Radio/Head unit software/interface

For discussing the software that runs on the stock MG ZS EV head unit and how to interface with the unit itself.

1 Like

Firmware and instruction manual

Software details

  • Vehicle concerned: AS23+ZS11E+ZS11MCE+EP22 vehicles equipped with DESAY SV color radio
  • Version: 202004021022
    • Source: /update.zip/root/etc/version
  • Version_extra: ZS11_EU_NAVI_8in_16G_01_20200402
    • Source: /update.zip/root/etc/version_extra

Engineering Mode

  1. Press Setup on the Home screen.
  2. Open the System menu.
  3. Press all four corners within the main area in this order (counter clockwise):
    1. Top left
    2. Top right
    3. Bottom right
    4. Bottom left
  4. Wait for a few seconds.
Exact location of the four corners

Developer Menu

  1. Press Setup on the Home screen.
  2. Open the System menu.
  3. Press all four corners within the main area in this order (clockwise):
    1. Bottom left
    2. Bottom right
    3. Top right
    4. Top left
  4. Menu opens on the right.
  5. The menu has three main categories:
    • General - Run various tests.
    • Screens - Toggle between screens in the system.
    • Languages - Toggle between available languages.
  6. Complete list with all available menu options translated from Chinese to English.
Exact location of the four corners

Note: The order is 4-3-2-1.

Section reserved for key findings

* Wifi Connection?
* Root Access?
* Installing external apps (APKs)?

Potential wifi/bluetooth connection details collected from various files:

VehicleID MG BT_09F3 SSID Mac Pwd WifiInfo Extend {“ServerIP”:“192.168.50.1”, “ServerPort”:50001, “PreSerialNo”:“0123456789”, “IsDebug”: 1} %s%s(%u|0x%08lX) [%s] INFO: DVRConnectWifiMgr::GetHeadCobsPackage,msgType[%d],seq[%d],serviceID[%d],msgID[%d]

\01_SW\svp\etc\svp.wifi.conf

WPA_NETWORK_IP_ADDRESS = 192.168.0.22
HOSTAPD_DEFAULT_NAME = DS03L
HOSTAPD_NETWORK_IP_ADDRESS = 192.168.50.1
DHCP_RANG_FROM = 192.168.50.2
DHCP_RANG_TO = 192.168.50.20

\01_SW\svp\etc\udhcpd.conf

.# The start and end of the IP lease block
start 192.168.50.2
end 192.168.50.20
opt dns 8.8.8.8 8.8.4.4 #public google dns servers
option subnet 255.255.255.0
opt router 192.168.50.1

\01_SW\svp\etc\wifi_and_ap.sh

ifconfig wlan0 192.168.43.1 netmask 255.255.255.0
dnsmasq --no-daemon --no-resolv --no-poll --dhcp-range=192.168.43.100,192.168.43.200,24h &

\01_SW\svp\etc\hostapd.conf

ssid=gan5G55
wpa_passphrase=123456789
wpa_key_mgmt=WPA-PSK

Looking in \01_SW\svp\etc\init.sh, it looks like when there is a file ap31ForceUpdate.xml on the USB during boot, it will try to start /svp/bin/forceupdate. Not sure what happens then, but it might fail and just bail out and show some error message and/or some admin panel?

Searching for usbstorage0 in file \01_SW\svp\lib\rn2\qml\libEngineeringHMI.so highlights more files that are potentially read when attempting an upgrade.

Just joined this. Hi.

The wifi config does not seem to be from /svp/etc/hostapd.conf but from a local stored /storage/data/hostapd.conf . The first one only seems to be a example/default config.
See the /svp/etc/svp.wifi.conf file which points to the storage location. The service binary /svp/bin/wifiservice uses this file as configuration.

Currently for me /storage looks to be a partiion (/dev/mmcblk0p6) on the main internal storage of the HU. So for now it is unclear if the hostapd.conf in that /storage dir is having any usefull config for wifi access.

Further, this wifiservice is started at boot eventually from /svp/etc/init.sh (which is started from the root /etc/init.d/boot-hmi). This init.sh script runs the /svp/bin/initdata binary which in turn runs /svp/etc/start_module.sh with module names as option. SAIC_WIFI is one of the options. This then start the svp_start_service.sh script which finally starts the wifiservice binary which I mentioned above.

To conclude, I am pretty sure the wifi service is started. However we don’t known the content of /storage/data/hostapd.conf as it is on the internal storage of the HU.

Looking through that last file (libEngineeringHMI.so) it seems that this is the content of the force update file:

<?xml version="1.0" encoding="UTF-8"?>
<config>
<!-- follows are generated automatically,don't need to edit -->
<update-flag> ALL </update-flag>
</config>

I guess that this can be used to force update without a public/private RSA check which seems to run only when you plugin the usb stick and select the update button on the GUI (it checks the Checklist file for RSA validation). If I am right it means that we can change content of the update and ignore the Checklist file by just adding the force update file. Who dares to try? :smiley:

2 Likes

Interesting regarding the possibility of pushing an update to it!

I’ve tried today using usb to serial adapters (PL2303) to see if I could interface using a null modem cable but unfortunately not.

I noticed in engineering mode there’s a USB_0 host and device option, tried both of these but no different.

Someone mentioned something about connecting direct with USB as the unit may use ADB?
This stands to reason as there’s references to ADB in the update but not sure if this is host or client.

I wouldn’t want to try a type A to type A cable on my head unit without confirmation though!

I already did try type A to type A cable on headunit and laptop but nothing. Device manager doesn’t see new connection even when I press buttons in the usb test menu.
However my laptop did reset suddenly while doing this. Not sure why.

@mikeRES looking at the possibility to install software on the head unit. Would this mean having the Thai/Indian “update.zip” would enable us to have the same functionalities (e.g. remote access, app controle, etc) as those cars have?

Apparently, the Dutch ZS EV cars have the following T-box (Xbox) unit installed for emergency services (SoS), perhaps the possibilities of the T-box can be extended with the more advanced Thai or Indian Head unit software?

Bottom-line, what kind of new features can we think of when having full access to the software on the head unit (instead of just only OVMS)?

Did anyone yet identified the hidden network from the head-unit? I was unable to connect with the credentials

ssid=gan5G55
wpa_passphrase=123456789
wpa_key_mgmt=WPA-PSK

Also with the app SAIClink (iOS) I could not get connected over bluetooth.

I tried plugging in a usb WiFi dongle from boot up but it didn’t do anything.

I also tried plugging in a USB keyboard. It seemed to activate ok and the Caps and Num Locks worked but it didn’t respond. I was hoping Alt-CTRL-F Key would get to a console but again it didn’t work.

Has anyone tried a usb ethernet port?

Found another hidden developer menu.

  1. Press Setup on the Home screen.
  2. Open the System menu.
  3. Press all four corners within the main area in this order (clockwise):
    4. Bottom left
    5. Bottom right
    6. Top right
    7. Top left
  4. Menu opens on the right.

The menu has three main categories:

  1. General - Run various tests.
  2. Screens - Toggle between screens in the system.
  3. Languages - Toggle between available languages.

See this complete list with all available menu options translated from Chinese to English.

1 Like

We are in the UK definitely missing hardware, and it is not clear if these “Xbox” units are the same as the one used in Thai markets (we think it is there for EU ECall requirements). We may be able to unlock the extra menus but we probably cannot go further without API and server side support.

If anyone is interested, a Belgium car wrecker is selling of the parts from a crashed MG ZS EV, including the radio module for €200.

Looking at the pictures, I can’t tell whether or not the tiny bit of green PCB that shows has a USB port on it or not. If so, I wonder if that is where the cable goes that connects the two ports in the center console or if it might be a dedicated port for diagnostics?

Update: The MG ZS ICE navigation module shown below does not have this extra board and is also lacking the brown port that is shown.

Update #2: Someone had some better pictures and already pointed out that it’s not a USB port.

I’ve being trying to decompile some of the update code to better understand it.

So far I’ve tried to decompile “forceupdate” It checks the update file is valid and then copies it across using external functions.

I found a number of those functions in “libsvapi.so.1”

The key functions appear to be:

svapi_upgrade_package_is_valid
svapi_upgrade_set_flag
svapi_upgrade_copy_to_emmc

When I attempt to decompile “libsvapi.so.1” it says those functions are undefined. I’m guessing they are stored somewhere else.

If anyone can find which library they are in I may be able to decompile them and work out what makes a file valid.

Have you guys seen that in Thai version head-up display shows valuable battery info?

This is from Bjørn Nyland’s MG which he owns.

Any chance of enabling the same on EU models? @mikeRES any thoughts?

The Thai unit has physically different hardware unfortunately.

I think the next steps would be to find out what sort of data the UK unit actually has access to.
I am making a broad assumption that it must have sort sort of tie in to the cars CAN in order to be able to set parameters (e.g. auto high-beam off) and get data (e.g. temp on new update and HVAC settings).

If we can figure out that part then perhaps we can figure out how to interface with the CAN using OVMS to set data such as HVAC.

In theory if we were able to make modifications to the head unit software and the head unit has CAN query capability then it could be possible to add a SoC display for example.

1 Like

Updated download links:

do all the variants of head unit run the same underlying OS?
are they all running linux, or is there a variant that runs embedded Windows? I vaguely recall something like that.

Hi

Thank you for the great Thread

i have MG HS AS23 i need the headunit firmware can anyone help?