AV Control Unit
This is a computer running Windows CE / Windows Automotive. It runs software from its internal memory and from an SD card which is required for operation.


While referred to as the AV Control Unit in service manuals, it's also known as the head unit, radio, In-Vehicle Infotainment (IVI) unit or navigation unit.
Model numbers edit
Gen 1 edit
Clarion QY7204, QY7224, QY7214, QY7254
Gen 2 edit
(information needed)
Early Gen 2 units have a similar Windows CE-based OS to the Gen 1 units[1], however some later units (e.g. 25915 5SR0B) run Linux[2].
Photos edit
Functions edit
- AM/FM radio tuner
- Audio amplifier
- TV tuner (in JDM models)
- Satellite radio tuner (in some models)
- CD player (in some models)
- Android Auto and/or CarPlay via USB (in some models)
- Bluetooth
- Satellite navigation
- Climate control information display (for example, it is the only place where the temperature setpoint is displayed)
- EV information display (power usage, etc)
- Charge timer control (in ZE0/AZE0 vehicles; in ZE1 this is in the Combination Meter)
- Rear-view or around-view camera display
- Display of information from the internet via the TCU, such as traffic information
Connections edit
- It communicates with various systems in the car via CANBUS
- It connects to the Telematics Control Unit (TCU) via USB and CANBUS
- It receives a video signal from the Around View Monitor Control Unit, and also controls it via CANBUS
SD card edit
The SD card contains map data in a user-accessible partition, part of the firmware (Windows CE image) in unpartitioned space near the start of the SD card, and a hidden partition towards the end containing the substance.skn file which contains icons and strings.[3]
In Gen 1 units, the SD card is locked. The password can be captured by dumping the flash memory of the unit, or by intercepting the communication to the SD card itself during boot.
In Gen 2 units, the SD card is not locked, as in its contents can be freely read and written.
An SD card can also be used to update the firmware in the unit.
Debugging edit
Gen 1 units (not sure about Gen 2) have a UART exposed on the 40-pin connector, which provides a debug shell.[3]
Projects edit
- It is possible to change the language. This is commonly required for vehicles imported from Japan (i.e. JDM vehicles) into English or Russian speaking countries. There are now companies such as Xanavi and EVs Enhanced that will do this for a fee.
- It is possible to replace a unit from a ZE1 Leaf with a 7 inch screen, to one with an 8 inch screen used on newer ZE1 vehicles, however at the time of writing some functions may not work.[4]
References edit
- ↑ Based on the contents of the SD card in a 2019 Leaf, which includes Windows CE data.
- ↑ https://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf
- ↑ 3.0 3.1 https://www.drive2.ru/l/667865354017446198/
- ↑ https://mynissanleaf.com/threads/how-to-2018-leaf-ze1-oem-headunit-replacement-7-8.33462/