Rooting the Cadillac Part 1: Lay of the Land – Surreal Development

Skip to content

Disclaimer: All actions performed here were performed in an enclosed safe environment by professionals with 10+ years in automotive pentesting experience. Attempting any of this yourself will likely cause irreparable hardware damage. Don’t try any of this. Anyway, just enjoy the show.

Most reading this are probably aware of the relatively cool looking screen seen in almost every single modern Cadillac. On this specific Lyriq EV below it is a 33 inch (diagonally) ‘9K’ screen. It behaves as a seemingly singular FALD (Full Array Local Dimming) high resolution panel, and it does look gorgeous even I’ll admit that. It may not be the most functional thing, but I respect it.

Anyway, it would be cool to use this screen for other purposes (desktop monitor, wall art, etc..). But what would be even more cool is if I reused this screen while reusing the original Factory Radio.

But snipesy! It’s all locked down!

Yes, well sort of. Not really. Depends on your point of view. More on that later… It just adds to the challenge. I really want to use the original factory radio for a few reasons.

It’s cool as hell, an epic story, and a world first.

It reveals the anti right to repair measures put in place by OEMs (for frankly no really great reason). Many of the measures put in place don’t add much security, but simply make it harder for third party interoperability and repair.

It’s a challenge. It’s been far too long since I proper challenged myself.

Perhaps this can be used to inspire others to do their own (responsible) tinkering.  There just isn’t enough disclosure or documentation when it comes to automotive pentesting, or just aftermarket parts development in general.

I personally don’t believe automotive software is near as secure as it is implied by OEMs in large part due to a lack of independent research. This is particularly important as most OEMs abandons their software after like 3 years of it being released. There are tens of millions of vehicles on the road today which are at risk.

Acquiring the Parts

Believe it or not acquiring the screen at a reasonable price was the hardest part of this project. It is around $1000 new before dealer mark up, and so I bought it used. The problem is the screen is fragile and most used automotive part shops are not exactly experienced with dealing with such fragile devices.

3 Screens arrived broken. All went back. That was until I spotted this guy. A 2025 CT5-V with 3 miles on it at Spalding auto parts in Spokane, Washington.

The screen arrived in nearly pristine condition with even the factory tape over it. I was so paranoid I put foam over it. Putting foam at the front bottom edge of the screen significantly helps its stability.

I was concerned the screen would have parts pairing in it which would prevent it from working with other radios, but I am happy to report it works fine on any radio that has a similar screen. I.e. a 2025 Lyriq screen works on a 2025 CT5-V, and vice versa (although the actual plastic mounting locations may differ).

The second hardest part of this project was the harness. While a harness is not strictly required, it does make life significantly easier. Rather than use the harness as a whole I instead opted to cut the harness open and take the individual wires I need to save space. This is also done to be able to remove several high speed data cables which cannot be reliably spliced (i.e. the display cable from the Radio -> Screen).

Partially stripped instrument panel wiring harness

I don’t really have any ‘part numbers’ to give. Most of the parts were bought by eye. The screen is from a CT5, and we have 5 radios from various Cadillac Lyriqs, a Chevy Colorado, and a Cadillac CT5. Each with different software depending on when the vehicle hit the bed. And they all work with the CT5 screen (except the colorado one is a bit temperamental). The part numbers vary randomly for reasons we aren’t told (probably different MFG runs, so take any part number with a grain of salt).

Dissecting the Radio

This where the fun begins

Variants

2025 CT5-V Radio w/ FAN and extra daughter board

There are several variations of the radio as evident by the numerous FCC Listings. But, they are all extremely similar to one another. We opted to open the 2025 Lyriq unit as it lacks the extra antenna module and is slightly easier to disassemble.

For example some will have the HUD slot not connected (and associated internal ICs missing). Some will have the extra tuner hardware on top missing, and there have likely been internal mods to each radio over the years.

General Motors also utilizes a legacy Intel based chip which is primarily used in lower trims of the Chevy Silverado/Sierra.

I did not acquire any of these, and have no idea what differences it has. This series is focusing on the qualcomm. Since Intel discontinued their automotive line going forward all radios will use...