Thread: Renault "Tuner List" Head Unit/CD changer hacking - Controls

[QUOTE=Vicne]Ale,
So if it's not in open collector configuration, then I have to add a pull-up resistor to 12V above the 2N2222 right ?
Problem is : I don't know how much to put there... 5K ?
QUOTE]
First try connecting only a resistor to HURX and verify if with 5K the voltage level is near 12V if not you can lower it to 1K.

Originally Posted by Ale

First try connecting only a resistor to HURX and verify if with 5K the voltage level is near 12V if not you can lower it to 1K.

OK. Thanks for the advice.
I'll have difficulties testing it as I don't have the scope anymore and most of the time, voltage is low, but I guess if it doesn't work, I'll lower it just in case. After all, it will just consume more power (150 mW instead of 30).

Circuit is done. Now who wants to try it ?

...

Nobody ? Tsss.

OK, then I'll test it tonight. Until then, I have to wake my little boy up :-)

Originally Posted by Vicne

Circuit is done. Now who wants to try it ?

Send it to me and I'll try it for you
No, seriously, could you check the voltage on pin 14 with nothing connected? (note that the 9V I saw may well be 12V, due to the "high quality" of my tester).
Just to know if I fried my HU

Originally Posted by pippolippi

Send it to me and I'll try it for you
No, seriously, could you check the voltage on pin 14 with nothing connected? (note that the 9V I saw may well be 12V, due to the "high quality" of my tester).
Just to know if I fried my HU

Well, I have indeed around 11.3V on this input when nothing's connected to it, so it seems there's an internal pull-up. Moreover, when connecting this input to GND through a 4.7K resistor, I'm getting a 5.7V on the input (almost exactly 11.3 / 2) , so the internal pull-up's value is around 4.7 too. So probably the external pull up isn't really needed, but it shouldn't do harm I think

Originally Posted by Vicne

OK, then I'll test it tonight

Well, guys, same result as pippolippi : nothing at all :-(

I'm trying to send "BOOTING" frames while powering up the HU and it doesn't acknowledge them, although I think this situation mimics perfectly the behaviour I had when opening the circuit at point B : CDC repeatedly sent BOOTING frames because I prevented it from receiving the acknowledges, and HU continued acknowledging them...

Anybody has an idea ?

OK, OK, OK, I said I wouldn't use java because it was too heavyweight for such an app, although :
- there was no clear consensus to settle on a given language
- java can be used for free : anybody can download a JDK, edit sources in any text editor, build and run the classes. No licensing problem.
- it's rather multi-platform. Agreed, serial communication needs native libraries, but using the Java Communications API, calling code can be used anywhere (*).
- and most important, I think I can code 5 times faster in java than any other language.

So here's my TLCDCEmu (Tuner List CD Changer Emulator) : source, classes and Windows libs. To use it under Windows :
- first download and install a JRE if you haven't one already. I'm using version 5 (1.5) from Sun
- then unzip the file below anywhere on your system and copy the file lib\win32com.dll to c:\Program Files\Java\JRE<version>\bin
- finally, check the serial port settings in TLCDCEmu.properties (text file) and start TLCDCEmu.bat. It should initialize a few things then start sending "PLAYING" frames and give you a few options : 'b'+return to switch to "BOOTING" frames, 'p'+return to come back to "PLAYING" frames, or 'q'+return to quit.

You can also adjust the debugging level from 0 (none) to 6 (verbose debugging). At 6, you can see the actual frames sent.

(*)Notes about the JavaComm API :
- For an unknown reason, Sun currenlty doesn't distribute Windows binaries for version 3, so the ones included are version 2, of which the complete package can be found here.
- On Linux, I read RXTX can be used although I didn't try. The driver to be used is loaded at run-time according to the settings in the properties file. Just put the jar in the classpath and adapt the class name, and it should work. If not, well, you've got the source :-)

Originally Posted by Vicne

Well, guys, same result as pippolippi : nothing at all :-(

Well, so there's a possibility that I didn't fry my HU after all (provided that everything still works when you reconnect the CDC)

I'm trying to send "BOOTING" frames while powering up the HU and it doesn't acknowledge them

I'm stating the obvious here, but either the HU isn't receiving or the interface cannot "translate" the acknowledgment

Anybody has an idea ?

Well, if you can get hold of the scope again you can check if the waveform and levels resemble what you see when the CDC is connected.
Or wait for mox to come over and reverse engineer the connects2 physical interface. Or open the radio cd and see what chip is driving the interface (IIRC last time I opened the radio there was something covering the tracks under the connector and it was something not easy to remove, but I cannot say I remember precisely what I saw).

Originally Posted by Vicne

Well, guys, same result as pippolippi : nothing at all :-(
Anybody has an idea ?

Try with a divider 22k/10k on the base of NPN, perhaps level 0 of receiver is greater than 0,6V. Or try too "renforcing" the pullup use a 470ohm, what if the input rx need exact 12V for level 1? think rx input with a pnp transistor with emitter to 12V and the base is the rx input with a pulldown to gnd it give exact 12-0,7=11,3V...

Originally Posted by pippolippi

Well, so there's a possibility that I didn't fry my HU after all (provided that everything still works when you reconnect the CDC)

Yes, it still works :-).

I'm stating the obvious here, but either the HU isn't receiving or the interface cannot "translate" the acknowledgment

I quickly rewired the CD changer to let it send frames instead of me and let my app run, sending frames to nowhere but reading what the HU replied and could see the acknowledges, so most probably, it's the first possibility : the HU cannot receive/recognize/read/decode my frames...

I admit I'm a bit puzzled.

Well, if you can get hold of the scope again you can check if the waveform and levels resemble what you see when the CDC is connected.

Yes, that's what I intend to do...

Or wait for mox to come over and reverse engineer the connects2 physical interface.

Well, the goal of our meeting is more to sniff the data sent by the connects2 than to physically reverse engineer it. Mox already has done a good job on that part, and if I'm not mistaken his connects2 is buried somewhere in his dashboard and not easy to access. Note however that the physical description is rather surprising to say the least : the chip it uses seems suited for synchronous data communications (clock in) !

Or open the radio cd and see what chip is driving the interface (IIRC last time I opened the radio there was something covering the tracks under the connector and it was something not easy to remove, but I cannot say I remember precisely what I saw).

I definitely won't go that way, but it would be interesting indeed.