E. Chenze (Sr)

I've been reverse engineering my old car (10+ years old Toyota) navi system to hopefully replace it with something that talks CarPlay and use my iphone as navigation and audio seamlessly. And the way the navigation system is built is quite interesting. It runs Linux, boots with uboot, but there is one very interesting point in the way it is setup. The car will load the OS from the map SD-card, but loading a whole kernel and root image (~256MB) at every boot is not something you want to wait for when you turn your car on as it takes nearly a minute. So instead, the engineers at Panasonic (I guess - that's the company name on the navigation module native to the car) built something quite ingenious. The car has a 8MB flash, itself also containing a linux kernel and a module called "osloader". If you do not have a map SD card, that image also provides a minimum UI with some configuration screens. If you do have a map SD card however, upon booting, osloader will load the whole linux image in RAM, then initiate a warm reboot. As it turns out, if uboot on start finds the kernel image at a specific address in RAM, it will boot that instead of the flash linux. And this is the interesting part. When you stop your car, the RAM stays powered. Keeping some DDR3 with enough energy it doesn't lose its bytes is actually very cheap on the battery, and this is the magic that allows the navi, as you turn on your car, to be able to bring up the UI quickly instead of needing to load the OS from the SD card. Of course because short power cut on the battery may leave a partial image of the OS in RAM, there are various ways the image is hashed, so uboot can verify it's ready to boot. If not, it'll just launch the flash OS instead, which will re-load the OS from the SD card. The linux kernel running in RAM also has a special module compiled in that will verify the hash of the whole disk image, and if it finds anything wrong will erase the image ready flag and force a reboot. I don't think I have ever seen any system operate like that before. I guess the flash was either too slow or too expensive, so the people working on this built a system where the RAM is actually kept between boots. This works, as you turn the power on the navigation system is ready in seconds, but this was quite interesting to reverse engineer, and I had to dig deep (literally) in the navi module to locate the flash and pull it from its board to dump it. I'm not done yet, producing a valid image with the right signature on a SD card is tricky, but if done right it'll allow me (and anyone with a similar navi) to finally get rid of those old boring default maps.