Location

Kaunas, Lithuania

 

NISSAN LEAF SD card protection. How to obtain SD card password?

SD card problem 

Very often problem for the Nissan Leaf owners is a stolen or lost SD card. Usually, cars bought from auctions, arrives without SD card. Just a “blue screen” is displayed with a message “NO SD CARD”. SD card contains not only the maps, but also part of navigation unit software. Without it navigation unit cannot be used and some vehicle features will not work ( AC, navigation, bluetooth, radio, …)

nissan leaf no sd card

 

Second-hand SD cards bought from Ebay or borrowed from another vehicle will not work, because each SD card is locked with unique password calculated from navigation unit serial number. SD card works only on the unit assigned to and cannot be used on another unit. If wrong SD card is inserted, navigation unit can’t unlock it and message “SD UNLOCK NG” is displayed.

nissan leaf sd unlock ng

 

NISSAN Leaf navigation systems made by Clarion, for SD card contents protection use SD card locking with password. Password locking is used in 1st generation units until 2016. Distinctive feature of these units are 2 SD card slots marked Slot A and Slot B. Navigation units from 2016 have a 1 SD card slot and doesn’t use SD card locking anymore.

So, where to get SD card if its lost or how to make a copy in case your SD will get lost or damaged?

nissan leaf sd cards

Spare SD card can be ordered from Nissan dealer, but it’s pretty complicated and sometimes cannot be accomplished at all. Another way is to order a Update SD card from Nissan Navigation Store and use it as main SD card (Confirmation number is need to order it).

And the last but not least way is to unlock SD card and make a copy. To unlock SD card, we need a password for it.

Where to get password?

SD Card password calculation algorithm is not known by me, so the only way is to extract it from navigation unit itself. There are several different methods to accomplish that:

  • read internal Flash and find it there
  • sniff it on SD card interface
  • read it via debug interface

I have tested all 3 methods to obtain password and all are valid and can be used in a real life.

SD Card password is 16 bytes in length . First 4 bytes are unique for each unit and other 12 bytes are common for all units (ASCII string: Clarion95321).

Password sniffing

 

Password sniffing on SD card interface data lines can be done using a logic analyzer and is not very convenient for everyday use. SD card sniffing interface must be build and/or some wires attached to SD slot for physical access. Also, it’s necessary to have knowledge in SD protocol to analyze captured data. I have accomplished this attack successfully, but will not go deeper in details unless there would be interest in it.

Flash chip reading

Navigation unit main MCU is build on a separate PCB as a microcomputer with all main components: MCU, RAM, FLASH, Display interface, SD Slots and I/O interface.

clarion main mcu

CPU: Renesas SuperH Family (SH-4A)
FLASH: SST 38VF6401

Flash Chips are BGA type and it is probably most complicated method for password reading, because BGA Flash chip rework is needed, as well as chip programmer with appropriate BGA adapter for programming. Using this method the whole flash memory dump is read and SD password, identification numbers and all other data can be read and/or modified easily. There is a special region at address 0x0000 A000h used as EEPROM area where identification numbers, configuration data, SD card password and some other info stored.

EEPROM area
Debug interface

As most of navigation units, this one is not exception and it have a debug interface. Its easy accessible without disassembling navigation unit and should be the fastest method to access internal memory contents if we will gain access to it.

Debug interface has a Rx, Tx and Mode select lines. In order to communicate with it, interface circuit must be built to match voltage levels between navigation unit and PC. I have built this interface in the  SD Toolbox hardware and implemented SD card password reading from navigation unit. Debug interface can be used not only for the password reading, but the whole internal memory can be accessed.

Description how to build interface for password reading with SD toolbox described in this post: SD Card Toolbox -Nissan Leaf navigation interface


40 Comments

  1. Dear author I quote You…..

    ((Another way is to order a Update SD card from Nissan Navigation Store and use it as main SD card (Confirmation number is need to order it).))
    My question is can I use an update instead of a missing card in my car.
    And if so what is the confirmation number needed to order it as you mentioned above Where can I get it. And how do I know the right card.
    My car is a 2018 nissan leaf manufactured the UK.
    Thank u.

    Please advise

    • In earlier models(up to 2016) it was possible to order update SD card and use it instead of a missing card. Newer models don’t need a confirmation number to order SD card and it can be ordered online without it, but the original update SD card will not work on models from 2016 without original SD.
      The only solution is to order a “hacked” SD card with new maps.

  2. I have a 2015 Leaf without an SD card. Can I order from the Nissan Navigation store? If so, what do I use as the confirmation number?

    My head unit shows
    SET: QY7223NN
    SNO: 00000796

    I assume these are model and serial numbers, respectively.

    • SET and SNO are model and serial numbers. Confirmation number is calculated from these 2 numbers.

      Confirmation number for your unit is 5D99

      Earlier it was possible to order update SD card from Nissan Navigation Store using these 3 numbers and use it as the main SD with latest maps.
      But, I didn’t tested it with the latest versions, so not sure 100% will it work. Because newer models from 2016 asks to insert original SD card when installing new maps from update SD.

      • Thanks so much for your work and the info you have documented here! With the cost of a map card from the Nissan Navigation Store running $208.95 USD for a “maybe” solution, I think I’d rather go the route of the Debug interface with your modified SD tool and have a sure thing. A friend of mine has a 2017 with a card that I can copy.

        Would you sell an SD tool that is modified for the debug interface? I’m not proficient with SMD soldering.

        Andrew

        • SD card from the 2017 leaf will not work on your unit. From 2016 it’s a different navigation model and SD cards are not locked anymore. Only the units up to 2016 with 2 SD slots using SD locking with the password.

          If you have an SD toolbox, you can do modifications by yourself. If not, then I can sell it modified with cable for leaf. But getting the password from your unit is just the first step. So if it’s just for one unit, this approach is to expensive.

      • Hi, could you please help me with the confirmation number as well?

        SET: QY7214NK
        SNO: 00015428

  3. Can you help me to discover my confirmation code please?
    Set : QY7200NF
    SNO: 00014295

  4. Thank you very much for this information. I also need help obtaining my confirmation code. It is a 2012 Leaf SL.

    SET: QY7200NH
    SNO: 00023320

  5. Hi sir. My car is Nissan Leaf 2018. SD card password require, 16 digit number. Set: QY8600NB, SNO: 00006071. Can you help me about 16 digit sd card password?

    • Hi, I cant calculate SD card password from Set and SNO. You can obtain it using the methods described in the post.

  6. Hello,

    I have a 2015 Nissan Leaf Tekna, with the 2 slot head unit.
    My codes are
    SET QY7221NL and SNO 00013515. It does not show the code, but I have found it from another side and looks to be EFCE. With these codes the Here website allows me to purchase a card. My question has anyone got it to work? I think you said it was possible in the past?

    Paul

    • Hi,
      Yes, your confirmation number is correct. A few years ago SD cards ordered from Here website worked without any problems with the newest maps without an old SD card. Update SD card updates head unit and stays in the unit as the main SD instead of the old one. So if Here doesn’t change anything in the software, I hope it should work.
      Some newer navigation models (QY82xx, QY86xx), require to insert an old SD card several times when installing new maps, and without old one isn’t possible to install new maps.

  7. Hi,
    I have nissan leaf 2018 with japan sd card and work well. But I need english and up to date maps. what you suggest me ?

  8. MY2018 Leaf with single card slot; I have a working original SD card with old maps, can I just get new maps SD and update with that without any card password or confirmation codes?
    thanks!

    • If you update your maps from update SD, it will ask for an activation code after the update. If update SD is obtained from Nissan, you will get an activation code together with SD card. I don’t know any other way to get the activation code, but you have to search the internet and maybe you will find another way to get it.

  9. Hi sir I’m from srilanka can I get my Confirmation code please sir
    SET:
    QY7201NG
    SNO:
    00008169

    • Hi, Confirmation code for your unit is CD4A. But I think nissan discontinued updates for these units and you will not be able to order SD anymore.

  10. Привет, Зелемар, помоги пожалуйста
    SET: QY7210NN
    SNO: 00011851

      • Большое спасибо. Но есть еще одна проблема. У меня Nissan 2014 года, дилер мне ответил, что поддержка моего авто только 5 лет. Где взять содержимое SD я не знаю. Можно еще раз попросить тебя о помощи?

  11. Hi, Zelemar !
    Please help me find the confirmation number.
    SET: QY6217NK
    SNO: 00014651

  12. Hi, just bought a 2018 LEAF (USA version sold in Chile).
    No SD card 🙁 but center console screen (radio, phone, clock, etc.) works fine, with MAPS option greyed out.
    In any case NAV useless in Chile, no local maps.
    But radio presets, phone pairing, time zone settings gets reset each time cars is switched off for a few seconds or more, rendering it useless. I assume these params stored on SD.
    No SET or SNO codes
    What are my options apart from ordering a new and very expensive SD from NISSAN
    Thanks!

    • SD cards on Leaf from 2016 not locked to the unit nor sd card CID. You can take SD from another unit and clone it (not copy). The only requirement – sw versions must match. If you will take SD with different sw versions, it will not work. Update card from nissan will not work, as it requires old card during installation.
      Also you can look for another solutions on internet.

      • Hello zelemar,

        What software can be used to clone the SD card? I have a 2018 leaf. I just tried copying it over, the navi doesn’t work with the copied sd card.

  13. I have a 2012 Nissan Leaf in the US that has lost the SD card.
    Can you please provide the confirmation number?

    SET: QY7200NE
    SNO: 00012885

Leave a Reply

Your email address will not be published. Required fields are marked *