ACDrive

ACDrive

ACDrive (Advanced Codec Drive) is the name used by Kenwood to describe car stereo headunits which can playback enhanced media created by PhatNoise Media Manager with many of the same searching features as PhatBox units.

This wiki page describes the ACDrive system and its hacking potential

Introduction

Kenwood ACDrive headunits can playback media created using PhatNoise Media Manager (PMM). This is often called mCD media. mCD media can include CDROM's, DVD's (for DVD capable units) and USB mass-storage devices (for USB capable devices.

When playing back mCD media you can browse by artist, album, genre and playlist. You can search alphabetically by artist, album and genre (but not playlist). Voice-prompt navigation is also possible. (non-mCD media can only be browsed by folder)

ACDrive headunits can playback mp3, wma and aac files.

Read more about ACDrive/mCD from Kenwood here: [1]

Technical Info

To allow fast navigation, mCD media contains a metadata database in an mcd directory in the root of the device. This is much like the ipod's itunesdb, though considerably simpler.

The MCD media contains (at least) the following files:

/mcd/
/mcd/mcd.db
/mcd/mcd.sig
/mcd/pkeys2.e
/mcd/pkeys2.sig

mcd.db

mcd.db is the song metadata database created by PMM. The structure has been reverse engineered, see mcd.db

pkeys2.e

This appears to be an array of RSA public keys used by the device (see below) for checking signatures of other files (such as mcd.db). pkeys2.e and pkeys2.sig are distributed with PhatNoise and never change. They can also be found on the sample cd distributed with ACDrive head units.

mcd.sig, pkeys2.sig

These are signature files for mcd.db and pkeys2.sig respectively, the signatures are generated in exactly the same way as PhatBox signatures as described in Signature except that the private signing keys are different.

The signing key for mcd.db has been extracted from PMM and can be found in mcdPrivateKey. This allows us to generate valid mcd.db/mcd.sig files for playback by the headunit!

The key used to sign pkeys2.e (and hence bless other signing keys) is not know. It is believed to be held by PhatNoise and not contained within the PMM software.