Technical Red connector on the side of the SatNav

Currently reading:
Technical Red connector on the side of the SatNav

Proudstiloowner

New member
Joined
Jan 2, 2018
Messages
7
Points
1
I'm trying to figure all ins and outs of the SatNav

Does anyone knows what's this red connector has it's purpose for?

rtjkgy.jpg
 
Haven't tried it yet, but could it be a terminal where one could enter the VxWorks os?

Sorry... I don't know.

If you use the 'Search' button on the green bar above, then click 'Advanced Search', then search for post by forum member danhans115 you may find more information. He was investigating JTAG and VxWorks for the Connect Navs several years ago.
.
 
Last edited:
Havent been on here in years, just came on by chance :)

The red connector has UART (serial) connections on it, although it was years ago since I owned a Stilo so cant remember the pinouts.

The only output you ever get from that port is one line of text (think it was either 9600bps/115200bps) saying something like vxworks ready - you can see this by using a simple 3.3v USB UART but it is useless - there isnt a debug shell or anything present. If you take the lid off, a little bit further up the right hand side of the mainboard is a row of around 8/10 soldered pins, this is the JTAG connections to the CPU.

Back when I had a Stilo (around 2010) open-source or free tools to use the SH-4 processor as a target were very thin on the ground, and commercial products very very expensive. but with the explosion of the maker movement there is much more available now with openocd and the like getting better and cheaper clone hardware from China.

Basically, from an attack/hack point of view you have two options. You can unpack the compressed binary image on the update CD - vxworks uses a very simple flash file system that resembles FAT16 so you can see the files and contents easily. Any changes made to that image would then need to be repacked in the same manner and the checksum recalculated (never fathomed out what type of checksum calculation was used) so it could be flashed back from CD - all a bit risky unless you have a recovery method. I hacked a simple utility to allow unpacking, but lacked the programming knowledge to repack.

Second method (probably more feasable).. You would have to get a JTAG adapter that is supported by openocd and see if you can scan the jtag chain and access the flash part, then you may be able to dump it or rewrite it.
I did try this with a simple wiggler (parallel port) interface, but never got it to work.

I may still have all my files someplace, so if they are of any use I can post the pin outs I traced out and the rest of my findings. I did have them on a blog somewhere but assume that it has now closed down.

Hope the above helps.

PS.
Hope you are keeping well Davren - I do strangely miss my Abarth :)
 
Last edited:
Back
Top