Hacking a Hyundai Ioniq to Play Doom

Running Doom on devices not meant to support the game seems to be the ultimate test to determine how “hackable” something may be. Hackers have continuously ported the game to devices such as calculators, ultrasounds scanners, digital cameras, and even an ATM machine. At some point in time, the challenge of running Doom on a device became the de-facto hack. Part of the reason it may be so popular is that the source code for the game was released for non-profit use way back in 1997. The latest Doom hack demonstrated shows the game running on a 2021 Hyundai Ioniq SEL infotainment system and uses the steering wheel and media control buttons as the game controller.

After purchasing a new 2021 Hyundai Ioniq, a user by the name of greenluigi1 decided to test the security and accessibility of the onboard infotainment system and began tinkering with it to determine what was possible. After some quick research it was determined that an engineering mode could be entered through the infotainment system. This allowed access to all types of diagnostic information, debug readouts, and hidden settings. In addition, what eventually ensued was root access to the system and the ability to modify the firmware. Eventually, sometime later in the second half of 2022, someone from Hyundai must have become aware of the security vulnerability and an additional firmware update was made available to secure these vulnerabilities.

After learning of the update pushed by Hyundai, greenluigi1 inspected the firmware updates made, and then went on again to hack the system. Although there were significant changes, including two ZIP files for the firmware instead of one, an additional security vulnerability was found that enabled unencrypted update files to be flashed into the system. This allowed for the update file to be modified, loaded into the infotainment system, and root access to the system to be maintained. Additionally, another method to gain entry into the system was found. This involved entering the engineering mode, navigating to a secret menu, and then forcing to update the system firmware from an unencrypted image on a USB drive.

With the infotainment system hacked a second time (and through various methods) the question popped into the mind, “can it run Doom?” Many versions and variants of Doom exists online that are available for porting to devices. The specific version in this hack happens to be doomgeneric, a version that was made specifically to be easily portable to different devices. Five functions need to be created to support the doomgeneric port that do not require too much work. On the other hand, getting the graphics to play nicely on the infotainment display did prove to be challenging. After some work tinkering with Qlabel, editing the .appconf file for the system, adjusting the frame buffer format, and finally explicitly refreshing the screen, Doom appeared on the screen.

The game requires the user to put on a seat belt to start the game, and then the steering wheel and media display controls act as the game controller. The files for the project are available on GitHub for those interested in learning more or potentially trying it out yourself. In addition, the complete, thorough write up on greenluigi1’s Hyundai hacking adventures can be found through this blog.