Thread: Renault "Tuner List" Head Unit/CD changer hacking - Controls

Originally Posted by Vicne

Thanks again.
(and sorry Mox not to have followed your advice at first)

That is quite alright -- It was just one of the first hits that popped up while googling

Please bear with me for still not being too helpful with any oscilloscope measurements. Hopefully this weekend. Now that you are making good progress, it surely is getting interesting to spy on the data to/from my Connects2 aux interface.

Originally Posted by Vicne

OK. I also found the low level PortMon which is part of the famous SysInternals free toolbox so I think I've got enough software to write a comparative review afterwards :-).

From the looks of it it's no good for your purpose: it's not a terminal emulation program but it attaches to a serial (or parallel) port to see what a program running on the pc is doing with it. Of course I may be wrong.

OK. I spent the evening trying all the programs I was pointed to and found the best suited was the one from http://www.232analyzer.com
It has "leds" for control wires which also can be clicked to change the state of the corresponding signal. I could then check that loopback was wired correctly.

I settled on spying the line from the head unit to the CD changer and let a CD play, having thus a constant "ACK" message, once per second (checked with the 'scope)

Unfortunately, when using correct com port settings (9600/odd/1), the status bar goes mad, quickly flashing between "Unknown Error" and "Buffer overflow", and the screen displays garbage, mostly zeroes. The app also uses 100% CPU and becomes unresponsive. So each time, I had to kill it (I had observed the same with MTTTY)

When using a lower (erroneous) bitrate, such as 4800 baud, here's what I'm getting :
-------------------------------------------------------------
09/02/2006 00:52:56
COM port: 1; Baud rate: 4800bps; Parity: Odd; Data bit: 8; Stop bit: 1; Handshaking: None
Operating mode: Debugging
Sending data notation: Oct; Receiving data notation: Bin

* * * * * * * * * * COM Port Opened * * * * * * * * * *

Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 77,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,77,0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 77,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,77,77,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,77,0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,
Data Received: 0,

* * * * * * * * * * COM Port closed * * * * * * * * * *
-------------------------------------------------------------

Note that the "Data Received: 0," lines come at the constant rate of 1 per second, so that's an image of the ACK's passing by (wrongly detected as 0 because of the wrong bitrate, but OK). However, I sometimes get bursts of data and then the status line goes mad. Those data aren't invented by the software : The UART actually sometimes reads complete garbage from the port.

One explanation could be that this PC actually needs higher voltages than the +/-5 output of the MAX I observed (although according to the RS232 spec, it should accept between 3 and 25V for logical 0 and between -3 and -25 for logical 1).

It could also be that the UART is damaged...

I think what I'll do next is :
1) wire a complete loopback DB9 plug (RX to TX) and see if it echoes correctly.
2) wire a cross COM port loopback (COM1 <> COM 2) and see if I can pass data from one to the other.
3) wire a loopback on the TTL side of the MAX chip and see if it still echoes.
4) maybe get a MAX232 instead of the low power MAX3232 and see if it changes something

But I admit I'm rather disappointed... So little sleep and still no exploitable HEX dump :-(.

Well as usual, any comment is welcome...

Best regards

He Vicne i'am the guest of yesterday.
The problem is that the headunit output an inverted UART signal and instead max232 input need a normally 1 TTL level on pin 11 (the start bit sholud be level 0 TTL) so pin 14 will be normally at -5V and output a start bit at +5V. if you put an inverter (or a NPN transistor with a pullup resistor of 10K to V+ on the collector) between the divider and pin 11 all should work fine. Check for confirmation the idle level output of your PC RS232 pin tx, should be -5 to -12V. Keep in mind also that if the signal is inverted the parity now is EVEN.
good luck!
Ale

you can use the max232 receiver inverter (Input Threshold is <1,5 and >1,8V): connect pin 13 to the divider, join pin 12 to 11, the other signal pin 8 to divider and join 9 to 10
13 12-11 14 8 9-10 7
--i>o--------i>o- --i>o--------i>o-

Originally Posted by Ale

The problem is that the headunit output an inverted UART signal and instead max232 input need a normally 1 TTL level on pin 11 (the start bit sholud be level 0 TTL) so pin 14 will be normally at -5V and output a start bit at +5V.

Aaa-haaa...

Well, I think I'm beginning to understand.
I don't know why, but I always thought that idle state on a serial line was logical 0, so +9V for example, with start bit at 1 (-9V), data and parity, then stop bit at 0 (+9V), but this is plain wrong : I should have started with the basics ... :-)

Check for confirmation the idle level output of your PC RS232 pin tx, should be -5 to -12V.

I can tell you without checking again : it's at +5V - see post 14 :-)

So, OK, I need to invert my input signal. Very good point. Thanks very much already.

Keep in mind also that if the signal is inverted the parity now is EVEN.

True.

you can use the max232 receiver inverter (Input Threshold is <1,5 and >1,8V): connect pin 13 to the divider, join pin 12 to 11, the other signal pin 8 to divider and join 9 to 10
13 12-11 14 8 9-10 7
--i>o--------i>o- --i>o--------i>o-

Phew, it took me a few minutes to understand.

On the principle, using this inverter seemed OK but I had in mind that RS232 has a "dead region" between -3 and +3V so feeding a RS232 entry with my divided signal (0.75V > 3V) would be risky...
Although, you're right, according to the data sheet of the MAX3232, it looks like their "dead region" is much narrower, being located typically between 1.5 and 1.8V, and guaranteed between 0.8 and 2.4 at most with a Vcc of 5V.
The only thing is - if I'm not mistaken - that I will have to take care of the internal pull-down resistor of 5k typ. So instead of my (high impedance) divider, I think a 18k resistor in series with the input on pin 13 would do the trick. Can you confirm this, or do you think I should use a lower impedance divider (such as 3.3k/1k) to reduce the influence of the internal 5k ?

On the other hand, maybe using a transistor inverter would also remind me of my electronics class :-)

Anyway, thanks already for all this. I'm motivated again :-)

Originally Posted by Vicne

I think a 18k resistor in series with the input on pin 13 would do the trick.

you are right, you can use without problem the internal 5k resitor. With a 18K resistor in series the ratio will be 5/(18+5)=0,217. at 12V = 2,6V and at 3V = 0,65V. It should work.
Another question: you think the data from HU is an ack or is a request to CDC for sending data? Which one is the first that send data?
And the very first data HU outs when CDC isn't connected is the same?
Ok soon we have the answer... Thankyou for the big work!!

Originally Posted by Ale

you are right, you can use without problem the internal 5k resitor. With a 18K resistor in series the ratio will be 5/(18+5)=0,217. at 12V = 2,6V and at 3V = 0,65V. It should work.

Just finished the wiring this way. I'll test tomorrow night because I need some sleep :-)

Another question: you think the data from HU is an ack or is a request to CDC for sending data? Which one is the first that send data?

It comes after the data stream from the CDC so it must be an ACK. Moreover, I could also check with my first WAV sample that when the communication is initiated by the head unit (e.g. next track), the CDC sends the exact same ACK byte.

And the very first data HU outs when CDC isn't connected is the same?

I'll have to check. All I could tell from the oscilloscope triggers is that even when the HU is on radio source (so no CD is playing), the CDC sends a different stream at each second with a typical "counter" bit pattern, incremented each time, maybe a packet ID or something...
Hopefully I'll have more info tomorrow night.

You're close, so have a good night sleep and make the test tomorrow. Perhaps I can hear your big YES!! when it works tomorrow, I from Belgium too.
Keep up the good work!