Hacking the Pedistrian Warning System Sounds

[daczone]

Wondering.... Could I change the pedestrian warning sounds?

I picked up a spare to play with via ebay.... This is located under the glove box.

Pretty simple device, 6 wires in and out. Power, Ground, CANBUS high and low and a speaker.

Cracked it open and identified the chips..

ARM processor, Amp chip on one side:

Op Amp, Line Driver and Flash memory on the bottom.

Dumped the Flash chip and low and behold... Our truck sounds.

Interestingly how they did it...

The Left Channel is the running sound.

While the Right Channel is the backup sound.

Which sounds like this:
(Couldn't upload audio files here.... so converted them to blank videos).

Backing up (Left Channel)

Driving (Right Channel)

Sponsored

 

[kraxner]

This level of nerd is amazing, I approve. Keep it up!

 

[Lightning Bronson]

Love these nerdy posts.

Interesting how different they sound from the data you dumped off the chips. I can definitely hear the resemblance! It's just lower pitched in person when driving.

In fact, the backup sound is *slower* than the one on the Mach-E in comparison. From what I've experienced in person.

Would it be possible to flash in your own sounds using the same format?

 

[daczone]

Love these nerdy posts.

Interesting how different they sound from the data you dumped off the chips. I can definitely hear the resemblance! It's just lower pitched in person when driving.

In fact, the backup sound is *slower* than the one on the Mach-E in comparison. From what I've experienced in person.

Would it be possible to flash in your own sounds using the same format?

Should be real easy.... Create the audio channels and write it back to the flash chip. There does appear to be a header in the flash memory with part number ML3T-14G493-AE which interestly looks like a Ford part number, but doesn't correspond to anything I can find.

They are only using 1 meg of the 32 meg of flash on that chip.

It'd be a matter of trial and error, But it looks to me as if the sound file starts 34 bytes in. So I would leave that and put the sound files after that header.

 

[GDN]

Should be real easy.... Create the audio channels and write it back to the flash chip. There does appear to be a header in the flash memory with part number ML3T-14G493-AE which interestly looks like a Ford part number, but doesn't correspond to anything I can find.

They are only using 1 meg of the 32 meg of flash on that chip.

It'd be a matter of trial and error, But it looks to me as if the sound file starts 34 bytes in. So I would leave that and put the sound files after that header.

That number is likely the software version of those sounds. I know just enough to get in trouble, but there are part numbers, SW versions and strategies. You may know all of this. I would guess Ford can update that file and those sounds any time they choose.

This is from an ICE truck - part of the forum left over when the Lightning came into existence, but the same applies to our trucks. For each module you'll find info like this: https://www.f150lightningforum.com/forum/threads/module-calibration-and-strategy-information.7821/

@rugedraw and @Mike G can likely confirm.

 

[rugedraw]

This goes beyond my scope of knowledge, but I think this may work. Worse case scenario, you'll lose the ability to update the PACM via OTA or FDRS, but imo, who cares? It's the PACM.

If there is no kind of encryption on the audio file and you can modify it and reflash it on the bench, then there should not be any file mismatch issues, but updating the PACM will most likely overwrite the audio file with the original one if the update package contains the audio file.

This seems like a fun project with little risk of messing anything up.

 

[derplz]

Keep this up, a great idea. What sound would you like to put in its place?

 

[daczone]

That number is likely the software version of those sounds. I know just enough to get in trouble, but there are part numbers, SW versions and strategies. You may know all of this. I would guess Ford can update that file and those sounds any time they choose.

This is from an ICE truck - part of the forum left over when the Lightning came into existence, but the same applies to our trucks. For each module you'll find info like this: https://www.f150lightningforum.com/forum/threads/module-calibration-and-strategy-information.7821/

@rugedraw and @Mike G can likely confirm.

Good info... and you are correct. Looking back at my Auction item this was indeed a F150. I was just matching part numbers and buying cheap. Yes Ford could change this at anytime. but why not have fun with it in the mean time.

My thoughts, Folks seem to want the jetson's car sound. But IMO that's been so overdone on the Tesla's. For backing up I like the idea of the Mario Coin Up or Level Up sound. But to each their own. The ultimate would be to create an app to update the sound yourself from your mobile device, or use the rest of that 32M flash to load multiple sound files and select the one you wanted.

 

[daczone]

This goes beyond my scope of knowledge, but I think this may work. Worse case scenario, you'll lose the ability to update the PACM via OTA or FDRS, but imo, who cares? It's the PACM.

If there is no kind of encryption on the audio file and you can modify it and reflash it on the bench, then there should not be any file mismatch issues, but updating the PACM will most likely overwrite the audio file with the original one if the update package contains the audio file.

This seems like a fun project with little risk of messing anything up.

My orginal idea was to intercept the CAN BUS messages and throw something else in it's place, Raspberry Pi Pico or ESP32 maybe. Then use bluetooth and an app to change the sound. But I think I could still do this via the flash chip writing from a Pico directly. I'd want to make sure the truck wasn't moving (for safety). I don't have experience with Android but I am a Apple Developer as a hobby. (hobby, not what I do for a living, and I make no money doing it). I did it because I wanted my own app to open my front gate based on GPS location. IE: as to not have to touch a button.

 

[daczone]

Keep this up, a great idea. What sound would you like to put in its place?

Don't throw tomatoes at me.... but I personally would probably just mimic the Tesla sounds (as that's what I am used to). (They are far less annoying).

 

[BennyTheBeaver]

Don't throw tomatoes at me.... but I personally would probably just mimic the Tesla sounds (as that's what I am used to). (They are far less annoying).

It doesn't matter if it's fart sounds, just flashing it and proving it works is pretty cool.

 

[derplz]

Don't throw tomatoes at me.... but I personally would probably just mimic the Tesla sounds (as that's what I am used to). (They are far less annoying).

HAHA that would be a thing to hear coming by Looking forward to what you come up with Im going to mimic your setup when you figure it out

 

[at1]

Imperial March backup sound

 

[rockhead]

The backup MUST be changed to a submarine dive warning !

 

[Paulb55]

Love this! Keep up the work.

Sponsored