Location
Kaunas, Lithuania
SD card problem
Very often problem for the Nissan Leaf owners is a stolen or lost SD card. Usually, cars bought from auctions, arrives without SD card. Just a “blue screen” is displayed with a message “NO SD CARD”. SD card contains not only the maps, but also part of navigation unit software. Without it navigation unit cannot be used and some vehicle features will not work ( AC, navigation, bluetooth, radio, …)
Second-hand SD cards bought from Ebay or borrowed from another vehicle will not work, because each SD card is locked with unique password calculated from navigation unit serial number. SD card works only on the unit assigned to and cannot be used on another unit. If wrong SD card is inserted, navigation unit can’t unlock it and message “SD UNLOCK NG” is displayed.
NISSAN Leaf navigation systems made by Clarion, for SD card contents protection use SD card locking with password. Password locking is used in 1st generation units until 2016. Distinctive feature of these units are 2 SD card slots marked Slot A and Slot B. Navigation units from 2016 have a 1 SD card slot and doesn’t use SD card locking anymore.
So, where to get SD card if its lost or how to make a copy in case your SD will get lost or damaged?
Spare SD card can be ordered from Nissan dealer, but it’s pretty complicated and sometimes cannot be accomplished at all. Another way is to order a Update SD card from Nissan Navigation Store and use it as main SD card (Confirmation number is need to order it).
And the last but not least way is to unlock SD card and make a copy. To unlock SD card, we need a password for it.
Where to get password?
SD Card password calculation algorithm is not known by me, so the only way is to extract it from navigation unit itself. There are several different methods to accomplish that:
- read internal Flash and find it there
- sniff it on SD card interface
- read it via debug interface
I have tested all 3 methods to obtain password and all are valid and can be used in a real life.
SD Card password is 16 bytes in length . First 4 bytes are unique for each unit and other 12 bytes are common for all units (ASCII string: Clarion95321).
Password sniffing
Password sniffing on SD card interface data lines can be done using a logic analyzer and is not very convenient for everyday use. SD card sniffing interface must be build and/or some wires attached to SD slot for physical access. Also, it’s necessary to have knowledge in SD protocol to analyze captured data. I have accomplished this attack successfully, but will not go deeper in details unless there would be interest in it.
Flash chip reading
Navigation unit main MCU is build on a separate PCB as a microcomputer with all main components: MCU, RAM, FLASH, Display interface, SD Slots and I/O interface.
CPU: Renesas SuperH Family (SH-4A)
FLASH: SST 38VF6401
Flash Chips are BGA type and it is probably most complicated method for password reading, because BGA Flash chip rework is needed, as well as chip programmer with appropriate BGA adapter for programming. Using this method the whole flash memory dump is read and SD password, identification numbers and all other data can be read and/or modified easily. There is a special region at address 0x0000 A000h used as EEPROM area where identification numbers, configuration data, SD card password and some other info stored.
Debug interface
As most of navigation units, this one is not exception and it have a debug interface. Its easy accessible without disassembling navigation unit and should be the fastest method to access internal memory contents if we will gain access to it.
Debug interface has a Rx, Tx and Mode select lines. In order to communicate with it, interface circuit must be built to match voltage levels between navigation unit and PC. I have built this interface in the SD Toolbox hardware and implemented SD card password reading from navigation unit. Debug interface can be used not only for the password reading, but the whole internal memory can be accessed.
Description how to build interface for password reading with SD toolbox described in this post: SD Card Toolbox -Nissan Leaf navigation interface
Dear author I quote You…..
((Another way is to order a Update SD card from Nissan Navigation Store and use it as main SD card (Confirmation number is need to order it).))
My question is can I use an update instead of a missing card in my car.
And if so what is the confirmation number needed to order it as you mentioned above Where can I get it. And how do I know the right card.
My car is a 2018 nissan leaf manufactured the UK.
Thank u.
Please advise
In earlier models(up to 2016) it was possible to order update SD card and use it instead of a missing card. Newer models don’t need a confirmation number to order SD card and it can be ordered online without it, but the original update SD card will not work on models from 2016 without original SD.
The only solution is to order a “hacked” SD card with new maps.
I have a 2015 Leaf without an SD card. Can I order from the Nissan Navigation store? If so, what do I use as the confirmation number?
My head unit shows
SET: QY7223NN
SNO: 00000796
I assume these are model and serial numbers, respectively.
SET and SNO are model and serial numbers. Confirmation number is calculated from these 2 numbers.
Confirmation number for your unit is 5D99
Earlier it was possible to order update SD card from Nissan Navigation Store using these 3 numbers and use it as the main SD with latest maps.
But, I didn’t tested it with the latest versions, so not sure 100% will it work. Because newer models from 2016 asks to insert original SD card when installing new maps from update SD.
Thanks so much for your work and the info you have documented here! With the cost of a map card from the Nissan Navigation Store running $208.95 USD for a “maybe” solution, I think I’d rather go the route of the Debug interface with your modified SD tool and have a sure thing. A friend of mine has a 2017 with a card that I can copy.
Would you sell an SD tool that is modified for the debug interface? I’m not proficient with SMD soldering.
Andrew
SD card from the 2017 leaf will not work on your unit. From 2016 it’s a different navigation model and SD cards are not locked anymore. Only the units up to 2016 with 2 SD slots using SD locking with the password.
If you have an SD toolbox, you can do modifications by yourself. If not, then I can sell it modified with cable for leaf. But getting the password from your unit is just the first step. So if it’s just for one unit, this approach is to expensive.
What would you suggest I do?
Andrew
Hi, could you please help me with the confirmation number as well?
SET: QY7214NK
SNO: 00015428
Hi,
Confirmation number for your unit is EC4B
Can you help me to discover my confirmation code please?
Set : QY7200NF
SNO: 00014295
Confirmation number for your unit is 1168
Thank you very much for this information. I also need help obtaining my confirmation code. It is a 2012 Leaf SL.
SET: QY7200NH
SNO: 00023320
Hi, confirmation number for your unit should be F010
Hi sir. My car is Nissan Leaf 2018. SD card password require, 16 digit number. Set: QY8600NB, SNO: 00006071. Can you help me about 16 digit sd card password?
Hi, I cant calculate SD card password from Set and SNO. You can obtain it using the methods described in the post.
Hello,
I have a 2015 Nissan Leaf Tekna, with the 2 slot head unit.
My codes are
SET QY7221NL and SNO 00013515. It does not show the code, but I have found it from another side and looks to be EFCE. With these codes the Here website allows me to purchase a card. My question has anyone got it to work? I think you said it was possible in the past?
Paul
Hi,
Yes, your confirmation number is correct. A few years ago SD cards ordered from Here website worked without any problems with the newest maps without an old SD card. Update SD card updates head unit and stays in the unit as the main SD instead of the old one. So if Here doesn’t change anything in the software, I hope it should work.
Some newer navigation models (QY82xx, QY86xx), require to insert an old SD card several times when installing new maps, and without old one isn’t possible to install new maps.
Hi Zelemar,
Thanks for replying to my question you’re a star:)
Paul