JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[dstevens]

Tx Address​	Rx Address​	Bus​	Module​
0x47E​	0x47F​	?​	Security Gateway​
0x620​	0x504​	CAN-IHS​	Body Control Module​
0x740​	0x4C0​	?​	RF hub​
0x742​	0x4C2​	?​	Instrument panel​
0x743​	0x4C3​	?​	Tire Pressure​
0x744​	0x4C4​	?​	Airbag​
0x747​	0x4C7​	CAN-C​	ABS​
0x749​	0x4C9​	?​	Electronic Shifter​
0x74A​	0x4CA​	CAN-IHS​	Sway bar​
0x74B​	0x4CB​	CAN-C​	Drive train FDC​
0x753​	0x4D3​	?​	Adaptive Cruise Control​
0x75A​	0x4DA​	?​	EPS​
0x762​	0x4E2​	?​	Park Assist​
0x763​	0x4E3​	?​	Steering Column​
0x783​	0x503​	?​	HVAC​
0x784​	0x504​	?​	Driver Door (?)​
0x785​	0x505​	?​	Passenger Door (?)​
0x792​	0x512​	CAN-IHS​	Unknown​
0x794​	0x514​	?​	Central Vision Processing​
0x7BC​	0x53C​	?​	Integrated Center Stack​
0x7BE​	0x53E​	?​	Amplifier​
0x7BF​	0x53F​	CAN-IHS​	Radio​
0x7E0​	0x7E8​	CAN-C​	PCM​
0x7E1​	0x7E9​	?​	TCM​
0x7E2​	0x7EA​	?​	Hybrid Control Processor​
0x7E7​	0x7EF​	?​	Battery Pack Control Module​

Sponsored

 

[dstevens]

Tx Address​	Rx Address​	Bus​	Module​
0x47E​	0x47F​	CAN-C​	Security Gateway​
0x620​	0x504​	CAN-C​	Body Control Module​
0x740​	0x4C0​	CAN-C​	RF hub​
0x742​	0x4C2​	CAN-C​	Instrument panel​
0x743​	0x4C3​	CAN-C​	Tire Pressure​
0x744​	0x4C4​	CAN-C​	Airbags​
0x747​	0x4C7​	CAN-C​	ABS​
0x749​	0x4C9​	CAN-C​	Electronic Shifter​
0x74A​	0x4CA​	CAN-IHS​	Sway bar​
0x74B​	0x4CB​	CAN-C​	Drive train FDC​
0x751​	0x4D1​	CAN-C​	Driver Presence​
0x753​	0x4D3​	CAN-C​	Adaptive Cruise Control​
0x75A​	0x4DA​	CAN-C​	EPS​
0x762​	0x4E2​	CAN-C​	Park Assist​
0x763​	0x4E3​	CAN-C​	Steering Column​
0x783​	0x503​	CAN-IHS​	HVAC​
0x784​	0x504​	?​	Driver Door (?)​
0x785​	0x505​	?​	Passenger Door (?)​
0x791​	0x511​	CAN-IHS​	Left blind spot​
0x792​	0x512​	CAN-IHS​	Unknown​
0x794​	0x514​	CAN-IHS​	Central Vision Processing​
0x799​	0x519​	CAN-IHS​	Right blind spot​
0x7AB​	0x52A​	CAN-C​	Assistance / telematics​
0x7BC​	0x53C​	CAN-C​	Integrated Center Stack​
0x7BE​	0x53E​	CAN-IHS​	Amplifier​
0x7BF​	0x53F​	CAN-IHS​	Radio​
0x7E0​	0x7E8​	CAN-C​	PCM​
0x7E1​	0x7E9​	CAN-C​	TCM​
0x7E2​	0x7EA​	CAN-C​	Hybrid Control Processor​
0x7E7​	0x7EF​	?​	Battery Pack Control Module​

Updated 3/26/2024

Engine Start Stop

Button
Two packets show the ESS button press.
0x297 CAN-C byte 6 = 0x24 when button pressed
0x2D3 CAN-IHC byte 0 = 0x24 when button pressed
Note both packets are nominally 1 Hz but will increase the rate when buttons are pressed.

Status
Two packets show the ESS status
0x137 CAN-C byte 6 bit 0 set when ESS disabled
0x340 CAN-IHC byte 5 bit 3 set when ESS disabled
0x137 is 10 Hz and 0x340 is 1 Hz

Traction Control

Button
0x2D3 CAN-IHS byte 7 bit 0 set when TC button pressed
0x2D3 is 1 Hz but will increase when the button is pressed

Status
0xDD CAN-C byte 6 bit 6 set when TC disabled
0xDD is 20 Hz

Autopark

Driver Door
Two packets show the driver door status.
0x9B CAN-C byte 3 bit 3 = 1 when driver door closed
0x2FA CAN-IHC byte 0 bit 0 = 1 when driver door opened
0x9B 50 Hz and 0x2FA 2 Hz.

Driver Seat Belt
0x1D0 CAN-C byte 2 bit 0 = 1 when driver seat belt buckled
0x1D0 1 Hz but will increase in frequency when something changes.

ESS/TC Memory
To retain ESS & TC between driving cycles (simplified somewhat)

• Continuously monitor the ESS and TC status using 0x137 and 0xDD
• After the engine has been on for 2 seconds, if the ESS or TC status is different from when the engine was switched off, wait for the next 0x2D3 (console button) packet.
• When the 0x2D3 packet arrives, alter and re-transmit with a ESS or TC button press if necessary.
• Save the ESS/TC status when the engine is switched off

This first attempt works ok for ESS but TC will self-enable when the transfer case is shifted. Probably the logic could be more complex where the TC switches back on in 2 hi at a certain speed.

 

[us3r1d]

I've only read the first 3 pages so far, but this thread is _amazing_.

My current goal is to connect a Raspberry Pi via the OBD port (I don't want to pull apart my dash yet) in order to stream telemetry to my own server and to replicate some features that will go away when FCA finally processes my privacy disconnect request on the cell modem. GPS coordinates are where I'm trying to start with that; kind of a homebrew version of SirusXM Guardian.

I'll finish reading the thread before I start asking questions.

 

[us3r1d]

I'll finish reading the thread before I start asking questions.

Finally had time to finish reading that; that's great.

(Though I don't trust _anything_ that comes out of ChatGPT or its ilk, so that's a problem with the most recent stuff.)

It also may not help me a lot, turns out, on account of I have a 2024 and so I guess I have the new Atlantis system instead of the PowerNet you've been working with.

I do have some ideas on securing your Pi installs while maintaining a wifi connection. I'll get that written when I'm on the computer; it's too much to type on my phone.

 

[us3r1d]

I do have some ideas on securing your Pi installs while maintaining a wifi connection. I'll get that written when I'm on the computer; it's too much to type on my phone.

So, this is what I do on my (rooted) android phone to allow me to ssh into it without having any externally-facing ports open; it also lets me ssh into it no matter what network it's on, even behind a NAT. It's what I intend to do on the Pi when I get it running in my Wrangler.

First, install "autossh"; there is an apt package for raspbian.

Next, switch the listener address in the sshd config file to either 127.0.0.1 or (if you also want to be able to plug into the Jeep's Pi on ethernet) to whatever non-routable IP you have assigned to eth0.

Then, you have to have a server running somewhere the Pi can reach. One that's only on your local wifi is fine, but a publicly-facing server will let this work from anywhere if you put a cell modem on the Pi.

I use this on my phone to manage the connection to the server:

AUTOS=`ps ax | grep autossh | grep -v grep | wc -l`

if [ ! 0 -lt $AUTOS ]
then
  autossh -f -N -M 0 -o "ServerAliveInterval 10" -o "ServerAliveCountMax 3" \
    -R 0.0.0.0:8022:0.0.0.0:8022 {server user}@{server}
fi

(You can call that from cron every minute to make sure it comes back if autossh dies.)

That will open a session on the server that carries a tunnel back to the Pi.

Then, from the server you can just run:

ssh -p 8022 {pi user}@localhost

That gives you a command shell on the Pi that can be accessed over the local wifi (or even the Internet) with no open listener ports.

Hope that's of use.

 

[us3r1d]

It also may not help me a lot, turns out, on account of I have a 2024 and so I guess I have the new Atlantis system instead of the PowerNet you've been working with.

I looked behind the glove box today, and it looks like the 2024 4xe has similar blocks of white and green canbus connectors to what was described earlier in this thread.

So if this is a new system, it's not _that_ different from the old one.

 

[jmccorm]

I looked behind the glove box today, and it looks like the 2024 4xe has similar blocks of white and green canbus connectors to what was described earlier in this thread.

So if this is a new system, it's not _that_ different from the old one.

Someone described the protocol to me once, but I remember enough to know that it won't be the same (but uses a standard configuration which you can match with your adapter settings). I believe it uses the longer address ID format, but what speed and other settings, I do not know. Hope this helps some!

 

[jmccorm]

Tx Address​	Rx Address​	Bus​	Module​
0x47E​	0x47F​	?​	Security Gateway​
0x620​	0x504​	CAN-IHS​	Body Control Module​
0x740​	0x4C0​	?​	RF hub​
0x742​	0x4C2​	?​	Instrument panel​
0x743​	0x4C3​	?​	Tire Pressure​
0x744​	0x4C4​	?​	Airbag​

Where did you find or how did you arrive at the Tx and Rx address of each Module? Is it from the spreadsheet (first post on this thread), or does this come from another source?

 

[azjl#3]

I'm out. good job guys

 

[jmccorm]

BCM $A01A - OIL CHANGE STATISTICS

Here's another discovery that I wish I could claim credit for. You can determine how many engine revolutions, how many hours, and how many kilometers it's been since your last oil change. (Or since you've done an "oil change reset" on your dash.)

Ready?
ENGINE REVOLUTIONS SINCE OIL CHANGE:
HOURS SINCE OIL CHANGE:
KILOMETERS SINCE OIL CHANGE:

Here's a project, potentially quite interesting, which I've had in the back of my mind for a while now, but no way to pursue it, as I don't have a Wrangler 4xe. So if someone who's digging around in this CAN bus traffic also has a 4xe, this might be worth looking at.

It started with a suggestion that someone made in an earlier post... has just stuck with me.

FORM - What Can Jeep Do to Improve Customer Interface

The idea @Dabrakeman had was an excellent one, which was to use a bargraph or some other indicator to show the vehicle's fuel-oil refresh status. Here's what it might look like:

"There is an algorithm calculating your exact status relative to FORM for both gas and oil for both entry and exit so the vehicle already knows this information, Jeep just needs to share the status (not the algorithm ? ) with the end customer." @Dabrakeman​

I really wish that Jeep would engage with us and help us figure out where some of these statistics are kept in the various modules. What @Dabrakeman has described is, otherwise, a 100% viable (low-cost) third party product that expresses what the 4xe has already figured out about itself... we just don't know WHERE it's done that.

Lacking those variables, I'm wondering if we can get at it another way. I'm thinking if we can approximate average engine RPM, we can get a rough idea for what kind of heat level we're generating. Anyone have any thoughts if a combination of oil change statistics for Engine Revolutions since Oil Change and Hours Since Oil Change would allow us to back into something like Average Engine RPM since Oil Change?

I'm thinking that Average Engine RPM would be a good proxy for "how hot (on average) we keep the engine", which sounds to me like a very good candidate for a number that Jeep might use to automatically enter / exit FOAM mode on the 4xe.

This looks like it could be a very cool (and helpful, and commercial) product, if successful.
Thoughts, anyone?

 

[us3r1d]

.
This looks like it could be a very cool (and helpful, and commercial) product, if successful.
Thoughts, anyone?

I do have a 4xe, but haven't had time to get a Pi hooked up yet.

RPM is problematic as a proxy for temperature, though, since ambient air temperature varies so much?

The actual data on whether the gas engine is running and what the oil temperature is is definitely available somewhere on the bus, since uConnect has it, so it should be possible to collect that and come up with an algorithm that approximates Jeep's.

(I'd guess that graphing the oil temperature over time and taking the area under 200 degrees minus the area over 200 degrees would give you a single stat that would be able to predict FORM reasonably? Not that I can remember how to calculate the area under a line anymore.

You'd need either someone with regular FORM happening or a large crowdsourced dataset for that, though.

I'm at almost 1,500 miles now and no FORM; being in NorCal, I don't have particularly low temperatures to deal with.

 

[rforbes]

I came her to say.... I found my people! I am definitely following this thread.

while I am here I am curious if anybody knows of PIDs for the 4xe that covers things like electric motor temp and battery temps.

really looking forward to reading all this.

 

[dstevens]

Where did you find or how did you arrive at the Tx and Rx address of each Module? Is it from the spreadsheet (first post on this thread), or does this come from another source?

A variety of sources with some confirmation using UDS 0x22 ReadDataByIdentifier. DIDs of 0xF18x will spit out part numbers for most modules.

 

[jmccorm]

I do have a 4xe, but haven't had time to get a Pi hooked up yet.

RPM is problematic as a proxy for temperature, though, since ambient air temperature varies so much?

I'm glad you asked that question. Actually, I'm thinking NO! Here's why:
Your coolant temperature is very much going to be associated with ambient temperature and will fluctuate seasonally, as you say. However, oil temperature is a very different beast. A vehicle's oil temperature is something that more easily stays within a very certain controlled range. (That range is dictated by optimum combustion temperatures, both minimum and maximum, which I want to guess my typical numbers are in the neighborhood of 175.)

Again, I'm not a 4xe person, but I thought I heard claim to some 4xe owners seeing the FOAM level improve in some situations when they told their vehicle (through the steering wheel controls) that they just performed an oil reset. Do you know if this is true or untrue? (If true, it would seem to point to Jeep actually using these same counters for their FOAM status calculations).

 

[jmccorm]

A variety of sources with some confirmation using UDS 0x22 ReadDataByIdentifier. DIDs of 0xF18x will spit out part numbers for most modules.

Darn it! I was trying to fish for any good resources you might have which other members of the group might take advantage from.

Sponsored