NavPro connectors - possible hack to enable carnet on MIB1

[phope]

Car Net in the US market doesn't seem to be the same as in Europe and other markets

https://carnet.vw.com/portal/en/owners/carnet/

It seems to be more along the styles of the On-Star services provided for years by the likes of GM - car tracking, emergency services tools, etc

[fredgroves]

Yes, I thought that too and commented when that link I pasted here came up the first time.

So the European carnet phone module is inside of that "media unit" in the glovebox we think?

I guess that would make sense, given that the SIM card slot is definitely in that unit (I can see that in my owners book). I don't think you could or would extend wiring some distance to a SIM card like that.

[fredgroves]

Reading the doc from Kevin again, I've figured out some interesting stuff:

1) The document he sent me shows the "media unit" in the glovebox makes no mention of the SIM card slot - I wonder if this is a UK specific VW manual...

2) The thing we all stare at in the dash is not actually the computer that drives it all - the thing in the dash is just a display and controls. The unit (known in VW speak as "J794") is actually under the drivers seat. Looks like it itself might be a plug in module  - which makes sense as it would allow for Nav/NavPro to be a simple plug in board. The "box" it sits in is known as J856.

3) The TV tuner I found reference to is also another module that plugs into the J856

4) In the glovebox media unit thingy (known as a "Chip Card Reader D8") it also has a toll sender unit... this will be like a Dart tag style automatic toll both ID sender for cashless toll payments.... kinda worrying that this technology is already in our cars eh?

I'll have to go take a look at my car in a sec and see if I can look at the J856 box under the seat - looks like the modules plug in from the rear - whether the box is totally encased I don't know yet - there might be some visible connectors.

Don't suppose Kevin that there is any manuals detailing the J856 and J794?

[fredgroves]

Well, I've just spent best part of 20 mins looking for the J856 box under the drivers seat.

Its not on the floor and its not in the seat unit itself (there are only 2 wires to the seat, which must be for passenger protection systems - from the schematic I know the J856 must have multiple cables)

So it must be under the carpet.... oh well.

[fredgroves]

I found this link from VW Vortex:

http://media.ccc.de/browse/congress/2013/30C3_-_5360_-_en_-_saal_2_-_201312281600_-_script_your_car_-_felix_tmbinc_domke.html#video&t=2225

This is a hacker showing you how to gain control of the bluetooth module.

Its very interesting...

But even if you don't understand the computer geeky bit, the bit which may interest you and backs up what I was saying before - the menus on the MFD and the steering wheel buttons all communicate using CAN bus messaging.

The phone menu on the MFD is sending stuff to the bluetooth phone "computer" whereas other things you select from the screens go to different modules.

I was always under the impression that one "box" (the thing in the dash) did all of this stuff, but it seems that there are multiple systems that send formatted messages to the display unit instead.

Don't know if this is interesting to anyone else, but hey, thought I'd share it

[kevinm]

The document I sent you is just for the wiring and plugs for each unit. I would not expect it to mention the sim card slot so i wouldn't read too much into that. Also this is a general mk7 document and covers many different regions and car specs.

The card reader you mention is for the road toll system that is Japan only so European cars don't have any of the hardware for it. There is no way VW would fit a discrete module that would just be disabled. In addition to the reader, there would be a sender unit at the top of the windscreen.

I think the reference to the TV antenna is because the amplifiers in the boot lid are combination amplifiers. Some versions are AM/FM only and some are AM/FM/TV with an additional plug that goes to the TV Tuner. It's the same for DAB. VW just fit a different amplifier The TV antenna is not wired to the unit in the glovebox.

The J794 in the glovebox communicates with the Dyna-audio and TV tuner over the MOST bus. This is plug O in the schematic for J794.

The J856 nav module under the seat must be special equipment fitment. It could be for police/emergency cars. There's no mention of it anywhere else in ELSA or ETKA. I had the front seats out out of my car when I fitted rear footwell lights and I did not see any module under the carpet. Also, as it is connected to the CAN network, it would show up in a vcds scan.

In lower spec radios, the screen and brains are combined in the centre console. There is no unit in the glovebox.

The Carnet module behind the clocks is only fitted to the GTE and e-Golf in europe.

[fredgroves]

In that video link I posted earlier today at 7:40 you see him show you where that J856 module is - albeit on a left hand drive car (and I think a Mk6 golf too)

Looking back at the schematic, it says the module is under the right hand seat, but I noticed the diagram shows a left hand drive car.

I must get myself a VCDS kit

[kevinm]

In that video link I posted earlier today at 7:40 you see him show you where that J856 module is - albeit on a left hand drive car (and I think a Mk6 golf too)

Looking back at the schematic, it says the module is under the right hand seat, but I noticed the diagram shows a left hand drive car.

I must get myself a VCDS kit

That module in the video is the bluetooth module. Bluetooth was not integrated into the radio in mk6 generation cars (except RNS315).

On the fitting locations, if it says right side, the module is located on right irrespective of the location of the steering wheel. If a module's location moves, it will say driver's side opposed to left or right. Look at the location description for the parking aid module.

[fredgroves]

Ahhh ok.

Thank you!

I am guessing that if I was to look in VCDS I'd be able to see all of the discreet modules because VCDS connects via the diagnostic port to the CAM gateway (if what the hacker guy said is correct).

[kevinm]

Ahhh ok.

Thank you!

I am guessing that if I was to look in VCDS I'd be able to see all of the discreet modules because VCDS connects via the diagnostic port to the CAM gateway (if what the hacker guy said is correct).

Yes vcds will show you all of the modules connected to it. If you do an autoscan, it will also show you the sub-modules that are connected on the various LIN bus networks. For example see below.  5Q0 937 084 AE is the part number of the BCM connected to the CAN Bus. But it also shows 3 sub-modules (wiper motor, rain sensor and another I'd have to look up). The sub modules communicate to the CAN bus through the BCM over their own LIN bus. There are a number of LIN buses. The rear window motors are controlled by the front door modules over a different LIN bus. The xenon range module communicates with the motors in the xenon headlights over another LIN bus.




Address 09: Cent. Elect. Labels: None

Part No SW: 5Q0 937 084 AE HW: 5Q0 937 084 AE

Component: BCM MQBAB H H16 0124

Coding: 03011E46C20122FB0B244080B11C07281800000000000000000000000000

Shop #: WSC 01357 011 00200

ASAM Dataset: EV_BCMCONTI 012001

ROD: EV_BCMBOSCH_VW37.rod

VCID: 7BFE0C91F21800C6C11-802E

Subsystem 1 - Part No SW: 5G2 955 119 A HW: 5G2 955 119 A

Component: WWS 131121 042 0551

Serial number: 131123075337

Coding: 0E4DDD

Subsystem 2 - Part No SW: 5Q0 955 547 HW: 5Q0 955 547

Component: RLFS 024 0042

Serial number: Y13M07D06H08M39S56S1

Coding: 00A8DD

Subsystem 3 - Part No: 5Q0 951 172

Component: Sensor, DWA

No fault code found.