JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[itswiggs]

The OBD port is definitely outside the SGW, since protecting the rest of the system from the OBD port (and from the entertainment system) is what the SGW is for. So I wouldn't expect non-authenticated access at the OBD port to be able to do any more than JScan already does.

Are you 100% sure you're not sniffing only, and not transmitting? Seeing glitches on the uConnect when you're plugged in should only happen if you transmit.

(I choose the block behind the dash because it's easy to get to, has the AUX power cable nearby and lots of space for hardware to go in. Being away from the OBD port that the dealer techs use is a bonus, though.)

I'll leave any more sophisticated responses to the other folks; I'm very much a dilletante with the CAN interface so far.

I will double check but I am 99.9% positive I am only set to recieve. I was thinking maybe it’s the resistance of my device itself or the voltage but after double checking voltages I am in the scope. My resistance is different for every connection on the ihs though, so I’m wondering if it has to do with what’s exactly programmed to the truck, and it knowing that hey this shouldn’t be here let’s block it. I may try a different part of the circuit to see if I’m still getting interference. It is puzzling to me to say the least. I know it’s doable and all I want is to get the messages for heated seat modules.

Sponsored

 

[ants24]

Hi Folks - Here is a picture of my 2024 Wrangler's CAN-C connector behind my glove box. My question is simply - Which wire is CAN-High and which is CAN-Low? TIA!

 

[Bradman147]

Hi Folks - Here is a picture of my 2024 Wrangler's CAN-C connector behind my glove box. My question is simply - Which wire is CAN-High and which is CAN-Low? TIA!

You can always check by using a multimeter with the ignition on. The meter will fluctuate from 2.5-2.7 for Can hi and 2.3-2.5 for Can lo. That being said I do have access to wiring diagrams so I can pretty confidently say if it's got a stripe on the wire it's probably Can hi.

 

[gianzilla]

Thank you for the very helpful Canbus database!

I was curious if anyone had ran into the regional setting for the cluster?

I know the 0x32A is the IHS side and I can read 02 00 00 00 02 03 08 10 as my vehicle is within Canada.. but I have difficult using the cluster on a bench with kmh / liter setting retained

I suspect there might be additional command coming from ECU or BCM to the cluster as cluster only take Can C data...

 

[DrTTB]

Wow what a great thread and kudos to everyone that contributed so much to this. I've spent a couple of hours this afternoon reading through this looking for a way to activate the A/C switch on the HVAC controls via CAN BUS.

I read through the excellent write-up on the SGW and ordered the bypass cable on Amazon.

Looking through the spreadsheet posted at the beginning of the thread, it looks like I'm after:

2D3: $0700000000000100 A/C system on/off
2D3: $0700000000000200 Air recirculation on/off

From the comments, setting 0200 ON will set A/C on automatically via the PCM.

What I'm trying to diagnose: the A/C is not working and by A/C, I mean it's not commanding the A/C compressor on when I engage the A/C switch on the Linkswell. The Linkswell shows the A/C switch illuminated, indicating it's engaged (see attached pic). However JScan shows the A/C button is not pressed.

The outside air temp and cabin temps seem spot on.

The blower motor works fine and the motor speed on the JScan 1-7 matches what is set on the Linkswell Gen 4 radio.

It's 92 degrees here and I have the auto climate set at 65F. The cabin temperature sensor is reporting correctly on Jscan.

The Linkswell replaces the factory HVAC controls and I believe it commands the A/C on via CAN-BUS. I went through the Linkswell A/C Wrangler JL setup procedure again and it didn't resolve it.

Screenshot of JScan attached and Linkswell attached for reference.

My guess is it's something with the Linkswell but unfortunately I left the OEM HVAC handy to swap in and see if it resolves the issue.

It was working fine until I performed the AUX battery delete. I completely removed the AUX battery and ran the two positive feeds that were connected to the AUX battery the main battery. Everything else is working fine and no codes.

 

[patternman]

Wow what a great thread and kudos to everyone that contributed so much to this. I've spent a couple of hours this afternoon reading through this looking for a way to activate the A/C switch on the HVAC controls via CAN BUS.

I read through the excellent write-up on the SGW and ordered the bypass cable on Amazon.

Looking through the spreadsheet posted at the beginning of the thread, it looks like I'm after:

2D3: $0700000000000100 A/C system on/off
2D3: $0700000000000200 Air recirculation on/off

From the comments, setting 0200 ON will set A/C on automatically via the PCM.

What I'm trying to diagnose: the A/C is not working and by A/C, I mean it's not commanding the A/C compressor on when I engage the A/C switch on the Linkswell. The Linkswell shows the A/C switch illuminated, indicating it's engaged (see attached pic). However JScan shows the A/C button is not pressed.

The outside air temp and cabin temps seem spot on.

The blower motor works fine and the motor speed on the JScan 1-7 matches what is set on the Linkswell Gen 4 radio.

It's 92 degrees here and I have the auto climate set at 65F. The cabin temperature sensor is reporting correctly on Jscan.

The Linkswell replaces the factory HVAC controls and I believe it commands the A/C on via CAN-BUS. I went through the Linkswell A/C Wrangler JL setup procedure again and it didn't resolve it.

Screenshot of JScan attached and Linkswell attached for reference.

My guess is it's something with the Linkswell but unfortunately I left the OEM HVAC handy to swap in and see if it resolves the issue.

It was working fine until I performed the AUX battery delete. I completely removed the AUX battery and ran the two positive feeds that were connected to the AUX battery the main battery. Everything else is working fine and no codes.

The problem I find with Linkswell is the choke hold they maintain.
For example satellite navigation, all they allow is IGo other sat navigation software I've tried won't work as well as other apps. Sure you can download other apps through the playstore but they don't work properly/can't integrate. For example mp3 player won't resume on vehicle start.
I keep hoping someone on XDA developers forum will post a root method for the software.

 

[DrTTB]

The problem I find with Linkswell is the choke hold they maintain.
For example satellite navigation, all they allow is IGo other sat navigation software I've tried won't work as well as other apps. Sure you can download other apps through the playstore but they don't work properly/can't integrate. For example mp3 player won't resume on vehicle start.
I keep hoping someone on XDA developers forum will post a root method for the software.

I agree 700%. The Linkswell really sucks, especially considering the price point. The boot time and how laggy it is. I have wireless CarPlay setup on mine and it just randomly stops audio and doesn't start again until the Jeep is restarted. Granted I'm on a Gen 4 and Gen 6 is supposed to be better, but...

Most of the aftermarket 'Tesla' style radios generally suck and have similar problems. I've been experimenting with the CarPlay libs on the RPI5 and they work very well.

Part of my CAN hacking is sniffing the Linkswell. I plan to replace it with a smaller ~$700 unit and reinstall the OEM A/C controls. From the feedback I've been reading, the $700 unit has a fast boot option that boots in 2-3 seconds without the lag of the Linkswell.

The $700 unit is the Dasaita, it's on Amazon and there are a few videos on YouTube about it. TL;DW - it appears much better than my Linkswell Gen 4 experience which I've had installed for 2 years.

How it works it remains in standby mode rather than powering off when the vehicle is switched off. It has a setting that tells it to power off when the battery voltage drops below a certain VDC as to not drain the battery.

I also have a CAN-BUS anti-theft device installed that requires a specific combination of button presses before the Jeep will start. And a digital RF key fob device as well to override the start-sequence.

I feel incorporating the Jeep specific CAN-BUS needed items into the RPI5, such as ESS disable, anti-theft, steering wheel controls, etc. and putting into a RPI5 touch screen would be a worth while community project. The anti-theft and some other items are probably better suited for a ESP32 device that is connected to the RPI5.

Fortunately, thanks to the trailblazers in this thread, a lot of the CAN bus reverse engineering for many of these items has already been completed.

Update on my A/C hacking: I was able to force the A/C on via CAN 2D3: $0700000000000200 Air recirculation on/off. The issue was the Linkswell.

I did a Linkswell software update, reset it to factory settings, went through the Jeep JL specific HVAC setup again and now the A/C is working as it should. However the "A/C Pressed" doesn't show as activated in JScan, but the clutch is engaged, shows clutch duty cycle and the A/C is working like it should. The A/C pressed button might be reserved for the OEM A/C controls rather than how the Linkswell commands it on via CAN bus.

 

[srogers]

Has anyone found the CAN ID for Volume? I've seen a few posts where volume was mentioned but no the hex value. Is there a hex value for it?

 

[rforbes]

Hello all! This is a super cool thread that I am definitely interested in. I built myself a little raspberry pi with a CAN HAT board so I can start doing some CAN sniffing. The part that I cant quite figure out is how to build a cable for this. I am assuming I am supposed to plug into the green STAR connector but not sure how. I have gone through some of the past posts but there are like 50 pages so it is a bit overwhelming.

If anybody has any advice I would love to hear it, thanks!

 

[dstevens]

Mouser or Digikey
2-2138650-1 white housing key B
5-2138650-1 green housing key E
5-928999-1 female terminal 22-24 awg
5-963715-6 female terminal 18-20 awg
On the star connector the far terminal is can high, can low is closest to edge

 

[patracy]

Hello, found this discussion over on reddit. I currently have a esp32 device to capture canbus traffic. What I specifically am looking for is two IDs. I know 079 is for the brakes. I *think 07D is for the cruise control + button.

What I'm after is the ability for my esp32 to sit on the canbus (I'm using a gateway bypass, not sure if I'd need it) then after around 3-5 seconds of engine run time I need it to announce the brake apply message and then 5 "taps" of the cruise + button.

I can easily see in savvycan the brake apply message and how it varies depending on apply. I can also see 07D update with taps to the + button. But when I hold the brake and apply the + button, I do not see any updates to 07D? Since brake defeats cruise while driving, maybe the cruise button values get incorporated into 079?

Anyone have any knowledge to share on this?

 

[patracy]

Looks like the ID for the cruise button is actually 0B1. I've tried to playback a log, but it doesn't seem like it does anything to the jeep. But that's probably something on my end.

 

[RooooySun]

Hi Stupid question, which one is c12?

 

[edvinmatu]

Hello,


I am performing a cluster swap on a 2013 Chrysler 300 using a 2015 cluster. However, I’ve encountered an issue where the cluster is stuck in imperial units. I’m trying to resolve this problem not only for my project but also to help others in the community who have done similar swaps outside the U.S. and need metric units.


From my research, I’ve found that pre-2015 BCMs (Body Control Modules) use different CAN IDs and lack the Customer Settings 2 (CSM2) feature, which allows users to select distance, speed, and temperature units. These settings are normally broadcast on the CAN-C bus, where the cluster reads them. If those messages are missing, the cluster defaults to imperial units.


I’m working on creating a CAN message that will keep the cluster in metric mode (km/h and °C). I’ve conducted extensive testing and analyzed multiple CAN dumps, but all publicly available data so far is in imperial units.


I’m looking for assistance from anyone who owns a 2015+ FCA car with Uconnect and can capture a CAN dump while switching between US and Metric units in Uconnect. Comparing these dumps would allow me to identify the differences and ultimately build a valid CAN message to lock the cluster in metric mode.


Based on the available data, it appears that the BCM broadcasts the relevant messages on CAN IDs 3B3 and 3B4, with the payload varying according to user settings.


Thank you in advance for any help or data you can provide.

 

[jaydenhollandGlad]

Just wondering if anyone has logged a trip with cruise control?? Long story short, I blew up the pentastar and don’t want to put a hemi or an LS in I have managed to map almost all of the can messaging through my own logs and other peoples logs on here but am struggling to find any with cruise activated speed up down. I am 90% of the way done on my build with an esp32 as a translator between the haltech ecu and the jeep bus but cruise is one item I don’t have and would really like to integrate. If any one has the ability to log it that would be greatly appreciated. The can-c side I have the button request but I need to know what the can-c side needs

Sponsored