FalconFour
Well-known member
I hate that dang thing. :lol:
It sucks that the 2013+ LEAFs don't have the VSP Off button. Regulations, whatever. People have eyes - pedestrians and drivers should both be responsible for avoiding one another. Not the job of the vehicle manufacturer. That petite dandelion "ding, ding, ding" backup sound is awful, as is the cutesy "whoosh" it makes, and the Japanese Utopia set of sounds embedded as "effects" in the control panel. That's my position on it.
So, in setting out to add "VSP Off" back to my 2013 LEAF, I found - spoiler alert - you just ground pin #5 of the VSP plug, which is where the button used to reside on 2011-2012 LEAFs. Just a momentary ground, and you'll get the "VSP Off" light on the center console (where the "passenger airbag" indicator is). One more momentary ground, and VSP is back on. It's a toggle button. So, just wire that up, and you've got a VSP Off button again. You're welcome.![Smile :) :)](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
But that's never enough for a hacker.
I took the VSP box apart, and found a MX25L8006E 8mbit (1MByte) SPI flash ROM chip on there. "That's an awful big chip for runtime parameters or code...", I thought.
So I dug into it with a Raspberry Pi and the "flashrom" program. I wired everything up, but found I had to pull the "HOLD#" pin high as well. Sure enough, Flashrom extracted the full contents of the ROM chip and placed it into a flat binary ROM file.
That file is here. Go at it!
https://onedrive.live.com/redir?resid=4C8184259C5488!4352&authkey=!AGOSs8h_iXQjdK8&ithint=file%2crom
I've been playing with methods to get the audio data out of the ROM. Best way to go about modifying something is to recreate it first. So, I fired up Audacity and took a stab at some RAW import parameters.
Seems like VOX ADPCM, 22050hz, but even that coding comes out a bit warbled. That also only seems to be the encoding for the interior sounds (startup sounds). The others - the beeps and the "whoosh" sounds - seem to be encoded differently, which makes sense, since the whooshing sound varies a LOT based on the speed of the car.
So far, I've found this structure:
(Lots of silence - 0xFF)
Default power-button chime
(silence)
Default startup sound -- update: these may be Yamaha ADPCM format, since the chip is a Yamaha YMF827B
(silence)
Effect 2(?) power-button chime
Whooshing effect base (encoded differently)
(silence)
Effect 2(?) startup sound
(silence)
Effect 3(?) power-button chime
(silence)
Effect 3(?) startup sound
(silence)
Series of beep/ding tones (encoded differently) -- update: these are also Yamaha ADPCM, 10 tones total
I think the whooshing effects and the beep/ding tones are used programmatically, hence they're stored with a different encoding.
With Flashrom, since the chip is one of their many supported chips, I can also write back this raw data directly onto the chip, so once we establish how the sounds are encoded, they can be modified, patched into the ROM (likely in place of the original sounds, exactly the same duration is required), and then flashed back onto the board. If all else fails, I still have the ROM backup that I can flash back, and it's like nothing ever changed.
Anyone want to try their hand at tearing that ROM apart? :mrgreen:
It sucks that the 2013+ LEAFs don't have the VSP Off button. Regulations, whatever. People have eyes - pedestrians and drivers should both be responsible for avoiding one another. Not the job of the vehicle manufacturer. That petite dandelion "ding, ding, ding" backup sound is awful, as is the cutesy "whoosh" it makes, and the Japanese Utopia set of sounds embedded as "effects" in the control panel. That's my position on it.
So, in setting out to add "VSP Off" back to my 2013 LEAF, I found - spoiler alert - you just ground pin #5 of the VSP plug, which is where the button used to reside on 2011-2012 LEAFs. Just a momentary ground, and you'll get the "VSP Off" light on the center console (where the "passenger airbag" indicator is). One more momentary ground, and VSP is back on. It's a toggle button. So, just wire that up, and you've got a VSP Off button again. You're welcome.
But that's never enough for a hacker.
I took the VSP box apart, and found a MX25L8006E 8mbit (1MByte) SPI flash ROM chip on there. "That's an awful big chip for runtime parameters or code...", I thought.
So I dug into it with a Raspberry Pi and the "flashrom" program. I wired everything up, but found I had to pull the "HOLD#" pin high as well. Sure enough, Flashrom extracted the full contents of the ROM chip and placed it into a flat binary ROM file.
![](https://proxy.imagearchive.com/be5/be59bb859f429f2e2c955d4f446a21b6.jpg)
That file is here. Go at it!
https://onedrive.live.com/redir?resid=4C8184259C5488!4352&authkey=!AGOSs8h_iXQjdK8&ithint=file%2crom
I've been playing with methods to get the audio data out of the ROM. Best way to go about modifying something is to recreate it first. So, I fired up Audacity and took a stab at some RAW import parameters.
Seems like VOX ADPCM, 22050hz, but even that coding comes out a bit warbled. That also only seems to be the encoding for the interior sounds (startup sounds). The others - the beeps and the "whoosh" sounds - seem to be encoded differently, which makes sense, since the whooshing sound varies a LOT based on the speed of the car.
So far, I've found this structure:
(Lots of silence - 0xFF)
Default power-button chime
(silence)
Default startup sound -- update: these may be Yamaha ADPCM format, since the chip is a Yamaha YMF827B
(silence)
Effect 2(?) power-button chime
Whooshing effect base (encoded differently)
(silence)
Effect 2(?) startup sound
(silence)
Effect 3(?) power-button chime
(silence)
Effect 3(?) startup sound
(silence)
Series of beep/ding tones (encoded differently) -- update: these are also Yamaha ADPCM, 10 tones total
I think the whooshing effects and the beep/ding tones are used programmatically, hence they're stored with a different encoding.
With Flashrom, since the chip is one of their many supported chips, I can also write back this raw data directly onto the chip, so once we establish how the sounds are encoded, they can be modified, patched into the ROM (likely in place of the original sounds, exactly the same duration is required), and then flashed back onto the board. If all else fails, I still have the ROM backup that I can flash back, and it's like nothing ever changed.
Anyone want to try their hand at tearing that ROM apart? :mrgreen: