Hacking the Infotainment system, WIP thread (it runs Linux)

The only thing I dislike about my new Prime is the infotainment system. I'd post links, but I can't yet (any mods around? *wink*)

From my research, it seems at least the 11" system runs Automotive Grade Linux which is nice, because the full source code is available, including UI examples, etc. Toyota is likely running an ARM CPU which would use your standard ext3/4 file storage.

As the source code is available, finding exploits to reprogram via USB or something rather down the line would be much easier. For now, I bet you there's a JTAG connector somewhere on the board. At the least, the flash chips could be desoldered and installed in a chipreader to read/modify the filesystem.

I don't have the full details and I'm hesitant to rip apart my brand new Prime to start reverse engineering, but what I can promise you is that I have experience with microcontrollers and reverse engineering. Maybe we can do more research as a community, pair up, get a gofundme or something together and buy a spare infotainment system to begin penetrating.

--------
The AGL Unified Code Base (UCB) is a Linux distribution built from the ground up through a joint effort by automakers and suppliers to deliver a modern in-vehicle infotainment and connected car experience for consumers.

The goal of the UCB infotainment platform is to provide 70-80% of the starting point for a production project. This enables automakers and suppliers to focus their resources on customizing the other 20-30% to meet their unique product needs.

Key features include:

• AGL Application Framework
• ConnMan network management for pairing multiple devices
• Vehicle bus messaging with built-in security to prevent unwanted intrusions
• Audio routing and mixing
• Multiple display capability (front and rear seat)
• IP Network Manager with WiFi and LTE
• Linux Security Module
• Linux-based distribution using Yocto Project
• Device Profiles for Telematics, Instrument Cluster
• Speech Recognition APIs

The latest release, UCB 6.0 (Funky Flounder), is available for download here.



------
EDIT, Lol.. Why is this underpowered ARM device $6k from Toyota? Looks like we need to find some wrecked Primes!

Has there been anyone here that has taken their Infotainment apart and took photos? It'd be a good starting point.

 

Nice Mazda uses AGL and someone wrote a USB Flash Stick hack to install Android Auto/Carplay on their infotainment systems:

Whoohoo! I can post links now!

Here's the dev who is hacking the heck out of Mazda's AGL:
Changelog

GH Repo:
GitHub - Trevelopment/MZD-AIO: Desktop app for AIO

 

Holy shiz.. there's a serial bus connection on Mazda's implementation of AGL to override USB access...
Serial Connection

Going to try working with the dev
Port for Prius Prime on AGL · Issue #51 · Trevelopment/MZD-AIO · GitHub

 

Did some more research.

While Mazda's implementation is based on Linux, it doesn't seem to be AGL like Toyota is using. There's also a pretty tight security model, but it all comes down to what Toyota has implemented. Heck, there's even hardware security features of AGL to guard against physical attacks:

"The board must store hardcoded cryptographic keys in order to verify among others the integrity of the bootloader. Manufacturers can use HSM and SHE to enhance the security of their board."

AGL Developer Site - Introduction -

 

I found the wiring diagrams for the Prius Prime:
Toyota Prius PHV (Plug-in Hybrid Vehicle) / ZVW52L, ZVW52R (EM32E1E) Wiring Diagram | Free Download

I found that our "infotainment" systems in the Prime do a heck of a lot more than just act as a radio. There are parking assist and other systems that wire into it. I'd go so far as to say that if you bricked your infotainment system, you'd lose important functionality in your car, or it wouldn't even run at all.

With the media hype over the last several years of people "hacking" cars, and the very real possibility of a remote/physical attack to do something like hold down an accelerator, disable the brakes, or steer a car into something - it makes sense that Toyota, and AGL have things buttoned down to the extreme. Considering the radio has a CAN bus interface, the radio could be exploited to control the vehicle.

I'm afraid that I'm going to have to pause research for now into exploiting the Prime's infotainment system publicly for the time being. If I get something wrong, it could have real-world safety consequences that I cannot afford to be liable for. Even if I were to do everything right, enabling the Wifi AP or exposing a root level shell over Bluetooth; someone could exploit this into the future, or a Toyota Entune update could brick your entire car. At the least, someone could use whatever exploits I find to brick/attack any car that uses AGL (which is several models).

In the meantime, pick up a Qi wireless charging dock for your Prime and use it instead.
Amazon Link

I really like mine, I mounted it so my phone is just left of the HUD and I control it with raise to speak Apple Watch Siri activation or steering wheel input!

Even if Toyota never updates existing Prime models, there will be a revision of the car to have it eventually. Yes, it'd be super shitty if Toyota didn't update previous models, and yes I know they've fecked owners of another car; but at the least, maybe swapping out the infotainment system could be a good avenue if you have deep pockets, if and when that time came.

 

I'm afraid that removal of the infotainment system would at the least disable Park Assist, possibly your gauge clusters, HUD, HVAC. If you have that much hate for it, you could use a mounting method to install an android tablet on top of the factory display and run Android Auto as a standalone app.

Heck, it wasn't 15 years ago and I was building a laptop mount for my car out of pipe to run Microsoft MapPoint WITHOUT turn by turn navigation because I couldn't afford a GPS receiver. I used it for a year to deliver pizza. We really are spoiled asses in the scope of things, aren't we?



Brings back memories

 

There's some interest ramping up in the Comma.ai Discord in #toyota-prius. I think if anyone has a shot over the mid term, it's us