Announcement

Collapse
No announcement yet.

Renault "Tuner List" Head Unit/CD changer hacking - Controls

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • #16
    Vicne, may be this could help to : http://rt3wiki.free.fr/pmwiki.php?n=Us.Document

    It deals with Peugeot's RD3 Headunits on a VAN bus, but the idea is the same : fool the HU into thinking there's a CDC.
    Now Galileo is real. Muhahahahaha :p

    Comment


    • #17
      Hard to tell, has probably something to do with port settings and/or handshaking. When nothing gets trough the port seems to blocked or waiting for something, try this http://www.serial-port-monitor.com/d...t-monitor.html program instead of Hyperterminal to monitor, its free.

      Comment


      • #18
        Originally posted by Putput
        Hard to tell, has probably something to do with port settings and/or handshaking. When nothing gets trough the port seems to blocked or waiting for something, try this http://www.serial-port-monitor.com/d...t-monitor.html program instead of Hyperterminal to monitor, its free.
        Thanks. Mox already pointed me to it, but as I read the description, I thought it was only an "interceptor" between a working Windows host application and a remote device. In my case, as I have no windows app (yet) to communicate with the head unit, I thought it was useless.

        Although, I just downloaded and started it and this seems that as soon as hyperterminal opens the port (no matter if settings are correct or not), the monitoring begins even though hyperterminal doesn't display a single character. I could only test it with an old serial mouse for now, but I'll give it a try at home tonight.

        The only thing that I'm still unsure of is the wiring of the DB9 plug...

        Thanks again.
        (and sorry Mox not to have followed your advice at first)
        Vicne
        SPDIF CarPC V2 - Tuner List CD Changer Emulator - Chris Conty

        Comment


        • #19
          As far as I can tell the connections are ok, 2 is receive, 4 is DTR connected to 6 DSR, 7 is RTS connected to 8 CTS. So hardware handshaking should be ok. You could try to disconnect DCD but I don't think that it would make any difference. Perhaps you can also try to connect pin 3 to the MAX232, maybe the UART detects this?? You can use Port Monitor to send/receive data to a serial port by means of the Console View window after opening Hyperterminal via Tools, Terminal and select the connected serial port.

          Comment


          • #20
            Originally posted by Vicne

            However, on the PC, I cannot get anything in Hyperterminal or MTTTY (sample MSDN application - see http://msdn.microsoft.com/library/de...sdn_serial.asp )

            I see two possible reasons :
            - Wrong wiring of serial port
            - Loopback handshake is not supported by these apps.

            Can someone with experience on serial communications (Putput ?) comment on this ?
            Hey Vicne, thanks for the heads-up (I tried to reply but wasn't allowed?!?), I was already (silently) following this thread

            Nothwistanding the fact that hyperterminal is a pile of s*** (cannot comment on MTTY) that I never managed to use without handshaking (and even with handshaking works badly), it may simply be that you didn't find the right combination of speed/stop bits/parity (thouh at least you should see some garbage once the receiver detects a start bit, but I doubt hypers*** will show you the garbage).

            I don't know of good terminal emulation programs for windows (I usually cook my quick and dirty tests in delphi or use minicom under linux) but a quick search (and following the above link) I found these two programs:

            http://www.electronics-lab.com/downl...010/index.html

            and

            http://downloads-zdnet.com.com/Free-...-10497123.html

            The latter uses some ms control for the serial port, so, while visually impressive, I don't know how good it is, the former I didn't check.

            Comment


            • #21
              Originally posted by pippolippi
              Nothwistanding the fact that hyperterminal is a pile of s*** (cannot comment on MTTY) that I never managed to use without handshaking (and even with handshaking works badly)
              Good to know :-)
              it may simply be that you didn't find the right combination of speed/stop bits/parity (thouh at least you should see some garbage once the receiver detects a start bit, but I doubt hypers*** will show you the garbage).
              Yes, and moreover, no matter how I look at the samples and scope captures aboven, I always end up with the same conclusion : 9600/odd parity/one stop bit...
              Hey, this one has the great advantage of being dual channel ! If scrolling is synchonized, it will help a lot to associate requests and responses.
              OK. I also found the low level PortMon which is part of the famous SysInternals free toolbox so I think I've got enough software to write a comparative review afterwards :-).

              Thanks for your help.
              Vicne
              SPDIF CarPC V2 - Tuner List CD Changer Emulator - Chris Conty

              Comment


              • #22
                Originally posted by Vicne
                Thanks again.
                (and sorry Mox not to have followed your advice at first)
                That is quite alright -- It was just one of the first hits that popped up while googling

                Please bear with me for still not being too helpful with any oscilloscope measurements. Hopefully this weekend. Now that you are making good progress, it surely is getting interesting to spy on the data to/from my Connects2 aux interface.
                CarPC status: HW all done, SW needs tweaked.
                Hardware: VIA MII-12K, 512MB, 60GB 2.5", CW-8123 DVD-CDRW, 7" Lilli ts, Opus 90W, BU-353 GPS, 802.11b PCI, USB bluetooth dongle, AverMedia AverTV Cardbus Plus, Morex Cubid 3677
                Software: RR, MM/FD

                Comment


                • #23
                  Originally posted by Vicne
                  OK. I also found the low level PortMon which is part of the famous SysInternals free toolbox so I think I've got enough software to write a comparative review afterwards :-).
                  From the looks of it it's no good for your purpose: it's not a terminal emulation program but it attaches to a serial (or parallel) port to see what a program running on the pc is doing with it. Of course I may be wrong.

                  Comment


                  • #24
                    No progress :-(

                    OK. I spent the evening trying all the programs I was pointed to and found the best suited was the one from http://www.232analyzer.com
                    It has "leds" for control wires which also can be clicked to change the state of the corresponding signal. I could then check that loopback was wired correctly.

                    I settled on spying the line from the head unit to the CD changer and let a CD play, having thus a constant "ACK" message, once per second (checked with the 'scope)

                    Unfortunately, when using correct com port settings (9600/odd/1), the status bar goes mad, quickly flashing between "Unknown Error" and "Buffer overflow", and the screen displays garbage, mostly zeroes. The app also uses 100% CPU and becomes unresponsive. So each time, I had to kill it (I had observed the same with MTTTY)

                    When using a lower (erroneous) bitrate, such as 4800 baud, here's what I'm getting :
                    -------------------------------------------------------------
                    09/02/2006 00:52:56
                    COM port: 1; Baud rate: 4800bps; Parity: Odd; Data bit: 8; Stop bit: 1; Handshaking: None
                    Operating mode: Debugging
                    Sending data notation: Oct; Receiving data notation: Bin

                    * * * * * * * * * * COM Port Opened * * * * * * * * * *

                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 77,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,77,0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 77,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,77,77,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,77,0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,
                    Data Received: 0,

                    * * * * * * * * * * COM Port closed * * * * * * * * * *
                    -------------------------------------------------------------

                    Note that the "Data Received: 0," lines come at the constant rate of 1 per second, so that's an image of the ACK's passing by (wrongly detected as 0 because of the wrong bitrate, but OK). However, I sometimes get bursts of data and then the status line goes mad. Those data aren't invented by the software : The UART actually sometimes reads complete garbage from the port.

                    One explanation could be that this PC actually needs higher voltages than the +/-5 output of the MAX I observed (although according to the RS232 spec, it should accept between 3 and 25V for logical 0 and between -3 and -25 for logical 1).

                    It could also be that the UART is damaged...

                    I think what I'll do next is :
                    1) wire a complete loopback DB9 plug (RX to TX) and see if it echoes correctly.
                    2) wire a cross COM port loopback (COM1 <> COM 2) and see if I can pass data from one to the other.
                    3) wire a loopback on the TTL side of the MAX chip and see if it still echoes.
                    4) maybe get a MAX232 instead of the low power MAX3232 and see if it changes something

                    But I admit I'm rather disappointed... So little sleep and still no exploitable HEX dump :-(.

                    Well as usual, any comment is welcome...

                    Best regards
                    Vicne
                    SPDIF CarPC V2 - Tuner List CD Changer Emulator - Chris Conty

                    Comment


                    • #25
                      He Vicne i'am the guest of yesterday.
                      The problem is that the headunit output an inverted UART signal and instead max232 input need a normally 1 TTL level on pin 11 (the start bit sholud be level 0 TTL) so pin 14 will be normally at -5V and output a start bit at +5V. if you put an inverter (or a NPN transistor with a pullup resistor of 10K to V+ on the collector) between the divider and pin 11 all should work fine. Check for confirmation the idle level output of your PC RS232 pin tx, should be -5 to -12V. Keep in mind also that if the signal is inverted the parity now is EVEN.
                      good luck!
                      Ale

                      Comment


                      • #26
                        you can use the max232 receiver inverter (Input Threshold is <1,5 and >1,8V): connect pin 13 to the divider, join pin 12 to 11, the other signal pin 8 to divider and join 9 to 10
                        13 12-11 14 8 9-10 7
                        --i>o--------i>o- --i>o--------i>o-

                        Comment


                        • #27
                          Originally posted by Ale
                          The problem is that the headunit output an inverted UART signal and instead max232 input need a normally 1 TTL level on pin 11 (the start bit sholud be level 0 TTL) so pin 14 will be normally at -5V and output a start bit at +5V.
                          Aaa-haaa...

                          Well, I think I'm beginning to understand.
                          I don't know why, but I always thought that idle state on a serial line was logical 0, so +9V for example, with start bit at 1 (-9V), data and parity, then stop bit at 0 (+9V), but this is plain wrong : I should have started with the basics ... :-)

                          Check for confirmation the idle level output of your PC RS232 pin tx, should be -5 to -12V.
                          I can tell you without checking again : it's at +5V - see post 14 :-)

                          So, OK, I need to invert my input signal. Very good point. Thanks very much already.

                          Keep in mind also that if the signal is inverted the parity now is EVEN.
                          True.

                          you can use the max232 receiver inverter (Input Threshold is <1,5 and >1,8V): connect pin 13 to the divider, join pin 12 to 11, the other signal pin 8 to divider and join 9 to 10
                          13 12-11 14 8 9-10 7
                          --i>o--------i>o- --i>o--------i>o-
                          Phew, it took me a few minutes to understand.

                          On the principle, using this inverter seemed OK but I had in mind that RS232 has a "dead region" between -3 and +3V so feeding a RS232 entry with my divided signal (0.75V > 3V) would be risky...
                          Although, you're right, according to the data sheet of the MAX3232, it looks like their "dead region" is much narrower, being located typically between 1.5 and 1.8V, and guaranteed between 0.8 and 2.4 at most with a Vcc of 5V.
                          The only thing is - if I'm not mistaken - that I will have to take care of the internal pull-down resistor of 5k typ. So instead of my (high impedance) divider, I think a 18k resistor in series with the input on pin 13 would do the trick. Can you confirm this, or do you think I should use a lower impedance divider (such as 3.3k/1k) to reduce the influence of the internal 5k ?

                          On the other hand, maybe using a transistor inverter would also remind me of my electronics class :-)

                          Anyway, thanks already for all this. I'm motivated again :-)
                          Vicne
                          SPDIF CarPC V2 - Tuner List CD Changer Emulator - Chris Conty

                          Comment


                          • #28
                            Originally posted by Vicne
                            I think a 18k resistor in series with the input on pin 13 would do the trick.
                            you are right, you can use without problem the internal 5k resitor. With a 18K resistor in series the ratio will be 5/(18+5)=0,217. at 12V = 2,6V and at 3V = 0,65V. It should work.
                            Another question: you think the data from HU is an ack or is a request to CDC for sending data? Which one is the first that send data?
                            And the very first data HU outs when CDC isn't connected is the same?
                            Ok soon we have the answer... Thankyou for the big work!!

                            Comment


                            • #29
                              Originally posted by Ale
                              you are right, you can use without problem the internal 5k resitor. With a 18K resistor in series the ratio will be 5/(18+5)=0,217. at 12V = 2,6V and at 3V = 0,65V. It should work.
                              Just finished the wiring this way. I'll test tomorrow night because I need some sleep :-)
                              Another question: you think the data from HU is an ack or is a request to CDC for sending data? Which one is the first that send data?
                              It comes after the data stream from the CDC so it must be an ACK. Moreover, I could also check with my first WAV sample that when the communication is initiated by the head unit (e.g. next track), the CDC sends the exact same ACK byte.
                              And the very first data HU outs when CDC isn't connected is the same?
                              I'll have to check. All I could tell from the oscilloscope triggers is that even when the HU is on radio source (so no CD is playing), the CDC sends a different stream at each second with a typical "counter" bit pattern, incremented each time, maybe a packet ID or something...
                              Hopefully I'll have more info tomorrow night.
                              Vicne
                              SPDIF CarPC V2 - Tuner List CD Changer Emulator - Chris Conty

                              Comment


                              • #30
                                You're close, so have a good night sleep and make the test tomorrow. Perhaps I can hear your big YES!! when it works tomorrow, I from Belgium too.
                                Keep up the good work!

                                Comment

                                Working...
                                X