JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[Temperance]

Mouser items received and tested!

Yay! I got my order and they worked perfectly as well.

I'll admit, my hardware skills could use some work, but I suspect many others are going to be equally unable to create a solid crimp to the terminal and then feed it into it's home inside the connector. I might be able to find some place local that could handle my own crimping, but is there a more universal solution? Some way to order the terminals already wired up, or... ?

I use this tool for crimping small wires and terminals: https://smile.amazon.com/gp/product/B00OMM4YUY/ref=ppx_yo_dt_b_search_asin_title?ie=UTF8&psc=1
It takes a little practice, but once you get it down it goes smoothly. It's also not the perfect tool for crimping sealed terminals. I need to pick up a crimper for that one of these days...

Sponsored

 

[c7j6y1]

I build police cars/trucks for a living and vehicle integration is a hit topic in my industry as of late. Every manufacturer, Whelen, Code 3, Federal Signal, and Feniex all have introduced OBD or CanBus reading into their systems to integrate the emergency system with vehicle signals.

Driver door opens and it kills the flashing lights on that side, patterns change with speed or Park.

I'm looking at upfitting my wrangler with a Whelen Core system once it arrives and want to OBD integrate it into the system. This information is awesome to have

 

[jmccorm]

That worked as expected. except....
"echo Third brake light on" isn't quite the text that I was expecting. ;-)

Ha! I should have been more careful when repurposing code.

On that topic, I'm taking the horn honking scripts and moving them up to the next level. Instead of "cansend", we're using "isotpsend" which (later) will allow us to send messages longer than 8 bytes. It also allows us to receive and process message acknowledgements.

The following script "3honk" will honk the horn three times, but using this new method which we're almost certain to build upon later.

#!/bin/bash

# Wake up the CAN bus if needed (at the cost of 0.2 seconds)
cansend can0 2D3#0700000000000000
sleep 0.2

echo "10 03" | isotpsend -s 620 -d 504 -p 00: -P a can1
for i in 1 2 3
do
echo HONK
echo "2F D0 AD 03 01" | isotpsend -s 620 -d 504 -p 00:00 -P a  can1
sleep 0.05
echo UNHONK
echo "2F D0 AD 03 00" | isotpsend -s 620 -d 504 -p 00:00 -P a  can1
sleep 0.1
done

NOTE: The script assumes that your vehicle is already awake. If not, wake it up first.

In another window, you can use either (or both) of these commands to watch what is happening at different levels of the messaging stack:

isotpdump -s 620 -d 504 -c -ta -u any​

candump any,400:400 | egrep -v "can.*4[01234]. "​

 

[redracer]

for some reason, this does not wake up the bus for the fist try. first run does nothing. subsequent runs work fine.

 

[jmccorm]

for some reason, this does not wake up the bus for the fist try. first run does nothing. subsequent runs work fine.

I have a script in my path called wake. It looks like this:

#!/bin/bash
cansend can0 2D3#0700000000000000

If you put that in your path, then all you have to do is add the following commands before the first echo:

wake ; sleep 0.2​

​

That'll take care of the issue. I've been trying to figure out if I should go ahead and put a wakeup command at the start of my scripts or not. At least, the ones that I share. I guess I'll go ahead and do it. (I'll go back up there and edit that script, too.) Just know that you can remove it if/when you know you're working with a vehicle that's on and active.

 

[jmccorm]

I'm looking at upfitting my wrangler with a Whelen Core system once it arrives and want to OBD integrate it into the system. This information is awesome to have

I'd be interested in seeing how that turns out, for sure. I'm assuming it already has the Chrysler door codes, but if not, we can hammer those out quickly enough. Speed related lights? No fair! I was wanting to do some glowing engine lights based upon the value it pulled off of the CAN bus!

 

[jmccorm]

SCRIPT: Hold Engine at 2,000 RPMs!

If you want to try something out, here's a lightly tested script that should raise your engine RPMs to 2K and hold it there until you CONTROL-C out of the script. I call the script 2k. I'm running this right now because I'm about to go out the door and it's COLD!

#!/bin/bash

# No wakeup script necessary
# If the engine isn't running, this whole thing is useless anyhow.

# Diagnostic session (requesting more rights)
echo "10 92" |  isotpsend -s 7E0 -d 7E8 -p 00:00 -P a can1
sleep 0.25

# Tester is present - remain in diagnostic session
# This is probably redundant, but I'm leaving it here for now.
echo "3E 00" | isotpsend -s 7E0 -d 7E8 -p 00:00 -P a can1
sleep 0.25

# Set engine to 2K RPMs
echo "31 05 07 D0" | isotpsend -s 7E0 -d 7E8 -p 00:00 -P a can1

# Maintain current setting by continuing to tell the Wrangler
# that a testing device is still connected to it. As soon as we
# exit this script (CONTROL-C or a kill command), our
# messages to the module will stop, and when that happens,
# we'll exit out of diagnostic mode and the engine RPM
# command will automatically be cancelled.

while [ 1 ]
do
  sleep 0.25
  # Tester is present - remain in diagnostic session
  echo "3E 00" | isotpsend -s 7E0 -d 7E8 -p 00:00 -P a can1
done

From inside the house, I'm reading the following vehicle stats:
KEY: RRun BRK: 0% ACCL: 0% (VALVE 1%) RPM: 1995 STEER: CENTR

PS: Thank you for collecting the data which made this command possible! And now that I'm back home from my trip, it looks like this script is reasonsbly safe. Because the engine RPM command requires the vehicle be in diagnostic mode, we're keeping diagnostic mode alive as long as we regularly send "Tester Is Present" messages. The only concerns I might have is if this bypasses the rev limiter. You'd want to be very careful not to specify 10,000 RPMs until you knew for sure.

 

[redracer]

I'd suggest that while we are playing with RPM, some safeties might be in order. My idea would be to treat it just like a remote start... Listen for any press of the brake or throttle pedal (or clutch if I can find it) and then turn off the diagnostics mode if found.

I'll play with how to do that. Probably just starting a candump at the start of the script and checking the running output in the loop for any of these values would do... or perhaps checking in a trap.

 

[c7j6y1]

I'd be interested in seeing how that turns out, for sure. I'm assuming it already has the Chrysler door codes, but if not, we can hammer those out quickly enough. Speed related lights? No fair! I was wanting to do some glowing engine lights based upon the value it pulled off of the CAN bus!

So according to the systems I've worked with, the chrysler versions have the 2 wire plug that gets tapped into a star port as seen in attached screen shots.

Does the wrangler use a common chrysler can bus signals? Does the wrangler use the same kind of plug in canbus plug?

If it did I can try and use the Chrysler/ dodge model and see what's available

They list the grand cherokee, so.....?

 

[redracer]

Yes,we have at least two of these star ports. And as for compatibility, I know that we are compatible with a 2018+ grand Cherokee... At least as far as audio and HVAC are concerned.

 

[jmccorm]

I'll play with how to do that. Probably just starting a candump at the start of the script and checking the running output in the loop for any of these values would do... or perhaps checking in a trap.

Actually, that'd be great! I don't hold myself up as having an ideal programming methodology, so I'm happy to see how someone else goes about this.

Yes,we have at least two of these star ports.

Here's a picture (reposted from earlier) with the two star ports behind the glovebox. The purple wires are my own (that I've connected to a Raspberry Pi in the glovebox).

Worth nothing, it's called a "star connector" due to the network topology of this design, not because of it's physical shape. CAN-C is on the left, CAN-IHS is on the right. There should be plenty of empty space for more items, no matter what options any of us has installed from the factory.

Does the wrangler use a common chrysler can bus signals?

As redracer alludes to, we share uConnect (the infotainment/stereo/vehicle menu system) with other models, and how uConnect operates is very strongly tied to the CAN bus configuration we see in the Wrangler. (I'm also seeing shared vehicle modules, such as the BCM, DCM, TCM, etc. There's quite a bit of shared components in play.)

But we've only just begun to dig into the Wrangler's CAN bus, so we don't yet have a list of models and model years that share our design. The (electrical) design of the bus goes back to 2012, but what we expect is that the message IDs and the content of the messages are only going to be shared with other late-model Jeep/Chrysler/Dodge/Fiat vehicles.

Wait a second... I'm looking over the documents you shared with us, and I think you may have given us the brand name for our CAN bus connector. We knew we the ones we got from Mouser came from TE Connectivity.. but it looks like Micro Quadlok System (MQS) is the trade name given to their automotive connectors. Nice!

Their PDF catalog has some designs that look remarkably similar (page 28 in particular), although I'm not seeing our exact part number listed. If that's the right one, then the mate for it is listed on page 31, which will be good to know when someone's looking to intercept and modify CAN traffic in-transit.

Thank you for sharing those pages from your installation instructions!

 

[jmccorm]

Aux Battery Voltage Script

It looks like I forgot to share one of the scripts I made along the way.

This pulls the battery's voltage from the regular flow of CAN traffic. So that means that the vehicle must be awake (or you'll need to wake it yourself), but it does not require any special UDS query to set it up. It automatically refreshes once a second.

#!/bin/bash

error() {
  echo "ERROR: Is the vehicle off? Battery voltage data not found."
  echo "DEBUG: A valid ID 2C2 message was not seen on CAN-IHS within 2 seconds."
  echo " "
  # Exit with a failure result code
  exit 1
}

COMMAND="timeout -s 9 2 /usr/bin/candump -L can0,02C2:0fff"
can2C2=$( $COMMAND | tail -1 )

if [ "$can2C2" == "" ] ; then error; fi
if [ "$( echo "$can2C2" | cut -c30-43 )" == "FFFFFFFFFFFFFF" ] ; then error; fi
temp="$( echo "$can2C2" | cut -c34-35 )"
temp="$( printf "%d" 0x$temp )"
temp="$( echo "1 k $temp 10 / p" | dc )"

echo $temp vdc

Which battery does it measure? I don't have eTorque, so my vehicle's design involves a regular sized automotive starter battery with a smaller aux battery below it. This appears to return the voltage of the aux battery.

For eTorque or hybrid vehicles, I'm not sure if this message will be present or how it ends up responding. It'd be interested to know, though!

 

[c7j6y1]

heres a list of the signals that Whelen uses to enact some of the inputs available

 

[jmccorm]

Read Vehicle VIN via Shell Script (Linux)

I thought I might of shared this before, but I looked back through all the messages and I couldn't find it. This script REQUIRES THE VEHICLE IGNITION TO BE IN THE "RUN" POSITION. (Waking up the bus is not enough.)

The VIN is transmitted in three messages, with each part appearing just 0.1 seconds from the last message. So if you listen for 0.31 seconds, you're guaranteed to have all the parts you need... although they may not be in the correct order. This script uses an array to assemble the VIN regardless of the order it was received in.

#!/bin/bash

# The vehicle's VIN is available from message ID $380.
# Due to it's length, it is split across three messages.
# The first character contains the messge ID [0-2]
# The next seven characters holds ASCII character (in hexadecimal)
# Each part of the message is sent 0.1 seconds apart.

# We need to combine all three parts, convert them to ASCII,
# and store them in the variable $VIN

# We'll wait up to 0.35 seconds for three message to arrive
# (in any order).

# We'll create an array called $message
declare -a message

# We're going to store the VIN number in a variable called $vin
vin=$( timeout -s 9 0.35 /usr/bin/candump -L can0,03E0:0fff | \
       cut -d# -f2 | while read a
do
  # Extract the message ID number [0-3]
  id="$( echo $a | cut -c1-2 )"
  id=$( printf "%d" $id)

  # Extract the data, convert to ASCII, remove trailing NULL characters.
  data="$( echo $a | cut -c3- )"
  data="$( echo $data | fold -w2 | paste -sd ' ' | sed -e 's/\( 00\)*$//g' )"
  data="$( bindechexascii --h2a $data 2>/dev/null | cut -d: -f2 |  cut -c2- )"

  # Assign the data to an array called $message
  message[$id]="$data"

  # Print all three message parts, present or not.
  echo ${message[@]} | tr -d ' '

  # Exit the loop, only keeping the last line, which we
  # have set (above) to be stored in the variable $vin

done | tail -1 )

chars=$( echo -n "$vin" | wc -c )

# If there are no characters, no VIN was received. Print an error.

if [ $chars -eq 0 ]
  then
    echo "NOTFOUND"
    exit 2
  fi

# Check to see how many characters are in our reassembled VIN.
# If it is less than 17, exit the script with an error.

if [ $chars -lt 17 ]
  then
    # INVALID VIN, EXIT WITH RESULT CODE 1 TO SIGNIFY AN ERROR.
    echo "INVALID($vin)"
    exit 1
  fi

# Print the VIN to standard output
echo $vin

Vehicle VIN could be used in a number of ways. For example, the Tazer and JScan use Vehicle VIN to authorize their devices to a specific vehicle. One might use the VIN in other ways, such as an encryption cypher which obfuscates data.

With some modification, this script might also be used to decode song title/artist/album/radio station data which appears on the EVIC music screen.

 

[jmccorm]

heres a list of the signals that Whelen uses to enact some of the inputs available

These appear to be generic vehicle parameters which might be pulled from the CAN bus. The only ones that really stand out as being brand or model specific would be the Drivemode ones. And I see how you can associate those triggers with different actions.

It doesn't reveal the raw CAN bus data that it's looking for with each trigger, so it seems that the best way to know if something's going to work or not is simply to try it.

Given what you've provided in your manual, you're going to have the right connector to plug into the CAN-C bus and one of the late-model Chrysler vehicles should do the trick. A hatchback is ideal, if not, select a RAM truck. Choose one with the same number of doors as you have (2 or 4). The ECU classifies the Wrangler as a hatchback, presumably because of the swing gate in the back.

Sponsored