Fun discoveries about Mazda 6 Hacking! A few months ago I bought a new 2016 Mazda 6. It’s a great car, in line with my Mazda 3 but better. Leather seats are nice, and it’s bigger inside. More horsepower, etc.. I’ve been really happy with it. Except for the Mazda Connect infotainment system.
It’s only obvious where things are going in the automobile electronics market. Soon we won’t be driving anymore, instead we’ll be fiddling away with giant touchscreens and mobile twitter accounts. Even the older crowd should welcome the advantages self-driving cars present, but until then, we need to drive.
I like the idea of a central information display, and it’s proved it’s usefulness already in airplane glass-cockpit setups. But I have to drive while operating it, and I’m not the only one who feels like the Mazda system falls short. It has a nice sized display, and it’s touch-screen, which is nice, but once you start driving, the touch ability turns off for safety. This is obviously debatable, and annoying, but while driving you’re left with controlling the system with a few buttons and a joystick-knob thinger.
I’m a HUGE fan of buttons. Buttons are awesome, and I was hopeful that I’d be fine just using the system as provided. However the menu system they provide requires about 400 twists, turns, presses and other twiddling to do just about anything. It’s really complex and a huge distraction while you’re driving. After my first few weeks of trying to learn it, I finally came to the conclusion that it just sucked.
Being the engineering type, I was thinking there probably was a way to hack an android tablet in there, or something actually useful with a bluetooth remote. While standing in the shower a couple mornings I went completely off the deep end thinking about how I could integrate the existing controls in, maybe even the steering wheel controls if they’re transmitted over the car’s CAN Bus. But I’m pretty busy, and that would be a big project, so I filed it mentally under the ‘rainy-day’ category project.
Mazda 6 Hacking
Apparently the whole infotainment system is run by a small embedded linux system that runs an Opera browser to display stuff on-screen. Think of it as a Raspberry Pi in your car. That’s hooked to everything including I think the CAN bus (still researching that.). This changes everything. Apparently Mazda wasn’t kidding when they told CES in 2014 that they were going to use the OpenCar system. A rare case of software openness in the car community I can’t compliment Mazda enough. What a fantastic idea! But what’s really going on.
Fire up your laptop and plug an ethernet cable into the USB to ethernet adapter and plug that into one of the USB ports in the armrest compartment. Then configure your ethernet port to use the IP address 192.168.42.2. In bash it should be as simple as:
ifconfig eth0 192.168.42.2
Without putting your foot on the brake pedal, so the car doesn’t actually start up, press the start button twice. This will turn on the peripherals for the car. You should see the lights on the adapter turn on. At this point the car will set it’s own IP address to 192.168.42.1, so you just need to go into the shell and type:
# ssh firstname.lastname@example.org
Add the new signature, and use the password
jci to log in. Pretty cool eh? So what’s in there? Doing a little poking around it seems that the system is an ARM based linux install. Fairly standard:
- Dual core
- 1GB of RAM or so, I was showing ~800KB of RAM available to the system.
- 512MB of storage
- WIFI, Bluetooth, and USB ports.
- Opera Browser installed and running in a kind of kiosk mode. I saw some configuration for Wayland, so maybe that’s what it’s using? Didn’t seem like X11.
So what’s to do? Immediately in the wiki I saw a couple of neat things to accomplish with very little effort.
Seriously. It’s bad enough when you brick your phone because of some rooting BS you’re trying out on a Sunday afternoon, but bricking your car radio would be like the 7th level of hell. Who knows if the dealer would fix it without a ton of $$, they clearly aren’t qualified to do much except to replace the whole system, and I can’t imagine how much that would cost. Simply put BE CAREFUL. There’s not a lot of support out there for this stuff, and the annoyance of having a jacked system every day on the way to work would kill me.
Here’s a few recommendations:
Backup the JCI folder
As far as I can tell most of the stuff you’d be getting into is in the /jci/ folder. It’s about 260MB I think, so not hard to back up and keep in a safe spot before you start screwing around. Here’s a decent way to do it – on your machine, after connecting, use SCP to copy the whole folder to somewhere local. This would copy it to your home folder, where you can then zip it up and put it somewhere safe.
scp -rp email@example.com:/jci ~/
BE CAREFUL STUPID!
..does it need to be said? All the following may very well bust your car. I don’t know all the details of how it’s connected to things, so it may break your radio, open your car up for a freeway script-kiddie attack, attract an alien invasion, pop a tire or break your transmission. I really don’t know, and haven’t gotten into the connectivity all the way yet. I believe it’s very possible for this system to be connected into the CAN Bus on your vehicle. THIS IS WHAT YOUR CAR USES TO DRIVE. So potentially there’s huge security risks as well as the possibility to make your car run bad, break it outright, or other nastiness. The Wifi provides an open attack vector for people in the real world. As with any networked computer system, be cautious and expect people to hack your stuff.
I plan on doing a more thorough investigation of how it’s hooked up, and I’ll make a new post when I have that available. Until then assume it’s very dangerous to change anything.
Disable the speed restriction
Just run this:
/jci/scripts/set_lvds_speed_restriction_config.sh disable /jci/scripts/set_speed_restriction_config.sh disable
Voila, no more restricting me from fiddling the touchscreen while cruising down the highway at 80MPH. Awesome!
I also noticed they had a section in the wiki for reducing the time the disclaimer screen shows.
This is cool, but I’d rather not see it at all. What if I reduce the time to 0? – Actually, the right way would be to just remove the call altogether, but being lazy and excited I just reduced the timeout to 0 instead of the 300 suggested in the article. Works great.
- Google Maps – Turn on the WIFI option, and link it to my phone’s hotspot. Then I can create an app for Google maps that will show me directions, and real time traffic.
- FLAC Drivers – I may be able to update the drivers to play lossless FLAC music from the USB ports. I already noticed it will play OGG files which is different.
- Fix the crappy menus – this could mean a lot of work, my first thought was to just re-arrange stuff in the existing system to give better more easily accessed shortcuts. Rewriting everything would take a while.
- Make better use of the wheel controller. Looks like you can access the wheel controller events as well as the stuff on the steering wheel. Maybe change it so when you’re playing music, pushing the wheel to the right goes forward a track, left -> back a track. This alone would save me like 10 clicks that I do all the time.
I’m sure you all would have some great ideas, I’d be curious to hear them.