NISSAN LEAF SD card protection. How to obtain SD card password?

SD card problem 

Very often problem for the Nissan Leaf owners is a stolen or lost SD card. Usually, cars bought from auctions, arrives without SD card. Just a “blue screen” is displayed with a message “NO SD CARD”. SD card contains not only the maps, but also part of navigation unit software. Without it navigation unit cannot be used and some vehicle features will not work ( AC, navigation, bluetooth, radio, …)

nissan leaf no sd card

 

Second-hand SD cards bought from Ebay or borrowed from another vehicle will not work, because each SD card is locked with unique password calculated from navigation unit serial number. SD card works only on the unit assigned to and cannot be used on another unit. If wrong SD card is inserted, navigation unit can’t unlock it and message “SD UNLOCK NG” is displayed.

nissan leaf sd unlock ng

 

NISSAN Leaf navigation systems made by Clarion, for SD card contents protection use SD card locking with password. Password locking is used in 1st generation units until 2016. Distinctive feature of these units are 2 SD card slots marked Slot A and Slot B. Navigation units from 2016 have a 1 SD card slot and doesn’t use SD card locking anymore.

So, where to get SD card if its lost or how to make a copy in case your SD will get lost or damaged?

nissan leaf sd cards

Spare SD card can be ordered from Nissan dealer, but it’s pretty complicated and sometimes cannot be accomplished at all. Another way is to order a Update SD card from Nissan Navigation Store and use it as main SD card (Confirmation number is need to order it).

And the last but not least way is to unlock SD card and make a copy. To unlock SD card, we need a password for it.

Where to get password?

SD Card password calculation algorithm is not known by me, so the only way is to extract it from navigation unit itself. There are several different methods to accomplish that:

  • read internal Flash and find it there
  • sniff it on SD card interface
  • read it via debug interface

I have tested all 3 methods to obtain password and all are valid and can be used in a real life.

SD Card password is 16 bytes in length . First 4 bytes are unique for each unit and other 12 bytes are common for all units (ASCII string: Clarion95321).

Password sniffing

 

Password sniffing on SD card interface data lines can be done using a logic analyzer and is not very convenient for everyday use. SD card sniffing interface must be build and/or some wires attached to SD slot for physical access. Also, it’s necessary to have knowledge in SD protocol to analyze captured data. I have accomplished this attack successfully, but will not go deeper in details unless there would be interest in it.

Flash chip reading

Navigation unit main MCU is build on a separate PCB as a microcomputer with all main components: MCU, RAM, FLASH, Display interface, SD Slots and I/O interface.

clarion main mcu

CPU: Renesas SuperH Family (SH-4A)
FLASH: SST 38VF6401

Flash Chips are BGA type and it is probably most complicated method for password reading, because BGA Flash chip rework is needed, as well as chip programmer with appropriate BGA adapter for programming. Using this method the whole flash memory dump is read and SD password, identification numbers and all other data can be read and/or modified easily. There is a special region at address 0x0000 A000h used as EEPROM area where identification numbers, configuration data, SD card password and some other info stored.

EEPROM area
Debug interface

As most of navigation units, this one is not exception and it have a debug interface. Its easy accessible without disassembling navigation unit and should be the fastest method to access internal memory contents if we will gain access to it.

Debug interface has a Rx, Tx and Mode select lines. In order to communicate with it, interface circuit must be built to match voltage levels between navigation unit and PC. I have built this interface in the  SD Toolbox hardware and implemented SD card password reading from navigation unit. Debug interface can be used not only for the password reading, but the whole internal memory can be accessed.

Description how to build interface for password reading with SD toolbox described in this post: SD Card Toolbox -Nissan Leaf navigation interface


2 Comments

  1. Dear author I quote You…..

    ((Another way is to order a Update SD card from Nissan Navigation Store and use it as main SD card (Confirmation number is need to order it).))
    My question is can I use an update instead of a missing card in my car.
    And if so what is the confirmation number needed to order it as you mentioned above Where can I get it. And how do I know the right card.
    My car is a 2018 nissan leaf manufactured the UK.
    Thank u.

    Please advise

    • In earlier models(up to 2016) it was possible to order update SD card and use it instead of a missing card. Newer models don’t need a confirmation number to order SD card and it can be ordered online without it, but the original update SD card will not work on models from 2016 without original SD.
      The only solution is to order a “hacked” SD card with new maps.

Leave a Reply

Your email address will not be published.