Notices

Engineers: Can this be hacked?

Thread Tools
 
Search this Thread
 
Rate Thread
 
Old 05-17-2004, 10:52 PM
  #101  
Registered User
Thread Starter
 
eXentric's Avatar
 
Join Date: Oct 2003
Location: Houston, TX
Posts: 298
Likes: 0
Received 2 Likes on 2 Posts
From the messages I've hacked already, I can force the HU to turn on tape mode.
Yes, of course, that makes perfect sense. How else would the CD player be able to switch to CD when you inserted one? The same holds true I'm sure for the cassette module. Don't know why that didn't hit me before. Currious, though, if the external CD changer would be able to initate the same system 'takeover' command. What event would trigger that? The insertion of the 6-disc cartridge?

Is there anything else that I or anyone can offer in relation to this port? What's the next step for you going this route (or is it tight-lipped time again? If it is, I understand.)
Old 05-18-2004, 06:22 AM
  #102  
Hyper Space RX-8 _,.-^'`
 
OverLOAD's Avatar
 
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes on 0 Posts
I obviously don't want to give everything away, since the potential success of the product i'm developing depends on it, but I am willing to share a lot more of the information I've found out than most (companies) would.

If it were a Mazda CD changer, with individually readable discs that were ejected seperately through the magazine, much like the internal CDC, then a single disk insertion should send the bus message to take over the HU output.

It would have to tell the HU that it was an external CDC connected to the rear port, if thats where it was connected, so just re-wiring a CDC to plug into the rear port probably wouldn't do it. There are several bits in the CD changer messages that represent various things such as mute vs play. Some of them appear to be unused from the settings I've seen. It's very possible that just toggling a different bit will enable the rear port audio input. really rather simple. The Upper module units (CD, mp3 CD & CDC) don't use any checksum value at the end of their messages, so it's very easy to 'forge' new ones. The Tape module however uses a special checksum that I can't figure out, so I have to use pre-defined messages to substitute that device.

The only problem with substituting devices in the upper slot, is that messages destined for the device of the same type in the upper slot would also respond if they were the same type as what I was emulating..

Hence my device emulates the tape module, and goes in the lower slot to not have any conflicts with other hardware configurations. There may yet be another way around it yet though..

Regards,

OverLOAD
Old 05-18-2004, 09:14 AM
  #103  
Registered User
Thread Starter
 
eXentric's Avatar
 
Join Date: Oct 2003
Location: Houston, TX
Posts: 298
Likes: 0
Received 2 Likes on 2 Posts
That's excellent information OverLOAD and thank you for sharing. When I asked if there was anything that I or anyone can offer in relation to this port, I was mainly asking if there's anything we could do to help. I know you're already working on this dilligently and it certainly sounds like you have all the tools you need, but I figured it couldn't hurt to ask.

Thanks again for that info. Don't know if you want to share any info on the protocol (and I wouldn't blame you if you didn't), but it does seem like there are some very knowledgable people on this forum and I thought that perhaps we could help you crack the checksum problem if you really wanted it solved. It sounds like that may not be a showstopper, however.

At any rate, I've got my hopes up again. Good work thus far. I know most people probably don't understand the full effort you have already made to get you to this point.

Regards,

eXe
Old 05-18-2004, 10:08 AM
  #104  
Registered User
 
Ped Xing's Avatar
 
Join Date: Dec 2003
Posts: 14
Likes: 0
Received 0 Likes on 0 Posts
Originally posted by jdaled
I found this yesterday while searching around again...

http://www.fosketts.net/miata/audiopins/index.html

I know this information is already out there in a couple places, but I thought this was a nicely organized collection of relevant information, all in one place.
Thanks, man! That would be me...

Let me contribute a little more. According to my '02 Miata workshop manual, the device codes for different devices are as follows:

00 - Cassette deck (lower module)
03 - CD player (upper module)
05 - CD changer (external type)
06 - CD changer (upper module)
07 - MD player (lower module)
09 - Base unit

Now, this is for external error reporting. But I have a suspicion that it might be the same on the system bus. Overload, does this help at all?

Also, I have it on good authority that the Sirius box attaches to the unused 16-pin port (J-02) on the back that we are discussing. It is triggered by the SAT button on the head unit, and probably has another device code. Maybe it's number 8?

So far, I know of the Japanese TV, the Sirius box, and the external CD changer that use this port. None of these necessarily triggers the switch by itself, but they might.

My concern is with pre-04 units since I have an '03 Miata and want an aux input! It doesn't have the SAT button, and the screen can't display complex text like the '04 units can. But it probably does work with the external CD changer. Hopefully whatever we get will work for the '01-'03 Miatas and other cars (like my '02 MPV which also has this head unit).

Cheers!
Stephen
Old 05-18-2004, 06:08 PM
  #105  
Hyper Space RX-8 _,.-^'`
 
OverLOAD's Avatar
 
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes on 0 Posts
Well, I can't confirm much,

My base unit messages are totally different. The base number that the unit uses is in the message, but it's not the same. In fact, none of the number you have match up.

In the numbers that you have, I also have these:

08 - base unit
18
28
38
58
68
78
88
e8


So put CDC, MP3 CD, SCD, Tape, MD, External CDC, TV tuner and Satalite and you have all eight used up. what is which is a good question though, I can only confirm about 4 of those codes for particular devices.

Who knows, they could still have generic uses too.

Regards,

OverLOAD
Old 05-20-2004, 10:21 PM
  #106  
Hyper Space RX-8 _,.-^'`
 
OverLOAD's Avatar
 
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes on 0 Posts
Well, www.pie.net seem to have found a connector for this slot. Someone said it's an AMP connector. Anyone care to dig?

I think there might be some merit in getting the PIE module, so I will. They have one that looks promising. a Pioneer CDC / Pioneer XM changer controller.

btw, all you people out there who really want XM input, this sounds like a nice easy way to do it.

I also took some snaps of the Mazda6 bose HU, it's very different from the RX-8 HU... I don't know if that pic above was a bose or non-bose radio, but there are many differences. The only thing that is glaringly the same, is the NEC 8-bit microcontroller. I've found similar data from nec's website on their 100-pin 8-bit 78K series 8-bit microcontrollers, and some look similar, but the part number on the M6 HU doesn't match up to anything on their site. I need to dig a little deeper. At least I know what the micro is capable of. It's got a lot of program memory, and it's not code-updatable (single write only).. so anyone who had hopes a while ago of getting their own text on the screen would only be able to do so by replacing the chip with a similar one, with the code altered.

I'll see what PIE can do, I can get my hands on a pioneer CDC pretty easily.

Regards,

OverLOAD

ps. by getting your own text on the screen, I mean that there is no way to push your own text to the display, and no way to change the default start up message.

Last edited by OverLOAD; 05-22-2004 at 09:50 AM.
Old 05-22-2004, 10:13 PM
  #107  
Hyper Space RX-8 _,.-^'`
 
OverLOAD's Avatar
 
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes on 0 Posts
p.s.

I did some diggin on tyco's page.

This looks very close to the external connector. I've confirmed that 0.090 pitch should be about right.

AMP part # 368184-1 It's kind of close, but still not quite a match.

I'm going to try using two blocks of 1/10th inch headers to get into the connector. I think it'll work ok.

O
Old 05-22-2004, 11:26 PM
  #108  
Registered User
 
bureau13's Avatar
 
Join Date: Feb 2003
Location: South Florida
Posts: 1,080
Likes: 0
Received 0 Likes on 0 Posts
OverLOAD,

I'm not sure I'm understanding this right...does this mean there isn't a way to put ID3 tag info on the screen from a future iPod connection using your aux module? I thought that had been discussed at one point as a possibility. And we know the stock MP3 player can put ID3 tag info up there...or is that different because its a pre-defined message type with some "user defined" data blocks (i.e. the text)?

jds


Originally posted by OverLOAD

ps. by getting your own text on the screen, I mean that there is no way to push your own text to the display, and no way to change the default start up message.
Old 05-23-2004, 09:12 AM
  #109  
Registered User
Thread Starter
 
eXentric's Avatar
 
Join Date: Oct 2003
Location: Houston, TX
Posts: 298
Likes: 0
Received 2 Likes on 2 Posts
a way to put ID3 tag info on the screen
OverLOAD correct me if I'm wrong, but if I've understood this all correctly, the text problem is a problem with the ports we're using.

There are essentially three ports in the system that are available for us to tinker with. The top port (which holds the CD / MP3 / 6DISC), the bottom port (Cassette or MiniDisc) and the port on the back side of the unit (TV Tuner, external changer, future XM radio, etc).

The problem is that only the top port (where the MP3 player goes) is able to display text. The other ports like the Cassette port (which is the port where OverLOAD was originally looking to connect) can only get pre-defined messages to pop up on the display. In other words, for your country there are some pre-defined messages for "PLAY" and "FAST FORWARD" etc.

Did I explain that right OverLOAD? If that is correct, does that mean that the top port has a separate data channel that the other ports do not possess? Or is it that the head unit ignores text requests when any port other then the top one is selected? Or does it the exact device ID of the MP3 player have to be the active device for text to be displayed?

Or do you not want to say for sure :P
Old 05-23-2004, 09:21 AM
  #110  
Hyper Space RX-8 _,.-^'`
 
OverLOAD's Avatar
 
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes on 0 Posts
Ok, to clarify,

Each of the ports has the capability to display text on the screen, if it's emulating a MP3 CD player.

You still have to push the display button the get it to come up the first time.

You can't force it to change display modes other than by pushing the display button.

It only will update the text, when you track-up/down to the next song.

The start-up message "mazda RX-8" is fixed in ROM, it can not be altered without replacing the micro. a 100 pin QFP is not up everyones alley, nor is re-flashing one and editing the values you specifically want.

If you are emulating tape mode, or CDC or SCD mode, you can't push text to the screen. Only when you are emulating a mp3 CD, can you put text on the display. This may be different for the sirius input that's coming, but I don't think that it's that easy to accomplish.

The text clock and data lines are much more complex than the bus line. It wil be quite an exercise to emulate that, and at this point, we've got enough to do without tackling that as well.. so we've put it off for a future project.

Regards,
OverLOAD

ps.

eXentric, the part about the pre-defined messages is indeed correct. as all the devices have their messages pre-defined in the micro.
Old 05-23-2004, 04:41 PM
  #111  
Hyper Space RX-8 _,.-^'`
 
OverLOAD's Avatar
 
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes on 0 Posts
Some of you may be interested in this... it's the HU from a bose M6 radio..

Regards,
OverLOAD
Old 05-23-2004, 10:20 PM
  #112  
Registered User
Thread Starter
 
eXentric's Avatar
 
Join Date: Oct 2003
Location: Houston, TX
Posts: 298
Likes: 0
Received 2 Likes on 2 Posts
Thanks for the pic OverLOAD. I will be currious to see what comes of the Sirrius radio. Part of the 'Big thing' about satellite radio is the ability to see what (and who) is playing. It would be interesting to see a factory-standard option without this feature, but it wouldn't be the first time. My father owns a Dodge truck with the factory Sirrius radio and it doesn't display any metadata. If he chose the next audio upgrade it would have though.

I for one would love that option, but it isn't as important as sound and steering wheel controls to me. I do plan to have a touch screen installed so the text display isn't as important. Others, I'm sure, would really like such a feature.

At any rate, thanks for sharing. Glad to keep getting some updates, even if the end still seems a ways away.
Old 05-24-2004, 08:11 AM
  #113  
Registered User
 
Ped Xing's Avatar
 
Join Date: Dec 2003
Posts: 14
Likes: 0
Received 0 Likes on 0 Posts
The Mazda Miata/M6/M3/RX8 Sirius does indeed display artist, track, and such on the screen. This was in the press release. Although it's only conjecture that the unit will use the rear port (which I've been calling J-02), it's pretty likely that it will. So we conclude that the rear port can display random text strings.

However, this does me no good since the '03 Miata head unit cannot display text at all.

Stephen
Old 05-24-2004, 12:29 PM
  #114  
RAM
Registered User
 
RAM's Avatar
 
Join Date: Dec 2003
Location: Orando, Florida
Posts: 92
Likes: 0
Received 0 Likes on 0 Posts
FYI


2005 Tribute Accessories

Satellite Radio Receiver Kit 2005 Tribute

Suggested Retail: 924.70
Our Price : 740.00
You Save : 184.70

SIRIUS, Mazda part # 0000-81-G01
Old 05-24-2004, 12:33 PM
  #115  
Registered User
Thread Starter
 
eXentric's Avatar
 
Join Date: Oct 2003
Location: Houston, TX
Posts: 298
Likes: 0
Received 2 Likes on 2 Posts
Do you have a URL?
Old 05-28-2004, 02:16 PM
  #116  
RAM
Registered User
 
RAM's Avatar
 
Join Date: Dec 2003
Location: Orando, Florida
Posts: 92
Likes: 0
Received 0 Likes on 0 Posts
FYI update: Price change in record time.
This is the price for the TRIBUTE version.

Suggested Retail: 399.00
Our Price : 320.00
You Save : 79.00
Quantity :

SIRIUS, Mazda part # 0000-81-G01
Old 07-28-2004, 08:09 PM
  #117  
vt_hokie2008
 
vt_hokie2008's Avatar
 
Join Date: Jul 2004
Location: Danville
Posts: 15
Likes: 0
Received 0 Likes on 0 Posts
I have a mp3 player that I want to hardwire in, so what would be the best way for me to do that? I have bose and 6 disc changer, but no cassette player. I would love to have the mp3 text on the HU, but is that possible right now?
Old 07-28-2004, 10:25 PM
  #118  
Registered User
 
bobclevenger's Avatar
 
Join Date: Oct 2003
Location: Ontario, Calif.
Posts: 493
Likes: 0
Received 1 Like on 1 Post
Check out this thread for an aux-in solution that works for most of us 8 owners. Then all you need are line-level output connectors (ar a line-level stereo output connector) on your player to connect to the PIE unit.
Sorry, but no present solution for the RX-8 shows tag info from an external source.
Old 07-29-2004, 03:07 PM
  #119  
vt_hokie2008
 
vt_hokie2008's Avatar
 
Join Date: Jul 2004
Location: Danville
Posts: 15
Likes: 0
Received 0 Likes on 0 Posts
I've seen that, but I'd rather just splice some wires and wire it in that way. I'd like to put $80 towards something else since money is kinda LOW. Any wire I can cut and solder to do this?
Old 07-29-2004, 03:35 PM
  #120  
Registered Lunatic
iTrader: (1)
 
Tamas's Avatar
 
Join Date: Aug 2003
Location: SF Bay Area, California
Posts: 3,575
Received 37 Likes on 32 Posts
Search for the stock CD player hack by ectomort on this forum - that might be what you're looking for.
Old 07-29-2004, 03:58 PM
  #121  
Registered User
 
bobclevenger's Avatar
 
Join Date: Oct 2003
Location: Ontario, Calif.
Posts: 493
Likes: 0
Received 1 Like on 1 Post
There is no place you can just tap into for an aux-in without buying something else -- either the tape unit to hack or the PIE unit or Overload's module which is still in development. You COULD tap into the amp inputs directly but then your mp3 player would be ON all the time and you'd have no volume control -- volume would be at max all the time. Yeah, I would have preferred not blowing the best part of a C-note on the PIE solution, but it was the cheapest option right now.
Old 08-06-2004, 01:12 PM
  #122  
Registered User
Thread Starter
 
eXentric's Avatar
 
Join Date: Oct 2003
Location: Houston, TX
Posts: 298
Likes: 0
Received 2 Likes on 2 Posts
Thanks to MazdaManiac for the pics and diagrams:




I just got my P.I.E. module. I haven't even had a chance to connect it yet (I'm at work), but I couldn't keep from opening it up. I found a few intersting things:

Only BUS+ [L] is connected. BUS- [K] is NOT.

Left Input+ [E] and Right Input+ [C] are connected, but Left Input- [F] and Right Input- [D] are NOT.

Signal Ground [G] IS connected, suggesting that the head unit can handle both differential AND non-differential input???

The unit draws its logic power from Power ACC [O] and / or Power B+ [P] (both of which are connected).

Power ground [A] is connected.

System Mute [B] is also connected! Could it be that people having trouble with their PIE modules cutting out could snip this wire (or pull the pin out)??? This is the white wire in the bundle of wires going to the head unit from the PIE module if someone wants to try.

Last edited by eXentric; 08-06-2004 at 01:16 PM.
Old 08-06-2004, 04:38 PM
  #123  
Registered Lunatic
iTrader: (1)
 
Tamas's Avatar
 
Join Date: Aug 2003
Location: SF Bay Area, California
Posts: 3,575
Received 37 Likes on 32 Posts
Originally Posted by eXentric
Only BUS+ [L] is connected. BUS- [K] is NOT.
It probably uses A (power ground) for -

Left Input+ [E] and Right Input+ [C] are connected, but Left Input- [F] and Right Input- [D] are NOT.
Can it be that this also uses A for - ?

System Mute [B] is also connected! Could it be that people having trouble with their PIE modules cutting out could snip this wire (or pull the pin out)??? This is the white wire in the bundle of wires going to the head unit from the PIE module if someone wants to try.
Not on mine.
B is NOT connected. The white wire goes to A which is Power Ground.
So people, don't disconnect/cut the white wire :p
Old 08-06-2004, 05:34 PM
  #124  
Registered User
 
bobclevenger's Avatar
 
Join Date: Oct 2003
Location: Ontario, Calif.
Posts: 493
Likes: 0
Received 1 Like on 1 Post
Originally Posted by eXentric
System Mute [B] is also connected! Could it be that people having trouble with their PIE modules cutting out could snip this wire (or pull the pin out)??? This is the white wire in the bundle of wires going to the head unit from the PIE module if someone wants to try.
Originally Posted by Tamas
Not on mine.
B is NOT connected. The white wire goes to A which is Power Ground.
So people, don't disconnect/cut the white wire :p
It seems that we have evidence that not all PIE units are the same. Curiouser and curiouser.
Tamas, does your PIE unit work?
Old 08-06-2004, 05:50 PM
  #125  
Registered Lunatic
iTrader: (1)
 
Tamas's Avatar
 
Join Date: Aug 2003
Location: SF Bay Area, California
Posts: 3,575
Received 37 Likes on 32 Posts
Don't know yet - I just received it today and I'm not sure if I'll have time to take the car apart to try it. This might have to wait until next weekend - I'll certainly post my result.

Bob, how many wires do you have connected in the PIE connector? I have seven... do you have eight? And then what color wire goes to A in your case?

Last edited by Tamas; 08-06-2004 at 05:52 PM.


You have already rated this thread Rating: Thread Rating: 0 votes,  average.

Quick Reply: Engineers: Can this be hacked?



All times are GMT -5. The time now is 07:04 PM.