e60bmw

iTrader: (1)

Very cool, just saw this link. I'm sure it wouldn't be that hard to break into if I had the time to play around with a unit I wasn't concerned about. I'm curious about what has been attempted thus far with the Toyota/Lexus ECU's, and what method people have used for trying to access it and what road blocks they ran into. The ECU is back from 2013 and methods have changed over time that could make it less trivial. I work with with engineering/security on linux systems but have never mess around with car stuff before. There would be no performance gain with getting into the hard drive, that drive is more around the entertainment and apps on the car, but I'm sure being able to access it would be interesting to see what other files are stored on it.
Edit: Found this, pretty cool, no idea if this can be applied for our cars but a good read nonetheless.
http://opengarages.org/handbook/ebook/

jonathancl

Bad news: the Toshiba drives are not locked using the default Toshiba 32 spaces master password.

I pulled mine out after stumbling upon this thread, connected it directly to a SATA port, used UBCD on a thumb drive to boot and launch MHDD.
MHDD sees the Toshiba MK1060GSC drive, and it knows that it's locked.
But issuing the unlock command and the password as 32 spaces failed.

It's quite frustrating to know that this part is likely to fail during the life of the car, and while the replacement part gets cheaper every year, we are (for the moment) prevented from producing suitable replacements.

Some pictures:

e60bmw

iTrader: (1)

I wonder what kind of password it is, it can probably be brute forced depending on the encryption.

jonathancl

It's a 32 character string, and you only get four attempts per drive power cycle.
Brute force isn't an option.

jonathancl

So...I have discovered a method to mount and back up the data on your radio's hard drive.
It isn't easy, and it isn't pretty, but it is possible.

Here's the logic:
The radio knows the passcode to unlock the drive. It must send this to the drive every time the drive powers up; that's how ATA Lock works.
Hypothesis: Leaving the drive powered on while you disconnect it from the radio and connect it to a computer should allow the drive to be mounted and read.
Hypothesis test results: SUCCESS!!

Need:
2x SATA Extension cables (https://smile.amazon.com/gp/product/B00O077B4W worked great)
1x usb3 sata drive adapter
Computer running drive imaging software (AOMEI Backupper Standard works great on Windows to create a whole drive image)

How:
Remove Radio
Remove bracket covering Drive
Remove Drive
Install sata extension cable 1 inside Radio
Install sata extension cable 2 on usb3 sata adapter
Connect power cable from sata extension 2 to drive
Connect sata cable from sata extension 1 to drive
Turn on usb3 sata adapter to supply power to the drive
Turn on car to acc mode
Wait ten seconds for Radio to boot fully
Remove sata cable from drive (leave power connected)
Connect sata cable from usb3 sata adapter to drive
Connect usb3 sata adapter usb cable to computer
Drive partitions should be seen by Windows
Optional: turn off car
Use drive imaging software to back up drive image
Use that image file and the imaging software to restore backup, perhaps to SSD (not yet tested)

Drive Info: Toshiba MK1060GSC
Layout
Pri 25GB FAT32 MAP (navigation map files)
Pri 25GB FAT32 WORK (for map update staging?)
Pri 8MB RAW
Extended Partition


Sadly, the apps and interfaces are compiled and monolithic. I was hoping to find interfaces using some modern interface markup framework that would be customizable, but it's not so.

Things seem messy in general. For example:
Message tones are in HD9/RING_TONE/MESSAGE encoded as .pcm.
Ring tones are in HD9/RING_TONE/PHONE encoded as .mp3.

peasodos

iTrader: (1)

Wow, nice breakthrough, never thought of powering up the drive in the car and then connecting it to a computer while it's powered to read it.
Looking forward to your update.

Instead of backing up the drive why not use software to clone it in the unlocked state?
I'm hoping the car will accept the new drive that not locked.

aachowhan

Excellent work! Do you think you could upload that complete image to Mega / Google Drive / Dropbox? I think this is a great step forward and could lead to finding a way to update the software or even updating the GPS. I would love to take a crack at it!

Let me know! Again nice work!

jonathancl

So far nothing I did violates any existing law.
If I upload an image, that will without a doubt run afoul of several.
I'm not doing that.

It's also 8GB of stuff...

peasodos

iTrader: (1)

Did you plan on putting this on a SSD and seeing if it works or simply just to create a backup?

ChronoR

Oh wow, very very clever use of SATA hotswap capabilities.

If cloning to SSD ends up working I will probably do this since I can hear the whirring of the hard drive and it bothers me because my GS450h is otherwise incredibly silent.

vuong05

Subscribed.

aachowhan

My thing is that now if we can use and ssd, this means we can replicate these drives and also get updated firm ware for our systems and even create backs up when eventually the HDD fails. The other thing is that we can now possibly find ways to update the gps, which IMO is the main thing for me. Since there is a way now, I'll have to pull an image of my own.

ssjkev16

I think that really is a great idea with the SSD, but I really do think that the hard drive that is used in vehicles are slightly different than the ones off the shelf since it has to be made to withstand extreme temperatures and whatnot...

LexSense

iTrader: (2)

This is awesome stuff. Thanks for the creative idea @jonathancl
SSD performance comparisons would be a great idea!

sonyfan

iTrader: (1)

Nice job... can't wait to see what you can do with it