Location
Kaunas, Lithuania
Nissan Leaf SD Cards used in Clarion navigation units are protected with password and it has been reviewed earlier in this post NISSAN LEAF SD card protection. How to obtain SD card password?
Here we will share the SD Toolbox upgrade details for password reading from Clarion navigation unit using debug interface. After some simple modifications in hardware, any SD Toolbox with the latest firmware can be used for this task.
Add missing components on PCB
Just a few components must be added on both sides of the PCB:
-
- PCB bottom side
- R18 – 1 kOhm
- PCB top side
- R20 – 270R
- R21 – 0R
- R13, R15, R19 – 47R
- Q1-Q4 – BSS123
- PCB bottom side
Add connector on PCB
Build cable
If this interface will be used more frequently, it’s recommended to use the connector on the SD toolbox and build the cable with a navigation connector. Otherwise, some single test wires can be used to connect the navigation unit.
If a detailed connector pinout is required, it can be found in this post: NISSAN CAN filter installation
Reading SD card password from the navigation unit
There is one condition for successful reading of the password: the navigation unit must be at room temperature (it will not work on a cold unit due to some nuances in schematics)
The video on how to read out the SD card password is below.
Hi,
On the build cable schematic, Test Mode 1 (purple) is below the RX line (yellow) and the TX line (green) is adjacent to the TM1 line? I want to make sure I’m reading it correctly.
Yes, its correct. For reference you can take a look to the full pinout here
hi sir i want to change cid number of my sd card is there any solution please tell me thanks
Hi, I will have a SD toolbox with CID changing option soon. Please check back on my webshop from time to time. It will be released soon.
Hey,
This is cool – the debug interface (physically) is the same as the older 06IT and 08IT product ranges from Clarion/Xanavi.
Different combinations of test bits equal different modes (although these modes also differ from old versions):
DIPSW=0 = PROD(Aging Mode)
DIPSW=1 = NORM(EVA)
DIPSW=2 = NORM(TV)
DIPSW=3 = MONI
DIPSW=4 = PROD
DIPSW=5 = NORMAL(RES)
DIPSW=6 = FACT
DIPSW=7 = Default
However that’s where the similarities stop. Not one single command I’ve tried from the old units is valid.
Would you be willing to share any commands (and which mode you were in) ?
Many thanks,
Hi,
Yes, you are right, there are 8 different modes available. The one most useful i found is a DSW=0006 – MONI>> (Firmware Monitor).
You can observe internal registers values as well to read and write memory locations and arbitrary code execution. You can get help on commands from console with ? or h.
FW>? will print out all available commands:
? [command]
h [command]
r [[register] [[=] [hex_value]]]
g StartAddr
mb [StartAddr [Count [Filler]]]
mh [StartAddr [Count [Filler]]]
mw [StartAddr [Count [Filler]]]
e StartAddr
s StartAddr Count Pattern…
w
wr
m1 [StartAddr] [Length] [StopOnError]
m2 [StartAddr] [Length] [StopOnError]
cb
ch
cw
mv
There is another mode with console, but unfortunately no help on command available, and i never figured out what command available there.
Thanks for the reply! ))
Ah, I found this – but they all appeared (to me) to be for writing, erasing or tests – I couldn’t see a way to read.
I’ve been doing some analysis with a SST38VF6401 dump I found online from a QY5017HC – Can’t believe they are WinCE; I spent a long time reverse engineering CE/WM ~16 years ago, slowly coming back to me, XIP and all!
But the unit currently on my bench is a QY8602 (with an eventual goal to try on QY8350). There is no 2nd SD card anymore with these, it’s all on a 512mbit 64pin “easy bga” (MICRON PC28F512) – beyond my skill to safely remove.
Re console:
FACT and NORM(EVA) give:
>>
MONI gives:
FW>
PROD: (and aging mode)
clarion>
This is a whole world away from the 08IT units (VXworks based) – even terminology, it is like it’s from a completely different company ((
Ah ignore me, mb/mh/mw work perfectly!
Dumped the bootloader now and having more investigations ) Thank you!
Can you provide a part # for the connectors used? Thanks.
The navigation unit connector is from TE Connectivity, Mfr. No: 1674312-1
Please answer how to unlock clarion NXR10 sd card lock?
Password for it can be read in similar ways as for Leaf navigation. I don’t know about debug interface on the NXR10 unit, as I never had it myself.
The fastest and cheapest way to read password is to use logic analyzer and sniff it on the SD card interface.
Sir,
Do you have information on the subsystems that can be accessed via the Debug Interface?
Regards,
Gilz
Hi,
There are several test modes, software start from reserve copy, internal memory access and other. Write me what you are trying to find out or what are your goals and i will help on it if i can.
Sir,
Do have any more information on the Clarion Navigation Unit Debug Interface?
Regards.
Gilz
Hi,
Yes, i have some more information. What exactly you are interested in?.