Kaunas, Lithuania


SD Card Toolbox – Nissan Leaf navigation interface

Nissan Leaf SD Cards used in Clarion navigation units are protected with password and it has been reviewed earlier in this post NISSAN LEAF SD card protection. How to obtain SD card password?

Here we will share the SD Toolbox upgrade details for password reading from Clarion navigation unit using debug interface. After some simple modifications in hardware, any SD Toolbox with the latest firmware can be used for this task.

Add missing components on PCB

Just a few components must be added on both sides of the PCB:

    1. PCB bottom side
      • R18 – 1 kOhm
    2. PCB top side
      • R20 – 270R
      • R21 – 0R
      • R13, R15, R19 – 47R
      • Q1-Q4 – BSS123
Add connector on PCB

Build cable

If this interface will be used more frequently, it’s recommended to use the connector on the SD toolbox and build the cable with a navigation connector. Otherwise, some single test wires can be used to connect the navigation unit.

If a detailed connector pinout is required, it can be found in this post: NISSAN CAN filter installation

Reading SD card password from the navigation unit
There is one condition for successful reading of the password: the navigation unit must be at room temperature (it will not work on a cold unit due to some nuances in schematics)
The video on how to read out the SD card password is below.


  1. Hi,
    On the build cable schematic, Test Mode 1 (purple) is below the RX line (yellow) and the TX line (green) is adjacent to the TM1 line? I want to make sure I’m reading it correctly.

  2. hi sir i want to change cid number of my sd card is there any solution please tell me thanks

    • Hi, I will have a SD toolbox with CID changing option soon. Please check back on my webshop from time to time. It will be released soon.

  3. Hey,
    This is cool – the debug interface (physically) is the same as the older 06IT and 08IT product ranges from Clarion/Xanavi.
    Different combinations of test bits equal different modes (although these modes also differ from old versions):

    DIPSW=0 = PROD(Aging Mode)
    DIPSW=2 = NORM(TV)
    DIPSW=3 = MONI
    DIPSW=4 = PROD
    DIPSW=6 = FACT
    DIPSW=7 = Default

    However that’s where the similarities stop. Not one single command I’ve tried from the old units is valid.
    Would you be willing to share any commands (and which mode you were in) ?

    Many thanks,

    • Hi,
      Yes, you are right, there are 8 different modes available. The one most useful i found is a DSW=0006 – MONI>> (Firmware Monitor).
      You can observe internal registers values as well to read and write memory locations and arbitrary code execution. You can get help on commands from console with ? or h.

      FW>? will print out all available commands:
      ? [command]
      h [command]
      r [[register] [[=] [hex_value]]]
      g StartAddr
      mb [StartAddr [Count [Filler]]]
      mh [StartAddr [Count [Filler]]]
      mw [StartAddr [Count [Filler]]]
      e StartAddr
      s StartAddr Count Pattern…

      m1 [StartAddr] [Length] [StopOnError]
      m2 [StartAddr] [Length] [StopOnError]




      There is another mode with console, but unfortunately no help on command available, and i never figured out what command available there.

      • Thanks for the reply! ))

        Ah, I found this – but they all appeared (to me) to be for writing, erasing or tests – I couldn’t see a way to read.

        I’ve been doing some analysis with a SST38VF6401 dump I found online from a QY5017HC – Can’t believe they are WinCE; I spent a long time reverse engineering CE/WM ~16 years ago, slowly coming back to me, XIP and all!

        But the unit currently on my bench is a QY8602 (with an eventual goal to try on QY8350). There is no 2nd SD card anymore with these, it’s all on a 512mbit 64pin “easy bga” (MICRON PC28F512) – beyond my skill to safely remove.

        Re console:
        FACT and NORM(EVA) give:
        MONI gives:
        PROD: (and aging mode)

        This is a whole world away from the 08IT units (VXworks based) – even terminology, it is like it’s from a completely different company ((

        • Ah ignore me, mb/mh/mw work perfectly!
          Dumped the bootloader now and having more investigations ) Thank you!

    • Password for it can be read in similar ways as for Leaf navigation. I don’t know about debug interface on the NXR10 unit, as I never had it myself.
      The fastest and cheapest way to read password is to use logic analyzer and sniff it on the SD card interface.

  4. Sir,

    Do you have information on the subsystems that can be accessed via the Debug Interface?



    • Hi,

      There are several test modes, software start from reserve copy, internal memory access and other. Write me what you are trying to find out or what are your goals and i will help on it if i can.

  5. Sir,

    Do have any more information on the Clarion Navigation Unit Debug Interface?



Leave a Reply

Your email address will not be published. Required fields are marked *