Simpler solution for disabling the DCM telematics - Silencing Antennas

DUH! It just hit me the UICC number was in the picture. UICC is what the built in style sim cards are called. So yes that is the sim card

 

Compare photos in post #85 to yours. Plus my post #121 where I removed the SIM chip.

Edit: 15 Mar 2024 Sorry didn't realize your picture was the picture in Post #85. Nice to have confirmation on my "real" removal of the now confirmed SIM.

 

I figured out how to create the perfect Faraday Cage to block big brother. Turns out it's a simple Zip-Lok bag. ( As long as it contains my DCM on the couch in my shop) LOL!

I pulled it tonight. No error codes, the SOS button doesn't even light up anymore.

I looked up the Qualcomm chipset on the modem. It's a common chipset, uses standard AT commands. When I get some time I'll try to find the serial interface to the CAN and scan it with QXDM and see what I come up with.

10-15 years ago I would have had the chips pulled and dumped by now, but 8 don't have that energy anymore...

I'll check my GPS sat signal levels tomorrow, 7AM is coming early tomorrow

One thing I did notice is when I hooked the battery back up, my Trip A on Odometer still read the miles since last fill up. Trip B I started when I installed new gears. My total Odometer miles on the truck is now less than my Trip B I started when I installed my new gears. I had the truck a few weeks before I got the new gears.

 

While I had panel off I took a pic of the OEM RIGHT Front speaker wires if you want tap into them. I had jotted down the other colors but I think I threw away the paper. But when you upgrade the speakers you will see the wires anyway.

 

Without the DCM unit the headunit is still getting a signal from the shark fin GPS antenna. No dash lights or codes, and the SOS button stays dark

 

For my own sanity, I made a single pdf of the howto remove the glove box made by another member. I take no credit for the pics or the work, I just consolidated it

 

I wonder if the new Tacomas will have the same setup (pulling DCM fuse will cause right speaker to go out).

 

Doesn't it kill the mic as well?

I'm completely ok with that.

Talking while driving is not how I'm going to spend drive time.

I'm off the clock once I'm behind the wheel.

 

Pulling the DCM fuse does not kill any speaker, it kills the microphone only. If you do not use the handsfree feature - no problem.

 

What device are you showing in your picture?

 

I think you can also back it out (the cell service provider info) based on the ICCID or IMSI code, but that requires pulling the DCM to read the code, and the big companies that control this stuff keeping it blacklisted. Plus, how does one make that request, and what’s to stop people from randomishly or improperly blacklisting others’ imeis if you can just call and they agree without proof it was yours?

It’s a head unit Eclipse AVN726E https://www.cnet.com/roadshow/reviews/eclipse-avn726e-dvd-gps-receiver-review/

 

https://www.nytimes.com/2024/03/14/technology/gm-lexis-nexis-driving-data.html

Apparently there is a very good reason to remove the spyware.

 

I was surprised no one posted about the dozens of similar articles about insurance using dcm data to raise your rates a few days ago when this story came out.

No mentions of Toyota, yet, that i sawthough, and just Lexis-Nexus the data company, not Lexus toyota yet.
Apparently, the gm bolt is the worst.

 

I missed commenting on this point earlier; the radio is getting GPS info from the antenna mounted between the instrument panel and the radio head unit - not the shark fin on the roof. Next time you have either the radio or instrument panel out look at the bottom of the dash. This information is also visually contained in Post#42. I had missed it earlier as I had no interest in the radio.

 

Interesting, did not know there was an additional antenna, erroneously had thought the sharkfin antenna had separate gps signal cables for the DCM and another running to the head unit.

Anyone know what are all the stock functions are inside/of the sharkfin? I thought about whether putting something inside, like a gps receiver or a cell signal thing for an independent hotspot puck type cellular internet unit would work. I think i saw a mod to make the sharkfin flat as well.

 

The above may be wrong; I currently have some of the right side of the vehicle open for inspection and see there are four (not three) coax cables going to the Shark Fin antenna on the roof. Three coax cables leave the DSM module, and one breaks off and heads towards the Driver's side while two additional coax cable join the remaining two DSM cables from the driver's side to go up the passenger side A-pillar to the roof. There is also a very small wire in the four-coax bundle, I suspect a ground or possibly power to the Shark Fin, if it needs power. This very small wire comes from the driver's side and joins the group of four coax cables above the DSM module. Wish I had the schematics for the DSM system.

 

Without digging out my old cell pen testing equipment I noticed a few significant traits. Reminds me when we reverse engineered the XM/Sirius radios.

Here goes .

Toyota is developing their own board to fit the truck. Toyota tells Kyocera build us us what we refer to as a CAN, meaning a black box that does what we want and is plug in play. Toyota has no idea how the Kyocera CAN works. Toyota just says it's going into an automobile to record and transmit telemetrics over 4G.

Kyocera builds a black box that Toyota solders on to their PCB. If you notice the Kyocera board is COMPLETELY separate and only connects to the Toyota board in a few places. Here is my original broad accessment...

The PCB in red is a proprietary modem built for Toyota by Kyocera. The orange square is the Qualcomm automotive telemetry processor. The green box is to simplify it, a protected flash chip, most likely encrypted that holds the operating system. My guess is unix or android. The purple box is outside of the Kyocera CAN. It's basically a sim card. We may be able to modify a standard ISO7816 reader to read it, not sure what the clock speed is.

Lastly, the yellow box I believe is the USB port to communicate with the Qualcomm chip. If I had one to disassemble I could know more

Basically if we hook up to it we would need the Qualcomm MDM9628 drivers or firmware updater to get the communication information. I have all the Qualcomm software, nothing for that chip. If someone can find a phone with that chip and a 'debrick' or 'IMEI Repair' thread somewhere that maybe useful.

Oh, it reminds me of XM/Sirius because they sold proprietary CANs to all manufacturers to add sat radio, the manufacturers just installed the black box and setup there own radio and interface around it, not knowing how it works

 

These black box module type setups are no joke. Our team probably destroyed 60 or 70 XM/Sirius black box CANs before we cracked it. At that point it was for proof of concept that it could be done. The chip readers were $4,500, adapter for each chip $309 each, plus cost of test units, thousands of hours of time. But back in those days, 20 yrs ago worth it to be the first to date only ones to reverse engineer the 'black box'

 

I could probably design a socket so you could insert your own SIM card to see what happens?

Best first step is social engineering. Play the dumbest you can, say your cell phone provider can offer the same service for a better rate, ask what provider it is currently with, what is the modems phone number and you need the IMEI unlocked, the IMSI, the APN information, unlock code and pin if there is one. Try a few times, that's what social engineering is, eventually you get a dumb ass who will give you the information.

 

Why not just pull the module?