2016 Mazda 6 Hacking – Howto

Fun discoveries about Mazda 6 Hacking! A few months ago I bought a new 2016 Mazda 6. It’s a great car, in line with my Mazda 3 but better. Leather seats are nice, and it’s bigger inside. More horsepower, etc.. I’ve been really happy with it. Except for the Mazda Connect infotainment system.

It’s only obvious where things are going in the automobile electronics market. Soon we won’t be driving anymore, instead we’ll be fiddling away with giant touchscreens and mobile twitter accounts. Even the older crowd should welcome the advantages self-driving cars present, but until then, we need to drive.

Glass-cockpitI like the idea of a central information display, and it’s proved it’s usefulness already in airplane glass-cockpit setups. But I have to drive while operating it, and I’m not the only one who feels like the Mazda system falls short. It has a nice sized display, and it’s touch-screen, which is nice, but once you start driving, the touch ability turns off for safety. This is obviously debatable, and annoying, but while driving you’re left with controlling the system with a few buttons and a joystick-knob thinger.

I’m a HUGE fan of buttons. Buttons are awesome, and I was hopeful that I’d be fine just using the system as provided. However the menu system they provide requires about 400 twists, turns, presses and other twiddling to do just about anything. It’s really complex and a huge distraction while you’re driving. After my first few weeks of trying to learn it, I finally came to the conclusion that it just sucked.

Being the engineering type, I was thinking there probably was a way to hack an android tablet in there, or something actually useful with a bluetooth remote. While standing in the shower a couple mornings I went completely off the deep end thinking about how I could integrate the existing controls in, maybe even the steering wheel controls if they’re transmitted over the car’s CAN Bus. But I’m pretty busy, and that would be a big project, so I filed it mentally under the ‘rainy-day’ category project.

Until I found THIS.

Mazda 6 Hacking

Apparently the whole infotainment system is run by a small embedded linux system that runs an Opera browser to display stuff on-screen. Think of it as a Raspberry Pi in your car. That’s hooked to everything including I think the CAN bus (still researching that.). This changes everything. Apparently Mazda wasn’t kidding when they told CES in 2014 that they were going to use the OpenCar system. A rare case of software openness in the car community I can’t compliment Mazda enough. What a fantastic idea! But what’s really going on.

After a little investigation and purchasing a suitable USB to Ethernet adapter I was able to just SSH into my car. If you’re using Linux like me you can just do this:

Fire up your laptop and plug an ethernet cable into the USB to ethernet adapter and plug that into one of the USB ports in the armrest compartment. Then configure your ethernet port to use the IP address 192.168.42.2. In bash it should be as simple as:

ifconfig eth0 192.168.42.2

Without putting your foot on the brake pedal, so the car doesn’t actually start up, press the start button twice. This will turn on the peripherals for the car. You should see the lights on the adapter turn on. At this point the car will set it’s own IP address to 192.168.42.1, so you just need to go into the shell and type:

# ssh root@192.168.42.1

Add the new signature, and use the password jci to log in.  Pretty cool eh? So what’s in there? Doing a little poking around it seems that the system is an ARM based linux install. Fairly standard:

  • Dual core
  • 1GB of RAM or so, I was showing ~800KB of RAM available to the system.
  • 512MB of storage
  • WIFI, Bluetooth, and USB ports.
  • Opera Browser installed and running in a kind of kiosk mode. I saw some configuration for Wayland, so maybe that’s what it’s using? Didn’t seem like X11.
  • OpenCar style application setup under the /jci/ folder. Lots of Javascript and images and other readily hackable stuff.

So what’s to do? Immediately in the wiki I saw a couple of neat things to accomplish with very little effort.

Bricked_up_door_-_geograph.org.uk_-_1650083BACKUP! BACKUP!

Seriously. It’s bad enough when you brick your phone because of some rooting BS you’re trying out on a Sunday afternoon, but bricking your car radio would be like the 7th level of hell. Who knows if the dealer would fix it without a ton of $$, they clearly aren’t qualified to do much except to replace the whole system, and I can’t imagine how much that would cost. Simply put BE CAREFUL. There’s not a lot of support out there for this stuff, and the annoyance of having a jacked system every day on the way to work would kill me.

Here’s a few recommendations:

Backup the JCI folder

As far as I can tell most of the stuff you’d be getting into is in the /jci/ folder. It’s about 260MB I think, so not hard to back up and keep in a safe spot before you start screwing around. Here’s a decent way to do it – on your machine, after connecting, use SCP to copy the whole folder to somewhere local. This would copy it to your home folder, where you can then zip it up and put it somewhere safe.

scp -rp root@192.168.42.1:/jci ~/

BE CAREFUL STUPID!

..does it need to be said? All the following may very well bust your car. I don’t know all the details of how it’s connected to things, so it may break your radio, open your car up for a freeway script-kiddie attack, attract an alien invasion, pop a tire or break your transmission. I really don’t know, and haven’t gotten into the connectivity all the way yet. I believe it’s very possible for this system to be connected into the CAN Bus on your vehicle. THIS IS WHAT YOUR CAR USES TO DRIVE. So potentially there’s huge security risks as well as the possibility to make your car run bad, break it outright, or other nastiness. The Wifi provides an open attack vector for people in the real world. As with any networked computer system, be cautious and expect people to hack your stuff.

I plan on doing a more thorough investigation of how it’s hooked up, and I’ll make a new post when I have that available. Until then assume it’s very dangerous to change anything.

Disable the speed restriction

Just run this:

/jci/scripts/set_lvds_speed_restriction_config.sh disable
/jci/scripts/set_speed_restriction_config.sh disable

Voila, no more restricting me from fiddling the touchscreen while cruising down the highway at 80MPH. Awesome!

Disclaimer Screen

I also noticed they had a section in the wiki for reducing the time the disclaimer screen shows.

This is cool, but I’d rather not see it at all. What if I reduce the time to 0? – Actually, the right way would be to just remove the call altogether, but being lazy and excited I just reduced the timeout to 0 instead of the 300 suggested in the article. Works great.

What’s next?

IMG_20150803_161135

So this opens up a whole range of possibilities – being a Javascript developer (among other things) and very familiar with Linux on ARM, it’s quite possible to do lots of stuff. Here’s my list of ideas so far:

  • Google Maps – Turn on the WIFI option, and link it to my phone’s hotspot. Then I can create an app for Google maps that will show me directions, and real time traffic.
  • FLAC Drivers – I may be able to update the drivers to play lossless FLAC music from the USB ports. I already noticed it will play OGG files which is different.
  • Fix the crappy menus – this could mean a lot of work, my first thought was to just re-arrange stuff in the existing system to give better more easily accessed shortcuts. Rewriting everything would take a while.
  • Make better use of the wheel controller. Looks like you can access the wheel controller events as well as the stuff on the steering wheel. Maybe change it so when you’re playing music, pushing the wheel to the right goes forward a track, left -> back a track. This alone would save me like 10 clicks that I do all the time.

I’m sure you all would have some great ideas, I’d be curious to hear them.

Like or share:

32 comments on “2016 Mazda 6 Hacking – HowtoAdd yours →

    1. Not working yet – I haven’t had a lot of time since I posted this, but I was able to get some arbitrary html and JS to load in the display on the car, so my next step was to explore displaying outside webpages, or perhaps shoehorn in an iframe so I keep some internal controls on-screen. Perhaps next month my schedule will open up and I can do this. I’ll post any updates here along with code if applicable.

  1. Cool post, I was wondering what type of capabilities might be available with a good hack. Probably too advanced for my level, but very neat post.

  2. Thanks for the write-up.  By chance, were you able to find any audio system configuration files?  I am curious as to why the frequency response (electrical signal) is not flat with Bass and Treble zero’d and wonder if there are settings I can access to change it.

    1. Hi!

      Yes, I wrote some details up in another post about this: Mazda 6 Diggings, Audio

      On first look, yes, you can get into the audio settings, but the code is just a proxy to send commands to a deeper layer which I haven’t gotten into yet. Javascript would be terrible language to write DSP in, so if this processor indeed handles DSP for Bass/Treble then I’m sure there’s some C or C++ program that’s doing it, not the Javascript. But you can control it from here and change UI pretty easily.

      Curious: What did you do to look at the frequency response? Run some white noise through the AUX port and listen with a microphone? Or did you do an electrical response test?

      No audio system is flat, flat sounds pretty awful unless you’re German (looking at you Sennheiser), so I’m not surprised by your statement, just curious what you’d prefer. There’s probably some options.

      1. I measured the electrical signal from the tweeter harness with my Rockford Fosgate 360.3 (the processor does this measurement and then auto-compensates to flatten the signal response as the first step in OEM integration).

        I am not sure if there is anything else that is altering the signal in the path between the outputs at the (non-Bose) HU harness and the tweeter harness. There does appear to be a module tucked away in the passenger’s front kickpanel, I am not sure of its function. I’d like to try tapping straight from the wire harness on the back of the HU/touch-screen but hesitate to remove it to access the harness. As it stands in my situation, I can boost the heck out of the sub-bass but the result is what I’d call “sloppy bass”.

        Tried setting up the ethernet/USB to the infotainment system, but apparently had a non-compatible chipset in my adapter, so just ordered the known compatible Plugable. I’m eager to pull a copy of the filesystem to my PC and do some digging.

        Thanks for the other blog reference. It looks like they comment their revision history well 🙂

    1. The code is proprietary, if I post it publicly it may piss some people off which is why I’m sticking to small snippets which hopefully are clear enough.

  3. It runs Linux and tons of OS stuff.Can you perhaps extract the OS as an VM image, thereby removing propriety stuff but leaving enough for others to have a representative environment?Or is that useless?

    1. It won’t run in a normal VM because it’s ARM architecture. You’d need an emulator. Getting an image might be tough, plus without the proprietary stuff it’s just another linux box, so not much use I guess. If you want to develop stuff on your PC, get a developer account on the OpenCar website and download their developer kit. That’s the ticket.

  4. You think it is possible to port the whole environment to a Raspberry Pi (using eg. ‘dd’ command) and run a local copy to fiddle with? (including GUI)?Apparently it’s both ARM arcitecture. If the current implementation is kept generic enough it might run on a slightly different ARM layer as well since it auto detects hardware differences, right?I’m looking for a safe environment to try stuff out, in particular the way the system handles mp3 ordering.The USB2UTP converter is ordered but I can’t wait to try it out myself. 🙂

  5. Thanks Micah!  I’ve used your details to get on my 2016 CX-5’s network, back it up, disable the annoying speed restrictions, and lower the disclaimer timer.Now I’m poking around on the backup to see what else is available.

  6. This is great,Are you able to change the MUTE button (when you push the volume button down) to PAUSE.I don’t listen to FM radio, only Bluetooth.  I want that button to PAUSE instead of MUTE.  Seems it would just be replacing the MUTE command with PAUSE when that button is pushed.Thanks!

  7. Hi! Very interesting write up. I got to this page since a Mazda CX3 is on my shortlist for a new car in the immediate future. But having to stick my phone to the windscreen with a sucker, just to get some internet radio and Waze and/or Google real time traffic, is an absolute show stopper. But if this thing is hackable, maybe … What about:
    Internet access through a USB LTE dongle?
    Direct app installs on device (Audials, Waze, Google maps)
    Or at least enable Apple Car Play/Android Auto
    any of these potentially feasible?
    I’ve been looking at one of the 2-DIN Android boxes (Newsy) for another application, but 2-DIN would not work in this case.
    Anything to make Mazda Connect better will clearly help!

  8. Due to limitations in the OEM audio setup (which I mentioned above), I’m planning to serve up audio via Raspberry Pi 3 and HifiBerry Pro+ DAC.I am curious as to what it’d take to use the OEM Mazda touch screen to control Volumio on the Pi, i.e. can I add a tab in the touch screen which is just an Opera browser pointing to the Pi (with connectivity via USB to ethernet dongle to the Pi)?  The audio controls in Volumio can be performed via the web browser so this seems a very attractive option if it’s feasible.In the worst case, I’m open to just launching the web browser from the OEM touch screen somehow or starting a VNC session to the Pi, and having it hog the whole display as long as I can close it out.

  9. Hello,Nice article. Is possible to use this technique on a car that has the uConnect System (based on QNX) ? I want to connect to the in car system and try to dump it by usb port.Any suggestion?Thanks.

  10. Great read. Just got the cx3 & saw its possible to get the infotainment system to mirror iPhone’s. Haven’t figured it out yet. Just wondering if you would know how this is done. Tjanks

    1. I’ve also heard that these units can be flashed with the Android car ROM as well, but I’ve never seen it done. As it stands there’s no mirroring capability, but the hardware is all there, bluetooth, wifi, USB, etc. You’d need to flash a new system on it.

      The newer 2017 vehicles may have a new version with more capability, I don’t know.

  11. I agree that the system sucks.  I have leased a CX-5 so I am reluctant to experiment.  However, I have begun writing to Mazda.  I suggest we all do.  Perhaps enough “suggestions” will produce an update sooner than later/

  12. Hey there, saw this post and figured I’d reach out.  I basically have disabled USB ports due to a bad version of AIO that was installed a few months back…  Short of replacing the infotainment system (~150-200$ via eBay), I’m not sure what else I can do.  Have you explored other ways of ssh without using the USB port?  Perhaps a serial connection?  Or even through the navigation SD slot?  Bluetooth?  Any suggestions or clues would be helpful.  Thanks for your post.

    1. The only way that’s feasible off the top of my head is to find the motherboard and get a terminal session going over the tty port (UART) – however this means finding the UART pins, and getting the baudrate correct and hoping that the developers left it operating in the first place. Usually these boards have a tty, but not sure on this. Next time I’m in the system I’ll check?

Leave a Reply

Your email address will not be published. Required fields are marked *