Audi automotive thermal imaging night vision camera teardown - Page 1
Forum section: electronics / general

author: mos6502
author_rank: Frequent Contributor
timestamp: November 11, 2013, 12:54:52 am
content: Here's an old thread on a German forum that deals with a BMW system:http://www.mikrocontroller.net/topic/177639If you scroll down for the pictures, you can see that the sensor module looks similar to yours. It's different inside, though. Different sensor, Altera FPGA.Anyway, the upshot seems to be that at least the BMW system, the sensor module, the control module and the car's ECU are locked together. They do a little chat on powerup and exchange serial numbers and stuff. This prevents the camera from being stolen and used in a different car, even if it's the same model.Here's an old listing on eBay for an "unlocking module":http://www.ebay.de/itm/ws/eBayISAPI.dll?ViewItem&item=330774553378&ssPageName=ADME:B:SS:DE:1123It connects as a man in the middle device between the car's CAN bus and the control module's CAN bus.What kind of data does the actual sensor itself spit out? Would it be feasible to just hook it up to an FPGA board?

author: Fraser
author_rank: Super Contributor
timestamp: November 11, 2013, 01:12:21 am
content: Mike,You never cease to impress !Thank you

author: amyk
author_rank: Super Contributor
timestamp: November 11, 2013, 08:38:21 am
content: Wow... is this the fourth or fifth one he's taken apart now?If I remember correctly from reading some documents Motorola "accidentally" exposed many years ago, the 9S12 can be powered up in a special internal peripheral testing mode where it's possible to unsecure the flash and thus readout the firmware.

author: Stonent
author_rank: Super Contributor
timestamp: November 11, 2013, 09:15:47 am
content: Next up on Mikeselectricstuff, Audi FLIR module connected to 1000 ipod displays mounted in a public place.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 11, 2013, 09:38:59 am
content: Quote from: mos6502 on November 11, 2013, 12:54:52 amI would expect it to be similar to the E4 sensor, but at the moment something is stopping the sensor doing anything.

author: Stonent
author_rank: Super Contributor
timestamp: November 11, 2013, 09:58:43 am
content: Quote from: mikeselectricstuff on November 11, 2013, 09:38:59 amIt doesn't by chance have a similar pin configuration to the E4 does it? Perhaps you could wake it up using the E4 as a host.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 11, 2013, 10:48:02 am
content: Quote from: Stonent on November 11, 2013, 09:58:43 amNo totally different - When I get time I will try throwing a bunch of CAN at it to see if I can get it to run. Worst-case I may have torentan i3 off ebay to see what the i-series sensor needs to be driven with.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 11, 2013, 11:27:35 am
content: I suspect most of the protection is in the control unit, and the cam itself may just need a command to turn on - I can see some line/frame sync type signals in the serialised steam, so there's probably just s 'go' signal somewhere.They _could_ have implemented some nasty challenge-response authentication though. The only obvious NV memory is the config flash - not looked hard enough yet to determine if one of the 8 or 6 pin devices is an eeprom.

author: amyk
author_rank: Super Contributor
timestamp: November 11, 2013, 12:22:33 pm
content: http://cvs.flir.com/tau2-electrical-iddDoes that 50-pin connector look familiar...?http://cvs.flir.com/tau2-product-specThis document says that all the outputs can be set to various options, one of which is "disabled". Maybe the camera module has just been configured with all the outputs disabled by default?http://cvs.flir.com/tau2-quark-software-iddHere details the commands that are used to change the settings, including the outputs.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 11, 2013, 02:05:31 pm
content: Quote from: amyk on November 11, 2013, 12:22:33 pmNo - the connector is smalley. Look slike it has 4 LVDS pairs plus a few other oddments. Two of the LVDS likes look like clock and a datastream, but only sync present. I will take a look at the serial flash - it will be pretty obvious is there's anything in there apart from the FPGA bitstream.It is also possible there's an eeprom - again won't be hard to find.

author: Rasz
author_rank: Super Contributor
timestamp: November 11, 2013, 03:48:08 pm
content: How much was it Mike? I remember looking them up when you did E4 teardown and people wanted ridiculous amounts of money for scrapped Audi cameras (>$1000).Quote from: mikeselectricstuff on November 11, 2013, 09:38:59 amI dont think there is anything stopping it from working, I think its the other way around - FPGA didnt initialize the sensor yet and is waiting for the command from the head unit.Those Flir sensors look to be designed just like cmos camera sensors, with buildin ADC and all. I suspect there is I2C interface to the ADC inside and its waiting for commands (gain,exposure,start,stop). Without those commands it just sits in idle state.We need ISC0601B pinout.You did probe around E4 sensor, was there something resembling i2c bus on the sensor pins? Does changing levels in the camera change gain in the sensor? or is it fixed 16 bit output leaving all this stuff to camera cpu/fpga for postprocessing?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 11, 2013, 03:56:50 pm
content: Quote from: Rasz on November 11, 2013, 03:48:08 pmThere's tons of them on Ebay.de, around the 500-600 Euro markQuoteNot probed the E4 sensor yet as it's hard to access - need to make a riser/breakout - I've ID'd the connector but couldn't find any stock of both parts.

author: equinoxe
author_rank: Contributor
timestamp: November 11, 2013, 09:13:39 pm
content: Quote from: mos6502 on November 11, 2013, 12:54:52 amThe module is also for sale here:http://www.navi-tools.de/index.php?option=com_content&view=article&id=4&Itemid=5&lang=enSadly they don't really give any useful info (probably to protect their business).

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 11, 2013, 09:24:04 pm
content: Quote from: equinoxe on November 11, 2013, 09:13:39 pm..well that probably rules out a complex enabling protocol - unfortunately I don't have access to a system installed in a car. When I get time I'll take a look at the CAN traffic & try throwing some commands at it

author: MrSquirrel
author_rank: Contributor
timestamp: November 11, 2013, 09:51:51 pm
content: Great teardown - this is very interesting, think i'm going to have to get one of these myself.I noticed the PCB had the marking "NV2":NV2 = Second version of Autoliv Night Vision with a 24 degree Field of view, 320x240 pixels, 25u pitch.According to some sales presentation stuff i found the camera is around $800 and image sensor alone $500. Ouch!http://www.hanser-automotive.de/fileadmin/heftarchiv/2004/17700.pdfInteresting block diagram on page 1. Camera simply pumps out raw video stream with CAN for control. Means camera module is somewhat universal, and processing engine can vary depending on that the OEM wants to do with it.Looks like these guys had a go:http://www.nightvisionforums.com/phpBB3/viewtopic.php?f=1&t=6799Info on NV2 system, product roadmap etc:http://www.chalmers.se/safer/EN/news/events/night-vision/downloadFile/attachment/Slides_Night_vision_presentation?nocache=1226396024.19Teardown of the 1st Gen Systemhttp://www.xolmatic.com/xprojects/XE65/Night_Vision_Camera.htmMore great 1st Gen info here, pics of 3rd Gen (NV3) board at bottom of page?: (oops, already posted earlier by mos6502)http://www.mikrocontroller.net/topic/177639And some tasty stuff here:http://liu.diva-portal.org/smash/get/diva2:218938/FULLTEXT01It is actually quite an interesting read in it's own right.This document references a document called:"Sundin Mats (2006) NV2 LVDS video link specification, Linköping: Autoliv Electronics AB"Looks like that is the jackpot, but i can't find a copy. Perhaps e-mail the guys that wrote the thesis.

author: Rasz
author_rank: Super Contributor
timestamp: November 13, 2013, 03:46:57 am
content: nice find, but as you probably noticed in teh pdf it relies on a car initializing the whole systemintercepting lvds data is "easy" (can read it before/after ldvs bridge chip) compared to guessing secret handshake headunit might have with ecu, or randomly fuzzing canbus between camera and headunit in hopes of initializing cameraThis is the problem Mike has now.Its probably as simple as headunit sending "#camera_address GO" to the camera unit.Might be easier to just connect bare sensor to FPGA.

author: amyk
author_rank: Super Contributor
timestamp: November 13, 2013, 11:46:04 am
content: Quote from: MrSquirrel on November 11, 2013, 09:51:51 pmNotice the phrase "video link" - we already know the video data format so probably nothing interesting in there that isn't already covered in Flir's public datasheets. Acontrol linkspec on the other hand...

author: Fraser
author_rank: Super Contributor
timestamp: November 16, 2013, 10:44:01 am
content: Slightly OTAn interesting document from Autoliv on the challenges of providing LW thermal cameras for the masses. Not applicable to the teardown specifically, but interesting to see what AutoLiv are up to and the hopes of the future. The lowering of the sensor and optics costs is detailed.....seems like the Flir E4 strategy.http://www.autoliv.com/ProductsAndInnovations/Documents/Research%20Papers/4.%20Autoliv%20Research.pdf

author: yogort1
author_rank: Contributor
timestamp: December 14, 2013, 10:47:14 pm
content: Anyone found out what this secret handshake consists of?With this information it would be possible to make some fairly simple startup emulator without having to spend 250E for activator module

author: Rasz
author_rank: Super Contributor
timestamp: January 02, 2014, 09:11:55 pm
content: http://youtu.be/7h7LWeET1fI?t=19m01smight work for powering this camera up

author: Lexman
author_rank: Newbie
timestamp: January 09, 2014, 07:51:20 pm
content: Hello everyone !Great teardown and very interesting project. I have also order one cam from ebay.I hope we can make some progress with this camera.It will probably take a week or so until I got my camera.I do not know if it's a NV1 or NV2. I could not see this in the pictures.BTW I think we have to send a request via the CAN bus for each individual frame ... if I understand the docs. correct.Cheers//Lexman

author: MrSquirrel
author_rank: Contributor
timestamp: January 09, 2014, 11:56:53 pm
content: Did you buy the Audi or BMW variant?I e-mailed these guys about their "enabler" unit for the BMW version:http://carsystems.com.ua/en/intelligent-modules.htmlConnection diagram attached for the NV1 and NV2 version. Looks like the vehicle only has basic integration with the control unit.Unfortunatley i can't find anyone doing an equivalent for the Audi model, i wonder how similar the protocols are?They want $250 for their module. Pretty reasonable as it potentially saves a lot of work and you can re-sell both it and the control unit on when the camera protocol is understood.The BMW system seems to attract far higher prices on eBay, a bit too high IMHO for playing with. Audi units are a lot more available and realistically priced.

author: Fraser
author_rank: Super Contributor
timestamp: January 10, 2014, 12:01:14 am
content: IIRC the camera enabler only 'fools' the camera system controller into accepting the control commands from a genuine BMW central command bus. It cannot be used to fool the camera controller as a stand alone unit or to make a BMW camera work in an Audi etc.Edit: This unit appears to be able to work in stand alone mode so I may be wrong about it still needing the BMW CAN Bus:http://carsystems.com.ua/en/intelligent-modules.htmlDefinitely described as 'stand-alone' yet I read a reply from the company previously (In answer to a question about using it in another brand of car) and they said it would only work on a BMW of the correct model. Maybe they have improved it ?

author: Fraser
author_rank: Super Contributor
timestamp: January 10, 2014, 12:16:27 am
content: If this has already been found, apologies. I attach an interesting document detailing the BMW system. Found here:http://www.bimmerboard.com/members/jcarey/original/BMW%20Night%20Vision.pdf

author: MrSquirrel
author_rank: Contributor
timestamp: January 10, 2014, 01:17:44 am
content: They said it worked standalone and "provided all appropriate CAN messages" though i will ask specifically about this. English is not their main language.

author: Fraser
author_rank: Super Contributor
timestamp: January 10, 2014, 01:51:29 am
content: It was interesting to read in the BMW camera document that I referenced, that the controller effectively up-scales the camera 320x240 output to 640x480.....niceIf the controller enabler is fully 'stand-alone', as described to MrSquirrel, and detailed on the web page, this is quite a powerful high frame rate TIC to own for a reasonable costTime to start hunting in the scrap yards for 'written off' high end BMW's ?

author: Lexman
author_rank: Newbie
timestamp: January 11, 2014, 11:46:32 pm
content: I bought the BMW variant but it is not the Pathfinder model.Still waiting for the delivery.It's made by Autoliv (from Sweden) and have 4 or 4+2 (6) pin connector.So the nightindependent stand alonecontroller from carsystems.com will not work with this camera if it's only have 4-pin connector.I think their second independent "solution" works only together with the Pathfinder from FLIR with 12-pin connector.And I dont have a BMW..Cheers//Lexman

author: Lexman
author_rank: Newbie
timestamp: January 12, 2014, 04:21:44 pm
content: I don't now if you have seen this video..It's a cam from BMW E65 made by Autoliv "Autocam C1" and working as standalone.What do you all Think about this cam ?Looks like PathFinder from Flir.Maybe this "old" model was not needed to be unlocked to work properly.Cheers//Lexman

author: MrSquirrel
author_rank: Contributor
timestamp: January 12, 2014, 05:20:06 pm
content: Quote from: Lexman on January 12, 2014, 04:21:44 pmYes that's the 1st generation model - this has a composite video output too so you should be able to have fun without much effort.Edit: Some more info for you on the Gen 1 camera:Spec sheethttp://www.flir.com/uploadedFiles/Brochure_PathFindIROEM.pdfThe PathFindIR cameras could have different firmware to the vehicle manufacturers models though? One way to find out.The interface specification is mentioned here, but you have to sign an NDA:http://www.flir.com/uploadedFiles/UserManual_PathFindIR.pdf?http://cvs.flir.com/l/6132/PathFindIR-Interface-Cable-pdf/wb66khttp://cvs.flir.com/l/6132/-FLIR-PathFindIR-OEM-Cable-pdf/wb66mSo you just need a serial to LIN converter, to communicate with that camera. At an physical level you can bet they have just stuck a serial to LIN converter on top of an existing design. I wonder how similar the commands are to other Flir cores?

author: MrSquirrel
author_rank: Contributor
timestamp: January 12, 2014, 06:14:30 pm
content: Just found this, loads of great info on how the 2nd Gen BMW system operates:http://www.kneb.net/bmw/F01-02/06.3_F01%20BMW%20Night%20Vision%202.pdfIt is similar to the BMW manual Aurora posted, but for the 2nd gen, not 1st.This suggests the 2nd gen camera is paired to the control unit:Programming and CodingInitializing SoftwareWhen replacing the camera, it is always necessary to initialize the software by entering anenable code (FSC).Note: The vehicle identification number (VIN) must always be entered whenordering a new camera or a new control unit.The camera is programmed by through of the control unit. The control unit receives theprogramming data for the camera through PT-CAN. The control unit forwards this data tothe camera through the "private CAN-bus".This is standard practise on with modern vehicles, hopefully nothing deeper? Often is simply a serial number check by a "master unit" on the bus. If the master notices one of the serial numbers (sometimes even a light cluster, or a door switch module) has changed it throws a wobbly.However, it does not mean to say that if the end device is powered up on the bench and sent the correct CAN messages it won't come to life. I'm no expert on how BMW/Audi do it though, Honda is more my scene.I think i would do a lot of sniffing before firing messages to either unit in case they get upset.

author: Myself
author_rank: Contributor
timestamp: January 14, 2014, 02:14:24 am
content: By the way, I don't know if any of the pages linked earlier in the thread have this info, but that round four-pin connector carrying the video signal is known as HSD:http://www.rosenberger.com/en/products/automotive/hsd.phphttp://www.bce.it/wp-content/uploads/2012/06/Amphenol-HSD-Connector-Introduction-BCE-06-12.pdfhttp://www.te.com/en/industries/automotive/browse-products/infotainment/high-speed-data-connector-system-hsd.htmlUnfortunately I don't know anywhere to source samples, but one could ask around. In the TE PDFs there's a part number for a female-female cable, 2141723, which their own site doesn't know about but Newark claims to carry it:http://www.newark.com/te-connectivity/2141723-3/connector/dp/55W4915All the other part numbers seem to be dead-ends, so perhaps calling one's local TE rep could yield fruit. Or just use solder -- the universal adapter!

author: Lexman
author_rank: Newbie
timestamp: January 14, 2014, 10:27:01 pm
content: I got my BMW camera today. (Autoliv)It was a NB2 version.Part no: 66.54-9 205 899-01HW:1SW:0.1.36 / 0.0.39I have not opened it yet but the connecting cable for the camera was included and it has ONLY 4 wires + woven shield.The connector on the camera has 4 + 2 pins. The "extra" 2 pins is positioned on the side of the shielded round 4 pin connecter and are not used in the female cconnector (Cable side)None of the four wires are connected to ground so I guess the neg power goes through the shield - through the shielded circular 4-wire connector.That means we have a total of 5 wires to the camera.I get confused ... 1 wire + shield for power, 2 wires for LVDS signal and 2 wires for the canbus = 5 wires + shieldI have 120 ohms between two wires so they are likely the canbus.Cheers//Lexman

author: Lexman
author_rank: Newbie
timestamp: January 14, 2014, 11:33:20 pm
content: Here is some pictures...

author: lacatusuflorin
author_rank: Newbie
timestamp: January 16, 2014, 06:25:40 am
content: Quote from: Lexman on January 14, 2014, 10:27:01 pmThe "extra" 2 pins is positioned on the side of the shielded round 4 pin connecter are use for 12 Vdc, 2 wires (red + / black -)

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 16, 2014, 08:57:10 am
content: Do you have both ends of that cable?From memory, the data parts are the same, but only the camera end has the power pins

author: lacatusuflorin
author_rank: Newbie
timestamp: January 16, 2014, 04:44:47 pm
content: Quote from: mikeselectricstuff on January 16, 2014, 08:57:10 amI have the cable with the both end?The end from the camera have 4+2 pinsandat the other end have 2 terminals: 1 with 4 pins and 1 with 2 pinsFrom the service manual for audi the 2 pins are for power supply with 12 VdcThe core of this camera are similar with the FLIR TAU 2, and even have the power module of the camera similar with the tau photon replicator board for use with voltage of 12 vdcThe tau core have the posibilities to use analog video signal NTSC / PAL, but i am not able to check the signal type for this connector.I need only the ntsc signal from this camera to use with an external displaythe 30 pins connector whwn power up have this kind of voltage levels, but i don't have an oscilloscope to see the signals forms, and i don't know how ntsc signals looks likeif you have any idea

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 16, 2014, 09:13:28 pm
content: Quote from: lacatusuflorin on January 16, 2014, 04:44:47 pmSee the teardown vid - the camera itself outputs LVDS data, once you send it whatever magic commands it needs. The control box outputs composite video, but needs to think it's in a car.I will be investigating it when I get time, but that won't be for a while

author: Lexman
author_rank: Newbie
timestamp: January 16, 2014, 10:52:23 pm
content: I purchase the camera including its outer plastic housing. - see picture.In the picture is the connecting cable visible, and its cut off.The cable I have received and which were connected to the camera when I received it is also cut off but its longer than the cable in the Picture. Which explains it all.It is not the right cable for the camera I have received. It's missing the DC power wires.I have seen in the newest camera version from Autoliv (NV3), it has only 4 pin connector, the extra 2 pin for Power is missing. I wonder how the interface works in this camera.New info...NV3 uses MAX9259 for the LVDS signal and the IC has also "full-duplex control channel" to control the camera. Canbus interface is no longer used.The camera connector is 4-pin, 2-pin for Power and 2-pin för LVDS AND control.Cheers//Lexman

author: LesioQ
author_rank: Regular Contributor
timestamp: February 05, 2014, 10:03:18 am
content: Howdy,New here.I also got NV2 IR cam core and would love to make good use of it. While hoping that Mike will crack the CAN init, I was wondering what B-plans can be assigned to the task.I noticed there's an ARDUCAM pcb project, being capable to communicate with CMOS sensors. It's open to modifications, comes at $50 with QVGA LCD and snapshot storage on a card. Maybe this would be a good path to read image from ISC0601B IR sensor, once (if) we know the pinout.Piotr.K

author: TheEnd
author_rank: Contributor
timestamp: September 15, 2014, 11:58:04 am
content: Hi guys,Yes, it's someone else interested in an easy and cheap way of getting hold of a thermal imaging core with as little extra stuff tacked on.Give me a nudge if there is another more detailed thread on this topic, otherwise I'm going to stick here as a data dump for those interested.I have some BMW diag software, including a very basic program that will forward and return commands.So- here are some of the possible commands and controls. Note- I think this is direct from the camera module itself!StatusesSTATUS_KAMERA_TEMP camera tempSTATUS_HEIZUNG_TEMP heating temp (it has a heated front lens for clearing rain and condensation)STATUS_KAMERA_SPANNUNG - spannung = voltageSTATUS_KAMERA_STUNDEN - operating hoursSTATUS_SHUTTER_CYCLE -shutter cycle time in secondsSTATUS_ZEILE_LESEN - "Read data of a line from the camera.It is the one half of one line read (160 bytes)The camera image consists of 320 columns and 240 rows" - official function descriptionSTATUS_VERDREHWINKEL - camera rotation angle, returns 1/10 deg angleSTATUS_OFFSETWINKEL - gives the offset angle, 8 bit data centred on 128decimal, and can read +/- 7.2 degreesSTATUS_DEAD_PIXEL - this returns the result of a dead pixel test, and gives the reply as a voltage(?!)STATUS_KAMERA_BOARD - this reads ID data such as serial numbers and manufacturer codesControls and commandsSTEUERN_TESTBILD "Displays test patterns NIVI the camera toTest Image 1 -> diagonal gray stripesTest Image 2 -> Vertical grayscale barTest image 3 -> horizentale grayscale barTest image 5 -> horizentale grayscale dark bottom light up"STEUERN_SHUTTER- The following closing procedure can be set00 => shutter remains open01 => Shutter closes automatically every 2 min WITHOUT pixel calibration02 => Shutter closes automatically every 2 min WITH pixel calibration06 => shutter is closed (not Image Display)STEUERN_WINKEL_SCHREIBEN - writes the rotation angleSTEUERN_HEIZUNG_AUS - switches heating offSTEUERN_HEIZUNG_EIN - switches heating onSTEUERN_ZOOM_AUS - zoom outSTEUERN_ZOOM_EIN - zoom inSTEUERN_TEST_PIXEL_EIN - switches on the dead pixel test, this takes 3.5 mins and outputs the total number of dead pixels - an off command is also availableNow some of the more interesting parts-AUTHENTISIERUNG_START - for this, you need to give an "argument", in this case feed it the binary buffer, and the binary buffer is formed like this (in German, but fairly self explanatory, google translate is there if you need it!)Als Argument wird ein vorgefuellter Binaerbuffer uebergebenDer Binaerbuffer hat folgenden AufbauByte 0 : Datentyp (1:Daten, 2:Maskendaten)Byte 1 : (unbenutzt) Wortbreite (1:Byte, 2:Word, 3:DWord)Byte 2 : (unbenutzt) Byteordnung (0:LSB zuerst, 1 MSB zuerst)Byte 3 : (unbenutzt) Adressierung (0: freie Adressierung, 1:Blockadressierung)Byte 4 : Authentisierungszeit in SekundenByte 5,6 : (unbenutzt) WordParameter 1 (low/high)Byte 7,8 : (unbenutzt) WordParameter 2 (low/high)Byte 9,10,11,12 : (unbenutzt) Maske (linksbuendig)Byte 13,14 : Anzahl Bytedaten (low/high)Byte 15,16 : (unbenutzt) Anzahl Wortdaten (low/high)Byte 17,18,19,20 : (unbenutzt) Wortadresse (low/highbyte, low/highword)Byte 21,.... : SchluesseldatenByte 21+Anzahl Daten: ETX (0x03)Fault code outputs0xA788 Heater Camera0xA789 voltage Supply Camera0xA78A Tamper Protection Camerauh oh! - it has a form of anti tamper0xA78B IR Sensor0xA78C Defective Pixel0xA78D Shutter0xA78E HW/SW error0xA78F Video out failure0xA790 Camera not adjusted0xA768 Camera Overtemperature0xA769 Watching Reset (Camera)0xFFFF unbekannter FehlerortSo, that might be making things overcomplicated, especially if someone is going to tap into the raw sensor data but it is explaining what the "private CAN" connections are about, and it shows the module has some brains and self diagnosis.This particular info should be for the first version of the camera, but it looks like it applies to all of them.I haven't got a camera, I'm not on the level of the hardware hacking that some people might be on, but if i can help, I will!

author: LesioQ
author_rank: Regular Contributor
timestamp: September 16, 2014, 06:55:58 am
content: Hi,That indeed sounds promising !Do these commands have any hex representation ? Do You have a command id table or something useful when trying to communicate with bare cam via CAN ?Piotr.K

author: TheEnd
author_rank: Contributor
timestamp: September 16, 2014, 02:38:34 pm
content: Sadly it's doesn't go that far, the program is still a "dashboard" or front page, and the data will be interpreted and formed into a CAN command somewhere else.Another translation table shows-NR MODE MODE_TEXT0x81 DEFAULT DefaultMode0x82 PT PeriodicTransmissions0x84 EOLSSM EndOfLineSystemSupplierMode0x85 ECUPM ECUProgrammingMode0x86 ECUDM ECUDevelopmentMode0x87 ECUAM ECUAdjustmentMode0x88 ECUVCM ECUVariantCodingMode0x89 ECUSM ECUSafetyMode0xFA SSS_A SystemSupplierSpecific (A)0xFB SSS_B SystemSupplierSpecific (B)0xFC SSS_C SystemSupplierSpecific (C)0xFD SSS_D SystemSupplierSpecific (D)0xFE SSS_E SystemSupplierSpecific (E)0xXY -- unbekannter Diagnose-ModeSo it looks like there is a command to ask what mode it is in, and the hex answer will define what it comes back as saying.This could well be a standard table for all modules in the cars, but it might also mean it could be set to a development mode 0x86, if the command to change modes could be found.I don't know much about CAN and the data side of things, but I'm guessing it'll make more sense to others.If it's useful, maybe it'll mean a way to get into these devices, if it isn't, well, hey, you can never have too much information.

author: LesioQ
author_rank: Regular Contributor
timestamp: October 07, 2014, 10:29:49 am
content: Meanwhile I noticed that my Audi NV2 responds to 0x301 to 0x303 frames (remote type) at 100kbps.Does anyone know IF I can use CAN interface to talk to LIN device ? (BMW NV1 cam).Piotr.K

author: yogort1
author_rank: Contributor
timestamp: November 05, 2014, 06:26:28 pm
content: Anyone managed to run this camera?

author: ogoun
author_rank: Contributor
timestamp: January 05, 2016, 03:08:40 am
content: Greets all,Has anyone got any further with this? I have both the cam and the controller, and have disassembled both, and have the serial eeprom from the camera (used with the Xilinx spartan3e FPGA). I will look at reading it (after making an adapter), to see if anything can be gleaned from its contents, as I suspect that the spartan3e has one of the Xilinx microcontroller cores in it, possibly a microblaze. If it does, then there may be some areas of the eeprom that have the code for this micro core. If so, it may shed some light on how the private can bus is used. Perhaps this will be enough to learn how to "wake up" the cam.Cheers,Pete

author: ogoun
author_rank: Contributor
timestamp: January 05, 2016, 05:07:50 am
content: Some interesting patents:7470902http://www.freepatentsonline.com/7470902.pdf6812465http://www.freepatentsonline.com/6812465.pdf6028309http://www.freepatentsonline.com/6028309.pdfGives a bit more info on the camera module and the FPA (320x240 focal plane array) chipCheers,Pete

author: therew
author_rank: Newbie
timestamp: February 23, 2016, 11:40:52 am
content: Does automotive thermal imaging have something in common with thermal systems for tactical/hunting purposes? I have a couple of the finest thermal imaging scopes fromhttp://www.atncorp.com/thermal-night-visionand I was wondering whether this technology is similar to what I can install on a car. My father got a FLIR thermal imaging night vision camera for a 99-03 Cadilac Deville, installed a 5" monitor above his radio and installed the camera behind the grill. Looks awesome.

author: encryptededdy
author_rank: Frequent Contributor
timestamp: February 23, 2016, 10:07:42 pm
content: Quote from: therew on February 23, 2016, 11:40:52 amI'm not sure about the new ATN thermal sights (the one with WiFi), however their older ones used FLIR Tau2 cores which is very similar if not the same sensor wise compared to automotive systems like the FLIR PathfindIR

author: nixxon
author_rank: Frequent Contributor
timestamp: April 15, 2016, 02:16:39 pm
content: Quote from: mikeselectricstuff on January 16, 2014, 09:13:28 pm

author: nixxon
author_rank: Frequent Contributor
timestamp: April 29, 2016, 07:58:50 pm
content: Quote from: nixxon on April 15, 2016, 02:16:39 pmI forgot to mention, there is a guy in the neighborhood selling an Audi Night Vison lens/sensor unit assembly. (no control box). I was thinking of using the Germanium lens as a close up tool for my Fluke TiR. And if it is possible I want to make the Audi camera a stand alone working unit (with a separate LCD screen and battery pack). He is asking the equivalent of US$ 130 for it. I guess it is worth that amount. Any chance somebody will hack this equipment any further soon?

author: Fraser
author_rank: Super Contributor
timestamp: April 29, 2016, 09:58:16 pm
content: They make good paperweights and a source of parts. Do not expect a working 'camera only' hack any time soon ;-)Any that have had any form of hacking already tried on them will be in 'lockdown' so an even worse hacking proposition.Fraser

author: xmjacky
author_rank: Contributor
timestamp: May 23, 2017, 11:27:14 am
content: I also have a BMW thermal imaging camera, the 2nd Gen BMW system,4 wire interface,and the research work has made little progress1 camera interface definition.(1.JPG)2, the decoder using MAX9260, as long as the build simple circuit can output RGB encoding 16bit, the logic analyzer results, video decoding is correct, but the camera does not output pixel data, should be the protection mechanism of the problem.3, the use of PC through the MAX9260 to send the camera command (232, RX/TX), in some baud rate can receive replies, but I do not have the exact command, can not let the camera work properly.If you have a BMW car or rent a car, you can grab data with a simple tool(logical analyzer or serial port tool), you can remove the protection mechanism.Wiring mode is as follows

author: xmjacky
author_rank: Contributor
timestamp: May 25, 2017, 10:49:19 am
content: Hope that more people join the crack job

author: Rasz
author_rank: Super Contributor
timestamp: May 25, 2017, 04:24:38 pm
content: Quote from: xmjacky on May 25, 2017, 10:49:19 amSo you are posting from Iran (at least you removed country from your profile now) asking for help with cracking ITAR controlled technology, and those are your only posts on this forum. Right.

author: james_s
author_rank: Super Contributor
timestamp: May 25, 2017, 06:52:15 pm
content: Why on earth are these locked down in the first place? What are they protecting them from? I can't see why BMW or Audi would care if someone uses their parts in something else. Are they afraid of the camera modules being stolen off of parked cars?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 25, 2017, 07:50:48 pm
content: Quote from: james_s on May 25, 2017, 06:52:15 pmBMW / Audi don't care - it's a condition imposed by the camera manufacturer to ensure they stay within US export regs, to avoid them being repurposed

author: Fraser
author_rank: Super Contributor
timestamp: May 25, 2017, 08:04:29 pm
content: As Mike says, it is a requirement of ITAR(USA) and Dual Use Technology regulations. These cameras are 320x240 pixels with a 60fps output. They therefore are a controlled product.The reasons for such controls have been detailed in other threads but basically, a thermal camera can be a very effective weapon aiming or guidance system. The appropriate authorities set the frame rate as <9fps for cameras that do not require the tighter ITAR and DUT distribution restrictions.9fps is not great on a vehicle travelling at high speed so Autoliv opted to use a FLIR high frame rate camera that was suitably locked down to comply with ITAR and DUT regulations. High frame rate thermal imaging can involve much red tape when it comes to export from one country to another. Not great for a car manufacturer.Fraser

author: BradC
author_rank: Super Contributor
timestamp: May 25, 2017, 08:06:11 pm
content: Quote from: james_s on May 25, 2017, 06:52:15 pmHigh speed IR cameras make great fine tuning guidance add-ons for high powered fireworks, so there are a number of places that try hard to keep them out of the hands of people who might like to use them like that.The amount of paperwork required to get some medium speed units used for CCTV into Qatar a few years ago would make your head spin. I'm sure the automotive manufacturers are doing their part in making them difficult to use.

author: james_s
author_rank: Super Contributor
timestamp: May 25, 2017, 08:30:34 pm
content: Surely anyone wanting to use such a thing for missile guidance would have the resources to make reverse engineering and re-purposing the cameras trivial? I mean it seems like designing an entire new board to interface directly with the sensor would be trivial compared to designing a workable guided missile.I guess that's the usual approach though, put a gigantic expensive and inconvenient lock on the front door but leave a window open.

author: Fraser
author_rank: Super Contributor
timestamp: May 25, 2017, 08:47:43 pm
content: You would have to ask those on the various Dual Use Technology commitees for their reasons and thought processes.Ask yourself this though...... if a technology has proven to be a tactical advantage over your enemies, why on earth would you make it EASY for them to obtain the same ? The 9fps restriction is actually generous in my opinion. If I had needed to prevent weapons use of the technology I would have limited the cameras to 1fps or even lower.As I say, this has been covered before and I do not want to quote chapter and verse about why a control is needed on this technology and go through all the counter arguments about ease of obtaining the technology on eBay etc. The regulations are extant and remain a legal requirement when selling this technology. That is all we really need to know.Fraser

author: james_s
author_rank: Super Contributor
timestamp: May 25, 2017, 09:22:11 pm
content: I just find artificial limitations annoying. I believe that if I own a piece of hardware then I am entitled to use it any way I please, and that includes unlocking the full potential of the hardware. I was similarly annoyed the way earlier GPS hardware was deliberately crippled but at least that requirement went away eventually. I don't care what their reasoning is, it's stupid, nefarious people will always find a way around such limitations leaving legitimate users as the only ones impacted.

author: xmjacky
author_rank: Contributor
timestamp: May 26, 2017, 01:04:23 am
content: Quote from: Rasz on May 25, 2017, 04:24:38 pmI think you are misunderstood, I came from China, concerned about "EEVblog" has been a long time, I just haven't posted any posts, The screenshot of the logic analyzer can prove what I said.Studying this is just out of interest, it's for fun. make it work instead of turning it into a scrap metal. I think you should be able to understand that feeling

author: xmjacky
author_rank: Contributor
timestamp: May 26, 2017, 01:21:18 am
content: Quote from: james_s on May 25, 2017, 08:30:34 pmIf it's for military use, I don't think it's going to come here at all.Just a FPGA can do, no matter which country has more resources to handle this

author: Rasz
author_rank: Super Contributor
timestamp: May 26, 2017, 08:08:15 am
content: Quote from: xmjacky on May 26, 2017, 01:04:23 amWhy did you initially put Iran in your profile ?to help you at this point would be crazy

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 26, 2017, 09:21:34 am
content: Quote from: xmjacky on May 26, 2017, 01:21:18 amYou know FPGAs are export controlled as well, right?

author: KE5FX
author_rank: Super Contributor
timestamp: May 26, 2017, 10:46:10 am
content: Quote from: Fraser on May 25, 2017, 08:47:43 pmBecause the bad guys will find a workaround, and everyone else will be inconvenienced. Pure security theater.

author: Fraser
author_rank: Super Contributor
timestamp: May 26, 2017, 12:22:07 pm
content: Your statement appears to be that of a disgruntled consumer. Those who NEED the technology in a friendly country can have it. That has ALWAYS been the case. Just contact FLIR, do the paperwork and pay your money. Nobody is stopping you owning a high resolution, high frame rate camera.It should also be remembered that the ONLY reason we have such advanced and affordable thermal imaging cameras these days is Military use and the Government military budgets that paid for the development of the sensors. The civilian world benefits from this military development because we were permitted to buy and own this technology. It was never a right to own it. The situation could have remained as it was when I started using such technology... high spec cameras were only provided to friendly Governments and scientific/Industrial institutions, and then, only after security checks.Many will likely disagree with me, but we should honestly be grateful for what we have, rather than whinging about thermal camera prices, current technology limitations or Government restrictions. People appear to not know just how fortunate they already are !If anyone wants a really nice high quality thermal imaging camera, contact FLIR and I feel sure that they will help you obtain the obje t of your desires.If you want high performance thermal imaging on the cheap via a hacked Autoliv camera....... you are on your own. But that is surely part of the 'fun' of hacking for those who do suchYou have never had it so good ......... enjoyFraser

author: lukier
author_rank: Unknown
timestamp: May 26, 2017, 12:41:29 pm
content: In principle I agree with the need of export controls - while there are anti-radar measures and counter measures for other guidance systems, the thermal response is difficult to hide. The only thing I know of is the thermal masking on the prototype polish PL-01 tank.I'm curious though if the export controls are effective. Somehow it didn't stop the North Korean and Iranian nuclear programs - see Siemens PLCs (Stuxnet), Mitutoyo's coordinate measuring machines and similar cases. I think the BIS export control lists are a bit outdated (mentioning tape devices etc), while sometimes having quite broad definitions (e.g. anything that digitizes analog signal with such and such parameters). For example 1 GHz oscilloscopes are export restricted (to some countries) - 1 GHz scope is not a big deal nowadays, even Rigol makes them.

author: Fraser
author_rank: Super Contributor
timestamp: May 26, 2017, 12:58:25 pm
content: I agree that the export controls need to be revisited. They are outdated in many areas. The intention was good, and appropriate when written. The World of technology moves very fast. This may be why the regulations are 'broad brush strokes' to cover current and predicted future developments.One thing I know about policies and regulations is that there will always be people who wish to circumvent them through legal loop holes. That fact makespolicy writers very prone to creating complex and comprehensive documents. I speak from the position of being a security policy author.Thermal imaging is a powerful tool and so the regulations on its distribution were made quite draconian. There has been relaxation of the regulation content over the years and the policy makers included the commercial world in the meetings that created the current policies and regulations. This was essential now that thermal imaging has become important in many industries outside the Military.Finally, there will always be failures in policy, regulations and people. Regulations do not prevent people on-selling a controlled product to an inappropriate or illegal destination. The regulations do enable a Government to prosecute that individual or company however. Just look at the Iraqi SuperGun and Missile system Batteries legal cases. Both defendants went to prison so they could do no further harm. That was only legally possible because of the legally binding regulations controlling such exports.Fraser

author: james_s
author_rank: Super Contributor
timestamp: May 26, 2017, 03:57:16 pm
content: It's the same with many things, as the saying goes "The road to hell is paved with good intentions." I very often encounter rules and regulations designed to stop various forms of abuse that instead only affect legitimate users. All forms of copy protection are like this, security dongles, HDCP, all of the various protections on CD and DVD media, it all creates hassle for paying customers but the pirates have no trouble cracking it. I also fundamentally hate intentional crippling, if the hardware is capable of doing certain things, I want to be able to utilize all of those features without any of it being locked out. Also I think people should be able to enjoy the cool technology the world has to offer regardless of what country they live in. The real danger in the modern world is small groups of individuals with very crude and often improvised weapons. The Oklahoma city bombing, 9/11, the subway bombings, the recent concert bombing, the list goes on and on. None of these attacks used any sort of fancy controlled technology whatsoever. The world has moved on and outdated export controls do not offer a lot of protection.

author: xmjacky
author_rank: Contributor
timestamp: May 27, 2017, 12:51:10 am
content: Quote from: Rasz on May 26, 2017, 08:08:15 amI don't know how it was set up in Iran

author: xmjacky
author_rank: Contributor
timestamp: May 27, 2017, 01:01:59 am
content: Quote from: mikeselectricstuff on May 26, 2017, 09:21:34 amSome high-end models do export controls, but this is only "EP3C25U256" and can be purchased anytime in China.

author: zxase258
author_rank: Contributor
timestamp: August 30, 2018, 02:10:11 am
content: Hi. I am also from China.Last year I tried to crack the BMW Night Vision Thermal Imaging Camera. It is a version with analog video output and LIN control. I am fortunate to have a complete set of components (CAMERA+CONTROL UNIT) and a possible VIN code. I purchased a programmer that can decrypt 9S12 from taobao. I tried to read the binary file in the control unit. But the programmer seems to be faulty and may have damaged the control unit microcontroller---When entering decryption, the programmer The internal power supply makes a lot of noise, there may be a short circuit, and the data cannot be read. Later I bought a new microcontroller from the other vendors for the programmer. The data has now been read, but it is not certain if he is undamaged. And the data read out has 2Mbyte. And the microcontroller memory doesn't have that much space...With regard to those export restrictions, it should be aimed at extremely backward countries. For example, if they want to connect their cameras to a TV, they can be used as an excellent reconnaissance equipment. Rather than rebuilding the camera's control system.

author: xmjacky
author_rank: Contributor
timestamp: August 30, 2018, 01:04:53 pm
content: Can you add me to chat? 我的微信号xmjacky0415