Hacking the Pedistrian Warning System Sounds

[hb.sagen]

I would love to lower the volume of the back up beeps. In EU the minimum dB requirement is 54 dB, pretty sure the lightning is higher.

Sponsored

 

[Firn]

Bringing this back.

Do we think there is any opportunity to reflash the memory chip with new sound effects?

I really want the little kid making motor sounds for the forward noise, and "move b---h get out of the way" for the backup sound.

Ok, maybe I won't do that second one, but I want to.

 

[The Weatherman]

I’m pretty sure Ford shut the OP down on this thread. His input and assistance just drop dead one day.

Funny how Ford can do that.

 

[chriserx]

Bringing this back.

Do we think there is any opportunity to reflash the memory chip with new sound effects?

I really want the little kid making motor sounds for the forward noise, and "move b---h get out of the way" for the backup sound.

Ok, maybe I won't do that second one, but I want to.

A raspberry pi could do it, as would a dedicated SPI flash programmer, possibly an arduino using 3.3v logic. Since it's running a relatively sophisticated processor for an arguably dumb device, there is a small chance the byte header OP mentioned, or elsewhere contains a checksum to prevent tampering. If the header contains it, that's a relatively easy fix though. On first run, I'd pull the file, most likely wav, note the format, number of channels, sample rate and bit depth, you'll likely want, if not need to match these parameters in creating the audio file you want. Create the file of your choosing, then prefix it with the header OP mentioned. Flash using a chip clip and the device you chose.
I'd do an actual write up if I had a spare device, have too many projects on going to be bothered to remove my own and try it. But this would at least get the ball rolling for those interested. If anyone wants to shoot me a spare one, I'd definitely look into it.

 

[Firn]

A raspberry pi could do it, as would a dedicated SPI flash programmer, possibly an arduino using 3.3v logic. Since it's running a relatively sophisticated processor for an arguably dumb device, there is a small chance the byte header OP mentioned, or elsewhere contains a checksum to prevent tampering. If the header contains it, that's a relatively easy fix though. On first run, I'd pull the file, most likely wav, note the format, number of channels, sample rate and bit depth, you'll likely want, if not need to match these parameters in creating the audio file you want. Create the file of your choosing, then prefix it with the header OP mentioned. Flash using a chip clip and the device you chose.
I'd do an actual write up if I had a spare device, have too many projects on going to be bothered to remove my own and try it. But this would at least get the ball rolling for those interested. If anyone wants to shoot me a spare one, I'd definitely look into it.

I know very little of programming these chips, but from what little I do know you describe it and it is a fairly simple process. Aside from a few components getting the module open is probably harder than the SW bit

 

[chriserx]

I know very little of programming these chips, but from what little I do know you describe it and it is a fairly simple process. Aside from a few components getting the module open is probably harder than the SW bit

It should be a relatively straightforward process, but if anyone is willing to do it with their own hardware I'm willing to offer what help I can. I haven't flashed any modules in this manner in over 20 years. I could probably admit to why I flashed chips now, statue of limitations and all, but I won't

 

[chriserx]

I just checked the flashrom source code, it doesn't appear to natively support the IS25LP032, it does support the IS25LP series though. If you get that far and encounter an issue related to that, I can help make the changes to add support assuming I can find the datasheet for it.

Edit: This also assumes that the chip is indeed an IS25LP032 since I can't actually see the writing on the actual chip.

 

[chriserx]

Just checked the data sheet, it's possible the chip is write protected. Depending on if it's utilized and what features Ford used would determine if the chip is writeable. A complete data dump may determine if protection is enabled, and even if so, applying 3.3v to pin 3 may disable that protection. Until someone tries it...
¯\_(ツ)_/¯

 

[hb.sagen]

Is it on the OTA list?

 

[daczone]

A raspberry pi could do it, as would a dedicated SPI flash programmer, possibly an arduino using 3.3v logic. Since it's running a relatively sophisticated processor for an arguably dumb device, there is a small chance the byte header OP mentioned, or elsewhere contains a checksum to prevent tampering. If the header contains it, that's a relatively easy fix though. On first run, I'd pull the file, most likely wav, note the format, number of channels, sample rate and bit depth, you'll likely want, if not need to match these parameters in creating the audio file you want. Create the file of your choosing, then prefix it with the header OP mentioned. Flash using a chip clip and the device you chose.
I'd do an actual write up if I had a spare device, have too many projects on going to be bothered to remove my own and try it. But this would at least get the ball rolling for those interested. If anyone wants to shoot me a spare one, I'd definitely look into it.

Raspberry Pi may be overkill, I was thinking of using a ESP32 to interface to a mobile phone and change the tones on the fly... Well from preselected sounds. The ROM Dump that I did has some other code in it that I'm not sure we can break. BUT a fallback would be to just replace the module and mimick it. The Module is connected to CANBUS and Power, and the speaker.

I picked up a Macchina ODB Dev board, which states:

• ODB-II compatibility with all modern cars (1996 or newer)
• Pre-loaded with SavvyCAN for plug and play (wireless!) reverse engineering
• WiFi and Bluetooth® Functionality
• ESP32 Processor
• Super bright RGB LED
• CAN Communication Functionality
• Programmable with the Arduino IDE

So grab the canbus signals for forward and reverse and use a ESP32 to play the audio. ESP32's have been used plenty of times for canbus communication.

ESP32 CANBus Sniffing

Once we know what we are looking for on the CANBUS it should be pretty straighforward.

Sadly... I'd gotten busy with other projects (WORK). Hopefully winter will allow me to spend some time on it. I did spend some time working through creating an app (Sorry I only do IOS (iPhone) with a picker wheel to select the sound files on the ESP32.

 

[chriserx]

Raspberry Pi may be overkill, I was thinking of using a ESP32 to interface to a mobile phone and change the tones on the fly... Well from preselected sounds. The ROM Dump that I did has some other code in it that I'm not sure we can break. BUT a fallback would be to just replace the module and mimick it. The Module is connected to CANBUS and Power, and the speaker.

I picked up a Macchina ODB Dev board, which states:

• ODB-II compatibility with all modern cars (1996 or newer)
• Pre-loaded with SavvyCAN for plug and play (wireless!) reverse engineering
• WiFi and Bluetooth® Functionality
• ESP32 Processor
• Super bright RGB LED
• CAN Communication Functionality
• Programmable with the Arduino IDE

So grab the canbus signals for forward and reverse and use a ESP32 to play the audio. ESP32's have been used plenty of times for canbus communication.

ESP32 CANBus Sniffing

Once we know what we are looking for on the CANBUS it should be pretty straighforward.

Sadly... I'd gotten busy with other projects (WORK). Hopefully winter will allow me to spend some time on it. I did spend some time working through creating an app (Sorry I only do IOS (iPhone) with a picker wheel to select the sound files on the ESP32.

Yeah, work gets the best of all of us. As far as the pi goes, I was specifically referring to using it and flashrom to reprogram the flash. Although I'm sure the Pi, amp and speaker could be used to make your own pedestrian programmable speaker... Glad you're alive and well, sounded like some people were worried about ya. If you still have the file around, can you post the 16 byte header from the dump.

 

[daczone]

Yeah, work gets the best of all of us. As far as the pi goes, I was specifically referring to using it and flashrom to reprogram the flash. Although I'm sure the Pi, amp and speaker could be used to make your own pedestrian programmable speaker... Glad you're alive and well, sounded like some people were worried about ya. If you still have the file around, can you post the 16 byte header from the dump.

I can't upload the dump here.. There are 300 bytes of data @ 0xffe80 in the dump. This may be a crypto signature, which would be nearly impossible to decode. I bought 10 flash chip to play with but no luck in decoding the code. At least one other member on this page was also working on this. The audio seems to be 32 bit stereo encoded @ 22050 sampling rate.

Anyone interested in the raw dump can pull it off my home server.

 

[chriserx]

I can't upload the dump here.. There are 300 bytes of data @ 0xffe80 in the dump. This may be a crypto signature, which would be nearly impossible to decode. I bought 10 flash chip to play with but no luck in decoding the code. At least one other member on this page was also working on this. The audio seems to be 32 bit stereo encoded @ 22050 sampling rate.

Anyone interested in the raw dump can pull it off my home server.

the first few bytes should tell you if it's write protected, I'll take a look when I get back home, don't know if this is the exact chip used but the datasheet is here
https://www.issi.com/WW/pdf/25LP-WP032D.pdf

 

[daczone]

the first few bytes should tell you if it's write protected, I'll take a look when I get back home, don't know if this is the exact chip used but the datasheet is here
https://www.issi.com/WW/pdf/25LP-WP032D.pdf

Yes that is the chip:

First couple of lines look like this:

Here are those 300 bytes @ 000ffe80 that is really of concern.

There is another member on this forum that has tried to flash the chip with a new sound file, without success.

 

[chriserx]

Yes that is the chip:

First couple of lines look like this:

Here are those 300 bytes @ 000ffe80 that is really of concern.

There is another member on this forum that has tried to flash the chip with a new sound file, without success.

Oops, I guess I incorrectly assumed the status register was at 00000000h since it lined up cleanly enough with what you described as a header, it's actually a separate SPI command to read them. Any idea what the result was? Did they attempt to raise pin 3 to high? If reflashing gave an error or just failed silently, as in it kept the previous programming, that certainly would suggest it was write protected. Raising pin 3 to high may allow it to be rewritten anyway. If the flash was rewritten, that means some kind of checksum or other layered protection was in place. If that were the case, then obviously the only remaining option so changing the sounds is building the custom module, which if we're being honest here, is likely to be the easiest to do anyway.

Sponsored