Jailbreak Honda Link, Possible?

Thread Tools
 
Search this Thread
 
  #21  
Old 09-02-2014, 06:37 AM
JupiterJoe's Avatar
Member
Join Date: Jun 2014
Location: Jupiter, FL
Posts: 108
Originally Posted by jr231
The iPhone HondaLink app displays navigation data on the the screen while the car is in motion (i.e. not in park/handbrake on). So maybe the answer does not involve sensors that detect if the handbrake is on or not.

Maybe the screen 'device' in the car has a private key or certificate in its software (or encoded into a chip) that is checked against a public key written into the HondaLink software. If the HondaLink app is subsequently authorized, then the app's output is sent to the display whether or not the car is in 'motion' or not.

If this scenario is correct, then it is going to take some clever person to either work out a way to disable the software authentication/authorization mechanism, or derive either the public or private key(s) to simulate the authentication in whatever device or application you're trying to connect.

Hacks like disconnecting the park brake sensors might have no effect unless the phone (or other device) is able to authenticate to the car's display software.

... just a thought, and happy to be laughed at.




I suspect it isn't that complicated. I suspect its just a simple command being sent to the Head Unit to enable the display while in gear or while the Honda Nav App is up and running.
 
  #22  
Old 09-02-2014, 10:52 AM
Join Date: Aug 2014
Location: Connecticut
Posts: 1,616
Originally Posted by JupiterJoe
I suspect it isn't that complicated. I suspect its just a simple command being sent to the Head Unit to enable the display while in gear or while the Honda Nav App is up and running.


One would hope its that simple. Sometimes the simplest explanations make the most sense. Now we need to wait for a computer programmer to buy a Honda Fit, get pissed off at the lack of functionality, and hope he/she is generous enough to provide a software patch on FitFreak to allow such a function.
 
  #23  
Old 10-01-2014, 12:58 PM
Juan Olvera Tenney's Avatar
New Member
Join Date: Sep 2014
Location: LOS ANGELES, CA.
Posts: 4
Originally Posted by Bassguitarist1985
I agree with your George. The hardware is not crippled, its the software that is crippled which makes the hardware crippled.




Another thread is covering the same topic too:


https://www.fitfreak.net/forums/3rd-...8-android.html


My Honda contact is hooking me up with some wiring diagram print outs of the head unit and see what exact sensor inputs its receiving. I still believe a software override needs to be created. It should come from Honda, but to limit the consumer to their inferior product is a bunch of crap.
I agree. We need a software hack or a way to force hidden menu to appear.
 
  #24  
Old 10-01-2014, 04:35 PM
GeorgeL's Avatar
Member
Join Date: May 2014
Location: SoCal, CA
Posts: 1,545
Originally Posted by Juan Olvera Tenney
I agree. We need a software hack or a way to force hidden menu to appear.
Since Hondalink somehow tells the head unit to allow HDMI input then all one has to do is figure out what it does and then emulate it.

Now, having said that, the figuring out is more than I am capable of. It is obviously something in the hondalink software and I'll bet that it sends some sort of code with every screen refresh. The code probably isn't complex but getting your phone to send the same code along with the signal from some other app might be more difficult.
 
  #25  
Old 10-01-2014, 05:31 PM
Satertek's Avatar
Member
5 Year Member
Join Date: Jun 2014
Location: Huntsville, AL, USA
Posts: 24
Originally Posted by 13fit
check the wiring diagram for the headunit for parking brake wire and VSS signal

If either of those two are present, you can wire in a relay, just like aftermarket units.
I've looked into it a little bit, it doesn't look that simple. There is a pin on the back of the head unit for parking brake, but this isn't what it looks at (at least for the CVT) The screen goes off when the gear shift is moved out of P, so the head unit is monitoring this over one of the two data bus lines. These would be very difficult to decode without the original design specs from Honda.

Spoofing the HondaLink app somehow seems the most promising direction at the moment.
 

Last edited by Satertek; 10-01-2014 at 05:34 PM.
  #26  
Old 10-01-2014, 08:41 PM
bensonr2's Avatar
Member
Join Date: Jul 2014
Location: parsippany, nj
Posts: 41
Originally Posted by Satertek
I've looked into it a little bit, it doesn't look that simple. There is a pin on the back of the head unit for parking brake, but this isn't what it looks at (at least for the CVT) The screen goes off when the gear shift is moved out of P, so the head unit is monitoring this over one of the two data bus lines. These would be very difficult to decode without the original design specs from Honda.

Spoofing the HondaLink app somehow seems the most promising direction at the moment.
I accidentally got Google Maps to play through Honda Link the other day while the car was still in drive.

I wasn't necessarily trying to accomplish this.

Since the update to Ios 8 there are several additional bugs that have appeared. Basically the biggest being the Honda Link menu no longer appears on the head unit display after loading.

In any case after attempting to load Honda Link I tried using the phone to switch between background apps and I noticed it was now displaying a mirror of the iphone even though it was in drive.

So I opened Google Maps and it continued to function for the duration of the trip.

It wasn't perfect as it doesn't automatically switch to landscape or orientation. I had to reposition the phone correctly for that.

And the picture didn't fit the screen completely. But other then that it worked fine (albeit with no touch screen functionality on the head unit).
 
  #27  
Old 10-08-2014, 01:20 PM
CIOWN's Avatar
Member
5 Year Member
Join Date: Sep 2014
Location: Coppell,Texas
Posts: 121
Audio Wiring Diagrams

This thread:

FIT Infotainment and HVAC Wiring Diagrams

has, thanks to user mecevans, wiring diagrams to the FIT audio systems (sheet4 and sheet53).

Can anyone here see a way to override and enable HDMI while driving?
 
  #28  
Old 10-08-2014, 07:09 PM
Darkshowdo's Avatar
Member
Join Date: Sep 2014
Location: US
Posts: 72
I guess i can try and put my Electronics Certification to use. Ill analyze the sheets for some info.
 
  #29  
Old 10-08-2014, 07:33 PM
Darkshowdo's Avatar
Member
Join Date: Sep 2014
Location: US
Posts: 72
Reviewing the diagram doesn't give me much information unfortunately.
The only thing i can really think of is Pin 13 CEC on HDMI connector is a like a remote wire for a amp, A signal can be sent via the Hondalink App to activate the CEC which then the Head unit will then say its okay to use. While CEC will always need to be wired up, It will only send a signal if the program were to send a signal to activate CEC.
It would be much easier to determine if we had access to code from the app.


Edit:
Infact giving it more thought, I am almost certain the headunit needs a specific CEC signal to allow video while moving.

I believe if we had access to the SD card info or the code from the hondalink app. We may be able to figure something else out.
 

Last edited by Darkshowdo; 10-08-2014 at 07:37 PM.
  #30  
Old 11-29-2014, 04:32 PM
Ductapemaster's Avatar
Member
5 Year Member
Join Date: Nov 2014
Location: Santa Barbara
Posts: 48
I just bought a 2015 Fit and I am very interested in working to get the HDMI connection to be useful while driving. This morning, I unfortunately confirmed that the HondaLink app does not signal the head unit through CEC. I did this by cutting the CEC bus wire in an HDMI cable and trying out the HondaLink app (and other apps). With the cable cut, the functionality remains undisturbed.

I suspect it has something to do with the device ID being sent to the head unit when you switch apps, although I need more equipment to confirm. I'll do some more testing once I head home from break!
 
  #31  
Old 11-30-2014, 09:49 PM
Brian Jones's Avatar
Member
5 Year Member
Join Date: Aug 2014
Location: Waverly, Iowa
Posts: 89
Out of my depth, but...

RE cutting CEC line. Since my iPhone while using Bluetooth has select functions locked out while in Drive, I assume that the head unit is making the determination about what the user can and cannot do/see based on some sort of signaling in the soft/firmware. When the HDMI is connected, perhaps the same strategy is employed. If that is the case, changing the behavior of the head unit will require hacking the code in the head unit. I applaud your curiosity and industry, but I am doubtful of your success. I would not discourage you, however; there a number of us that would like to modify the behavior of the head unit in various ways.
I wonder what motivates car manufacturer's to lock out certain features in their information centers. Is it a concern over lawsuits? A government law or guideline? An agreement among car manufacturers? Or is it simply each manufacturer's concern for the safety of its customers, unmotivated by outside forces? If there is an external guideline, I would be interested to read it. Some of the decisions about what functions are locked out don't make sense to me. For example, why disallow changing the bass and treble settings and allow the user to scan through all 1,0000 songs on his or her iPhone, looking for a specific song?
 
  #32  
Old 12-01-2014, 02:23 AM
Ductapemaster's Avatar
Member
5 Year Member
Join Date: Nov 2014
Location: Santa Barbara
Posts: 48
After doing some more research, my next suspicion is that the HondaLink app broadcasts some sort of ID via the DDC channel on the HDMI connector, which I hope to confirm sometime this week once I hook up my logic analyzer. After that, things will get more difficult if that proves not to be the case.

I also have plans to jack into the CAN bus in the car and check out the traffic going to the head unit. After playing around in the diagnostic menus a bit, I noticed two flags: PARK and PARK-VIDEO. PARK is triggered when the car is in park via the gear shift, and PARK-VIDEO is triggered when the e-brake is pulled. I confirmed that the video display is disabled when the car is put into any gear but park, regardless of the state of the e-brake. I was really hoping that the e-brake would trigger the video to display, since that would be an easy fix (its a switch directly connected to the head unit), but alas, that is not the case.

Going forward, I strongly believe that some sort of hardware interrupter device will be necessary, either on the HDMI side of the CAN bus side, in order to enable us to use the unit as we wish. Unfortunately this means a lot of work, but it would be a plug and play solution rather than some scary software modifications.

To address the other part of your answer, I believe there is a team of lawyers and quants that has figured out the risk of enabling certain features while the car is in motion. From there, they probably decide which to allow the user access to and which to block. The legal route is really the only one that makes sense to me, since blocking functions based on some sort of conditional (speed, gear, etc) is more work than just allowing the user access at all times.
 
  #33  
Old 12-01-2014, 02:23 PM
Brian Jones's Avatar
Member
5 Year Member
Join Date: Aug 2014
Location: Waverly, Iowa
Posts: 89
What image would I see if HDMI was not disabled?

Ducktapemaster: Thanks for this pondering of possible strategies. Many of us really have one main objective in mind, i.e., to use the GPS in our phone to drive the dash display. I have no plans to watch the Little Mermaid while driving. I wonder, however, what image I would see via HDMI. When in park, I can see a rather small image of my iPhone screen, too small to be very useful. In order for the phone GPS to be useful, I would want the display to fill the screen. I assume this would require a software change in the iPhone. What I really want is for one of the GPS manufacturers to supply an iPhone app that will fill the entire screen, or for Apple to offer a modified output for all apps enlarged and in landscape mode.
 
  #34  
Old 12-01-2014, 05:36 PM
Ductapemaster's Avatar
Member
5 Year Member
Join Date: Nov 2014
Location: Santa Barbara
Posts: 48
So I've found that the mirrored display does not take up the entire display (the aspect ratio is different than the iPhone output, which I believe is 720p). However, it helps if you rotate your phone sideways. That way at least you are trying to display a horizontal image on a horizontal display.

I'd say in that case the app is usable until Honda comes out with CarPlay, at which point we can ignore all this silliness!

On a side note, I'm under the impression that the HondaLink app uses a protocol called "MirrorLink" to do its display on the head unit. I read a bit about it and it appears to be some sort of VNC connection to the phone, which allows for user interaction via the touchscreen. I'm very interested to know how they implement this over the HDMI channel...could be over the ethernet channel, but somehow I don't believe that Apple has that kind of functionality implemented in the little lighting <-> HDMI connector they have (but I don't know for sure).

That said, the MirrorLink protocol is public (well, kinda...you have to pay to access it unless you are part of a consortium), so hopefully some app devs can implement the protocol directly into their apps and give us access through the display.
 
  #35  
Old 12-01-2014, 09:17 PM
Ductapemaster's Avatar
Member
5 Year Member
Join Date: Nov 2014
Location: Santa Barbara
Posts: 48
Apologies for the double post, but I have some interesting developents in HondaLink land!

So I wired up a little adapter that allows me to connect or disconnect (as well as tap in to) the HDMI communication channels. This was so I could test my theory about how the app communicates with the head unit, and whether or not the HDMI link required HDCP encryption (or even if that was the method of authentication).

In order to remove the number of variables from the system, I turned bluetooth off on my phone, and lo and behold, the HondaLink feature requires it! Very interesting, to say the least.

So I turned bluetooth back on, connected up the app, and then started removing connections on the HDMI cable. I discovered that the link in fact does NOT use HDCP, and only uses the serial channel on the HDMI connector to negotiate the resolution to display on the display (when I started up the app without the serial channel connected, the display was a funky size....had to restart the car and the app after that). However, if it negotiates first, you can disconnect those lines. They are used for HDCP encryption once the link has been negotiated, and therefore I can conclude that HDCP is not used for HondaLink.

The following connections are required:

5V, GND, SDA, SCL, and HotPlug detect. Pinout info can be found here: HDMI (High-Definition Multimedia Interface) interface connector pinout diagram @ pinouts.ru

So, my conclusion is this:

- HondaLink does not require HDCP, and the HDMI connection is both "dumb" and unidirectional
- The authentication is performed via bluetooth from the HondaLink app
- Additionally, the touch interface to the app is handled via bluetooth as well

Next, on to sniffing bluetooth traffic.....
 
  #36  
Old 12-02-2014, 05:15 PM
GetFit15's Avatar
Member
Join Date: Nov 2014
Location: El Paso, TX
Posts: 46
Thumbs up

Originally Posted by Ductapemaster
Apologies for the double post, but I have some interesting developents in HondaLink land!

So I wired up a little adapter that allows me to connect or disconnect (as well as tap in to) the HDMI communication channels. This was so I could test my theory about how the app communicates with the head unit, and whether or not the HDMI link required HDCP encryption (or even if that was the method of authentication).

In order to remove the number of variables from the system, I turned bluetooth off on my phone, and lo and behold, the HondaLink feature requires it! Very interesting, to say the least.

So I turned bluetooth back on, connected up the app, and then started removing connections on the HDMI cable. I discovered that the link in fact does NOT use HDCP, and only uses the serial channel on the HDMI connector to negotiate the resolution to display on the display (when I started up the app without the serial channel connected, the display was a funky size....had to restart the car and the app after that). However, if it negotiates first, you can disconnect those lines. They are used for HDCP encryption once the link has been negotiated, and therefore I can conclude that HDCP is not used for HondaLink.

The following connections are required:

5V, GND, SDA, SCL, and HotPlug detect. Pinout info can be found here: HDMI (High-Definition Multimedia Interface) interface connector pinout diagram @ pinouts.ru

So, my conclusion is this:

- HondaLink does not require HDCP, and the HDMI connection is both "dumb" and unidirectional
- The authentication is performed via bluetooth from the HondaLink app
- Additionally, the touch interface to the app is handled via bluetooth as well

Next, on to sniffing bluetooth traffic.....

Great work! Keep it up! Following this for sure.
 
  #37  
Old 12-02-2014, 09:20 PM
Join Date: Aug 2014
Location: Connecticut
Posts: 1,616
Interesting developments. Watching this thread too! Great efforts ducktapemaster!
 
  #38  
Old 12-02-2014, 11:10 PM
Ductapemaster's Avatar
Member
5 Year Member
Join Date: Nov 2014
Location: Santa Barbara
Posts: 48
So unfortunately it looks like my efforts from the App side may be limited without additional cost or help.

I've done some research into packet sniffing for Bluetooth and there's really only two options:

1. Use the iOS development kit (which costs $100 I believe) to capture traffic going in and out of the iOS network stack

2. Invest in a bluetooth sniffing device (also about $100)

The former has a better chance of success (the bluetooth sniffer hardware only works at low speed), and I might at some point want to do some iOS development, but for now I think there is a better course to take.

I'm going to focus my efforts on two things:

1. The CAN bus going to the unit. I have some hardware on order that will allow me to capture CAN bus traffic. The idea here is to build some sort of interrupter that sits in between the main bus and the head unit, and it will block or modify commands that would turn off the HDMI mirroring, or disable functions in the UI

2. Dump the SD card contents and see if I can modify the OS and applications to allow access to the HDMI port while moving. This is much harder than the CAN bus work, but it could result in a lot more functionality from the user side, like disabling the silly warning at bootup, for example. I need to learn a lot before I make any progress here...

That said, if anyone around here does any iOS app development and would be interested in helping me out, please let me know!
 
  #39  
Old 12-02-2014, 11:45 PM
mecevans's Avatar
Member
Join Date: Apr 2014
Location: Monterey
Posts: 229
don't forget there's also an SD card in the Honda Parts Catalog for some kind of update or add-on for
navigation.
 
  #40  
Old 12-03-2014, 01:57 AM
Ductapemaster's Avatar
Member
5 Year Member
Join Date: Nov 2014
Location: Santa Barbara
Posts: 48
According to all the documentation I've read, there is an SD card present in both Navi and non-Navi models. The one that is listed in the parts catalog appears to replace the one that comes standard with the head unit. This is also backed up by the diagnostic mode on the head unit, which says my EX-L has an SD card installed.

There appears to be differences between the Navi and non-Navi units as well, but I can't confirm that without tearing each apart. They both connect differently to the car (for example, the Navi unit has a vehicle speed input that the non-Navi unit does not), and the documentation I've seen claims that the Navi unit has sensors in it that the non-Navi unit does not.

However, that all may be untrue as all of the listed features can be software enabled, likely via the SD card. The documentation says that the SD card holds the applications, among other things, and therefore it could enable those features in the unit.

If no one responds to my other post about the SD card, I will pull mine this weekend and see what I can gather from it.

Also, side note: it appears the GPS is active in the non-Navi units because the head unit can use you phone to call 911 in the event of an accident. It's not necessarily enabled for navigation.
 

Last edited by Ductapemaster; 12-03-2014 at 01:58 AM. Reason: Add'l info


Quick Reply: Jailbreak Honda Link, Possible?



All times are GMT -4. The time now is 05:55 AM.