i figured it out fot you. now just do it lol

[XiiiXiii]

I never said it was impossible, I even laid out what high level steps are needed. Have you studied the tech diagrams? I already told you what is and what isn't there. Like I said, if you don't believe me then study it for yourself.

 

Yes MAN created the code, and yes some one can someday reprogram it if he wanted to but be realistic. The R/D to get it done is so impractical that no one is going to do it. Even if someone reporgramed a EEPROM you're still stuck with how do you get it so the average guy can reprogram theirs. Average Joe doesn't have an EEProm burner, Average Joe doesn't know how to desolder his IC chips. So once again realistically its impractical.

 

Lets be practical, you want someone to do thousands of man hours to reverse engineer a boost gauge into a stock screen. That takes hardware reverse engineering to get to the chips you need to program, takes learning/stealing proprietary code that none of us have access to, and after all that you still don't have a simple solution to deliver the goods to Average Joe. Even if you pay a salary to an qualified engineer you're looking at spending thousands of dollars to what? make you a stupid boost gauge for your car when its not even a critical device?

 

Whine, cry, bitch all you want but realistically you won't see anything.

 

>Flame on<

[SubLo]

Nah. </Flame> (off)

 

http://www.longislandsubaruclub.com/forums/images/smilies/starwars.gif

 

I hear ya man.

 

The Acura guys did it:

• http://tl.acurazine.com/forums/showthread.php?t=145426

Admittedly, their system is different but hacked.

 

The Audi guys did it and theirs is Denso based. Can't remember the links but I've seen it done.

 

Oh well... maybe we'll have an answer one day - maybe not

[hybridandy]

...PS- I've disassembled the screen and found a nice data ribbon to steal signal of the touch panel for my possible analog way to get rid of the annoyance screen. Little more research on touch panel signals and I'll be ready to build and wire up a prototype.

 

Hello XiiXii, I appreciate all the hard work you've done with our cars and I'm hoping I will actually get some free time soon to try your "input while moving" hack that's in the other thread.

 

I'm interested in your statement above. I realize that reprogramming the nav screen probably won't be possible without Subaru's help. I am planning to install a laptop based CarPC in the future and feed with via OBD II Diagnostic Port to USB (which hopefully exists) and then either develop or buy some software to display the gauges I would want. It's all theoretical at this point but I'll probably do the CarPC regardless just to get music and video but one issue I know I'll run into is that I won't be able to use the display's touchscreen input to control the computer. However, if there are ribbon cables I can tap and feed to a USB or PS/2 port, I might be able to make it work. Let me know if you come up with anything on that front. Thanks.

[XiiiXiii]

Nah. </Flame> (off)

 

http://www.longislandsubaruclub.com/forums/images/smilies/starwars.gif

 

I hear ya man.

 

Yeah, not trying to attack you or anything. I guess I've looked at these documents for too long and realize too much of how difficult it would be to get something OEM like in our systems. Thats why I'm just trying to approach items in other ways. Whole reason why I'm trying to find a slick way to hack the screen for the nag screen. I want something simple like a Jazzy Aux In module so that just about anyone can install it on their own.

 

 

However, if there are ribbon cables I can tap and feed to a USB or PS/2 port, I might be able to make it work. Let me know if you come up with anything on that front. Thanks.

 

http://www.nyccs.net/filelib/Kenwood%20Touch%20Screen%20Integration%20By%20Stefan%20Friscia.pdf

 

<credit to sublo for his original links at the begining of this whole thread>

 

There's a good write up in there of how he stole signal from his touch panel. Its the same concept/idea as what you want to do. He talks about it on page 3,4.

[SpecBee]

Sorry to interrupt this tiff but has someone figured out the exact model # or type of pin that the DVD unit requires to add a wire to terminal #5 on the molex style plug? I don't want to jamb a paper clip into the back of the jack as some has instructed. Thanks for any help.

[f85stealth]

Anyone knwo where they can get the 08 tribeca rearview camera from for cheap? Dealer wants almost 3 hundred im hoping to spend only 2