Opening the Car Thing

[big-harry]

At a temperature of roughly 180F (80C) I was able to melt the glue at remove the screen. I do not recommend holding the Car Thing while melting the glue.

[big-harry]

[big-harry]

When opening the unit, there's a brick connector which may come off when opening. On the inside, there's 3 screws which have a six sided star shape on top.

[big-harry]

They are T6 screws. Removing them and disconnecting the ribbon cable is all that's left to fully tear down the Car Thing.

[big-harry]

I measured most of the test pads, one of them is 38V and that's not a mistake.

[ghost]

If you can figure out where the flash is maybe you can use glitching by shorting a pin on the flash to ground if possible somehow to corrupt u-boot process? Just a thought.

[big-harry]

Looking at the part, it would be hard to short it because it's BGA.

I'm guessing I might be able to scrape the masking off to short it, but it might break it. Also I don't really know what we can do with a corrupted boot process, I think we should see which pins correspond to UART.

[ghost]

Usually it would kick you to a u-boot shell. Not really sure about this one tho.

[williamtcastro]

Are we able to find the flash memory capacity ?

[justMaku]

Are we able to find the flash memory capacity ?

Most likely 4Gb - 2gb data, 2x512mb for os partitions, last 1gb is some other random system partitions.

[williamtcastro]

Are we able to find the flash memory capacity ?

Most likely 4Gb - 2gb data, 2x512mb for os partitions, last 1gb is some other random system partitions.

I've looked up for the datasheets of the components and the EMMC its in fact 4GB and surprisingly enough the car thing as a 4Gb ram chip

4gb_ddr3_e_die_component_datasheet.pdf

[Merlin04]

Note that 4Gb=4 gigabits, which is equivalent to 512 megabytes

[williamtcastro]

Note that 4Gb=4 gigabits, which is equivalent to 512 megabytes

Yes that was pointed out for me on reddit, thanks, sorry for the rookie mistake