Hacking Fiat Blue&Me infotainment system
A few years ago I’ve got a Fiat Doblò 263. The infotainment system is run by the Fiat/Microsoft Blue&Me, an ECU running Windows Mobile for Automotive 5. As you can imagine, it is quite limited: potato Bluetooth call quality, random crashes/reboots (“No media available”), random switches between radio and music. But most notably, no A2DP Bluetooth support! Yes, they thought that phone calls were enough, who cares about music?
During the years, Fiat promised to release software updates. They did release some updates, however even if I’m on the latest release available (5.6) it is still buggy, and they never implemented A2DP music streaming. At some time they realized to have deployed a Demogorgon, and around 2014 they stopped to use B&M and they switched to U-Connect for newly produced cars.
On the 263 the Blue&Me ECU is located under the driver’s seat and it is enclosed in a black plastic case labelled as Magneti Marelli p/n 51882404:
Removing and opening the case you can see the board. There is not so much stuff there, except for the STA2062A SoC (“infotainment application processor with embedded GPS”), which features a 333MHz ARM MCU. A fork of Windows CE, including the registry and thereabouts, on a 333MHz microcontroller!
The 32-pin connector carries power and several signals: USB port, CAN bus, audio out (AUX), microphone input.
The audio out (AUX) is connected to the radio, which is connected to the B-CAN network too. When pressing the mute button on the steering wheel, a CAN message is sent. That message is received from the B&M, which eventually pauses the song. The radio listens to CAN messages too, dropping the volume to zero and displaying “MUTE”.
My idea is to replace the B&M ECU with a Linux single board computer connected to the CAN bus and to the audio. The magic world of Pulseaudio, Bluez and Ofono should allow A2DP audio. However, replacing the music system is only the beginning: having a full computer running Linux will allow me to add backup parking cameras and other fancy stuff.
Continues in part 2: connecting to the CAN network.
