iCrap

iTrader: (8)

Before anything, Disclaimer.
You can screw up your car and headunit by messing with this stuff. Be careful.
This thread documents my findings after playing around in both the hard drive & serial console on both generations of head units (2007-2009) and (2010+)By default, the hard drive is ATA password locked, and will relock EVERY TIME you boot it back up in the factory head unit. Note that you can disable the ATA security once gaining console access, but if the hard drive is locked, it will stay locked.

Parts needed:
IDE Cable & 3.5 to 2.5” adapter
USB Bootable Flash drive with FreeDOS and ZU Betta - Include zu betta - Ultimate Boot CD
Legacy PC with Native IDE.

Boot off the FreeDOS USB and run “zu /p” and that’s it, it should unlock. Note that I did have to sometimes hotplug the drive for it to recognize. The drive will unlock within 1 second, if it takes any longer…. It probably isn’t going to work. It should look like this:



Once the drive is unlocked, you can pop it in the PC and you’ll see this.


From here, you can create a backup of your drive, clone to an SSD or pull the system files if you like.
A confirmed working SSD is the “64GB KingSpec 2.5-inch PATA/IDE SSD Solid State Disk (MLC Flash) SM2236 Controller”

Hard Drive Images (Currently have 2009 Sedan, 2014 Sedan, 2010 GT-R) - Flash with win32 disk imager
2009 G37 - https://mega.nz/file/ctdxiLDZ#OKZs3a...ZPv4YcNc1e7y-U
2010 GT-R - https://mega.nz/file/U0EQxJja#Xgylh0...7hsBTBwdRY-DbA
2014 Q60 - https://mega.nz/file/olNUFA4Q#Yjvdzr...mJrQwShEzLRmSsRegardless of the year, first we need to ground test bit 2. This will put the unit into Console mode, and without doing this you will get no output.



Test bit config:

B2 – Terminal mode
B1/B2 – Terminal mode with additional debug responses
B0/B1 – XTP (Express Transfer Protocol) mode. Unsure what this is for. Flashing firmware?

Next, we need the TX and RX pins, and the pinout for each is below:

2007-2009:



2010+


Receiving is easy, however TX is not so simple as the headunit uses inverted logic.

So, to get around this we used two arduinos, one for read, and another for write.

You also need a level shifter, as well as a 5k ohm resistor

Level shifter used: Wiring pic:





The wiring is as follows
RX > HV1 > LV1 > Arduino Pin 3 (TX Arduino)
TX > HV2 > LV2 > Arduino Pin 1 (RX Arduino)
12V > HV > LV > Arduino 3.3v (TX Arduino)
GND > GND > GND on both Arduino > Pin 13 on TX Arduino
5k Ohm resistor between LV – LV2

If everything is wired up correctly, you’ll see this:

These are the console commands, extracted from the app.bin files of the respective drives.

(2007-2009 and GTR 2010) - Note that Non GT-R images are missing MFD and HDLMFD commands
(2010+ Commands)
That’s a lot, but here are the useful ones:

All years:
ver- version
HDD - HDD Information
avt - app information
dusa - delete all user data. (essentially factory reset, CANNOT BE UNDONE)
hms - cycle through UI pages
lang - change language
sig - car signal data
hdlmfd - HDL GT-R MFD Configuration Menu
Mfd - GT-R MFD Configuration Menu

2007-2009
imcarinfo - change car spec
xrcc - car code
xrvt - car vehicle type

2010+
xrcnf 2 - Prints vehicle configuration data
sys - Used to write configuration data

ver output:






HDD Display. Useful commands here:
Hdd 1 1 – display drive info
Hdd 4 8 – remove HU security
Hdd 4 9 – disables password








Continued on next post....

iCrap

iTrader: (8)

2010+ System Configuration

Unlike the 07-09 system, the 2010+ System is much more configurable, probably due to it being used in a variety of models.
First, print the factory configuration data for the unit:

xrcnf 2 - Print configuration data
Factory config for a 2013 G37 Sedan:



This is the current configuration table, and most of it can be changed. By sending the command “sys 2” we can start to write vehicle configuration data, and that will look like this:


Here are some useful commands:
sys 2 9 1 Start to write table data
sys 2 9 1 9 0 opening animation set to infiniti
sys 2 9 1 0 0x5245 - Set vehicle body shape to GT-R
sys 2 9 1 1 0x5245 - set vehicle type to GT-R
sys 2 9 1 13 1 Turn on TPMS
sys 2 9 1 10 1 Turn on drive data (??)
sys 2 9 1 8 0 Set Infiniti for Premium/M3H
sys 2 9 1 9 1 Set opening animation to Nissan
sys 2 9 1 3 3 enable comfort menu

The vehicle type can also be changed, and here is the full list I was able to extract:
Steering switch can also be set, if the head unit was pulled from a different car
So what does all this mean?
- We can unlock additional features from other models, such as the GT-R MFD, TPMS, comfort menus, etc. It looks like even additional cameras can be added, if you can figure out how to wire them.
- Disable AV and NAV regulation (control while in motion)
- Customize your head unit with different theme (nissan orange / infiniti blue), startup animation, etc
- Used / replacement headunits can be reconfigured for the model you need, EX a Nissan Murano headunit reused in a G, or a G headunit reused in a Nissan GT-R. (D52E/ 0x5245 is the GT-R, if the vehicle type, shape and controls are set it should work)

iCrap

iTrader: (8)

Unlocking GT-R Functionality (MFD)

2007 – 2009:

On the earlier head unit, the GT-R Functionality is not on the image. The only way to run it is to flash your drive with the GT-R image (linked in this thread) and rename the F5U folder to F8U. This will allow booting off the GT-R image. By sending the command “mfd 2” the display will come up, no other configuration needed.





2010+

Unlocking the MFD on the 2010+ units is done only by configuration, no hardware changes needed.

Before the MFD will display correctly, you need to set the vehicle type to GT-R. Do this by sending the following:

sys 2 9 1 1 0x5245



After this, send the same “mfd 2” command, and the MFD will open.



MFD Menu. Several parameters can be changed. Trigger the MFD with MFD 2




hdlmfd debug menu





Bringing up the MFD in the car: Still a WIP.
However, I found a way to make the MFD come up on every bootup.
Sending MFD 2 2 through 6 (One of these commands now causes it to come up every bootup, unsure on which one)

iCrap

iTrader: (8)

I hit the word limit but i'll continue to update the first 3 posts as I learn more stuff.

petemo94

iTrader: (1)

Just came across this thread. Wow, this would be a dream to see the GTR gauge set on the display.

Any news or progress on this project? Great work!

iCrap

iTrader: (8)

That's a funny coincidence, today was the first time I came back to this project literally since May.

Well, the answer is no... not really

Today I installed the modified 09 headunit in my car, where it was configured with the GT-R image on the SSD to boot into the MFD on boot. Where previously it was working consistently on the bench on each boot up, it brought up the MFD exactly ONE time and then refused to do it again. I need to hookup console access now in the car to see whats going on, but I guess i'll do that another day.

MotorvateDIY

First of all, a big thank you to iCrap for everything you have figured out and shared here.
You are awesome!!

My third AV unit should be be arriving by the end of the week. I will be using it to build a stand alone desktop AV unit for testing (GVIF LCD, AV Unit and NAV/AV buttons) and hope to get into the command console.
I bricked the first AV module trying to reprogram it via the CAN bus, then I purchased a second AV unit from a 2013 G37. It seemed to have newer circuit boards and software, so I didn't do anything with it as I thought it may be too new to work with my 2011 G37. As I result, I have high hopes for the third unit

I'm going to try to use an USB to TTL converter with a 2N7000 MOSFET to handle the 12 volt logic and UART inversion.
This will allow any "serial terminal" to send the commands and receive the response as a simple plug and play cable.
Wish me luck!

MotorvateDIY

Good news: The third AV unit arrived today!
Bad news: It was damaged during shipping and the LCD video (GVIF) and USB connectors have been smashed and ripped off the circuit board.

I will be contacting the ebay seller and see what the options are...
I might be able to solder it back on, but that is very tricky as the circuit board trace is about 0.5mm / .013 inches.

However, I still have a good hard drive to copy and the serial terminal should still work.
Stay tuned

BULL

That sucks, the usual with a reputable seller will be to send you a replacement packed in in 50 lbs of bubble wrap and packing peanuts as well as keeping the damaged one. Hopefully this is what happens for you!

iCrap

iTrader: (8)

Yeah my first AV unit had an issue, the seller sent out another one for free though luckily.

MotorvateDIY

Here is a picture of the AV unit:


The upper orange arrow shows the USB port and the lower arrow shows the video (GVIF) port.
Both connectors have been ripped off the circuit board.

I've sent the seller this picture and hope to resolve this soon.

iCrap

iTrader: (8)

Whoever pulled that from the car just yanked the crap out of those connectors I guess, I doubt that happened in shipping. They should have noticed that before sending it.

MotorvateDIY

It was shipped with the connectors plugged in and in a box of foam peanuts.




The box must of been thrown around during shipping
With the angled connectors (Video + USB) plugged in, if the unit hit the inside of the box, it would cause damage.
The original pics from the listing don't show any damage.

Anyways, I'm still waiting to hear back from the seller.

iCrap

iTrader: (8)

Oh wow, whoever shipped it like that is an idiot. It's nice to have the connectors though, i'm just using a pile of jumper wires. Good luck with the refund

MotorvateDIY

Yes, it is REALLY nice to have the connectors!

I'm not looking for a refund... I'm looking to get another AV unit from the same seller at a discount.
Even with the video and USB connectors torn off, I still have a hard drive (to copy) and terminal console, so there is still some value in it to me.

Plus the more AV units I have, the better I can understand the differences in hardware and software.
If all goes as I hope, I will have 4 AV units to test and or brick