Remember Me? MX-5 Miata Forum
Join us now!
Help/Rules Calendar
ND Infotainment and Electronics Mazda Infotainment System and other auto electronics, such as Cameras, Warning systems (LDWS, BSMS, etc), sensors, and other non-engine electronics. Also for Blutooth, Navigation, Audio, Apps, and Keyless Entry.
MX-5 Miata Forum > ND (2016+) Miata > ND Infotainment and Electronics > [Guide] ND1/ND2 - Touchscreen in motion on latest FW, No hardware required Reply
Page 1 of 24 1 2 3 4 5 6 7 8 9 10 11 > Last »
Thread Tools Display Modes
Old 9th June 2024, 04:10 #1 Yorkfieldx Second gear
Join Date: Mar 2023 Location: Sydney Posts: 180
[Guide] ND1/ND2 - Touchscreen in motion on latest FW, No hardware required Due to popular demand I'm publishing a step-by-step guide on how to access the engineering menu [allowing to activate touchscreen in motion] on ND1/ND2 with the latest firmware version.
This method does not require you to disassemble the car or install any third party hardware.
TESTED ON LATEST V74 FIRMWARE
What this gives you:
- Ability to disable "Touchscreen in Motion" restrictions (allows to use touchscreen at any time)
- Access to Linux root shell
- By extension to the previous point, ability to install Mazda AIO Tweaks
Disclaimer IMO procedure is very safe and not very involved, however, as always with things like this, I am not responsible for any damages to the car / infotainment system and everything you do is AT YOUR OWN RISK.
Now that we’ve got this out of the way, let’s begin.
This method was discovered a while ago and shared on Mazda3Revolution forums. I'm just putting this together as a text guide for others to follow. It's referred to as "MP3 Hack" or "XSS Exploit".
How does this work A bit of technical background- head unit (also known as CMU- Connectivity Master Unit) on ND1 and ND2 is an embedded computer. Not in a way your engine control unit or pretty much any other piece of electronics in a car is called a "computer", but a bit more literally. It's running Linux operating system, and has some programs installed on it, similar to a server or your conventional "personal computer". The "UI" or what you actually see on a screen is just a web browser, with a "locally served“ webpage rendered on it. Webpages, apart from visual elements, may contain executable code, JavaScript. Normally any visual elements on a webpage should be "sanitised", meaning visual element shall NOT be treated as potentially executable code (e.g. I can't write a bit of JavaScript code in this post, and make your browser execute it), but the company (not to be named) that has developed Mazda's CMU may have skipped this Web Dev 101 class and caused this vulnerability which is called XSS (Cross-Site-Scripting).
So, the "hack" really only does this:
- The "title" of the .mp3 file contains JavaScript executable code
- When you go to play that file in your car, the UI (browser on the CMU) renders the title of the song on a webpage, which in turn, due to sanitisation failure, gets executed.
- Executable code, in this case, third-party code, performs the same operation as you could previously do manually on earlier versions of CMU firmware, "programmatically" opening the in-built diagnostics/engineering menu. 3.5) This works, because the company (not to be named) that has developed Mazda's CMU, rather than completely patching out this diagnostics menu pretty much "disabled visible buttons" allowing to access it. The menu itself is still there.
Step by step guide
[Prepare USB Payload]
- Go to https://github.com/mzd-evo/mzd-connect-1-root and click on green “code” button and choose “download zip”.
Example Screenshot
- This will download the archive with USB payload
- Unzip the downloaded file
- The resulting folder “mzd-connect-1-root-main” contains all the files and folders you would later need to copy over to a USB drive
[Prepare USB Drive]
- Pick a USB flash drive you’d like to use for this
- Format the drive as FAT32 (This will delete all the data) and give it a recognisable name- I named mine “MAZDA”. If you’re doing this under MacOS, use Disk Utility and make sure you pick “FAT” and “Master Boot Record”.
- Copy the CONTENTS of “mzd-connect-1-root-main” folder onto the USB Drive
How your USB Drive should look like in the end
[Run the exploit on the car]
- Put the car in ACC mode or start the engine
- Wait for infotainment system to boot up completely, show disclaimer, and give it 1-2 minutes to “settle”.
Get to this screen
- Plug the USB drive into one of the USB ports
Example
- You should see the car recognise plugged in USB drive and show it’s name in a little pop-up at the top saying “USB1/2: MAZDA (or the name of your drive) Connected”
USB Recognised
- If you're not already on it. go to infotainment menu (list containing Bluetooth Audio, Apple CarPlay, and etc) and find an entry for your USB Drive (e.g. USB 1 - MAZDA)
- Select it, and you should see infotainment attempt to “play” files from it.
USB Playback Started
- If you prepared your USB correctly, you should see a white popup screen appear. On this screen tap “Open Terminal”
Exploit executed successfully
- Wait a few seconds and you will see the standard diagnostics menu
Standard diagnostics menu Standard diagnostics menu a few seconds later
- A few seconds later, “Choose a script you would like to run” popup will appear.
Script Menu - 1 Script Menu - 2 Script Menu - 3
- Tap “Next” twice, until you see “LVDS SPEED TOGGLE” in the top left corner of the pop-up window
- Tap on it, and you should see another popup saying “LVDS Speed Restriction has been toggled: DISABLE”
Result Message
- Tap OK, and turn the car off
- Unplug USB
Congratulations, you have now activated touchscreen in motion. You can now go for a drive and test it out.
DO NOT CLICK ON ANYTHING ELSE IF ALL YOU WANT IS TOUCHSCREEN IN MOTION This "setting" persists until you go into the engineering menu again and change the setting back yourself.
For those who want to poke around firmware, you may open "terminal" and operate it by connecting a USB keyboard to your USB port. The terminal is under the root user, you can set your own password for it (cmu linux user), and for further convenience setup SSH and etc.
What is this Terminal" button? What is this Linux Root Shell and how do I use it? If you have to ask, respectfully, it's not for you.
What do other buttons do? If you have to ask, respectfully, it's not for you.
How do I install tweaks I might write a guide on it later, but for now it's out of scope for this post. For now I’d actually recommend against installing tweaks. Yorkfieldx is offline Reply With QuoteReply With Quote Old 9th June 2024, 07:53 #2 Shawn_C137 First gear
Join Date: Jul 2023 Location: Central Florida Posts: 49
This is so cool! Thank you very much for the detailed explanation and walkthrough. A couple questions before I run outside and install this:
Is there a way to factory reset/restore this if I mess it up, or since this is basically displaying a hidden menu is that not really a thing?
Will this enable touchscreen for Android Auto?
Thanks again for helping me distance myself from that stupid knob and bringing my Infotainment system up to basically every other auto manufacturer's standards! Shawn_C137 is offline Reply With QuoteReply With Quote Old 9th June 2024, 09:28 #3 The Answer First gear
Join Date: May 2024 Location: USA Posts: 34
Awesome, thanks for the write up. Updated to 74.00.324 a few days ago, which is the last update the 2016-2023 ND is ever going to get (2024+ ND3 is different).
I embedded the photos in your post into this quote for easier reading:
Quote: Originally Posted by Yorkfieldx View Post Due to popular demand I'm publishing a step-by-step guide on how to access the engineering menu [allowing to activate touchscreen in motion] on ND1/ND2 with the latest firmware version.
This method does not require you to disassemble the car or install any third party hardware.
TESTED ON LATEST V74 FIRMWARE
What this gives you:
- Ability to disable "Touchscreen in Motion" restrictions (allows to use touchscreen at any time)
- Access to Linux root shell
- By extension to the previous point, ability to install Mazda AIO Tweaks
Disclaimer IMO procedure is very safe and not very involved, however, as always with things like this, I am not responsible for any damages to the car / infotainment system and everything you do is AT YOUR OWN RISK.
Now that we’ve got this out of the way, let’s begin.
This method was discovered a while ago and shared on Mazda3Revolution forums. I'm just putting this together as a text guide for others to follow. It's referred to as "MP3 Hack" or "XSS Exploit".
How does this work A bit of technical background- head unit (also known as CMU- Connectivity Master Unit) on ND1 and ND2 is an embedded computer. Not in a way your engine control unit or pretty much any other piece of electronics in a car is called a "computer", but a bit more literally. It's running Linux operating system, and has some programs installed on it, similar to a server or your conventional "personal computer". The "UI" or what you actually see on a screen is just a web browser, with a "locally served“ webpage rendered on it. Webpages, apart from visual elements, may contain executable code, JavaScript. Normally any visual elements on a webpage should be "sanitised", meaning visual element shall NOT be treated as potentially executable code (e.g. I can't write a bit of JavaScript code in this post, and make your browser execute it), but the company (not to be named) that has developed Mazda's CMU may have skipped this Web Dev 101 class and caused this vulnerability which is called XSS (Cross-Site-Scripting).
So, the "hack" really only does this:
- The "title" of the .mp3 file contains JavaScript executable code
- When you go to play that file in your car, the UI (browser on the CMU) renders the title of the song on a webpage, which in turn, due to sanitisation failure, gets executed.
- Executable code, in this case, third-party code, performs the same operation as you could previously do manually on earlier versions of CMU firmware, "programmatically" opening the in-built diagnostics/engineering menu. 3.5) This works, because the company (not to be named) that has developed Mazda's CMU, rather than completely patching out this diagnostics menu pretty much "disabled visible buttons" allowing to access it. The menu itself is still there.
Step by step guide
[Prepare USB Payload]
- Go to https://github.com/mzd-evo/mzd-connect-1-root and click on green “code” button and choose “download zip”.
Example Screenshot
- This will download the archive with USB payload
- Unzip the downloaded file
- The resulting folder “mzd-connect-1-root-main” contains all the files and folders you would later need to copy over to a USB drive
[Prepare USB Drive]
- Pick a USB flash drive you’d like to use for this
- Format the drive as FAT32 (This will delete all the data) and give it a recognisable name- I named mine “MAZDA”. If you’re doing this under MacOS, use Disk Utility and make sure you pick “FAT” and “Master Boot Record”.
- Copy the CONTENTS of “mzd-connect-1-root-main” folder onto the USB Drive
How your USB Drive should look like in the end
[Run the exploit on the car]
- Put the car in ACC mode or start the engine
- Wait for infotainment system to boot up completely, show disclaimer, and give it 1-2 minutes to “settle”.
Get to this screen
- Plug the USB drive into one of the USB ports
Example
- You should see the car recognise plugged in USB drive and show it’s name in a little pop-up at the top saying “USB1/2: MAZDA (or the name of your drive) Connected”
USB Recognised
- If you're not already on it. go to infotainment menu (list containing Bluetooth Audio, Apple CarPlay, and etc) and find an entry for your USB Drive (e.g. USB 1 - MAZDA)
- Select it, and you should see infotainment attempt to “play” files from it.
USB Playback Started
- If you prepared your USB correctly, you should see a white popup screen appear. On this screen tap “Open Terminal”
Exploit executed successfully
- Wait a few seconds and you will see the standard diagnostics menu
Standard diagnostics menu
Standard diagnostics menu a few seconds later
- A few seconds later, “Choose a script you would like to run” popup will appear.
Script Menu - 1
Script Menu - 2
Script Menu - 3
- Tap “Next” twice, until you see “LVDS SPEED TOGGLE” in the top left corner of the pop-up window
- Tap on it, and you should see another popup saying “LVDS Speed Restriction has been toggled: DISABLE”
Result Message
- Tap OK, and turn the car off
- Unplug USB
Congratulations, you have now activated touchscreen in motion. You can now go for a drive and test it out.
DO NOT CLICK ON ANYTHING ELSE IF ALL YOU WANT IS TOUCHSCREEN IN MOTION This "setting" persists until you go into the engineering menu again and change the setting back yourself.
For those who want to poke around firmware, you may open "terminal" and operate it by connecting a USB keyboard to your USB port. The terminal is under the root user, you can set your own password for it (cmu linux user), and for further convenience setup SSH and etc.
What is this Terminal" button? What is this Linux Root Shell and how do I use it? If you have to ask, respectfully, it's not for you.
What do other buttons do? If you have to ask, respectfully, it's not for you.
How do I install tweaks I might write a guide on it later, but for now it's out of scope for this post. For now I’d actually recommend against installing tweaks.
2019 RF GT-S MT - Titan 7 T-R8 17x9+45/PS4S 245/40R17 Last edited by The Answer; 9th June 2024 at 09:48. Reason: Added quote of OP with pictures embedded. The Answer is offline Reply With QuoteReply With Quote Old 9th June 2024, 11:12 #4 MaladjustedPlatypus Second gear
Join Date: Jul 2023 Location: Florida Posts: 112
This desperately needs to be stickied. Tons of folks would appreciate the info! Thanks for sharing, the Mazda AIO for later versions is the real icing on the cake here.
2021 RF GT Snowflake White Pearl Mica Miata, Automatic. MaladjustedPlatypus is offline Reply With QuoteReply With Quote Old 9th June 2024, 14:53 #5 Unusualdesigner Moderator Unusualdesigner's Avatar
Join Date: Aug 2012 Location: Somewhere in the L. A. area... Posts: 18,347
Thank you Yorkfieldx, good work.
2019 ND 30AE /ST #0908 ... 2020 ND GT /ST. .... 2018 CX-5 . It is easier to make a steam powered lobster trap than a lobster powered steam trap.... Unusualdesigner is offline Reply With QuoteReply With Quote Old 9th June 2024, 19:41 #6 Yorkfieldx Second gear
Join Date: Mar 2023 Location: Sydney Posts: 180
Quote: Originally Posted by Shawn_C137 View Post This is so cool! Thank you very much for the detailed explanation and walkthrough. A couple questions before I run outside and install this:
Is there a way to factory reset/restore this if I mess it up, or since this is basically displaying a hidden menu is that not really a thing?
Will this enable touchscreen for Android Auto?
Thanks again for helping me distance myself from that stupid knob and bringing my Infotainment system up to basically every other auto manufacturer's standards! I’m not really sure. I can tell you though that re-installing the firmware package definitely does a full wipe of the system partition, so the answer is “maybe”.
As for android auto, you’ll have to test. I can confirm it works for Apple CarPlay Yorkfieldx is offline Reply With QuoteReply With Quote Old 9th June 2024, 19:43 #7 Yorkfieldx Second gear
Join Date: Mar 2023 Location: Sydney Posts: 180
Quote: Originally Posted by The Answer View Post Awesome, thanks for the write up. Updated to 74.00.324 a few days ago, which is the last update the 2016-2023 ND is ever going to get (2024+ ND3 is different).
I embedded the photos in your post into this quote for easier reading: Thanks mate! If the moderators could update the original post with pictures like this it would be very helpful! I couldn’t upload more than N number of pictures when I originally posted this. Yorkfieldx is offline Reply With QuoteReply With Quote Old 10th June 2024, 00:25 #8 schlapper Second gear
Join Date: Apr 2020 Location: Germany Posts: 176
Quote: Originally Posted by Yorkfieldx View Post Due to popular demand I'm publishing a step-by-step guide on how to access the engineering menu [allowing to activate touchscreen in motion] on ND1/ND2 with the latest firmware version. Hello Yorkfieldx, thanks for sharing. Would be nice if it was pinned with all the pictures. The post shouldn't get lost in the forum.
Greeting schlapper schlapper is offline Reply With QuoteReply With Quote Old 10th June 2024, 01:40 #9 johnmiata New-tral
Join Date: Feb 2024 Location: above the surface Posts: 24
Quote: Originally Posted by The Answer View Post Awesome, thanks for the write up. Updated to 74.00.324 a few days ago, which is the last update the 2016-2023 ND is ever going to get (2024+ ND3 is different).
I embedded the photos in your post into this quote for easier reading: I was about to comment to OP that this could be improved in an edit... Quoting a post this long, and embedding big high-resolution photos does not help with readability I appreciate the use of imgur as image host, as I know all too well how it feels to have to register on a website to be able to view images, or to stare at the greyed out logos of photobucket and 404 pages.
I commend the effort to document this and I agree with this being stickied.
2016 Blue Reflex Mica 1.5 "Sports-Line" When you read my posts, imagine me waving enthusiastically with the roof down johnmiata is offline Reply With QuoteReply With Quote Old 10th June 2024, 04:51 #10 DaveA Second gear
Join Date: May 2006 Location: North Carolina Posts: 170
Just to verify. Has anyone this yet and, if so, does it work? No issues? DaveA is offline Reply With QuoteReply With Quote Old 10th June 2024, 06:14 #11 Faxie First gear
Join Date: Aug 2023 Location: Netherlands Posts: 40
I'll keep an eye on this for the AIO tweaks. There are a few I would really like to be implemented. Thanks a lot! Faxie is offline Reply With QuoteReply With Quote Old 10th June 2024, 06:19 #12 bill keksz Overdrive bill keksz's Avatar
Join Date: Apr 1999 Location: Annapolis MD Posts: 14,057
I intend to try it this week. 2020 Sport, 70.000.367 ...
20 Sport MT GWR SQTT, TecnaGT, ContiDWS, Hypergrams, BaysonR air dam, Voodoo Ti, Cusco STB, some LEDs and Cravenspeed and mx5things bits, JBL Club 620F, Seat mods, CG-Lock RIP 16 Club MT; Ex-NA's... bill keksz is offline Reply With QuoteReply With Quote Old 10th June 2024, 08:46 #13 senfinger Second gear
Join Date: Mar 2023 Location: South Posts: 187
So tried this just now on MY23 Club and get the white menu, however it just sits there while cycling quickly through files and never gets another menu or screen option. I'm able to open terminal, logs and restart. But not able to get to the script menu windows. senfinger is offline Reply With QuoteReply With Quote Old 10th June 2024, 09:07 #14 johnmiata New-tral
Join Date: Feb 2024 Location: above the surface Posts: 24
Quote: Originally Posted by senfinger View Post So tried this just now on MY23 Club and get the white menu, however it just sits there while cycling quickly through files and never gets another menu or screen option. I'm able to open terminal, logs and restart. But not able to get to the script menu windows. If you can open terminal, you can check what the AIO modpack does to disable the no-touchscreen-while-moving limitation: https://github.com/Trevelopment/MZD-...chscreen-i.txt
Of course, don't do anything you don't understand. Of interest are the following lines: Code:
/jci/scripts/set_speed_restriction_config.sh disable /jci/scripts/set_lvds_speed_restriction_config.sh disable
if ! grep -Fq "//"Global.AtSpeed" /jci/gui/common/js/Common.js then sed -i 's/ .Global.AtSpeed/ //"Global.AtSpeed/g' /jci/gui/common/js/Common.js fi
I shouldn't need to stress twice to MAKE BACKUPS. So long as you can at least get into Linux via serial, you can restore any changes you do to the system. If you do anything that causes a boot-loop, you are going to have to drive to Mazda, explain the situation, and cough up several hundred dollars for them to reflash the firmware (or replace the hardware).
I'll run the thing myself tonight when I get off work. Just from looking through ./main/js/run.js, it looks to me like pressing "terminal" should open the JCI test mode after ~20 seconds (7000 ticks in the code). See the function at line 9 of this file: https://github.com/mzd-evo/mzd-conne...n/js/run.js#L9
2016 Blue Reflex Mica 1.5 "Sports-Line" When you read my posts, imagine me waving enthusiastically with the roof down johnmiata is offline Reply With QuoteReply With Quote Old 10th June 2024, 10:32 #15 senfinger Second gear
Join Date: Mar 2023 Location: South Posts: 187
3rd time is a charm... redid Zip extract to make sure it wasn't a bad/corrupt copy. Also, allowed a slightly longer startup and boot... than ran the USB... Got the second menu way faster the third time- and did the terminal just for fun /20-sec timeout... but was able to see the menu prior to this- so wasn't needed. Was able to disable the speed on MY23CLUB with no Issues so far... Thank so much for this thread!!! senfinger is offline Reply With QuoteReply With Quote Old 10th June 2024, 11:32 #16 JeffGoji & Miyoshi Sixth Gear
Join Date: Feb 2003 Location: Houston, TX Posts: 5,958
This worked perfectly on my 2023 RF GT. One caveat, it works with the Mazda screens, but if you are using Android Auto the touch screen is still disabled. I'm running Android Auto 11.9.641844, Samsung Galaxy S23.
My Car Blogs JeffGoji & Miyoshi is offline Reply With QuoteReply With Quote Old 10th June 2024, 12:34 #17 Not Daijoubu Second gear
Join Date: Jul 2023 Location: IL Posts: 189
It's great to have this functionality unlocked.
Also an Android user. What a disappointment the AA software is compared to Carplay, as much as I like Android more overall. Not Daijoubu is offline Reply With QuoteReply With Quote Old 10th June 2024, 12:53 #18 jmacken37 Third gear
Join Date: Aug 2006 Location: SE Michigan Posts: 813
Oh HOT DANG. Big thanks Yorkfieldx! I'm going to do this today. ETA: Worked like a charm!
2019 ND2 Grand Touring ST Soul Red/Tan interior. HKS SC (Retired/replaced) silver 1999 w/ 2001+ console, SE wood wheel. MP62. jmacken37 is offline Reply With QuoteReply With Quote Old 10th June 2024, 13:36 #19 shawndoggy First gear
Join Date: Oct 2019 Location: Reno Posts: 60
Oh wow, this is awesome. Just did the flash and drove around the block. Carplay actually works as intended now! It's like having a whole new headunit! shawndoggy is offline Reply With QuoteReply With Quote Old 10th June 2024, 14:10 #20 kirkusinnc New-tral
Join Date: Aug 2023 Location: Cary, NC Posts: 14
I can confirm this works on my 2021 RF GT. And, as others have reported, Android Auto doesn't work. My suspicion is that the "hack" enables the touchscreen only. If the underlying system has disabled a feature or menu item from using the touchscreen (Android Auto, many of the settings selections, etc) when the car is moving, you are still going to be disabled. Kirk
-- Kirk Smith Cary, NC kirkusinnc is offline Reply With QuoteReply With Quote Old 10th June 2024, 14:42 #21 senfinger Second gear
Join Date: Mar 2023 Location: South Posts: 187
I went ahead and did the Speed Toggle also since it reverses some of the other speed related items as found in the Fiat124 forum... along with the LVDS Speed Toggle. = ) senfinger is offline Reply With QuoteReply With Quote Old 10th June 2024, 15:19 #22 Ringwuppie New-tral
Join Date: Jun 2024 Location: Vught Netherlands Posts: 7
Thank you very much! Worked perfect on my 2019 ND2.
The white screen with the diagnostic menu became visible again when the ignition was switched off -> on. I then tapped 'Reset' and the system rebooted and everything was fine. Ringwuppie is offline Reply With QuoteReply With Quote Old 10th June 2024, 15:57 #23 JeffGoji & Miyoshi Sixth Gear
Join Date: Feb 2003 Location: Houston, TX Posts: 5,958
Quote: Originally Posted by senfinger View Post I went ahead and did the Speed Toggle also since it reverses some of the other speed related items as found in the Fiat124 forum... along with the LVDS Speed Toggle. = ) I'm interested in this, what other settings does it affect?
My Car Blogs JeffGoji & Miyoshi is offline Reply With QuoteReply With Quote Old 10th June 2024, 16:41 #24 RLBullivant Second gear
Join Date: Aug 2023 Location: St. Louis Posts: 125
Awesome work! And thanks for the share with excellent details! RLBullivant is offline Reply With QuoteReply With Quote Old 10th June 2024, 19:55 #25 KZcheese First gear
Join Date: Jul 2021 Location: Massachusetts Posts: 38
I tried this today on my '23 ST and it worked like a charm. The 1st menu stayed after restarting the car a couple of times so I hit the "restart" option and gave it a few minutes. I hope this will lead to other tweaks such as pausing on mute. Would love to have in CarPlay.
'23 Deep Crystal Blue Club MT KZcheese is offline Reply With QuoteReply With Quote Reply
Page 1 of 24 1 2 3 4 5 6 7 8 9 10 11 > Last »
« Previous Thread | Next Thread »
Posting Rules You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Forum Rules
Forum Jump
All times are GMT -5. The time now is 07:00.
Contact Us Powered by vBulletin® Version 3.8.10 Copyright ©2000 - 2025, vBulletin Solutions, Inc. Copyright ©1994 - 2025, Eunos Communications LLC
Contact Us MX-5 Miata Forum FAQ Sponsors Garage Privacy Statement ©1994-2025