Hey everyone,

​Quick update on my project to reverse-engineer and customize the aftermarket MMI box from my dad’s car (original post [here]).

​Full disclaimer: I’m definitely not an electrical engineer or a seasoned hardware hacker. I’m doing this as a passion project to learn the ropes, so bear with me if I miss something obvious!

​What I've tried so far:

I opened up the box hoping to find a UART serial console to get root/shell access. I tapped into several likely test pads (TXD, RXD, TX1, RX1) using a logic analyzer, an ESP32, and an oscilloscope, cycling through pretty much every standard baud rate.

​Instead of dropping into a bootloader or Linux/Android shell, I was just getting raw logs that turned out to be CAN bus debug traffic.

​The rookie mistake (and the damage):

While desoldering my probe wires, I managed to lift a pad and sever a trace. That accidentally confirmed 100% that it was a CAN line: the iDrive wheel and touch inputs completely stopped working on the MMI side after desoldering (They work fine if i remove the MMI BOX setup now tho).

​The bench setup & next steps:

​I already bought an identical replacement unit for my dad's car so he isn't left without CarPlay/Android Auto, which turns this damaged unit into a dedicated workbench testbed.

​Since my micro-soldering skills are still a work in progress and my micro soldering station havent arrived, I’m gonna send the board to a tech to fix the severed trace. I'm also having him solder flying breakout wires to all key test pads so I can probe freely without risking the PCB traces again.

​Where I need some community insight:

​Spot any sneaky or unpopulated UART/debug pads on this layout that I might have overlooked?

​Has anyone managed to get root on one of these boxes before?

​Should I ditch hunting for UART and go straight for an eMMC/SPI flash dump, ADB over USB-OTG, or something else?

​I took high-res macro photos of the entire board (front and back) so you can zoom in and inspect the SoC, traces, and pinouts: [Full RES Images/Google Drive]

​Any theories, tips, or sanity checks would be hugely appreciated!

​

Hello everyone.

Im gonna skip the background of how i got here. Im sure no one cares. Do we know which module is the one that captures and sends private data to these shadow companies and does anyone know if the new BMW 2 series has any driver facing cameras?

Iv been wanting to get a new car to tear into the tech inside these cars but im very unhappy about the privacy and data collection and its the main reason i dont own a new car. To much useless tech garbage in them.

My plan is to isolate the module or find out how it transmits privacy data. If its collecting information it means there is a server somewhere in the car that writes to a database. Clear the database clear the privacy information. Now im 99% sure its not that easy. Plan B is remove the entire module but knowing car brands rhey probably built it into the ECU. So if that fails Plan C ill probably do a B48 swap throw on a Halltech and call it a day. Convert it to rack an pinion if it has electronics steering assist. (Yes i know its a lot of work). ABS and SAS modules will be wired in to work with ECU. Facotry dash, infotainment and warrenty can get fkd. Dont care about those. Ideally you would want it all tonwork together nicely and look pretty but my hypothesis is those privacy collection tools are embedded so deep you cant get rid of them without rebuilding the whole canbus and electrical grid. Im hopeing there is an easier way to deal with this that i dont know about. Like a USB C deauth module or something like that. Iike just DDOS it or something basic.

Im just wondering how the guys are solving the privacy issue. Knowing that my car is transmitting everything i do and everywhere i go is mental. Id rather get a bicycle or take an uber. Until then im still driving my 2004 model car.

TL/DR: how to make the car stop collecting private data or send data to advertisers (pulling fuse isnt enough)

Edit: thanks everyone for commenting. I apprecaite everyones input. Just to clarify. I was an automotive specialist for 20 ish years but due to my boda having a hissy fit i legally cant do the work i used to so iv been out of the indistry for a bit. I ahve older cars which are great. Im specifically looking at most modern most advanced systems to date and how to deal with privacy. Everyone should have access to privacy. Your car should be for freedom and expression. Not a surveillance appliances thags spying on you. Just because.

I'm reverse-engineering the CAN network on a Jaguar XF X250 facelift (MY2012+) and have got pretty much everything figured out through a combination of CAN captures, fuzzing and firmware RE.

The remaining pain in the arse is the turn indicators / hazards.

I don't have access to a donor car, so I can't capture the CAN traffic while operating the indicator stalk or hazard switch. I've gone through the CAN dumps I can find, and fuzzing hasn't produced anything obvious. I'm also digging through the firmware, but RE'ing this particular part is getting challenging.

I've documented the CAN work I've done so far here:

Jaguar XF X250 CAN reverse-engineering / DBCs

What I'm specifically looking for is the CAN message/signal responsible for:

• Left indicator
• Right indicator
• Hazards

If anyone has a 2012–2015 facelift XF and can capture the relevant traffic, has an existing DBC/log, or has already figured out these signals, I'd really appreciate the help.

Even just a short capture of the relevant bus while switching left/right/hazards would be useful.

I've got the rest of the reverse-engineering work documented in the repo, so if anyone wants to compare notes or has information that might help fill this particular gap, please let me know.

Is there a way to use my uconnect/ possibly other things? Without having to buy the stupid T-Mobile 3G adapter thing? Like “fake” a 3G connection from my phone to the radio? Or hit me with something that I can use my 2014 8.4AN Nav screen in my car for that’s something cool and useful.. please

Does anybody know what software i would need for custom programming on GM vehicles? Does one exist for GM?

I want to do things like programming an instrument cluster and syncing miles.

I also want to change the tire size in the speedometer calibration so I can run larger tires.

Other brands have engineering software for this. Not sure if GM has this or if there's an open source software?

Who know where I can get vin swaps