Hack away - GM will never upgrade the 2013's for sure. When we bought the car the marketing was that they would be doing updates and apps - nada. As for making it work - have your iPhone nearby and press the main button to get Siri which works through the car Mic. You can send texts, google stuff, find locations and map stuff. Sadly that great video screen in the car goes unused. I have an iPad mini about the same size and I think the best "upgrade" maybe to just buy a suction cup holder and use the iPad for everything. Don't mean to be so negative but part of what sold this car to me was that Cadillac was thinking much differently - but they got over it apparently.
Hacking CUE
-
February's Cadillac of the Month Challenge Is Now Open For Entries!
21 - 32 of 32 Posts
no, it's not Debian Linux. It's a custom compiled Linux kernel based on Freescale's build chain. I've managed to reverse engineer my cluster. Here is what I know about it.
There are two CPUs. 1. Freescale (now NXP) iMX5 running Linux 2. Renaissance not sure what it's running; autosar?. I have the fully reconfigurable display which is about a 12" TFT display. I soldered a USB to serial cable to the iMX5's serial port - there is depopulated header on the PCB. I managed to figure out the console password on my unit as "Cadipcng". The unit has nand and nor flash you can get access to once the serial cable is attached. U-Boot is the boot manager and once the iMX5 detects there is a serial cable, u-boot can be interrupted. Using a u-boot flaw, I won't name at this time, I was able to copy off the nand partitions. I found two Linux kernels. One is used for running the display and other other, I believe, is to facilitate CAN or MOST based reflashing of some sort or it's some kind of fail safe.
The cluster is connected to a CAN bus (GMLAN) via the Renaissance chip. There appears to be chip to chip communications over a UART link. From the Linux login, I could find various applications running such as alertmanager, linapp, populus, odigateway, telephone, etc...
I did some further google searches and ODI is some protocol that GM uses on top of CAN but it appears that between the two CPUs, odi messages are sent back and forth - just a guess going off the name of the odigateway executable. I ran strace linux tool on some of the applications to see what other information they gave up. I could see that the odigateway application is talking on the uart port - it's pid matched the pid of the open call to the uart tty device.
I'm a computer nerd... and so being I have copied off all the executables to try and reverse engineer them with arm decompiler. This is a much longer process. If anyone would like copies of the executables to do similar investigations, post here...
also of note worthiness is that there are a couple chips on the cluster called an inic and a companion chip. These two chips put the cluster on a MOST network. MOST is an automotive network used primarily for entertainment type traffic such as stereo, etc... (https://en.wikipedia.org/wiki/MOST_Bus) I'm guessing the MOST is used to get meta data for bluetooth paired phones or on-star but not sure as this data could also come over via CAN. I don't have any tools to spy on the MOST traffic. MOST is one of those networks that is based on a ring topology and once you break the ring, the entire network stops working. I can't find any cheap tools to get on a MOST network either and the only chips that appear to terminate a MOST network are proprietary and expensive. http://www.microchip.com/wwwproducts/en/OS81118. The inic and companion chip are connected together over something called a MLB bus and the companion chip has an I2C serial interface. I plan to attach to that i2c bus and see what I can do with it.
Populus is an graphics engine of some sort. I'm guessing this is the same product from a company called Luxoft (https://www.luxoft.com/populus/)
this is a brain dump of about everything I've been able to learn about it. Hope this helps others interested in the same.
One last thing... I found that if I kill populus, I can access the Linux framebuffer /dev/fb0 to draw on the display screen - pretty cool.
There are two CPUs. 1. Freescale (now NXP) iMX5 running Linux 2. Renaissance not sure what it's running; autosar?. I have the fully reconfigurable display which is about a 12" TFT display. I soldered a USB to serial cable to the iMX5's serial port - there is depopulated header on the PCB. I managed to figure out the console password on my unit as "Cadipcng". The unit has nand and nor flash you can get access to once the serial cable is attached. U-Boot is the boot manager and once the iMX5 detects there is a serial cable, u-boot can be interrupted. Using a u-boot flaw, I won't name at this time, I was able to copy off the nand partitions. I found two Linux kernels. One is used for running the display and other other, I believe, is to facilitate CAN or MOST based reflashing of some sort or it's some kind of fail safe.
The cluster is connected to a CAN bus (GMLAN) via the Renaissance chip. There appears to be chip to chip communications over a UART link. From the Linux login, I could find various applications running such as alertmanager, linapp, populus, odigateway, telephone, etc...
I did some further google searches and ODI is some protocol that GM uses on top of CAN but it appears that between the two CPUs, odi messages are sent back and forth - just a guess going off the name of the odigateway executable. I ran strace linux tool on some of the applications to see what other information they gave up. I could see that the odigateway application is talking on the uart port - it's pid matched the pid of the open call to the uart tty device.
I'm a computer nerd... and so being I have copied off all the executables to try and reverse engineer them with arm decompiler. This is a much longer process. If anyone would like copies of the executables to do similar investigations, post here...
also of note worthiness is that there are a couple chips on the cluster called an inic and a companion chip. These two chips put the cluster on a MOST network. MOST is an automotive network used primarily for entertainment type traffic such as stereo, etc... (https://en.wikipedia.org/wiki/MOST_Bus) I'm guessing the MOST is used to get meta data for bluetooth paired phones or on-star but not sure as this data could also come over via CAN. I don't have any tools to spy on the MOST traffic. MOST is one of those networks that is based on a ring topology and once you break the ring, the entire network stops working. I can't find any cheap tools to get on a MOST network either and the only chips that appear to terminate a MOST network are proprietary and expensive. http://www.microchip.com/wwwproducts/en/OS81118. The inic and companion chip are connected together over something called a MLB bus and the companion chip has an I2C serial interface. I plan to attach to that i2c bus and see what I can do with it.
Populus is an graphics engine of some sort. I'm guessing this is the same product from a company called Luxoft (https://www.luxoft.com/populus/)
this is a brain dump of about everything I've been able to learn about it. Hope this helps others interested in the same.
One last thing... I found that if I kill populus, I can access the Linux framebuffer /dev/fb0 to draw on the display screen - pretty cool.
WOW! I thought somebody was writing a Latin lesson....
MARTIANS ARE REAL:shocked2:
MARTIANS ARE REAL:shocked2:
I actually understood the general principles of most of that!
I just want a way for the car door handles to light up when I hit unlock from the inside, not just when I hit unlock from the key fob.
I just want a way for the car door handles to light up when I hit unlock from the inside, not just when I hit unlock from the key fob.
I almost feel like it would be easier to do this the good old physical way rather than try to program the car to do it.
One thought is if you could re-wire the power for the lights on the door handles to the same power source as the dome lights you could use the dome light switch to turn on the handles and interior lighting.
It sounds like you are wanting the handles to light up while you are in the vehicle and someone else is getting in. So this would probably be a pretty useful way to do that without needing to do any programming.
Disclaimer: I don't know jack about electronics so this may be a terrible idea.
Joined
·
5 Posts
Grow up!
I'm not saying they would without arm twisting, but they have additional incentives not to since dealers insist on being involved in all software updates.
https://arstechnica.com/cars/2017/0...020-but-only-for-a-new-infotainment-platform/
https://arstechnica.com/cars/2017/0...020-but-only-for-a-new-infotainment-platform/
Very True. Ford owners in Europe get free over the air map updates for the in-car navigation system. American owners of the same vehicles have to pay well over $100 per for a dealer to install updated maps (or pay the same on-line for the media). And the price for the Navigation option is ~the same, so the map update costs aren't hidden in that.
2018 CUE has the Weather Network app built in.
Try contacting IT consulting services. It may be expensive, but you are guaranteed to solve your problem
Joined
·
1 Posts
Thank you for this post... got more from this than an hour of searching in 2022...
21 - 32 of 32 Posts
