JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[EVguy1]

Thanks redracer, this was the first thread that I found that was doing anything close to what I think I need. There is a lot of basic info that would cross to any vehicle as far as reading the Canbus so at least its a starting point.

Sponsored

 

[dstevens]

PCM UDS service 22 (read data by id)

01 AE = knock retard (reply = unsigned char, lsb = 0.5, unit = degrees)
02 27 = fuel level (reply = unsigned char, lsb = 1, offset = 100, unit = %)
06 DA = engine torque (reply = signed short, lsb = 0.4, unit = Nm)

 

[dstevens]

Here's an option for a dash display. I have no interest in Lufi, nor do I get a commission etc from them. It's a relatively cheap display that will be useful for anyone interested in the JL OBD.

Lufi makes 4-5 different OBD displays - the X1, XF, X7, but the one that is useful for us is the XS. It can be found on Amazon from $125 or Aliexpress for $80 if you can wait a week for shipping.

It is a LCD display with 7 pre set screens (of which most are not that useful to us). It can display the standard J1979 OBDII PIDs that the JL supports but the neat thing about the XS is that it supports custom PIDs. And the double neat thing is that it supports data from the CAN packets that are floating around on the CAN-C bus. I know of no other display that can do that.

It has its problems.

• It has GPS which takes forever to get a lock (30+ minutes) and then is wildly inaccurate (often 1000 feet elevation). I think the GPS is just there for speed.
• It has this horrible feature of 'smoothing' between data readings which results in the display numbers constantly changing. For example, if you are showing the ignition timing and it changes from 10 degrees to 20 degrees with a one second interval the XS will show the numbers clocking smoothly from 10.0 to 20.0 over one second, so you just see a jumble of changing numbers. For things like temperatures this is not a big deal.
• The XS has an alarm feature where it will highlight the alarm value in a deep red which is unreadable. So when the ECT gets hot it changes to something unreadable so you don't acxtually know what the ECT is.
• There are seven screens which can be cycled and they each show some fixed information and some information that can be customized. For me it would be vastly more useful if I had 3-4 screens which were all customizable. I don't need any which show the tach nor speed. I'd like one for the highway. One for towing. One for off road.

Once again I wish the people who work on the product actually had to use it in the field, but despite these problems it still is useful.

The XS has USB-C and enumerates as a mass storage device. The user PIDs all are stored as small binary files. There are built in selections for various vehicles; Jeep has about 10 of which 4-6 actually work.

I'll run through how to set each type of custom PID for anyone who is interested.

 

[dstevens]

Here's how to grab the tire pressures from the CAN-C 296 packet. It's not useful information to show; I just are using it for the example.

Here's my tire pressures.

We go into the menus and select a user PID to edit. In this case, user 10.

The relevant settings are
request function = on
request message = can id read (next section)

When we go into the request message, we can set the CAN ID which we are interested in. After we set it to 296 (from the speadsheet in the first post in this thread) the XS will show some CAN packets around the same CAN ID. If you scroll up and down, then the XS will show the packet contents. If we select the 296 packet note that the data 24 25 23 24 matches the tires pressures above (values are the same in hex - 24 hex = 36 decimal, 25 hex = 37 decimal etc, so values are straight psi).

Once the packet is selected then there are two tasks. Select the offset and length of the data. For this example I was grabbing the left front tire pressure, which is is offset 4 in the CAN packet (yes, then use an index starting at 1). And the length of the data is an unsigned char. Other options are unsigned/signed with lenthgs of char/sint/long.

Now we get into conversion. For this example it is very easy because the data was encoded as straight psi. The XS has options of value=data, value=data*a/b and value*a/b-c.

And that's our custom PID working showing the tire pressure.

Of course the deal here is that we should be able to show anything from the CAN-C bus. From ACC following distance to transmission torque to power steering fluid temp.

There also is a function to preview the CAN packet with the interpreted data (request test)

 

[dstevens]

Here is an example on how to use a custom PID to get the knock retard. It's different from the above example because we get the XS to send a CAN packet UDS service 22 (get data by ID) to get the knock retard value.

Slightly out of order, the data is offset 4 and the conversion is * 5.

Here is the custom PID. We use UDS service 22 with a PID of 01AE. The ECU address is 7E0. The packet we send is 03 (length) 22 (service) 01 AE (PID).

In a previous menu there is the option to test the packet and data conversion.

And final result. In highway driving I never could get the ECU to show any knock retard. So either the tuning is very conservative or the PID does not work. Looking at how retarded the ignition timing is I'm included to believe the former.

 

[AC77]

This is incredible stuff. I’ve always appreciated altering and playing with factory BCM’s and ECM’s lol. Love it. Keep it up !

 

[dstevens]

The J1939 OBDI PID for the A/F does not work correctly. It always shows the commanded AF, not the actual AF. I successfully added a custom PID to get the actual AF. It might be the Lufi or it might be the JL.

 

[us3r1d]

A new device enters the CANBUS hacking space:

https://www.hackster.io/electronic-cats/can-flipper-hack-a-car-ce7ec0

Pretty psyched; Flipper is great for wireless, so connecting to cars should be fun.

 

[Grayhound]

A new device enters the CANBUS hacking space:

https://www.hackster.io/electronic-cats/can-flipper-hack-a-car-ce7ec0

Pretty psyched; Flipper is great for wireless, so connecting to cars should be fun.

I've been familiar with flipper for a few wireless applications.
Hope the canbus adapter does as well as I understand the wireless use cases do with flipper.

 

[redracer]

FYI, I've finally delved into my 4xe for a bunch of the CAN messages specific to the electric drive system. There is so much data there. I've added a bunch to the spreadsheet. including...

Battery %
Battery cell voltages
Battery group temperatures
Lots of different power measurements
primary electric motor power
Starter / Generator Power use / generation
Etc......

I'm still looking to identify the primary electric motor RPM, which i may have found as a input shaft rpm in a transmission ID.

I'm adding a lot of this to my Raspberry PI Screen that I created years ago for my manual transmission JL. I really want a screen with all of the battery cell voltages and temps to watch for issues. Then another one with the engine and electric RPMs so I can better time when I'm shifting to M modes to start the gas motor.

 

[de1phi]

Hello everyone. Thank you for such a great contribution to the reverse engineering of the CAN bus. I am currently working on connecting an 8hp shifter with a custom TCM. I encountered the fact that when shifter receiving any message in CAN-C, it wakes up and then goes to sleep. I can't find the necessary packet traffic for the bus so that the shifter does not go into sleep mode. Can you suggest anything on this issue?

 

[Pelican]

Hi all,

I am diving into world of CAN bus messages and I have a bit of an odd problem. My Candump is giving me an Arbitration ID of 8 characters rather than the 3 that I see in this thread. I am trying to cross reference my ID's to the thread spreadsheet and I think I'm missing something.

Here's the detail:
2017 JKU
I am tapping into the wires the Maestro is using
(replacing current radio w/OpenAuto Pro):
Wht/Gry Can Bus 3 High IDS
Wht/Org Can Bus 3 Low IDS

Here's some examples:
(1738508363.328330) can0 03E31F0F#9DFFE7DCF4F6FF
(1738508363.328369) can0 03E30F1F#0FFFB0FF52F6FF

Any suggestions on how to reference to SS would be greatly appreciated.

 

[itswiggs]

Can anyone help??

I’ve started reading this forum in hopes for insights into what I’m trying to accomplish, however I haven’t seem to find anything for the specific application needed.

I am trying to build an interface between a heated/ventilated seat switch that communicates via Lin bus to operate the module that communicates via the can ihs.

I purchased seats from a 5th gen ram while my truck is a 4th gen. So my bcm doesn’t recognize the rear module or switch as the 4th gen does not have a rear csm, with only heated seats available working off of the front csm.

I’ve tried to hook up directly to the module, however without knowing a specific “wake-up” message I have no luck reading anything.
The module is utilizing the r5f10bmg 80 pin mcu from renesas and a tja1042 transceiver.

I tried posting in the ram forums with no luck. I was hoping someone here may have insight into steps I can take to work this out.
For reference, I am using the uno r3 with mcp2515 transceiver. I am open to switching up to a different interface if needed. I am very new to this side of sniffing and decoding but very interested to learn if someone could help

 

[itswiggs]

Is there a certain spot to connect to the can ihs. I can connect and read the can c network under the dash but when attempting to sniff the can ihs my unconnect screen begins glitching. I’m assuming it has to do with the sgw module. I’ve read posts on here that behind the glovebox is where you guys are connecting but only to hide your setups.

I’ve adjusted baud rates and cnf mapping, I’ve tried to connect at the obd2 port but nothing. But when connecting at the OBD port I get no glitching.

 

[us3r1d]

Is there a certain spot to connect to the can ihs. I can connect and read the can c network under the dash but when attempting to sniff the can ihs my unconnect screen begins glitching. I’m assuming it has to do with the sgw module. I’ve read posts on here that behind the glovebox is where you guys are connecting but only to hide your setups.

I’ve adjusted baud rates and cnf mapping, I’ve tried to connect at the obd2 port but nothing. But when connecting at the OBD port I get no glitching.

The OBD port is definitely outside the SGW, since protecting the rest of the system from the OBD port (and from the entertainment system) is what the SGW is for. So I wouldn't expect non-authenticated access at the OBD port to be able to do any more than JScan already does.

Are you 100% sure you're not sniffing only, and not transmitting? Seeing glitches on the uConnect when you're plugged in should only happen if you transmit.

(I choose the block behind the dash because it's easy to get to, has the AUX power cable nearby and lots of space for hardware to go in. Being away from the OBD port that the dealer techs use is a bonus, though.)

I'll leave any more sophisticated responses to the other folks; I'm very much a dilletante with the CAN interface so far.

Sponsored