Optrex 323 1867 display

[symbianas]

So its SPLC501C driver which seems to be almost the same as SED1530, but has few additional commands. I was able to display stuff on display by trying to write same commands as I read.
Attached result.

Now I need to try read pins that radio sends to display and re-translate them to display. After that I could modify re-translation and intercept what is being displayed. Not sure if that is possible.

[Prehistoricman]

Awesome! I'm impressed you found the exact driver that they're using. How did you do that?

So the goal is to make translate the default commands to drive another display?

[symbianas]

Awesome! I'm impressed you found the exact driver that they're using. How did you do that?

Well, I have found information on Optrex 323 display which is different, but same manufacturer and it uses SED1531 driver. When I searched for SED1531 driver I got some suggestions about SED1530/SPLC501C as I understand they are the same or very similar, has few additional functions. And bingo, the codes I saw in logic analyzer matched the codes in documentation.

So the goal is to make translate the default commands to drive another display?

First goal would be to intercept signal - to read data pins which are sent from radio with arduino/stm32 and write them to display. Then to try to add additional information on display since radio is connected to CAN BUS I can read a lot of useful information about car and display it.

Second goal would be to use another display, but this step is challenging, as I would need same dimensions display or to 3D print radio front panel, but I have no experience with 3D printing...

[Prehistoricman]

What are the brains in this unit as it stands? I would poke about, see if there's a microcontroller with firmware that could be modified (but I'm crazy so most people would not do this).

[symbianas]

What are the brains in this unit as it stands? I would poke about, see if there's a microcontroller with firmware that could be modified (but I'm crazy so most people would not do this).

I think its Renesas H8S/2674R microcomputer which drives display. On board there is also ST10F273M chip and also S29AL016D70TF 16MB flash memory. I tried reading flash memory as I imagine all the software information is there, but has no luck, so decided to try to understand display itself. But still it would be hard to understand assembler code. I think coding with arduonu/stm32 should be much faster, but yes solution does not look very elegant.

[Prehistoricman]

Well IDA Pro supports that architecture. You can find that software for free in the right places, as I have.
If you don't know what IDA is, it basically makes the reverse-engineering process with assembly much easier.

[symbianas]

Well IDA Pro supports that architecture. You can find that software for free in the right places, as I have.
If you don't know what IDA is, it basically makes the reverse-engineering process with assembly much easier.

And how would you read/write the data from/to Renesas H8S/2674R, ST10F273M, S29AL016D70TF?

[Prehistoricman]

One hopes that the program is stored in that flash chip. So you could dump it, analyse with IDA, make changes (probably with a hex editor), and overwrite the same flash.

Flash datasheet: https://www.digchip.com/datasheets/parts/datasheet/013/S29AL016D70TF-pdf.php

CPU family programming manual: https://www.st.com/content/ccc/resource/technical/document/programming_manual/27/c0/48/83/94/9d/4d/45/CD00147146.pdf/files/CD00147146.pdf/jcr:content/translations/en.CD00147146.pdf

IDA might not support the instruction set of that CPU but it does support the Hitachi H8S ISA, so one would assume that your Renesas CPU uses that.

[symbianas]

One hopes that the program is stored in that flash chip. So you could dump it, analyse with IDA, make changes (probably with a hex editor), and overwrite the same flash.

Well thats hope. What device do I need to get to read/write it? I bet its not cheap.

As for reading signals from radio with arduino/stm32 its too slow, I guess its impossible to read pins with software. for example WR takes 187nanoseconds when its LOW, so during that time I need to get all D pins and so on... Is there any hardware module which whould be cheap and would help to read and send signals to arduino/stm32?

[Prehistoricman]

You can read the bus using any old 8-bit latch, such as this one:

http://www.ti.com/lit/ds/sccs075/sccs075.pdf

Not that part in particular though because it uses 5V IO.

I don't know what programmers would support that flash chip. It's probably not hard to make your own with an Arduino, but you will need more of those latch chips to expand the IO because this thing needs 35 address and data lines