[jwhazel]

Warning: some pretty geeky computer stuff ahead.
Look toward the end for 'What I need' to see if you can help.

Greetings all. I know that there was a thread similar to this posted awhile back but it seemed to focus more on the hardware side of adding video inputs. I'm creating this thread to specifically talk about the software that iMid runs, how to hack it, and what I've discovered so far. Even if this thread doesn't get any/many responses right away, it will get picked up by google and maybe useful to someone in the future. I'd like to try to keep discussion in this thread technical with the goal being to figure out how to successfully modify the software runs the iMid.

Alright with all that out of the way, here is what I've discovered so far:

Hardware/software:

• The iMid unit was made by a company called Johnson Controls Inc., a large supplier of car infotainment systems.
• The non-navi units are running a Renesas SH7761 400mhz SH-4 cpu (SH7761).
• The OS is custom version of QNX built for the sh7761. I'm not sure which version yet, but I think it's reasonable to assume something based on the QNX Car Platform (as opposed to Neutrino or any one of their other embedded packages).
• The file system used for the OS is something called ETFS. This is a transactional file system for flash based storage exclusive to QNX. Note that when mounting ETFS files, /dev/etfs1 is the default for the raw boot image.

Software discoveries so far:

• Based on the instructions in this thread (iOS in the Car/Siri Update) I paid the $10 to grab a copy of the official HFL updater software to install the latest software update to the iMid
• The software seems to download every firmware update release so far for the iMid. It's located in C:\JohnsonControlsIncBRT\UpdatePackages.
• Upon closer inspection each firmware package is simply an archive using gzip compression (7zip will be your best friend here). Each file contains a root ini manifest which instructs the iMid itself to check for compatibility before installing. Then you have 18 more gziped packages called "up.0, up.1, up.2 ..." It seems that the HFL updater sends each of these "up" packages individually to the iMid during update.
• up.0 contains a manifest called 'main_instructions.ini'. This file is useful because it shows the offsets used of each nand files in up.2 - up.17 which is a raw ETFS image.
• up.2-up.17 contain folders called 'whole_nand' which contain a gziped chunk of the userland ETFS filesystem that the iMid software runs off of. These end up all getting mounted to /dev/etfs2 on the iMid.
• I haven't been able to mount the individual raw filesystem chunks yet but I have browsed through them with a hex editor. Some pretty interesting stuff. Seems like a lot of configuration is done by XML which gives me hope. I think the iMid's GUI is driven by adobe flash.

Helpful tools:

• VMware Player - free VM software for running qnx.
• QNX vmware image (30-day evaluation) - useful for mounting, creating, modifying ETFS filesystems. The 2 magic terminal commands you are looking for are 'fs-etfs-ram' and 'etfsctl'. Note: The source code to these supposedly is out there where you can compile and run inside of your favorite *nix. I wasn't able to track it down though.

What I need:

• Shot in the dark but if anyone ends up with a busted iMid system (any model for the 9th gen) that they would like to part with for cheap or free in the name of science.
• I've been working with *nix for nearly 20 years now and dabbled with QNX about 10 years ago (I don't believe ETFS was around back then). I need someone who has *nix or embedded experience and who knows how to mount file systems. Specifically I'm having a problem trying to mount the individual raw chunks of the ETFS. I'm not clear how you go about mounting them all of them as one. When I run

  fs-etfs-ram img.etfs.1

  it gets mounted properly to /dev/etfs2. However when I try to mount so that I can read it using

  mount -t etfs /dev/etfs2 /tmp

  I get the following
  
  
  
  
  I've searched high and low and so far can't figure out why this error occurs. I'm sure I can figure it out eventually, but figured I ask in case anyone has any experience with this.

-------------------------------------------------------------------------
Well, thats all I have so far. If you have any ideas, discoveries, questions... feel free to post. I'll update my thread as I discover new things.

 

[Yukfoo2]

Outstanding post. What capabilities/features are you hoping to discover with a hack?

 

[13BLACK]

Outstanding post. What capabilities/features are you hoping to discover with a hack?

x2
what are you looking to achieve with this hack?

 

[oOKhanhOo]

x2
what are you looking to achieve with this hack?

These are my guesses:

Permanently remove restrictions while vehicle is in motion.

Cheaper way to mirror phone to the imid

Add/Remove features

I am really looking forward to what OP can find and do. Glad you're here. Thanks OP! :thmsup:

 

[CobraPA]

Neat stuff, did you run across any info on the Navi units?

Just a quick thought on your mount command, and maybe you checked this already…

On a lot of Unix systems /tmp is a special file, or already used by the system. Most versions of 'mount' I've used need a directory which exists, but is not otherwise used by the system. Does QNX have /tmp in use already? (Although I'd expect a little different error in that case.)

 

[timeshifter]

This is pretty exciting! A few thoughts...

First, wouldn't it be more accurate to call this hacking the head unit or radio? The way I understand things the iMid is just the display. For a desktop computer system that would be akin to saying "hacking the monitor". Right? Wrong?

There's three head units for the 9th generation Accords: Nav systems, EX-L systems and LX / Sport / EX systems. Nav has one knob next to the screen and a control knob below the climate controls. EX-L systems have two knobs - one on each side of the screen. LX / Sport / EX systems have no center touchscreen. Just a large knob in the center with buttons surrounding it.

I would hope that the first hacks aren't for bypassing safety features like preventing actions while the vehicle is in motion. If that's so then I'd expect Honda not to look the other way. Kind of like the early days of TiVo hacking. TiVo didn't seem to mind as long as most of the hacks were about expanding storage space rather than copying content.

 

[jwhazel]

What are you trying to accomplish

I've had my car for 2 weeks and I hate the imid with a passion. I feel that its a black eye on an otherwise wonderful car. If I had a wish list I'd like to redo the interface, get rid of the animations to speed things up, and change a lot of the behavior. My initial thought was to go the video route and just replace the brain with a cheap android box but then I'd loose a lot of features that go along with the sensors and diag info for maintenance. If I could go out to the stereo store and plunk down the cash for a new aftermarket unit, I would. But clearly thats not an option for us.

I've been hacking on stuff for a long time. Occasionally it results in something tangible, sometimes it doesn't but knowledge documented helps someone else, and other times it results in nothing but keeps my mind sharp and I have fun doing it.

Neat stuff, did you run across any info on the Navi units?

If you're asking about software: I've definitely run across things related to navigation like how to handle intersection data and phonetic pronunciations of nav stuff as well as gps info but at this point I can't tell if its related to the actual nav that H is using or if its just generic frameworks that ship with the OS. I probably won't know a whole lot about nav since I don't have one/don't have the software for it. If you were asking about hardware: theres a good chance it could be the same system/cpu. But I didn't want to make that assumption yet till I had some more solid info. If anyone who has the nav and manages to get a dump of the hard drive that would be great.

On a lot of Unix systems /tmp is a special file, or already used by the system. Most versions of 'mount' I've used need a directory which exists, but is not otherwise used by the system. Does QNX have /tmp in use already? (Although I'd expect a little different error in that case.)

Very good catch. I was just using /tmp as an (very poor) example. I did try other folders that I know I could mount things too and same error. Do you have any experience with mounting raw multipart filesystems? Can't remember if I've ever come across this before. I'm starting to think that each of these chunks is just a an actual piece and that they all have to be loaded into /dev/etfs2 before you can actually mount it. Attempting to re-run fs-etfs-ram on another chunk just increments it to /dev/etfs3 and 4 as you can see in that picture, even if you try to force it into /dev/etfs2

First, wouldn't it be more accurate to call this hacking the head unit or radio? The way I understand things the iMid is just the display. For a desktop computer system that would be akin to saying "hacking the monitor". Right? Wrong?

Good catch. I'm interested in others opinions on this. I called it iMid because it's more specific to Honda and 'radio' just makes me think of am/fm. But I'm willing to change title if someone thinks it will help be more specific.

I would hope that the first hacks aren't for bypassing safety features like preventing actions while the vehicle is in motion. If that's so then I'd expect Honda not to look the other way.

I wouldn't say its the main reason or the first priority but it is definitely a goal. I totally understand what you are trying to say but since you mentioned 'safety features' I'd like to take this opportunity to point out one of my many annoyances with this system.

----------------------------------------

So... I'm driving down the road and I get a text. This window pops up every single time after a restart and new message comes in.

So I'm driving and I've got this alert AND a choice I need to make. But I can't do it with the steering wheel controls... gotta take my eyes of the road and hunt for the knob on the stereo to provide the input. Even though I've told you this umpteen times, Yes I want to receive my text.

What tha... Alright, big 'ole wall of text I need to read and clear in order to proceed, while I'm still driving. Thanks for letting me know how to undo what I just did. Seems the instructions haven't changed in past umpteen times you've told me. So I clear you off.

Alrighty, so now I'm on my 3rd screen, and yet another choice I have to make while I'm driving. Why bother asking me in the first prompt if I want to read text's if you're going to bother prompting to read them every single time? In what situation would I click 'Ignore'? Of course you have a message. Of course I want to know what it is. Thats why I turned the feature on. My phone doesn't prompt me yes/no to read every text I get. It alerts me, but it doesn't prompt me for interaction. I either read it or I don't.

YOU'RE... F#&^ING ... KIDDING ME. I just sat through 3 prompts, 2 choices I had to think about and provide input for, none of which could be controlled from the steering wheel but instead with my hand on the center console ALL WHILE I'M DRIVING. And now you've decided to preach to me some safety bullshit about how I need to be parked in order to read my text message which in all probability was shorter than any one of those 3 prior messages? I would like to round up each of the lawyers and developers who had a hand in that chain of ridiculousness and beat them with a sack of oranges.

I could have taken my phone out of my pocket (which I'm not supposed to do while driving) and been able to read the text and tell who it was from (something the iMid doesn't do) with one button click. I'd also like to point out that these pictures where taken sitting and stopped in my driveway with the car in neutral. Apparently H's definition of 'safe' is when you are stopped AND have the e-brake on (at least as is the case for the 6MT). So this makes it literally impossible to read the message on a long road trip without pulling over. As much as I hated my previous Nissan, at least their definition of 'safe' to mess with stuff was a much more reasonable 'under 5mph'.

Congratulations Honda. You've successfully turned my distracted driving into road rage.​

-------------------------------------------------------------------

If that was the only complaint I had, then I wouldn't even bother with this but like I said, its one on a list of many. I don't think it's an exaggeration to say that Honda's implementation isn't just shitty, it's downright dangerous in some situations. I'd actually get a kick of seeing a cease and desist letter for removing their wonderfully bureaucratic and clearly unobtrusive safety features.

 

[timeshifter]

Wow, that's bullshit! I've never seen those screens. I've had my car for about a month and I have an iPhone. I thought I heard that iPhone's texts don't show up on screen so I've never bothered. That would annoy the shit out of me too.

Otherwise, I think what's displayed on the iMid is pretty useless. I've got four choices - music, MPG1 and MPG2, and a clock. The last three are pretty useless. The MPG displays have info you can get from the center of the speedometer.

The music display is a joke. There's a ton of wasted space there. I know that white space is a design element and you need to balance it. But come on, does the text have to be that small? And can't you arrange things so you can read the full song or artist name instead of truncating it? How about making the album art a little bigger.

Yes, there's a ton of room for improvement. I've always thought Honda did a good job of clearly presenting information and arranging controls on my two previous vehicles. This one is pretty good too, except for the goofy touchscreen radio and iMid display.

 

[Nossan]

lol, that's so freaking annoying to me as well. If I ever get in an accident with one of those prompts up I'm going to try to sue the shit out of Honda for continuously distracting me while I'm trying to drive! Thanks for documenting this, mine does the exact same thing. You left out the fact that if you hit "back" after the "check message when parked" screen it will display the text message in it's entirety WHILE YOU'RE DRIVING!...or didn't you figure that one out yet?

 

[oOKhanhOo]

Ah yes, I said that a while back... The imid is pretty much useless but very useful for the reverse cam only. I've always though the imid has more potential.... As long as the tech spec are "good".

 

[timeshifter]

I've always though the imid has more potential.... As long as the tech spec are "good".

Haha... maybe we can overclock the CPU!

 

[404]

I browsed through the QNX documentation. It seems that fs-etfs-ram creates an empty blank filesystem in ram that is mounted at /dev/etfs2. I don't think it actually loads the contents of that zip file.

Take a look at the documentation for etfsctl http://www.qnx.com/developers/docs/...ilities/e/etfsctl.html&resultof="etfs" "etf"

This seems to control the file system and allows you to read and write data from the filesystem to a file. The key here is that it allows you to read/write to/from a file and a ETFS file system at offsets which sounds exactly like the up.1, up.2 files that you are describing. So you could try using etfsctl to write the contents of each zip file at the nand offsets mentioned in that ini file.

x2
what are you looking to achieve with this hack?

Ideally we can fiddle around with the UI that the iMid shows us and maybe change some of the configuration settings of the audio system or other parts. That would be the basic first step I think. From there we could try more complicated things such as adding completely new features.

 

[LAF]

I've had my car for 2 weeks and I hate the imid with a passion. I feel that its a black eye on an otherwise wonderful car. If I had a wish list I'd like to redo the interface, get rid of the animations to speed things up, and change a lot of the behavior. My initial thought was to go the video route and just replace the brain with a cheap android box but then I'd loose a lot of features that go along with the sensors and diag info for maintenance. If I could go out to the stereo store and plunk down the cash for a new aftermarket unit, I would. But clearly thats not an option for us.

+1 on this it is very annoying to say the least. I hope you get it figured out.
I worked with QNX 30 years ago but remember little. All I know is maybe a KORN or Bourne script may have something you can use.

I would love just to upload the latest software version on mine and I think it would be easy with a script on reboot from the usb port.

 

[Accord2014LX]

Nice posting. It'd be awesome if you can crack the programming and find a way to have the software boost the amplified sound permanently.

 

[dtube]

@jwhazel,
Interesting ... I was looking up ETFS here: http://www.qnx.com/developers/docs/6.3.2/neutrino/utilities/f/fs-etfs-ram.html

It says: When started, ETFS creates two devices as follows:

/dev/etfs1
Raw partition for boot image
/dev/etfs2
Filesystem partition for etfs files.

The raw partition is used for boot images and is always at the start of the device. It may be zero bytes long if no boot image is needed. The filesystem partition is mounted in the pathname space as specified by the -m option. If the -m option is absent, the default mountpoint is /fs/etfs.

Did you see anything in /fs/etfs ?

 

[ShaggySS]

A thread to follow. I am very interested in this one. I agree those text prompts are annoying. Just an annoying is not knowing who the message is from when it is read or the fact that its not reading the message loud enough.

I think just arranging the radio icons around would be awesome. I don't listen to AM so move that to page two and move the items from page two that I use to page one.

 

[oOKhanhOo]

I think just arranging the radio icons around would be awesome. I don't listen to AM so move that to page two and move the items from page two that I use to page one.

This. And to fix this, if possible, when I play music via USB. BT connects with the car and the music pause. Not sure if this is the phones fault, doubt it, or imid fault.

 

[djkev21]

i was disappointed to know that CDN accords didnt get the Siri eyes update...after reading this, i am kinda glad. my imid would have a punch hole thru it!

 

[nayr14]

It looks like Mitsubishi uses a similar setup:

http://mitsubishiforum.com/forum/mitsubishi-outlander-10/fuse-firmware-update-ios-4-a-40411/

 

[jwhazel]

You left out the fact that if you hit "back" after the "check message when parked" screen it will display the text message in it's entirety WHILE YOU'RE DRIVING!...or didn't you figure that one out yet?

Interesting. I tried that this morning and mine does not operate in that manner. Pressing 'back' gets me to a MAP account selection screen. Pressing 'select' to choose my phone then takes me to a screen that has a blank line for what I assume is the sender and a subject line that just says "no subject" (because it's a text) and then a timestamp. Pressing select will take me back to the "check message when parked" screen.

Now with the "parked" screen, I can hit 'select' and it will display the message but the whole right side is obscured by a dialog box asking me to "read" it so unless the text is ~3 words long I still can't make it out. And because I'm really curious what the text is, my eyes will dart back and forth between the road and my brain is now working overtime trying to "fill in" whats underneath the dialog box.

At that point I realized that this was likely not going to get any less stupid or dangerous and disabled text messaging all together. I'll just ask siri.

I browsed through the QNX documentation. It seems that fs-etfs-ram creates an empty blank filesystem in ram that is mounted at /dev/etfs2. I don't think it actually loads the contents of that zip file.

Well, thats an interesting notion. I originally thought that it was copying because /dev/etfs2 and img.etfs.X had the exact same file sizes. Now you have me thinking that maybe fs-etfs-ram defaults to size that coincidentally happened to be the same size as the image (which is reasonable given its a flash based filesystem with fixed 4M multiples). I probably made a flawed assumption.

I tried doing etfsctl -r img.etfs.X which says it should "read" the file, but IIRC it just made a bit copy of the image to another file. I'll experiment with this more over the weekend. Right now I would settle for just a raw file list so I could see what I'm working with.

Did you see anything in /fs/etfs ?

Good catch. I remember checking this and /fs didn't even exist. I'm not sure why unless 404 was correct in the fact that it wasn't actually ever copying anything to /dev/etfs2 in the first place.

It looks like Mitsubishi uses a similar setup

Nice catch! I checked around and it doesn't seem like anyone bothered to poke around inside of their firmware which is a shame. Was nice to see confirmation of a similar INI file setup for bootstrapping though.