Engineers: Can this be hacked?
#101
Registered User
Thread Starter
From the messages I've hacked already, I can force the HU to turn on tape mode.
Is there anything else that I or anyone can offer in relation to this port? What's the next step for you going this route (or is it tight-lipped time again? If it is, I understand.)
#102
Hyper Space RX-8 _,.-^'`
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes
on
0 Posts
I obviously don't want to give everything away, since the potential success of the product i'm developing depends on it, but I am willing to share a lot more of the information I've found out than most (companies) would.
If it were a Mazda CD changer, with individually readable discs that were ejected seperately through the magazine, much like the internal CDC, then a single disk insertion should send the bus message to take over the HU output.
It would have to tell the HU that it was an external CDC connected to the rear port, if thats where it was connected, so just re-wiring a CDC to plug into the rear port probably wouldn't do it. There are several bits in the CD changer messages that represent various things such as mute vs play. Some of them appear to be unused from the settings I've seen. It's very possible that just toggling a different bit will enable the rear port audio input. really rather simple. The Upper module units (CD, mp3 CD & CDC) don't use any checksum value at the end of their messages, so it's very easy to 'forge' new ones. The Tape module however uses a special checksum that I can't figure out, so I have to use pre-defined messages to substitute that device.
The only problem with substituting devices in the upper slot, is that messages destined for the device of the same type in the upper slot would also respond if they were the same type as what I was emulating..
Hence my device emulates the tape module, and goes in the lower slot to not have any conflicts with other hardware configurations. There may yet be another way around it yet though..
Regards,
OverLOAD
If it were a Mazda CD changer, with individually readable discs that were ejected seperately through the magazine, much like the internal CDC, then a single disk insertion should send the bus message to take over the HU output.
It would have to tell the HU that it was an external CDC connected to the rear port, if thats where it was connected, so just re-wiring a CDC to plug into the rear port probably wouldn't do it. There are several bits in the CD changer messages that represent various things such as mute vs play. Some of them appear to be unused from the settings I've seen. It's very possible that just toggling a different bit will enable the rear port audio input. really rather simple. The Upper module units (CD, mp3 CD & CDC) don't use any checksum value at the end of their messages, so it's very easy to 'forge' new ones. The Tape module however uses a special checksum that I can't figure out, so I have to use pre-defined messages to substitute that device.
The only problem with substituting devices in the upper slot, is that messages destined for the device of the same type in the upper slot would also respond if they were the same type as what I was emulating..
Hence my device emulates the tape module, and goes in the lower slot to not have any conflicts with other hardware configurations. There may yet be another way around it yet though..
Regards,
OverLOAD
#103
Registered User
Thread Starter
That's excellent information OverLOAD and thank you for sharing. When I asked if there was anything that I or anyone can offer in relation to this port, I was mainly asking if there's anything we could do to help. I know you're already working on this dilligently and it certainly sounds like you have all the tools you need, but I figured it couldn't hurt to ask.
Thanks again for that info. Don't know if you want to share any info on the protocol (and I wouldn't blame you if you didn't), but it does seem like there are some very knowledgable people on this forum and I thought that perhaps we could help you crack the checksum problem if you really wanted it solved. It sounds like that may not be a showstopper, however.
At any rate, I've got my hopes up again. Good work thus far. I know most people probably don't understand the full effort you have already made to get you to this point.
Regards,
eXe
Thanks again for that info. Don't know if you want to share any info on the protocol (and I wouldn't blame you if you didn't), but it does seem like there are some very knowledgable people on this forum and I thought that perhaps we could help you crack the checksum problem if you really wanted it solved. It sounds like that may not be a showstopper, however.
At any rate, I've got my hopes up again. Good work thus far. I know most people probably don't understand the full effort you have already made to get you to this point.
Regards,
eXe
#104
Originally posted by jdaled
I found this yesterday while searching around again...
http://www.fosketts.net/miata/audiopins/index.html
I know this information is already out there in a couple places, but I thought this was a nicely organized collection of relevant information, all in one place.
I found this yesterday while searching around again...
http://www.fosketts.net/miata/audiopins/index.html
I know this information is already out there in a couple places, but I thought this was a nicely organized collection of relevant information, all in one place.
Let me contribute a little more. According to my '02 Miata workshop manual, the device codes for different devices are as follows:
00 - Cassette deck (lower module)
03 - CD player (upper module)
05 - CD changer (external type)
06 - CD changer (upper module)
07 - MD player (lower module)
09 - Base unit
Now, this is for external error reporting. But I have a suspicion that it might be the same on the system bus. Overload, does this help at all?
Also, I have it on good authority that the Sirius box attaches to the unused 16-pin port (J-02) on the back that we are discussing. It is triggered by the SAT button on the head unit, and probably has another device code. Maybe it's number 8?
So far, I know of the Japanese TV, the Sirius box, and the external CD changer that use this port. None of these necessarily triggers the switch by itself, but they might.
My concern is with pre-04 units since I have an '03 Miata and want an aux input! It doesn't have the SAT button, and the screen can't display complex text like the '04 units can. But it probably does work with the external CD changer. Hopefully whatever we get will work for the '01-'03 Miatas and other cars (like my '02 MPV which also has this head unit).
Cheers!
Stephen
#105
Hyper Space RX-8 _,.-^'`
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes
on
0 Posts
Well, I can't confirm much,
My base unit messages are totally different. The base number that the unit uses is in the message, but it's not the same. In fact, none of the number you have match up.
In the numbers that you have, I also have these:
08 - base unit
18
28
38
58
68
78
88
e8
So put CDC, MP3 CD, SCD, Tape, MD, External CDC, TV tuner and Satalite and you have all eight used up. what is which is a good question though, I can only confirm about 4 of those codes for particular devices.
Who knows, they could still have generic uses too.
Regards,
OverLOAD
My base unit messages are totally different. The base number that the unit uses is in the message, but it's not the same. In fact, none of the number you have match up.
In the numbers that you have, I also have these:
08 - base unit
18
28
38
58
68
78
88
e8
So put CDC, MP3 CD, SCD, Tape, MD, External CDC, TV tuner and Satalite and you have all eight used up. what is which is a good question though, I can only confirm about 4 of those codes for particular devices.
Who knows, they could still have generic uses too.
Regards,
OverLOAD
#106
Hyper Space RX-8 _,.-^'`
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes
on
0 Posts
Well, www.pie.net seem to have found a connector for this slot. Someone said it's an AMP connector. Anyone care to dig?
I think there might be some merit in getting the PIE module, so I will. They have one that looks promising. a Pioneer CDC / Pioneer XM changer controller.
btw, all you people out there who really want XM input, this sounds like a nice easy way to do it.
I also took some snaps of the Mazda6 bose HU, it's very different from the RX-8 HU... I don't know if that pic above was a bose or non-bose radio, but there are many differences. The only thing that is glaringly the same, is the NEC 8-bit microcontroller. I've found similar data from nec's website on their 100-pin 8-bit 78K series 8-bit microcontrollers, and some look similar, but the part number on the M6 HU doesn't match up to anything on their site. I need to dig a little deeper. At least I know what the micro is capable of. It's got a lot of program memory, and it's not code-updatable (single write only).. so anyone who had hopes a while ago of getting their own text on the screen would only be able to do so by replacing the chip with a similar one, with the code altered.
I'll see what PIE can do, I can get my hands on a pioneer CDC pretty easily.
Regards,
OverLOAD
ps. by getting your own text on the screen, I mean that there is no way to push your own text to the display, and no way to change the default start up message.
I think there might be some merit in getting the PIE module, so I will. They have one that looks promising. a Pioneer CDC / Pioneer XM changer controller.
btw, all you people out there who really want XM input, this sounds like a nice easy way to do it.
I also took some snaps of the Mazda6 bose HU, it's very different from the RX-8 HU... I don't know if that pic above was a bose or non-bose radio, but there are many differences. The only thing that is glaringly the same, is the NEC 8-bit microcontroller. I've found similar data from nec's website on their 100-pin 8-bit 78K series 8-bit microcontrollers, and some look similar, but the part number on the M6 HU doesn't match up to anything on their site. I need to dig a little deeper. At least I know what the micro is capable of. It's got a lot of program memory, and it's not code-updatable (single write only).. so anyone who had hopes a while ago of getting their own text on the screen would only be able to do so by replacing the chip with a similar one, with the code altered.
I'll see what PIE can do, I can get my hands on a pioneer CDC pretty easily.
Regards,
OverLOAD
ps. by getting your own text on the screen, I mean that there is no way to push your own text to the display, and no way to change the default start up message.
Last edited by OverLOAD; 05-22-2004 at 09:50 AM.
#107
Hyper Space RX-8 _,.-^'`
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes
on
0 Posts
p.s.
I did some diggin on tyco's page.
This looks very close to the external connector. I've confirmed that 0.090 pitch should be about right.
AMP part # 368184-1 It's kind of close, but still not quite a match.
I'm going to try using two blocks of 1/10th inch headers to get into the connector. I think it'll work ok.
O
I did some diggin on tyco's page.
This looks very close to the external connector. I've confirmed that 0.090 pitch should be about right.
AMP part # 368184-1 It's kind of close, but still not quite a match.
I'm going to try using two blocks of 1/10th inch headers to get into the connector. I think it'll work ok.
O
#108
Registered User
Join Date: Feb 2003
Location: South Florida
Posts: 1,080
Likes: 0
Received 0 Likes
on
0 Posts
OverLOAD,
I'm not sure I'm understanding this right...does this mean there isn't a way to put ID3 tag info on the screen from a future iPod connection using your aux module? I thought that had been discussed at one point as a possibility. And we know the stock MP3 player can put ID3 tag info up there...or is that different because its a pre-defined message type with some "user defined" data blocks (i.e. the text)?
jds
I'm not sure I'm understanding this right...does this mean there isn't a way to put ID3 tag info on the screen from a future iPod connection using your aux module? I thought that had been discussed at one point as a possibility. And we know the stock MP3 player can put ID3 tag info up there...or is that different because its a pre-defined message type with some "user defined" data blocks (i.e. the text)?
jds
Originally posted by OverLOAD
ps. by getting your own text on the screen, I mean that there is no way to push your own text to the display, and no way to change the default start up message.
ps. by getting your own text on the screen, I mean that there is no way to push your own text to the display, and no way to change the default start up message.
#109
Registered User
Thread Starter
a way to put ID3 tag info on the screen
There are essentially three ports in the system that are available for us to tinker with. The top port (which holds the CD / MP3 / 6DISC), the bottom port (Cassette or MiniDisc) and the port on the back side of the unit (TV Tuner, external changer, future XM radio, etc).
The problem is that only the top port (where the MP3 player goes) is able to display text. The other ports like the Cassette port (which is the port where OverLOAD was originally looking to connect) can only get pre-defined messages to pop up on the display. In other words, for your country there are some pre-defined messages for "PLAY" and "FAST FORWARD" etc.
Did I explain that right OverLOAD? If that is correct, does that mean that the top port has a separate data channel that the other ports do not possess? Or is it that the head unit ignores text requests when any port other then the top one is selected? Or does it the exact device ID of the MP3 player have to be the active device for text to be displayed?
Or do you not want to say for sure :P
#110
Hyper Space RX-8 _,.-^'`
Join Date: Aug 2003
Location: Motor City
Posts: 529
Likes: 0
Received 0 Likes
on
0 Posts
Ok, to clarify,
Each of the ports has the capability to display text on the screen, if it's emulating a MP3 CD player.
You still have to push the display button the get it to come up the first time.
You can't force it to change display modes other than by pushing the display button.
It only will update the text, when you track-up/down to the next song.
The start-up message "mazda RX-8" is fixed in ROM, it can not be altered without replacing the micro. a 100 pin QFP is not up everyones alley, nor is re-flashing one and editing the values you specifically want.
If you are emulating tape mode, or CDC or SCD mode, you can't push text to the screen. Only when you are emulating a mp3 CD, can you put text on the display. This may be different for the sirius input that's coming, but I don't think that it's that easy to accomplish.
The text clock and data lines are much more complex than the bus line. It wil be quite an exercise to emulate that, and at this point, we've got enough to do without tackling that as well.. so we've put it off for a future project.
Regards,
OverLOAD
ps.
eXentric, the part about the pre-defined messages is indeed correct. as all the devices have their messages pre-defined in the micro.
Each of the ports has the capability to display text on the screen, if it's emulating a MP3 CD player.
You still have to push the display button the get it to come up the first time.
You can't force it to change display modes other than by pushing the display button.
It only will update the text, when you track-up/down to the next song.
The start-up message "mazda RX-8" is fixed in ROM, it can not be altered without replacing the micro. a 100 pin QFP is not up everyones alley, nor is re-flashing one and editing the values you specifically want.
If you are emulating tape mode, or CDC or SCD mode, you can't push text to the screen. Only when you are emulating a mp3 CD, can you put text on the display. This may be different for the sirius input that's coming, but I don't think that it's that easy to accomplish.
The text clock and data lines are much more complex than the bus line. It wil be quite an exercise to emulate that, and at this point, we've got enough to do without tackling that as well.. so we've put it off for a future project.
Regards,
OverLOAD
ps.
eXentric, the part about the pre-defined messages is indeed correct. as all the devices have their messages pre-defined in the micro.
#112
Registered User
Thread Starter
Thanks for the pic OverLOAD. I will be currious to see what comes of the Sirrius radio. Part of the 'Big thing' about satellite radio is the ability to see what (and who) is playing. It would be interesting to see a factory-standard option without this feature, but it wouldn't be the first time. My father owns a Dodge truck with the factory Sirrius radio and it doesn't display any metadata. If he chose the next audio upgrade it would have though.
I for one would love that option, but it isn't as important as sound and steering wheel controls to me. I do plan to have a touch screen installed so the text display isn't as important. Others, I'm sure, would really like such a feature.
At any rate, thanks for sharing. Glad to keep getting some updates, even if the end still seems a ways away.
I for one would love that option, but it isn't as important as sound and steering wheel controls to me. I do plan to have a touch screen installed so the text display isn't as important. Others, I'm sure, would really like such a feature.
At any rate, thanks for sharing. Glad to keep getting some updates, even if the end still seems a ways away.
#113
The Mazda Miata/M6/M3/RX8 Sirius does indeed display artist, track, and such on the screen. This was in the press release. Although it's only conjecture that the unit will use the rear port (which I've been calling J-02), it's pretty likely that it will. So we conclude that the rear port can display random text strings.
However, this does me no good since the '03 Miata head unit cannot display text at all.
Stephen
However, this does me no good since the '03 Miata head unit cannot display text at all.
Stephen
#114
Registered User
Join Date: Dec 2003
Location: Orando, Florida
Posts: 92
Likes: 0
Received 0 Likes
on
0 Posts
FYI
2005 Tribute Accessories
Satellite Radio Receiver Kit 2005 Tribute
Suggested Retail: 924.70
Our Price : 740.00
You Save : 184.70
SIRIUS, Mazda part # 0000-81-G01
2005 Tribute Accessories
Satellite Radio Receiver Kit 2005 Tribute
Suggested Retail: 924.70
Our Price : 740.00
You Save : 184.70
SIRIUS, Mazda part # 0000-81-G01
#116
Registered User
Join Date: Dec 2003
Location: Orando, Florida
Posts: 92
Likes: 0
Received 0 Likes
on
0 Posts
FYI update: Price change in record time.
This is the price for the TRIBUTE version.
Suggested Retail: 399.00
Our Price : 320.00
You Save : 79.00
Quantity :
SIRIUS, Mazda part # 0000-81-G01
This is the price for the TRIBUTE version.
Suggested Retail: 399.00
Our Price : 320.00
You Save : 79.00
Quantity :
SIRIUS, Mazda part # 0000-81-G01
#117
I have a mp3 player that I want to hardwire in, so what would be the best way for me to do that? I have bose and 6 disc changer, but no cassette player. I would love to have the mp3 text on the HU, but is that possible right now?
#118
Registered User
Check out this thread for an aux-in solution that works for most of us 8 owners. Then all you need are line-level output connectors (ar a line-level stereo output connector) on your player to connect to the PIE unit.
Sorry, but no present solution for the RX-8 shows tag info from an external source.
Sorry, but no present solution for the RX-8 shows tag info from an external source.
#119
I've seen that, but I'd rather just splice some wires and wire it in that way. I'd like to put $80 towards something else since money is kinda LOW. Any wire I can cut and solder to do this?
#121
Registered User
There is no place you can just tap into for an aux-in without buying something else -- either the tape unit to hack or the PIE unit or Overload's module which is still in development. You COULD tap into the amp inputs directly but then your mp3 player would be ON all the time and you'd have no volume control -- volume would be at max all the time. Yeah, I would have preferred not blowing the best part of a C-note on the PIE solution, but it was the cheapest option right now.
#122
Registered User
Thread Starter
Thanks to MazdaManiac for the pics and diagrams:
I just got my P.I.E. module. I haven't even had a chance to connect it yet (I'm at work), but I couldn't keep from opening it up. I found a few intersting things:
Only BUS+ [L] is connected. BUS- [K] is NOT.
Left Input+ [E] and Right Input+ [C] are connected, but Left Input- [F] and Right Input- [D] are NOT.
Signal Ground [G] IS connected, suggesting that the head unit can handle both differential AND non-differential input???
The unit draws its logic power from Power ACC [O] and / or Power B+ [P] (both of which are connected).
Power ground [A] is connected.
System Mute [B] is also connected! Could it be that people having trouble with their PIE modules cutting out could snip this wire (or pull the pin out)??? This is the white wire in the bundle of wires going to the head unit from the PIE module if someone wants to try.
I just got my P.I.E. module. I haven't even had a chance to connect it yet (I'm at work), but I couldn't keep from opening it up. I found a few intersting things:
Only BUS+ [L] is connected. BUS- [K] is NOT.
Left Input+ [E] and Right Input+ [C] are connected, but Left Input- [F] and Right Input- [D] are NOT.
Signal Ground [G] IS connected, suggesting that the head unit can handle both differential AND non-differential input???
The unit draws its logic power from Power ACC [O] and / or Power B+ [P] (both of which are connected).
Power ground [A] is connected.
System Mute [B] is also connected! Could it be that people having trouble with their PIE modules cutting out could snip this wire (or pull the pin out)??? This is the white wire in the bundle of wires going to the head unit from the PIE module if someone wants to try.
Last edited by eXentric; 08-06-2004 at 01:16 PM.
#123
Registered Lunatic
iTrader: (1)
Originally Posted by eXentric
Only BUS+ [L] is connected. BUS- [K] is NOT.
Left Input+ [E] and Right Input+ [C] are connected, but Left Input- [F] and Right Input- [D] are NOT.
System Mute [B] is also connected! Could it be that people having trouble with their PIE modules cutting out could snip this wire (or pull the pin out)??? This is the white wire in the bundle of wires going to the head unit from the PIE module if someone wants to try.
B is NOT connected. The white wire goes to A which is Power Ground.
So people, don't disconnect/cut the white wire :p
#124
Registered User
Originally Posted by eXentric
System Mute [B] is also connected! Could it be that people having trouble with their PIE modules cutting out could snip this wire (or pull the pin out)??? This is the white wire in the bundle of wires going to the head unit from the PIE module if someone wants to try.
Originally Posted by Tamas
Not on mine.
B is NOT connected. The white wire goes to A which is Power Ground.
So people, don't disconnect/cut the white wire :p
B is NOT connected. The white wire goes to A which is Power Ground.
So people, don't disconnect/cut the white wire :p
Tamas, does your PIE unit work?
#125
Registered Lunatic
iTrader: (1)
Don't know yet - I just received it today and I'm not sure if I'll have time to take the car apart to try it. This might have to wait until next weekend - I'll certainly post my result.
Bob, how many wires do you have connected in the PIE connector? I have seven... do you have eight? And then what color wire goes to A in your case?
Bob, how many wires do you have connected in the PIE connector? I have seven... do you have eight? And then what color wire goes to A in your case?
Last edited by Tamas; 08-06-2004 at 05:52 PM.