Recently I replaced the instrument cluster (combination meter) in my 2005 Nissan Altima. After installing the new one, I noticed two things. First, the mileage is incorrect—which was expected—the old cluster had 190k miles and the new one shows just over 260k. That’s not a huge deal; I’ll just write down the difference and keep it in the glove box. But I also noticed the old meter was a “With NAVI” unit, while the new one is “Without NAVI.” What does NAVI mean? I have no idea, BUT I prefer the new cluster since it displays more information on the dashboard.
The Odometer
There are services that will reprogram your odometer, typically for around $250. When buying a used instrument cluster, many places offer to match the odometer reading if you send yours in. So, it’s possible to alter the reading. However, aside from the $3,000 Nissan Consult II programmer, I haven’t found a scan tool that supports this function.
Now for the Hacking
EEPROM swapping and reprogramming are very common among car modders. However, I couldn’t find any info specific to the Altima combination meter, so let’s crack it open and see what we find.
The two SOIC chips near the main MCU are the AB2C250 CAN transceiver and the 93C66 serial EEPROM. Taking a closer look at the EEPROM, we can verify the pinout—pins 6, 7, and 8 are all shorted and tied to VCC; pin 5 is tied to ground with a bypass capacitor between them.
After wiring into the EEPROM and connecting it to my Saleae Logic 4 analyzer, we can see that at power-up there are seven distinct transactions with the EEPROM.
Verify Our Assumptions
Currently, we’re assuming the mileage is stored in this EEPROM chi, but we don’t have any real evidence yet, other than “it makes sense.” So… What can we do? Remove the chip and see what happens, right?
Well, not exactly. Instead of removing the chip, you can break the communication circuit. The CS pin is connected to the main MCU via a 470 ohm resistor, so you can safely short the EEPROM side of that resistor to ground. This prevents the MCU from “talking” to the EEPROM.
SUCCESS! (Kinda?)
Now, the odometer reads 0 miles, but the display shows DTE, and I can scroll through MPG and MPH. So… looks like this is a “Without NAVI” dashboard now?
Summary
We found the EEPROM chip on the combination meter board, captured the communication between the EEPROM and the MCU, and confirmed that both the odometer value and the “With/Without NAVI” configuration are stored in the EEPROM.
Next, we’ll need to analyze the communication export and try to reconstruct the memory map of the EEPROM chip itself. Then, we’ll need to decode the bitmap for odometer and configuration data.
Leave a Reply