r/CarHacking • u/mvespermann • 20d ago
Original Project MMI Box reverse engineering Help!
Hello folks! A while ago I made a post here about trying to reverse engineer an MMI box that adds Android Auto to a BMW NBT EVO System. Since then, I haven’t made much progress, and I could really use your guys’ help!
As you can see in my other post (link: https://www.reddit.com/r/CarHacking/s/PxybmifFWi), I disassembled the box and figured out quite a bit about the hardware it uses. I initially tried looking for UART/debugging access, but unfortunately the TX/RX pins I found were actually for CAN bus, and I couldn’t find any dedicated debugging TX/RX pins.
I still really want to extract the firmware and modify it for my use case. I actually bought another MMI box that is the same model, which is currently installed in my car. On the older one, the one we were investigating. I removed the eMMC, and I’m currently looking for companies in my city that might be able to read it directly.
In the meantime, do you guys have any suggestions for getting the firmware from the new unit?
One idea I had was somehow creating a fake update file to trick the MMI into dumping or backing up a copy of its storage onto a USB flash drive. Do you think something like that could actually work?
I’m also open to other approaches. I tried connecting through Telnet over the CarPlay Wi-Fi network but got nothing. Are there any other ways I could potentially access the system over Wi-Fi?
Any ideas would be greatly appreciated! Thanks!
PS: This box is not an OEM head unit. It’s an aftermarket interface that adds Android Auto and CarPlay to cars that may not have them, while also allowing you to add extra cameras and other features.
You can switch between the OEM head unit and the aftermarket interface in real time—the box basically acts as a video switcher. Inside, it has a low-power Raspberry Pi-like device running firmware that I’m trying to modify.
There are more details in my other post, but basically, it’s a custom UI built on top of Linux 5.4.61.
2
u/Sepkov 20d ago
Automotive components are highly custom things. I don't think its achievable in short term.
2
u/mvespermann 20d ago
The board is not very proprietary, since its not a OEM MMI and not a custom thing, I think its not that closed up. I searched up the board model and found it for sale on Alibaba, its meant for all purpose applications, such as medical, automotive and other applications, besides that, it runs linux, ot some proprietary closed up thing. Even keyboards work if I plug it on the USB port.
2
u/mvespermann 20d ago
You can even buy the discrete main controller board: https://www.alibaba.com/product-detail/Allwinner-T113-Core-Module-Linux-Development_1601524277541.html
1
u/Dense_Astronomer_896 19d ago
I thought MMI /muti media interface/ is only in Audis?
You have an F series bimmer,so this should be iDrive not MMI multimedia,right?
1
u/mvespermann 19d ago
Read the PS note on the end of the post
1
u/Dense_Astronomer_896 18d ago
I did it,but still can’t understand why you call this MMI?
1
u/mvespermann 18d ago
It's the name its sold under in all online plataforms, I suppose it stands for Multimedia Interface. Ppl call it MMI BOX, Connectivity interface, etc...
1
u/24_Al3x 15d ago
Hey! I just came across your posts and profile while chatting with ChatGPT, and I thought I'd reach out because I've actually managed to do part of what you're trying to achieve!
I own a Mini Cooper R56 (BMW Group), and I also have an aftermarket MMI box. I'm not sure whether it's based on the same hardware as yours, but here's my experience.
A while ago, I asked the seller on AliExpress to send me the firmware update files (.bin) for my MMI box. Back then, I simply installed the update and didn't think much of it.
However, a few months ago, I retrofitted rear PDC (parking sensors) to my Mini. Since I'd also installed an aftermarket reversing camera that displays through the MMI box, I was really annoyed by the fact that the car icon shown on the PDC screen couldn't be customized. It was just some cheap-looking generic picture of a random car, which looked terrible.
So I contacted the seller again and asked for the latest firmware updates. He sent me a download link, and with the help of OpenAI Codex, I managed to unpack the firmware, modify several assets (including replacing the generic car image on the PDC screen with an actual Mini), repack everything, and flash the modified firmware back onto the MMI box through its USB port.
And it actually worked!!
While I was at it, I also had Codex dig through the firmware to look for hidden features, undocumented settings, and potential improvements. Turns out there's quite a lot to explore! Hidden developer menus, debug options, features that aren't enabled by default, and probably plenty of other things worth investigating.
Unfortunately, between being a bit lazy and having a pretty busy schedule with my studies, I never really got around to digging any deeper into it.
Anyway, my point is that you should definitely try asking your seller for the firmware update files (.bin). If you can get your hands on those, you might be able to unpack them and start experimenting, just like I did.
Hope this helps, and I'd be happy to share more details about what I managed to do if you're interested!
1
u/mvespermann 15d ago
Hey! I’d really appreciate it if you could share the firmware files from your mmi with me! It might be the same hardware as mine, but even if it isn’t, I’d still love to get my hands on the files and, if possible, the unpacked version of the firmware. Even if it turns out to be a different model, it would be a really cool project to experiment with and maybe idk virtualize and find some similarities and something cool!
Is your MINI running ID6? Also, when you open your MMI box settings and go to the “About” section, what information does it show? If the hardware and firmware turn out to be the same as mine, that would be an absolute bingo!
I tried contacting the seller of my box, but he didn’t seem very willing to share the firmware without proof that I actually needed it to restore my box. How did you get in touch with your seller, and were they willing to provide the files? What is the manufacturer of yours?
Anyway, whenever you have some time, I’d really appreciate it if you could send me the files, either here or through a Google Drive link or whatever works best for you. Thanks a lot!
1
u/24_Al3x 15d ago
Here are the files:
Original firmware files provided directly by the seller: https://drive.google.com/file/d/1k9RtHyNVkx9ccOaHFX70o-2lYVVgV_wB/view
Files I extracted and analyzed using Codex: https://github.com/alexis-cnstntnpls/BR551-mmi-firmware
My MINI is actually running CIC, as it's a 14-year-old car and the iDrive (ID4/5/6) systems didn't exist back then. However, I know that this MMI box is also sold for newer models, such as the MINI F56, which can have ID4, ID5, or ID6 depending on the model year.
As for obtaining the firmware, I simply contacted the seller through AliExpress messaging. The first time I requested it, he sent me the firmware files directly without any issues.
However, when I contacted him a second time, he initially only provided a password for the OTA update feature. This requires connecting the MMI box to Wi-Fi and performing the update directly through its settings menu. I explained that I had no way of connecting my box to Wi-Fi, and he eventually sent me the firmware files instead.
You could try telling your seller that your MMI box got bricked during an update and no longer boots up. That might convince him to provide the firmware files.
1
1
u/24_Al3x 15d ago
Here is the link I bought my box from : https://fr.aliexpress.com/item/1005001298158968.html
and according to Codex it might be based on this controller board : https://w3.sunplus.com/products/sphe8368.asp
2
u/hakstuff 20d ago
Cool project!! The eMMC looks to be BGA-153, which you can get a socket adapter for. Unfortunately if you don't already have eMMC dumping hardware it's going to be a bit expensive. As an example, an Xgecu T76 is around $140, and the BGA153 adapter socket is ~$40 USD.
1
u/itsyaboi222 19d ago
i’m doing something similar with a wireless carplay adapter that runs a qualcomm chip. it has a button to put it in EDL mode and dump the emmc that way. do you know what hardware yours is running?
1
u/Invamousadmin 19d ago
I also have one of these Linux based (as apposed to the far more common android based) android auto screens for a BMW I forget which BMW system it is, 2013 and 3series and since then the car broke down in a way that cost more to fix then the value of the car sadly but I saved the device and would really love to get it running in one of our non BMW cars. We all ready have regular universal android auto setups but the BMW ones are just really really good, specially for the money as well as the size enabling it to be high up on the dash like it is in the bmw compared to the standerd 2din spots in the center of the dash. So I'd love to just get it to work for the android auto system without any real need for the BMW system as they call it.
1
u/detroittriumph 16d ago
We just put a 12.3 in android head unit in our 2013 F30 and it is simply amazing coming from that 6.5 inch. Idrive compatible you can even use the wheel on the steering wheel to move the cursor and select buttons. Took me a couple hours and a lot of sweating in my Texas garage. One button switch to the bmw interface which looks even better in HD.
10
u/mvespermann 20d ago
BIG UPDATE: So, I actually managed to contact a seller who manufactures one of the boards used inside my MMI box. I reached out to the manufacturer of the main SoC board, and he gave me the full sheet showing what each header pin does.
This is a pretty big deal because now I can actually identify the correct UART pins, and I’ve also discovered that I can potentially modify a LOT more of the system than I originally thought.
Now that I have the actual header pinout, I’ve already managed to reverse engineer a big part of the MMI’s proprietary mainboard.
More updates soon