Page 1 of 10

Hacking the VSP Box (Noise Maker)

Posted: Tue Aug 11, 2015 7:33 pm
by FalconFour
I hate that dang thing. :lol:

It sucks that the 2013+ LEAFs don't have the VSP Off button. Regulations, whatever. People have eyes - pedestrians and drivers should both be responsible for avoiding one another. Not the job of the vehicle manufacturer. That petite dandelion "ding, ding, ding" backup sound is awful, as is the cutesy "whoosh" it makes, and the Japanese Utopia set of sounds embedded as "effects" in the control panel. That's my position on it.

So, in setting out to add "VSP Off" back to my 2013 LEAF, I found - spoiler alert - you just ground pin #5 of the VSP plug, which is where the button used to reside on 2011-2012 LEAFs. Just a momentary ground, and you'll get the "VSP Off" light on the center console (where the "passenger airbag" indicator is). One more momentary ground, and VSP is back on. It's a toggle button. So, just wire that up, and you've got a VSP Off button again. You're welcome. :)

But that's never enough for a hacker. 8-)

I took the VSP box apart, and found a MX25L8006E 8mbit (1MByte) SPI flash ROM chip on there. "That's an awful big chip for runtime parameters or code...", I thought.

So I dug into it with a Raspberry Pi and the "flashrom" program. I wired everything up, but found I had to pull the "HOLD#" pin high as well. Sure enough, Flashrom extracted the full contents of the ROM chip and placed it into a flat binary ROM file.

Image
That file is here. Go at it!
https://onedrive.live.com/redir?resid=4 ... file%2crom

I've been playing with methods to get the audio data out of the ROM. Best way to go about modifying something is to recreate it first. So, I fired up Audacity and took a stab at some RAW import parameters.

Seems like VOX ADPCM, 22050hz, but even that coding comes out a bit warbled. That also only seems to be the encoding for the interior sounds (startup sounds). The others - the beeps and the "whoosh" sounds - seem to be encoded differently, which makes sense, since the whooshing sound varies a LOT based on the speed of the car.

So far, I've found this structure:
(Lots of silence - 0xFF)
Default power-button chime
(silence)
Default startup sound -- update: these may be Yamaha ADPCM format, since the chip is a Yamaha YMF827B
(silence)
Effect 2(?) power-button chime
Whooshing effect base (encoded differently)
(silence)
Effect 2(?) startup sound
(silence)
Effect 3(?) power-button chime
(silence)
Effect 3(?) startup sound
(silence)
Series of beep/ding tones (encoded differently) -- update: these are also Yamaha ADPCM, 10 tones total

I think the whooshing effects and the beep/ding tones are used programmatically, hence they're stored with a different encoding.

With Flashrom, since the chip is one of their many supported chips, I can also write back this raw data directly onto the chip, so once we establish how the sounds are encoded, they can be modified, patched into the ROM (likely in place of the original sounds, exactly the same duration is required), and then flashed back onto the board. If all else fails, I still have the ROM backup that I can flash back, and it's like nothing ever changed. :geek:

Anyone want to try their hand at tearing that ROM apart? :mrgreen:

Re: Hacking the VSP Box (Noise Maker)

Posted: Tue Aug 11, 2015 8:31 pm
by FalconFour
Already made some great progress here! It appears that the effects are encoded as - naturally - Yamaha ADPCM format. By extracting a section and giving it the extension ".YADPCM", a little piece of software called Awave Studio (shareware) was able to open it up and play it 100% perfectly.

Image

For your listening pleasure, here it is in WAV format:
https://onedrive.live.com/redir?resid=4 ... file%2cwav

Now that we know what the format is supposed to be, we can replace sounds! :mrgreen:

update: Also, looking at the ROM file, it looks like the effect sounds line up quite clean with the boundaries of 0x10000 segments - which means that a replacement sound may not necessarily need to be the same size! It may be perfectly fine with a shorter sound being padded with 0xFF at the end, or a longer sound extending into the existing 0xFF padding. I think it just cares about the start address...

Re: Hacking the VSP Box (Noise Maker)

Posted: Tue Aug 11, 2015 8:51 pm
by TickTock
Very cool. Nice work! Is one of the wires into the VSP a speed indicator or does CANbus go there and it just snoops? Was the ROM socketed or did you have to unsolder it? Be interesting to try programming a new ROM with a minor tweak to see if there is a checksum protection. Don't know why they would bother for the sound bytes (bites?) except, perhaps, out of habit.

Re: Hacking the VSP Box (Noise Maker)

Posted: Tue Aug 11, 2015 9:43 pm
by FalconFour
This is the diagram for 2011-2012 - which is basically identical to 2013+ (except that 2013 has the VSP OFF switch just removed from the diagram, pin position and all - though it still works!).

Image

I think it listens to the CAN bus. It almost seems like the module just listens for specific commands, and has a fair bit of its own (non-persistent) memory. Example - it forgot that I set the Effect to "off" after unplugging the module, so when I plugged it back in, it went back to the default sound-set. I tried changing the effect while it was unplugged, and the dash was happy to navigate, but to no effect (it defaulted back to the normal sounds when plugged back in). Finally, if I plug the VSP module back in *just* after pressing the power button, but before it'd typically play the startup sound, it'll actually play only the startup sound, right on time. I think it's based on a CAN command set.

As for the ROM, I just hacked it in-place, no soldering needed. I used one of these (exact items, actually), and a Raspberry Pi using this guide for installing & configuring flashrom on the Pi with a clean Raspbian base. The circuit was totally cool with being given 3.3V, it seems. The board still works perfect in the car after various attempts at getting the ROM out of it. Holding "HOLD#" high (actually just shorting it to VCC pin) was the key to getting it working in the end.

Re: Hacking the VSP Box (Noise Maker)

Posted: Wed Aug 12, 2015 12:04 am
by JeremyW
Only the 2011's have the VSP off button, btw. US 2012's didn't have it either. All other markets have it regardless of year I think.

Re: Hacking the VSP Box (Noise Maker)

Posted: Wed Aug 12, 2015 12:16 am
by DaveEV
Nice work, FalconFour!

Re: Hacking the VSP Box (Noise Maker)

Posted: Wed Aug 12, 2015 12:26 am
by cwerdna
JeremyW wrote: All other markets have it regardless of year I think.
Interesting, if that's the case.

Personally, (now that I have an owned Leaf) I'd only really only want a clean switch/button to toggle the VSP off. The only time I'd want to turn it off when backing out of my driveway @ home, after no sound or a just a few reverse chimes. I'd otherwise want all the noises whenever they normally sound. I don't want to disconnect the module and lose all those sounds.

I just don't want to alert bad guys that I'm leaving home. And yes, my house was burglarized for the 1st time ever in January 2015. I'll never know if the Leaf noises helped w/them determining my coming/going patterns, but they broke in on a weeknight while I wasn't on vacation (but wasn't home either). This house (built in 1979) has never been burglarized nor has any place I've lived, until now.

It really irks me Nissan removed the toggle on the '12+ Leafs. I've been meaning to officially contact Nissan (no, not via a dealer) to have them bring it back in future models and also sell a supported mod w/a disable switch for ones w/o it. I'm 99% sure the latter won't happen but the former could happen, if enough people complain.

Re: Hacking the VSP Box (Noise Maker)

Posted: Wed Aug 12, 2015 4:50 am
by jhm614
Great work! I'm looking forward to the Jetson's Car Sound mod!

Re: Hacking the VSP Box (Noise Maker)

Posted: Wed Aug 12, 2015 8:06 am
by desiv
jhm614 wrote:Great work! I'm looking forward to the Jetson's Car Sound mod!
That was my first thought! ;-)
JeremyW wrote: The only time I'd want to turn it off when backing out of my driveway @ home,
I would think, with people/kids in neighborhoods, that's a time I'd want it on more than some others..
As for the crime aspect, I would think any criminal so close that they can hear a backup beep can also see your car driving away.
But that's just me.. ;-)

desiv

Re: Hacking the VSP Box (Noise Maker)

Posted: Wed Aug 12, 2015 5:08 pm
by KillaWhat
jhm614 wrote:Great work! I'm looking forward to the Jetson's Car Sound mod!
If you can change my VSP sound to the Jetson's sound, I'll buy this right NOW,

Image