Very often problem for the Nissan Leaf owners is a stolen or lost SD card. Usually, cars bought from auctions, arrives without SD card. Just a “blue screen” is displayed with a message “NO SD CARD”. SD card contains not only the maps, but also part of navigation unit software. Without it navigation unit cannot be used and some vehicle features will not work ( AC, navigation, bluetooth, radio, …)
Second-hand SD cards bought from Ebay or borrowed from another vehicle will not work, because each SD card is locked with unique password calculated from navigation unit serial number. SD card works only on the unit assigned to and cannot be used on another unit. If wrong SD card is inserted, navigation unit can’t unlock it and message “SD UNLOCK NG” is displayed.
NISSAN Leaf navigation systems made by Clarion, for SD card contents protection use SD card locking with password. Password locking is used in 1st generation units until 2016. Distinctive feature of these units are 2 SD card slots marked Slot A and Slot B. Navigation units from 2016 have a 1 SD card slot and doesn’t use SD card locking anymore.
Spare SD card can be ordered from Nissan dealer, but it’s pretty complicated and sometimes cannot be accomplished at all. Another way is to order a Update SD card from Nissan Navigation Store and use it as main SD card (Confirmation number is need to order it).
And the last but not least way is to unlock SD card and make a copy. To unlock SD card, we need a password for it.
SD Card password calculation algorithm is not known by me, so the only way is to extract it from navigation unit itself. There are several different methods to accomplish that:
I have tested all 3 methods to obtain password and all are valid and can be used in a real life.
SD Card password is 16 bytes in length . First 4 bytes are unique for each unit and other 12 bytes are common for all units (ASCII string: Clarion95321).
Password sniffing on SD card interface data lines can be done using a logic analyzer and is not very convenient for everyday use. SD card sniffing interface must be build and/or some wires attached to SD slot for physical access. Also, it’s necessary to have knowledge in SD protocol to analyze captured data. I have accomplished this attack successfully, but will not go deeper in details unless there would be interest in it.
Navigation unit main MCU is build on a separate PCB as a microcomputer with all main components: MCU, RAM, FLASH, Display interface, SD Slots and I/O interface.
CPU: Renesas SuperH Family (SH-4A)
FLASH: SST 38VF6401
Flash Chips are BGA type and it is probably most complicated method for password reading, because BGA Flash chip rework is needed, as well as chip programmer with appropriate BGA adapter for programming. Using this method the whole flash memory dump is read and SD password, identification numbers and all other data can be read and/or modified easily. There is a special region at address 0x0000 A000h used as EEPROM area where identification numbers, configuration data, SD card password and some other info stored.
As most of navigation units, this one is not exception and it have a debug interface. Its easy accessible without disassembling navigation unit and should be the fastest method to access internal memory contents if we will gain access to it.
Debug interface has a Rx, Tx and Mode select lines. In order to communicate with it, interface circuit must be built to match voltage levels between navigation unit and PC. I have built this interface in the SD Toolbox hardware and implemented SD card password reading from navigation unit. Debug interface can be used not only for the password reading, but the whole internal memory can be accessed.
Description how to build interface for password reading with SD toolbox described in this post: SD Card Toolbox -Nissan Leaf navigation interface