JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[JustinB]

# 3honk.py
import time, os # MUST HAVE can-utils INSTALLED

os.system('cansend can1 620#10.03.00.00.00.00.00.00')
for i in range(0, 3): # HONK 3 TIMES
    print("HONK")
    os.system('cansend can1 620#2F.D0.AD.03.01.00.00.00') # HONK
    time.sleep(0.05)
    os.system('cansend can1 620#2F.D0.AD.03.00.00.00.00') # UNHONK
    time.sleep(0.1)
    i += 1

or if you prefer isotpsend

# 3honkisotp.py
import time, os

os.system('echo "10 03" | isotpsend -s 620 -d 504 -p 00: -P a can1')
for i in range(0,3):
    print("HONK")
    os.system('echo "2F D0 AD 03 01" | isotpsend -s 620 -d 504 -p 00:00 -P a can1')
    time.sleep(0.05)
    os.system('echo "2F D0 AD 03 00" | isotpsend -s 620 -d 504 -p 00:00 -P a can1')
    time.sleep(0.1)
    i += 1

Ok, I think I figured out the meeting place, just a little confused on the date.
#closeencountersofthethirdkindLOL

Sponsored

 

[Drdyer9051]

well fell down a rabbit hole today and found this..

we could use shifter buttons or wireless mouse, on our own menus displayed on the 8.4 by connecting our pi's to the display.....

 

[redracer]

I've been radio silent for a while on this as I've been busy with family life... but I have a run coming up this weekend so I've been putting in some time on this. attached is a screenshot of where I'm at, and I have more work to do this week. But, it's all functional! I setup a raspi camera on the front grill and used the HDMI adapters to connect the camera to the PI on my dash. The best part about this, is it's completely lag free.

This is the tkcan3.py on our github repository.

 

[redracer]

More Progress. I think that it's good enough for my first run. The code is quite ugly, as I hard coded a bunch of stuff. I just don't have the time to make this elegant at the moment.

I give to you tkcan4.py

https://github.com/rstellhorn/jeep-jl-powernet-scripts/blob/main/tkcan4.py

 

[redracer]

Well I got to do the Sierra Trek run this weekend and everything worked great. My Jeep survived the Fordice trail from camp down to the creek and back up. Man what a trail!

And my pi screen was immensely helpful! I used the front camera a lot and flipped back to look at temperatures every so often. I saw my power steering temp get as high as 209°... But it never caused the overheating alert that I have seen before. The pi camera with the fisheye lens gave a very helpful perspective on this difficult trail.

I have new ideas and more changes to code to come.

 

[MissAnnThorpe]

it's major problem appears to be that there's no direct source of power in the immediate area. (If I'm overlooking something, please, add what you know!)

There are two options I know of, at least. There's a small adapter you can get from a bunch of sources to tap the cigarette lighter from behind. There's also this wire harness and switch bank that provides power around that area inside the cabin.

If you've gone that far, you might as well temporarily yoink out the UConnect unit and run power up through the dash. Pretty safe to drill if you're careful once you've removed the head unit. I've got power going to a Pi with touchscreen mounted with a 20mm ball adapter and vesa bracket on a 67 designs arm.

 

[MissAnnThorpe]

apple car play is the culprit I believe. don't think android people are having issues with Uconnect

I can replicate the issue with my iPhone 16, Pixel 6 Pro, and Pixel 4. My guess would be Jeep f**ked up the USB PD implementation since it's pretty common and causes these elsewhere.

It's gonna be a bigger issue in the future since almost all phones, including newer iPhones, use the USB Power Delivery standard for charging.

I'm taking it to the dealership tomorrow to replicate the issue in front of the techs since it's been three times already, they "can't replicate" the issue, and I'm entirely out of tolerance.

 

[MissAnnThorpe]

Waveshare 2-Channel CAN adapter

Anybody try this on a pi4 running 64 bit RaspiOS? I am getting a failed SPI probe and I'm not sure if it's the driver in the 64 bit OS or a failed hat. I will probably rule the latter out tomorrow on another Pi unless somebody can confirm it does work on 64 bit RaspiOS.

[    9.314240] mcp251x spi0.0: MCP251x didn't enter in conf mode after reset
[    9.314422] mcp251x spi0.0: Probe failed, err=110
[    9.314443] mcp251x: probe of spi0.0 failed with error -110
[   10.329906] mcp251x spi0.1: MCP251x didn't enter in conf mode after reset
[   10.330087] mcp251x spi0.1: Probe failed, err=110
[   10.330110] mcp251x: probe of spi0.1 failed with error -110

My config.txt is

...
dtparam=spi=on
dtoverlay=mcp2515-can1,oscillator=16000000,interrupt=25
dtoverlay=mcp2515-can0,oscillator=16000000,interrupt=23

 

[redracer]

Anybody try this on a pi4 running 64 bit RaspiOS? I am getting a failed SPI probe and I'm not sure if it's the driver in the 64 bit OS or a failed hat. I will probably rule the latter out tomorrow on another Pi unless somebody can confirm it does work on 64 bit RaspiOS.

Yes, @jmccorm at first tried to use a Pi 4 and ran into lots of issues. If I remember right, he was able to get just one can bus online, but it would crash on bringing up the 2nd interface. He ended up going to a Pi 3

 

[MissAnnThorpe]

Since that time, we've found a low-cost source for Jeep's official CAN connectors.

Any chance this text in OP could be hyperlinked to this? I've been looking for those.

Yes, @jmccorm at first tried to use a Pi 4 and ran into lots of issues. If I remember right, he was able to get just one can bus online, but it would crash on bringing up the 2nd interface. He ended up going to a Pi 3

Thanks! That's useful. I'll try that tomorrow then, although one interface is probably all I need for what I want to do (read only, safe, simple stuff).

 

[redracer]

Any chance this text in OP could be hyperlinked to this? I've been looking for those.

I found it buried in this thread...

Mouser items received and tested!

The green CAN-IHS connector and the white CAN-C connector both plugged into their respective hubs without issue. They appeared identical to the factory connectors to the left and to the right of them. The keying was correct, so it was not possible to plug either one of them into the wrong bus. EXCELLENT!

Assembled using pre-wired terminals from an official Jeep CAN connector repair kit.​

The terminals (metal pins which go inside the connector) turned out to be a bit of a problem for me. I either don't have the right tools, or I don't have the right skills to create a solid crimp between the connector and a wire. So, to the best of my ability, I believe that these terminals are also correct. Total cost for both CAN bus connectors and terminals is $1.86 (plus the cost for wire).

I'll admit, my hardware skills could use some work, but I suspect many others are going to be equally unable to create a solid crimp to the terminal and then feed it into it's home inside the connector. I might be able to find some place local that could handle my own crimping, but is there a more universal solution? Some way to order the terminals already wired up, or... ?

I'm wondering if we should point people to the DLC (OBD-II) connector and bypass cables, or do we just make note of this as a hurdle when connecting directly to the CAN bus? Perhaps this isn't a problem that should be solved right now?

Thanks, all. And again, many thanks to Temperance for her keen eye and solid skills in locating just the right parts at Mouser! A+++

 

[redracer]

And...

I placed an order with Mouser. The items should be here tomorrow. Naturally, I'll let you know how it turns out. (Just to hedge my bets, I ordered another model of terminal in case the first one doesn't work out.) And thanks!

Line Number​	Mouser Part Number Customer Part Number Manufacturer Part Number Description​	Quantity Ordered​	Quantity Shipped​
1​	571-5-2138650-1 5-2138650-1 TE Connectivity Automotive Connectors US HTS:8536694040 ECCN:EAR99 COO:US​	10​	10​
2​	571-2-2138650-1 2-2138650-1 TE Connectivity Automotive Connectors US HTS:8538906000 ECCN:EAR99 COO:US	10​	10​
3​	571-5-963715-6 5-963715-6 TE Connectivity Automotive Connectors US HTS:8544200000 ECCN:EAR99 COO:DE	20​	20​
4​	571-1718760-2 1718760-2 TE Connectivity Automotive Connectors US HTS:8538908140 ECCN:EAR99 COO:DE	10​	10​

Note, later he discovered that the line item #3 part 5-963715-6 was not necessary.

... But I checked my order and I had the following...

​

Line Number​	Mouser Part Number Customer Part Number Manufacturer Part Number Description​	Requested Delivery Date(s)​	Estimated Shipment Date(s)​	Quantity​	Unit Price (USD)​	Extended Price (USD)​
1​	571-5-2138650-1 5-2138650-1 2P MQS Unsealed Plug​	JAN 04, 2022​	JAN 04, 2022​	10​	0.366​	3.66​
2​	1 571-2-2138650-1 2-2138650-1 2P MQS Unsealed Plg​	JAN 04, 2022​	JAN 04, 2022​	10​	0.381​	3.81​
3​	1 571-5-963715-6 5-963715-6 MQS REC CONT​	JAN 04, 2022​	JAN 04, 2022​	20​	0.153​	3.06​

 

[MissAnnThorpe]

Turns out I did a derp and was trying to load the wrong overlay. I have a slightly different hat. Works now using the instructions at that link (on pi4 even, although I've not yet connected to the Jeep's can bus).

ann@jeep-cabin:~ $ dmesg | grep can
[    8.201509] mcp251xfd spi0.0 can0: MCP2518FD rev0.0 (-RX_INT -MAB_NO_WARN +CRC_REG +CRC_RX +CRC_TX +ECC -HD c:40.00MHz m:20.00MHz r:17.00MHz e:16.66MHz) successfully initialized.
[    8.249925] mcp251xfd spi1.0 can1: MCP2518FD rev0.0 (-RX_INT -MAB_NO_WARN +CRC_REG +CRC_RX +CRC_TX +ECC -HD c:40.00MHz m:20.00MHz r:17.00MHz e:16.66MHz) successfully initialized.

 

[MissAnnThorpe]

And...

That's exactly what I needed. Thanks!

 

[redracer]

Well, we have a new data point. I just traded my '18 Manual for a '23 4xe . I look forward to discovering some data around the hybrid system. I'll get a capture done and posted in the next few days.

Sponsored