Honda SD Card Tools

This project contains Teensy firmware and host scripts for interacting with locked Honda SD cards at the raw block level. It is primarily intended for inspection, backup, and research of SD cards that use the SD CMD42 password lock feature.

This firmware is specifically designed to work with Honda navigation SD cards used in Windows CE based Honda head units, primarily found in model years 2014 through 2017, with some limited compatibility extending into later model years depending on the head unit generation.

The firmware runs on a Teensy 4.1 using SPI mode and the danman fork of the Arduino SD library. Communication happens over USB serial to an SD card breakout board. The following was used from SparkFun Electronics: SparkFun SD Sniffer

• Initialize SD cards over SPI
• Read and print the card CID
• Preview sector 0
• Unlock Honda SD cards using CMD42 with the known Honda navigation password
• Set and clear SD passwords using CMD42
• Full card dump with metadata header
• Byte exact raw card dump with zero framing or logging
• CRC32 hashing of arbitrary LBA ranges for verification

• Teensy 4.1
• SD card wired in SPI mode
• Level safe 3.3V power

The main firmware lives in src/main.cpp.

After flashing, open a serial monitor at 115200 baud to access the command menu.

Honda navigation SD cards used in Windows CE based head units are protected using the SD CMD42 password lock mechanism.

Through SD bus sniffing with a logic analyzer, the following 16 byte password was recovered from an authentic Honda head unit during normal operation:

95 D5 9D E5
86 FD BD 85
8D DD F6 76
5D 96 FE FF

This firmware uses the above password when issuing CMD42 UNLOCK and CLEAR commands. The password is hard coded and intended solely for use with genuine Honda navigation SD cards. Using this password on non Honda cards or incorrect model years may permanently lock the card.

There are two different dump mechanisms. Which one you use depends on whether you want a human readable protocol or a byte exact disk image.

This is a verbose dump mode intended for interactive use or custom host scripts.

Protocol:

• ASCII header STARTIMG\n
• 4 bytes little endian block count
• Raw block data
• Periodic progress text over serial

This mode is useful when debugging or when you want the firmware to tolerate read errors by zero filling failed sectors while continuing the dump.

Because it includes text output, it is not byte exact unless your host script explicitly parses and strips the header and logs.

This is the recommended mode for forensic quality backups.

Characteristics:

• No ASCII text
• No headers
• No progress output
• Exactly blocks × 512 bytes streamed
• Read failures are replaced with zero filled sectors to preserve alignment

This mode is designed to be captured by a host program that knows the card size in advance and reads an exact byte count.

The included dump_raw.py script performs a byte exact capture of the SD card image.

• Python 3
• pyserial

Install dependency: pip install pyserial

python3 dump_raw.py <serial_port> <output_image>

Example: python3 dump_raw.py /dev/tty.usbmodem123456 dump_raw.img

1. Opens the serial port at 115200 baud
2. Sends i to initialize the card
3. Sends n to receive the 4 byte little endian block count
4. Calculates expected total byte size
5. Sends R to begin raw streaming
6. Reads exactly block_count × 512 bytes
7. Writes data directly to disk
8. Performs a sanity check for a 0x55AA boot sector signature

If the serial stream stalls or returns fewer bytes than expected, the script aborts to prevent silent corruption.

• CMD42 password operations can permanently lock SD cards if misused
• Always verify the password bytes before issuing SET or CLEAR commands
• Do not remove power or the SD card during a dump
• Raw dumps can take several minutes depending on card size and USB speed
• This tool is intended only for Honda navigation SD cards and should not be used on arbitrary SD media

This project is intended for research, reverse engineering, and personal backup of SD cards you own. It is not intended for bypassing access controls on devices you do not have legal rights to.

Use at your own risk. No warranty is provided.