Head Unit

[JW0914]

What?

https://thehackernews.com/2022/03/hondas-keyless-access-bug-could-let.html

https://www.theregister.com/2022/03/25/honda_civic_hack/

https://www.thedrive.com/tech/i-tried-the-honda-keyfob-hack-on-my-own-car-it-totally-worked

I wasn't aware of that, thanks =]. It does say something this was only discovered this year and that it only allows locking/unlocking doors and remote starting with an OEM remote start if someone uses the OEM key fob to do so and would only be effective within ~30' of the vehicle (the OEM fob's range IIRC) and does not allow takeover once remote started, nor does it allow starting the vehicle (a problem with other manufacturers).

• Starting the 10th/11th gen Civics requires a PKI exchange between the fob and the BCM (which stores a fob's encryption key within one of five slots)

Sponsored

 

[alvav]

Different electronics packages - these would have a base electronics package and would not have the same wiring and components that come in U.S. CTRs or international versions with the same electronics package the U.S. CTRs come with by default (this is why when you access the EWD [Electronic Wiring Diagram] section of Techinfo's SIS/iHDS subscription you have to manually select the CTR version, as the schematics are entirely different).




To alleviate this concern, the keyfob communications on 10th/11th gen Civics are not crackable, hijackable, or cloneable. There was a really good writeup by a security researcher back in 2017 or 2018 explaining why this is, but it has to do with spread spectrum and how the signals are encrypted.

Teslas, Toyotas, Lexuses, and a few other luxury brands are highly susceptible to exploiting RF communication between fob and car, but most 2010+ Hondas are not (there were a handful of models back in 2017/2018 that were exploitable, but the Civic isn't one of them).

I've read quite the opposite where Honda's keyless system is amongst the most susceptible. Again, I could be wrong (but I don't think so)...

 

[JW0914]

I've read quite the opposite where Honda's keyless system is amongst the most susceptible. Again, I could be wrong (but I don't think so)...

Honda uses different keyless access systems on different vehicles and AFAIK, this is the first time it's been "demonstrated" on 10th/11th gen Civics.

• The Hacker News article implies Honda doesn't use Rolling Codes on the 10th gen Civics when it actually does, per the article by a security researcher in 2017/2018 and Honda itself via The Drive article:
  "'[W]e’ve looked into past similar allegations and found them to lack substance,' said a Honda spokesperson in a statement to The Drive. 'While we don’t yet have enough information to determine if this report is credible, the key fobs in the referenced vehicles are equipped with rolling code technology that would not allow the vulnerability as represented in the report. In addition, the videos offered as evidence of the absence of rolling code do not include sufficient evidence to support the claims.'"

That being said, I weigh what a security researcher has found more heavily than what a manufacturer has stated, however 10th gen Civics do use Rolling Codes, which is at odds with what security researchers are claiming. Honda should be far more transparent about why it believes these lack substance and researchers should provide an unedited video of the exploit start to finish.

• Also in The Drive article, Honda makes a common sense point, as this type of exploit will never allow driving the vehicle, since the Key fob must be with a few feet of the ignition button for the PKI exchange with the BCM to occur, which also prevents the parking brake from being disengaged:
  "Further, access to a vehicle without other means to drive the vehicle, while hi-tech in nature, does not provide thieves an advantage much greater than more traditional and certainly easier ways to gain entry to a vehicle. And there is no indication that the type of device in question is widely used."

On a side note, I'm perplexed why anyone would install a Honda factory remote start when there are far better options from CompuStar that cost less for the whole installation, while at the same time gaining 3mile range 2way remotes using spread spectrum, and unlimited 2way range via CompuStar's DroneMobile service. For example, the only thing my OEM fob is used for is starting the car once I'm in it - the alarm and remote start is through a CompuStar 7000AS brain and a T11 remote. Using an OEM fob, regardless of manufacturer, limits the range to 30' - 100' depending on the fob, which isn't enough to even allow starting the vehicle from within most stores.

 

[vactor]

i take it safe to say that if you want to retain full interface functionality, you cannot replace the stock headunit, and that you also cannot upgrade the amplifier (and speakers) as the amplifier DSP interfaces with the bluetooth microphone in such a way that you cannot have bluetooth mic functionality with an aftermarket amp unless you keep the factory amplifier?

 

[spdmn75]

Look into this:

Products | Axxess Integrate (axxessinterfaces.com)

 

[JW0914]

i take it safe to say that... you also cannot upgrade the amplifier (and speakers) as the amplifier DSP interfaces with the bluetooth microphone in such a way that you cannot have bluetooth mic functionality with an aftermarket amp unless you keep the factory amplifier?

An aftermarket amp can be added (OEM amp remains installed) by using an amp with an SPDIF input (OEM uses an SPDIF digital coax input signal from the Audio-Nav unit [brain that sits behind the tablet]) or by using a JL Audio FiX-86 (if wanting to retain rear fade), FiX-82 (has an SPDIF optical out with analog in, and no rear fade), or other OEM integration processor. A LOC [Line Output Converter], such as JL Audio's LOC-22, would be used if only wanting to add an aftermarket amp for subs (incl. OEM sub; versus aftermarket speakers and subs, as it's the speakers that require an OEM integration processor, and when a processor is used, a LOC isn't needed unless the processor doesn't support a sub channel), whereas the FiX-82/86 also removes the horrendous factory DSP imposed by the OEM amp, returning the signal to flat [0dB] and allowing adjustments to made via JL Audio's TUN software on a PC or tablet (the version for smartphones lacks all the features available due to screen size limitations).

• When it comes to OEM integration processors and Line Output Converters, you do get what you pay for (a $25 LOC will not perform as well as a quality one that's $100, e.g. signal quality degradation)

As to the mic, there's no issue with integration provided an OEM integration processor is used.

• I use a FiX-82 with several JL Audio VXi amps and have replaced all speakers, except the two 3" speakers directly above each side of the rear seat, and added two subs (removed the OEM one), with all OEM functionality being retained.
  
  I didn't learn about the OEM amp's SPDIF input until more than a year after I did my install, so if you replace the speakers and are able to use an amp with an SPDIF input, that may be the preferred route to go (although I'm unsure how this would affect the center channel dash speaker and mic - a better option may be to tap into the SPDIF line and split the signal to the OEM and aftermarket amps), else you're going to spend 3+ hrs routing speaker cable, as the speaker output wires from the OEM amp need to be cut and the amp's side routed back to the OEM integration processor near the amps (ensure a minimum of a 6" pig tail on the connector side is left for soldering wires back together down the line, and for a proper install, run within the OEM plastic snap casings that run the length of the cabin directly under the carpet next to the door sills - they're a PIA to get open), then each speaker has to have it's wire run back to the amps (OEM speaker cables cannot be utilized with aftermarket amps since they won't support the extra wattage), under the rear seat and behind the carpet and trim in the cargo area.
  • If using an OEM integration processor with an SPDIF optical out to amps that support SPDIF optical in (e.g. FiX-82 with VXi amps), you technically could place the processor under the dash somewhere and only run a single SPDIF optical cable back to the amps (or VXi-Hub in my case), however there's not a lot of room under, or within, the passenger side dash or kick panel to house the processor, and while there's plenty of room under the driver's side dash, there are few places to mount one, not to mention OEM integration processors need unobstructed airflow around the housing since they do generate heat (minimal amounts unless ambient air cooling was restricted)
  • If using an amp with a digital coax SPDIF in, the OEM amp's SPDIF input signal could be split and a digital coax ran back to the amp, whereas an amp with an SPDIF optical in would need a digital coax to optical out converter.

While it is possible to run the dash center channel speaker through an aftermarket amp, simply upgrading it to an aftermarket 3.5" often suffices (one that doesn't require crossovers, e.g. JL Audio C2-350), providing a richer, fuller sound. To run it through an amp, it's channel would need to be run through an OEM integration processor (likely a second one, unless the processor being used has a 9 or 10 channel input - 4 woofers, at least 2 tweeters, center channel, and sub), then passed to a dedicated stereo input on an amp.

Look into this:

Products | Axxess Integrate (axxessinterfaces.com)

All Axxess offers for the 10th gen Civics are products for when the tablet and Audio-Nav Unit are removed for an aftermarket headunit:

• ASWC/AXSWC-1:
  used to retain steering wheel controls [SWC] when replacing a factory headunit
• AXSP-HN:
  Amplifier Retention Interface for use only with Metra's 99-7821B TurboTouch dash kit when replacing the OEM "headunit"

In order to add an aftermarket amp to a factory headunit with an OEM amp, either a Line Output Converter [LOC] is needed (adding an amp for subs) or an OEM integration processor is required (adding an amp for speakers and subs) - please see above.

 

[spdmn75]

I ran an Audiocontrol LC7i from the speaker level outputs of the factory amp and it sounded fine before.

 

[dt10g]

Random Brainstorm:

Could one could punt the factory Brain box into the passenger footwell, glovebox, trunk, anywhere... and then put your preferred audio system into the console?

Alternatively some aftermarket head-units have a movable display panel that (iirc) allows you up to 62" of positioning on an umbilical. So maybe you put them somewhere else and put their panel into - or in front of - the dash space somehow

 

[JW0914]

Random Brainstorm:

Could one could punt the factory Brain box into the passenger footwell, glovebox, trunk, anywhere... and then put your preferred audio system into the console?

Alternatively some aftermarket head-units have a movable display panel that (iirc) allows you up to 62" of positioning on an umbilical. So maybe you put them somewhere else and put their panel into - or in front of - the dash space somehow

Great idea and thinking outside the box, however it wouldn't be recommended unless Honda verifies in writing doing so [extending harness wires] wouldn't cause signal degradation on the multiple data lines (for the SVGs, right-click schematic graphic → open in new tab) routed through the Audio-Nav Unit. Without verification/knowing the tolerances for those data lines, it could potentially wreak havoc in other systems since the Audio-Nav Unit is connected to almost every other data system in the cabin.

• Data lines aren't like analog 12v voltage wires, as they carry protocols and/or varying voltages, amperages, and/or impedance values to communicate multiple signals across the same wires
  
  
• Another question for Honda would be potential interference on data lines depending on how the harness extension is routed, e.g. is there anything the harness extension needs to be shielded from that could cause interference on the data lines
  
  
• Getting verification in writing from Honda is a CYA, as due to the Audio-Nav Unit being tied into almost every other electronic component in the cabin through data lines, it could cause data collisions/wonky behavior, or if an issue did arise in it or another component, without written verification, it could make a potential warranty issue more complicated

 

[AirCaveman]

Lots going on in this thread… anyway!
I couldn’t stand how dated the factory unit was so I replaced the whole thing, the amp on the passenger side, even pulled the antenna tuner by the rear seat… well because.
The canbus adapter the new unit comes with can convert most of the signals, the main limitation is the software for android doesn’t have all the options as the units are not made for a specific trim level of civic. I can see maintenance minder info, reset TPMS, and many other functions. As stated before the Type R function of rev-match is not available , and that is due to coding the app. In the future will they add that function once they decode it? Wouldn’t hold my breath.
To each their own when it comes to infotainment.

 

[alvav]

For those that made the switch, some companies ask if the car has the separate factory amp as it has an additional wiring harness for the amp. As I plan on NOT using the factory amp (will be using the RCA outs), do I need to make sure to get one with this factory amp harness output? The unit that interests me the most is the Teyes and it doesn't accommodate this.

Sponsored