JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[redracer]

Or I can give you read/write permission on the spreadsheet itself if you hit the request button...

I have hit the request button. I agree that directly adding to the spreadsheet would be more effient.

Sponsored

 

[jmccorm]

I have hit the request button. I agree that directly adding to the spreadsheet would be more effient.

Done!

In other news, here's an update on my related side-project...

New Project? RGB *Smart* Halo Lights

I pulled the trigger on an Amazon Lightning Deal for some budget 9" RGB LED headlights. As it turns out, the RGB elements are quite good. As you'd expect, you can choose a new default setting over bluetooth.

I've connected the RGB halo lights to AUX4 and configured it (via the uConnect radio) to turn on with the vehicle's ignition. Everything is installed, working, and ready for the next step.

Back at the workbench, using the open source rpi_ws281x library and a GPIO pin on the Raspberry Pi, I'm able to fully control a strand of 150 RGB LEDs. If all goes well, that should translate into what I can do with the RGB halos (120 RGB LEDs each).

Once another of RGB halos arrives (a set for experimenting with), I'm going to pair it up with some potentially compatible connectors that I'm hoping will expose it's wiring without having to hack it's wiring harness. From there, I should be able to connect them to the test bench's Raspberry Pi and iron out any bugs with this new configuration. Then it'll be a matter of (figuring out Python and) coming up with new expressions and patterns of light.

After I've got some of those down, based upon our decoded CAN bus messages, I'll have the Raspberry Pi modify or change patterns based upon vehicle speed, gear selection (park vs reverse vs drive), turn signals, hazard signal, and time of day, and maybe even roll/pitch/yaw or axle force sensors. Then it'll really start taking advantage of some of the CAN bus goodies we've learned so far.

Whew! Still a ways to go!

The route that I'm taking now (directly controlling the RGB LEDs) wasn't my first choice. I had planned to let the RGB controller do it's job and to use the Raspberry Pi to command it via bluetooth. But I didn't even begin to figure out how that'd work. This backup plan is more difficult and time consuming, but hopefully more rewarding in terms of the final result.

Once this is all finished, it should be something can easily translate into tiny sealed microcontroller package with wires running to CAN, power, and the headlights themselves.

I hope this ends up being a good example of what's possible (and not a cautionary tail of what isn't). HA! ?

 

[redracer]

Whohoo! I finally found the manual transmission gear status.

Can-C 0x093 ????xx??????
0x4E = N
0x31 = 1
0x32 = 2
0x33 = 3
0x34 = 4
0x35 = 5
0x36 = 6
0x52 = R

I found this by using a really interesting tool. it analyzes the log file and creates a few different outputs, one of which is a .png graphic with a bunch of data graphs for each can_ID:
https://github.com/brent-stone/CAN_Reverse_Engineering

 

[Drdyer9051]

anyone find power and ground behind glovebox where Can Busses are located?
I don't want to plug into media port, I would prefer to be hidden away.
I ordered the correct plugs for each Can bus posted here... thanks btw

raspberry pi3, Pican2 dual canbus, ordered 22 JTRubi

 

[jmccorm]

Whohoo! I finally found the manual transmission gear status.
Can-C 0x093 ????xx??????
0x4E = N 0x31 = 1 0x32 = 2 0x33 = 3
0x34 = 4 0x35 = 5 0x36 = 6 0x52 = R

Congratulations!! I'm glad you were able to nail that one down! (I was a little embarrassed that we didn't have that one nailed down. This is great!)

That tool looks complicated. I'll put it on my to-do list. It'll be a little difficult for me because I work in a text-based environment, but I could get it to work for me with some extra effort.

Nicely done.

 

[jmccorm]

Power Option available to Certain Builds

anyone find power and ground behind glovebox where Can Busses are located? I don't want to plug into media port, I would prefer to be hidden away. I ordered the correct plugs for each Can bus posted here... thanks btw

Welcome to the club! Hope to see more of you soon!

I don't know if this applies to you or not, so let me share my recent story. Actually, this all happened two days ago. I finally found an power source that was already available in my own vehicle! But not everyone's going to have it.

If you've got the famous Trailer Tow & HD Electrical Group package (that gives you all the AUX buttons), right at the end of the front passenger's footwell and up top with all the black plastic is a set of wrapped cables. Inside the wrapping includes calbes for: ignition power, battery power, aux1, aux2, aux3, aux4. It's okay to dig into these cables and make use of them -- they're there for you!

The really nice thing, I thought, is that this cable can be routed right up into the right hand side of the glovebox space. No problem. So behind the glovebox I'm now feeding power via AUX3 (as is our agreed to standard) into a DROK 12v to 5v 3A DC Regulator. I've connected the regulator to a nicely shrink wrapped (and then further insulated with electrical tape) Female USB-C Terminal. My Raspberry Pi 3B+ requires a Micro-USB, so I connect the two with a 1M USB C to Micro USB Cable. Out of caution, I try to keep these away from the CAN bus wires themselves as much as possible.

All those things, plus the Raspberry Pi 3B+ (in a protected case), can live comfortably in the space behind the glovebox. But I decided to go ahead and keep my Raspberry Pi in the glovebox I have easy access to it and can manually switch it over to an external USB battery for extended programming sessions.

So if you've got the Trailer Tow & HD Electrical Group, hopefully this is going to work out well for you. If not, you've got some hunting to do. Perhaps a source in the center cluster, or you might find a way to route through the firewall and into the engine compartment for power. It'd be right there where the battery is, too.

Wish there was an easier answer. That would probably be to use the OBD-II port for both power and CAN connections. You'd need a bypass cable, and you wouldn't be able to use the OBD-II port for anything else. But it should work just as well.

 

[redracer]

anyone find power and ground behind glovebox where Can Busses are located?

If you don't have the HD Towing / electrical group, then I'd suggest this harness...
https://www.amazon.com/Power-Adapter-2018-2020-Wrangler-Gladiator/dp/B0886DNNSP

 

[jmccorm]

If you don't have the HD Towing / electrical group, then I'd suggest this harness...
https://www.amazon.com/Power-Adapter-2018-2020-Wrangler-Gladiator/dp/B0886DNNSP

I've heard about this! That's a really good choice, isn't it?

An average person might not be able to figure it out from the product images (they're a bit of a mess), but this taps off of the cigarette lighter using plug-and-play cables (no rewiring, no soldering).

As I remember hearing this described, you unplug the connector that goes into your cigarette lighter. Then you plug this cable into the cigarette lighter and you plug the other end of the cable into the other cable you just unhooked. It goes between the cigarette lighter and the cigarette light power cable.

Then it gives you a pair of terminals (+12VDC, GROUND) that you can use a screw to tighten your own power wires into. Absolutely perfect! As it turns out, my aftermarket Z Automotive Trail Cam kit did something very similar to this.

It's really is a good source for ignition (accessory) powered devices.

 

[Drdyer9051]

wow, thanks Josh and Robert, I have ordered my truck with the AUX switches, I have been tinkering with can buses a couple times over the last few years, currently have Pi zero / fd pican connected to my Silverado on the low speed GMLAN single wire bus. gettiing warmed back up to tackle Gladiator when it gets here. already have pi3/dual configured. and a pi4 but i think they overheat due to too much power consumption.

 

[oceanblue2019]

Have you found and decoded ICT?

 

[Drdyer9051]

help me out here what is ICT

 

[jmccorm]

Have you found and decoded ICT?

Via OBD-II we have two intake air temperatures ($0F and $68) and the CACT (Charge Air Cooler Temperature which I believe is a synonym for ICT?) at $77. See the OBD-II page of our spreadsheet and then visit our code repository for the "obd.sh" script which can pull those values.

Some of the formats are documented on the spreadsheet. But some of the others need a bit of reverse-engineering. I've colored the important bits. This is from having taken my vehicle down the road about an hour ago:

# obd 0f​

66​

# obd 68​

5 66 0 86​

# obd 77​

2 0 74 0 0​

I have some personal code I haven't published that decodes some of this...

 # $0f Intake Air Temperature 1
  obd0f=$( ~pi/bin/obd 0f )
  if [ $? -gt 0 ] ; then
    obd0f=9999
  else
    obd0f=$(( ($obd0f - 40)*9/5 +32  ))
  fi
  echo Intake air temperature 1: ${obd0f}F
  sleep 0.33

  # $68 Intake Air Temperature 2
  obd68=$( ~pi/bin/obd 68 )
  if [ $? -gt 0 ] ; then
    obd68=9999
  else
    obd68=$( echo $obd68 | cut -d" " -f4 )
    obd68=$(( ($obd68 - 40)*9/5 +32 ))
  fi
  echo Intake air temperature 2: ${obd68}F
  sleep 0.33

  # $77 Charge Air Cooler Temperature
  obd77=$( ~pi/bin/obd 77 )
  if [ $? -gt 0 ] ; then
    obd77=9999
  else
    obd77=$( echo $obd77 | cut -d" " -f3 )
    obd77=$(( ($obd77 - 40)*9/5 +32 ))
  fi
  echo Charge Air Cooler temperature: ${obd77}F
  sleep 0.33

  # $05 Coolant Temperature
  obd05=$( ~pi/bin/obd 05 )
  if [ $? -gt 0 ] ; then
    obd05=9999
  else
    obd05=$(( ($obd05 - 40)*9/5 +32 ))
  fi
  echo Coolant temperature: ${obd05}F
  sleep 0.33

That's currently giving me this...

Intake air temperature 1: 78F​

Intake air temperature 2: 114F​

Charge Air Cooler temperature: 98F​

Coolant temperature: 142F​

I think I'm rambling now, but I hope that was meaningful? I think the first temperature is true air intake, the second temperature is post-turbo, and the third temperature is post-intercooler.

EDIT: Corrected a flaw in the Celsius to Fahrenheit conversion.

 

[jmccorm]

help me out here what is ICT

InterCooler Temperature. I'm assuming we'd be looking at the intake air temperature right where the intercooler and the intake manifold meet, but this isn't my area of expertise.

Someone with more knowledge in this area might have a more precise explanation.

 

[jmccorm]

already have pi3/dual configured. and a pi4 but i think they overheat due to too much power consumption.

If you're overclocking your Raspberry Pi 4, you can use temp_limit in /boot/config.txt to set a temperature at which overclocking is temporarily suspended. Alternatively, if you are using a Raspberry Pi 4 for reasons other than performance, you might control temperatures by underclocking it via some of the settings available in /boot/config.txt.

For others reading this, underclocking is where you run a component slower than it's rated speed. Underclocking might even be a good idea in an automotive environment as a trade-off for increased stability.​

Once the operating system is loaded, you might further control temperatures via the CPU governor policy. You could use "cpufreq-set -g powersave" to select the powersave governor. Actually, the ignition switch monitoring script "monitor" (not yet in the repository) defaults to powersave until the vehicle is turned on, when it uses ondemand.

But you're right, from everything I remember, the Raspberry Pi 4 draws more power (and therefore creates more heat) by default than it's predecessors. But that might also mean it has more environmental heat tolerance if you're running it below it's rated speed.

 

[patternman]

If you're overclocking your Raspberry Pi 4, you can use temp_limit in /boot/config.txt to set a temperature at which overclocking is temporarily suspended. Alternatively, if you are using a Raspberry Pi 4 for reasons other than performance, you might control temperatures by underclocking it via some of the settings available in /boot/config.txt.

For others reading this, underclocking is where you run a component slower than it's rated speed. Underclocking might even be a good idea in an automotive environment as a trade-off for increased stability.​

You might be able to control some of the temperature at the operating system level with the CPU governor policy. You could use "cpufreq-set -g powersave" to select the powersave governor. Actually, the ignition switch monitoring script "monitor" (not yet in the repository) defaults to powersave until the vehicle is turned on, when it uses ondemand.

But you're right, from everything I remember, the Raspberry Pi 4 draws more power (and therefore creates more heat) by default than it's predecessors. But that might also mean it has more environmental heat tolerance if you're running it below it's rated speed.

I'm using heat sinks on the chips and printed a case that accepts a fan for my Pi 4.
I'm not using the Pi for my Wrangler though. I'm using it to stream video of my 3D prints
with Spaghetti Detective AI to monitor my prints.

Sponsored