Tim 10/12/26 Tim 10/12/26

OSINT: Research on the New BMW IDC EVO Platform

BMW recently revealed the BMW iX3 and i3 Sedan, some of their latest vehicles based on their new “Neue Klasse” platform/architecture. Peeking at photos of the new interior, I couldn’t help but notice: They seem to have a new infotainment system!

The latest cars have a system that includes four displays (three panoramic displays embedded into the dashboard and one tablet-style one in the center), something that’s brand new to the latest generation of vehicles!

This post is a deep dive into these new infotainment systems, attempting to answer:

What the heck is their new infotainment system?
Does it use new hardware?
A new OS?
Are there any teardown pics online? (spoiler alert: yes)

Off we go, deep dive time!

Tim 3/22/26 Tim 3/22/26

Teardown: Rivian R1S Autonomy eXperience Module (AXM) 1.0

Today we’ll be performing a teardown and analysis of the Rivian “Autonomy eXperience Module”, or AXM. The AXM is a core part of the Rivian R1S and R1T vehicles, controlling driver assistance, media playback, infotainment display, and essentially all ADAS/infotainment tasks in the vehicle!

Tim 1/30/26 Tim 1/30/26

Car Hacking and Vulnerability Reporting in 2026

Now that we’re fresh into the start of 2026, I thought it would be interesting to take a look back at the state of automotive cybersecurity. To do this, I wanted to answer the question of: What is the state of automotive vulnerability reporting in 2026?

Tim 1/14/26 Tim 1/14/26

Teardown: The BMW / Harman IDC23H Infotainment Unit (B423)

Another day, another teardown - and the first blog post of 2026! Today we’ll be looking at the BMW IDC23H infotainment unit, manufactured by Harman Becker.

The IDC23H is one of the newest infotainment units from BMW, as of January 2026. The design is based on the previous-generation MGU22/MGU22H, and is used in a wide variety of BMW models - this unit in particular was found in one of BMW’s newest X1 U11 SUVs.

Tim 12/23/25 Tim 12/23/25

Dissecting the BMW NBT EVO HU Boot Process - Part 1: QNX and the IFS

For the past 2-or-so years, I’ve been hacking on my car’s infotainment unit - the BMW NBT EVO HU. I figured this would be the perfect opportunity to dive into a new topic: What does the boot process of a modern QNX-based infotainment unit look like?

Tim 12/13/25 Tim 12/13/25

Teardown: The BMW / Harman NBT EVO HU Infotainment Unit (B211)

Today’s teardown is of the BMW NBT EVO HU, an infotainment unit built by Harman Automotive - sound familiar?

Tim 12/2/25 Tim 12/2/25

The QNX_info ELF Section

When poking at binaries on a QNX-based system, you may run into an interesting ELF header: The so-called QNX_info section!

Tim 11/6/25 Tim 11/6/25

Teardown: The BMW / Harman NBT HU Infotainment Unit

Today’s teardown is of the BMW NBT HU infotainment unit, built by Harman Automotive. This head unit was used between 2012 and 2019 across a wide array of models in BMW’s lineup, in everything from their sedans to SUVs.

Tim 9/8/25 Tim 9/8/25

Edge Connector Breakout Boards

The goal was simple: For the past year or so, I’ve been poking at my car’s head unit in my free time. This has now escalated to the point where I have two or three of the head units…

They use a 1mm-pitch edge connector for debugging and development access, and I didn’t want to solder wires directly to the pins in an irreversible way. As such, I created a breakout board!

Tim 5/30/25 Tim 5/30/25

Extracting QNX IFS Partitions

There isn’t a lot of content online discussing how to dump a QNX IFS partition, so I thought I’d write up a few paragraphs here to spread the tips and tricks that I’ve learned.

(If you just want the tl;dr and already know what IFS partitions are, scroll to the bottom!)

Tim 5/23/25 Tim 5/23/25

Embedded Firmware Exfiltration - The Easy Way

It’s not often you look to extract an embedded device’s firmware over the network. Luckily, it’s possible with SSH! We’ll go over a few techniques for dumping raw block device bytes out onto the network to facilitate quick extraction of device firmware for static analysis on a separate host computer.