MIB2 STD PQ Reverse Engineering

Unlocking hidden features, fixing bugs, and injecting custom logic

MIG

Following Follow project

Liked Like project

Become a Hackaday.io member

Just one more thing

To make the experience fit your profile, pick a username and tell us what interests you.

OK, I'm done! Skip

Public Chat

Similar projects worth following

1.5k views

0 comments

11 followers

10 likes

Description
Details
Files 0
Components 0
Logs 1
- View all
Instructions 0
Discussion 0

View Gallery

Public Chat

Description

Introduction
The Modularer Infotainment-Baukasten (MIB) system, developed by Technisat/Preh, is used across both PQ and MQB platform vehicles in the Volkswagen Group. While the PQ variant of the MIB2 STD system shares much of the same hardware and software architecture as its MQB counterpart, including the HMI framework, it lacks access to many advanced features enabled via the CAN bus.

This project aims to unlock that hidden potential by reverse-engineering the system’s internals, enabling new functionality and fixing known issues.

Project Objectives
- Unlock MQB menus and advanced features on PQ platform MIB2 units

- Interface with the DSI (Device Service Interface) to dynamically update the HMI state from external tools

- Patch known PQ firmware bugs, including date/time sync and screen brightness issues with older BCMs

- Create a modular framework for future feature expansion, diagnostics, and personalisation

Details

Core Hardware

Main MCU: TI Jacinto 5e (DRA623)
- Cortex-A8: Runs QNX Neutrino for application-level logic
- Dual Cortex-M3s: One runs the Carcom RTOS blob (CAN, LIN, watchdog, EEPROM)
HMI Processor: NXP i .MX6, also running QNX, handles graphics and user interaction
PMIC: S9S08DN32
Flash: Macronix MX25L12835F (128Mb SPI NOR for bootloader and M3 firmware, loaded early boot)
EEPROM: ST M95512-R (Contains configuration and component protection keys) accessible via the M3 RTOS system only

Boot and System Flow

M3 Core boots first
- Loads encrypted firmware blob ("Carcom") from NOR SPI
- Handles CAN, LIN, and watchdog before QNX even starts
Cortex-A8 boots into QNX Neutrino
- Connects to M3 via shared memory at 0x28010000
- IPC driver (Com2M30 / cmsg) handles semaphores, buffers, and mailbox IRQs
NXP i.MX6 subsystem
- QNX processes relay data over QNET or IPC to frontend services and Java HMI

Project Logs

Collapse

2026 Huge Progress
MIG • 02/02/2026 at 01:10 • 0 comments

The DSI IPC protocol has now been fully worked out, and i can emulate menus and have any of the MQB menus work on the PQ units.
Next steps are confirming the hardware needed to send and receive the missing car states back to the MIB2