Reverse Engineering the firmware on a Kenwood DDX9903S

I bought and really like my Kenwood Excelon DDX9903S headunit. I had it in my WRX, and moved it to my LS430. It supports Android Auto and CarPlay, which I find really useful when driving.

However, it has a nag screen every time it boots up. This got me curious as to how it worked, and see if it could be patched to skip this disclaimer. I figured it probably ran Linux on a SoC, as pretty much everything does nowadays. So I grabbed the latest firmware for it (mine was already updated to it), and started probing.

S_V2_7_0008_0600_AT1.zip

Extract that and you get 3 folders under S_V2_7_0008_0600/:

BOOT_V2_7_0008_0600_release/
MAIN_V1_0_2758_0400/
SOC_V2_7_0008_0600/

In each there’s a .nfu file, which I’ve never encountered before. I ran binwalk on each:

[BOOT_V2_7_0008_0600_release]$ binwalk Boot_2.7.0008.0600.nfu
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
248776 0x3CBC8 Android bootimg, kernel size: 0 bytes, kernel addr: 0x4F525245, ramdisk size: 1226848850 bytes, ramdisk addr: 0x6C61766E, product name: "ERROR: Cannot read kernel image"
1571592 0x17FB08 ELF, 64-bit LSB shared object, AMD x86-64, version 1 (SYSV)
2358024 0x23FB08 ELF, 64-bit LSB shared object, AMD x86-64, version 1 (SYSV)
3209992 0x30FB08 ELF, 64-bit LSB shared object, AMD x86-64, version 1 (SYSV)

Surprise, surprise, it runs Android. But, I’m thinking this image is possibly just the firmware updater, and not what I am looking for.

Continue reading

405HP 280Z

A somewhat local place had a surprise dyno day so I went to try and tune my car a bit. Was somewhat successful, reaching 405 HP and 420 Ft-lbs. before giving up. I was hoping for 450 HP, as my turbo and injectors should be able to support it easily, but oh well. I couldn’t get past ~14psi or so.

But I kept experiencing some spark blow-out and had a rear main leak, so I decided to cut it short.

October Autocross

Got a new oxygen sensor installed, tuned it a bit, and went to an autocross in my 280Z a couple weeks ago. I was third in my class! Out of three, though. So last. Still, the real victory is that my car made it there, ran, started and restarted fine, and then made it back home.

I also got to try my slicks out for the first time, and man, they make the car much more predictable. Lift-off oversteer is still there but manageable and much more forgiving (which probably doesn’t help that I have a bad habit of inducing it). Traction is not as greatly improved as I thought it would be, but I was just running them on the rear.

Anyway, here are a couple runs. A fun run (no time, just learning the course), and my fastest run.

 

280Z Update

It’s been a while since I’ve worked on my Z. I’ve been working on rebuilding my wife’s 300ZX, which is progressing slowly. My Z had a dead oxygen sensor and was not tuned correctly. It also had a fuel leak. But last week I fixed both of those issues and now it runs like a champ.

I then leaned out the fuel table by about 25% (I had richened it up when the sensor died to be safe). I was able to use autotune to then fix up the fuel map quite a bit. I really think it’s time to get it tuned on a dyno, but haven’t committed yet.

Sent off my oil temperature gauge to get the range changed from 100-300 degrees F or so to 60-260.

I’d like to use the slicks I got in at least one race this season, but I need to remove my bump steer spacers for the 15″ wheels they are on to fit.

3rd pump’s the charm

So I picked up a Bosch 044 fuel pump for a song, and decided to get rid of my Fuelab Prodigy pump. I almost wrote about the Fuelab install, but since I intended on replacing it, it wasn’t worth it. It was just too much for my vehicle, even at my target boost levels.

The Fuelab pump was brushless, and so was very picky about voltage. It was unusable during cranking due to a large voltage drop because of my small battery. So I had to add in a check valve, which helped, but I still needed to do a ten-fold increase in my cranking pulsewidth calculations. Then there was the speed control wiring. It was too much ‘because racecar’, so I decided to swap to the Bosch when offered.

To my surprise it came with a check valve integrated in to a type of banjo fitting. But, since I already added a check valve closer to the fuel rail, this would be redundant. Also, banjo fittings flow poorly.

A couple of new fittings and moving the mounting brackets over a bit was all it took to get it installed. Note all the holes for all the difference bracket configurations on my mounting plate. Heh.

On Properly Setting Your Cooling Fan Temperature Threshold

When I first installed an aftermarket ECU (Megasquirt I) in my 1984 300ZX, years ago (almost 10 as of this writing!), I used the recommended GM sensor for coolant temperature. It required a bit of machining to fit the sensor, nothing major.

With my latest engine (and the two cars it was in), I decided to use the OEM Cylinder Head Temperature Sensor, since hey, why not? It was already there, in an optimal spot. All I had to do was make software changes to calibrate MS-II to it’s temperature/resistance curve. I had the data in the Factory Service Manual, all was well. Continue reading

Harbor Freight Trailer Build

So I’ve got this autocross bug, despite being a terrible driver. After about 5 seconds of thought, I came to the conclusion that I must get an autocross trailer in order to improve my skills.

So, after a bit of research it looked like item #90153 was the thing to get. The key is it has 12″ wheels, whereas the cheaper one (#42708) has 8″ ones. The larger the wheel the less RPM the wheel bearings see, which is good. The increased payload capacity and trailer height were just bonuses. Since I plan on hauling some wheels and tires and some tools, I don’t see coming near the 1000+ lb. payload capacity. And if you wanted to carry more, all you’d really need is some better tires, since that’s the actual limiting factor. However, I don’t recommend carrying anything near the payload capacity.

Note that this is one of the few big-ticket items you can use the 20% coupon on, so if you want to save $46 or so off the price, use one! I got it and built it:

I also picked up a trailer jack, LED lighting kit, 1-7/8″ ball, and ratcheting straps from HF. From elsewhere I got a backup alarm, more LED lights, battery tray, some wire and a voltage gauge.

I then painted the frame and wheels to match my 280Z:

Continue reading