JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[CaJLMetalHead]

I blame the Raspberry Pi Foundation.

Up until recently, the Raspberry Pi name was used to describe a small single board computer that was capable of running Linux, Android, and even a version of Windows. They decided to expand upon their success and start producing microcontrollers, still with the Raspberry Pi name, but called a "pico".

Unfortunately, the two items are totally separate and in no way interchangeable in terms of features or compatibility. The pico is a much more limited device that's geared towards microcontroller type tasks. The other Raspberry Pi models are (in relative terms) bloated and geared more towards Windows PC type tasks.

I appreciate the extra set of eyes, but the Raspberry Pi Foundation has confused things for those not involved with the platform. The only significant power saving modes on a Raspberry Pi (except pico) require a full shutdown (and reboot) instead of a lightweight suspend operation. ?

Yeah.. similar to what ford did with Bronco .. and the Bronco Sport... it confused even Ford employees.... LOL

Sponsored

 

[CaJLMetalHead]

Never seen it before. I'm encouraged by this diagram...

...along with this document on triggering a wakeup. If I'm reading this correctly, we might have the opportunity I just discussed with the interrupt signal from the Waveshare CAN HAT.

If the CAN HAT remained powered on, and if (unconfirmed) it still sends interrupts on CAN traffic when the host is powered down (and for no other reason), then Sleepy Pi could monitor that pin and use it as a reset signal for the Raspberry Pi. Alternatively, CAN+ could be wired to a GPIO input on the Sleepy Pi, and ordinary CAN traffic could be enough to trigger a state change from low to high.

Rather than a custom circuit, this might do the trick too! Perhaps a custom circuit is too fancy of a wish-item at low volumes and something like this should fill in the gap unless/until there's more demand.



I've never really looked at the Raspberry Pi Zero models, but if I was looking for a Raspberry Pi in the current market, unless someone else knows of a reason why not, I'd seriously consider one.

Amazon has a Rasbperry Pi Zero 2 W starter kit with slow shipping (10-20 days, likely from China) for $70. Newegg also has it with an estimated 7-9 shipping days for $70. Keyboard, mouse, and screen not included.

Yes!.. I was looking at the Pi Zero 2 W before the pandemic... the good times.. look at how Adafruit had it posted before this mayhem:

 

[CaJLMetalHead]

Never seen it before. I'm encouraged by this diagram...

...along with this document on triggering a wakeup. If I'm reading this correctly, we might have the opportunity I just discussed with the interrupt signal from the Waveshare CAN HAT.

If the CAN HAT remained powered on, and if (unconfirmed) it still sends interrupts on CAN traffic when the host is powered down (and for no other reason), then Sleepy Pi could monitor that pin and use it as a reset signal for the Raspberry Pi. Alternatively, CAN+ could be wired to a GPIO input on the Sleepy Pi, and ordinary CAN traffic could be enough to trigger a state change from low to high.

Rather than a custom circuit, this might do the trick too! Perhaps a custom circuit is too fancy of a wish-item at low volumes and something like this should fill in the gap unless/until there's more demand.



I've never really looked at the Raspberry Pi Zero models, but if I was looking for a Raspberry Pi in the current market, unless someone else knows of a reason why not, I'd seriously consider one.

Amazon has a Rasbperry Pi Zero 2 W starter kit with slow shipping (10-20 days, likely from China) for $70. Newegg also has it with an estimated 7-9 shipping days for $70. Keyboard, mouse, and screen not included.

I read an article about a guy who made his own microcontroller-based circuit to control the power states of the Raspberry Pi... I will go back and look again... this discussion looks promising

 

[Drdyer9051]

When the CAN+ line goes from 0V to 2V+, if we had a circuit that momentarily shorts a 3.3V reset line, we could have a device that wakes up the Raspberry Pi from it's shutdown state (via the RPi P6 header) whenever the vehicle wakes up.
..
....
.....
But yes, if some small amount of outside computation or device monitoring be needed to watch for an event, then you could use something like a pico to do the monitoring (at a lower power level) and then wake the larger Raspberry Pi 3B+ when ready. That's essentially what CaJLMetalHead's Sleepy Pi 2 does.

sorry to ruffle feathers about the Pico. just have a couple laying here and knew it was a low power capable device that could wake up a Pi from a rising trigger similar to sleepy pi Arduino..
what is sleeping current of Arduino? Video of Pico shows sleep current at 0.002 Amps

carry on your excellent work...

 

[jmccorm]

I read an article about a guy who made his own microcontroller-based circuit to control the power states of the Raspberry Pi... I will go back and look again... this discussion looks promising

You'd think that feature would be in high demand. Since we haven't seen it elsewhere, I'm kind of skeptical about it... either in terms of functionality/reliability or complexity/cost (or both). Of course, I'm happy to be proven wrong.

On the other side of things, I've recently done a little tweaking to reduce boot time, but I've only manage to shave 5 seconds off the process. That's between overclocking the CPU during the first 60 seconds of boot-up, increasing the microSD IO rate, and disabling a few miscellaneous services (bluetooth, for example).

I know that the road to faster boot times will require a custom kernel with many unnecessary features removed. That that's not a trivial task, yet a trimmed down kernel really would make all of this a lot less painful. At some point it probably has to happen.

Part of the problem trimming down the kernel is that any two people might not agree on what's necessary and what isn't. I might not think that video drivers are necessary, but I know that redracer strongly believes otherwise. ?

I haven't tried it in recent years, but historically, recompiling a kernel is delicate and tedious work.

 

[Drdyer9051]

Yes!.. I was looking at the Pi Zero 2 W before the pandemic... the good times.. look at how Adafruit had it posted before this mayhem:

only found single can Hat for the zero. I can have one on a regular zero not the 2. and works well.

from Copperhilltech . com

 

[CaJLMetalHead]

I've never really looked at the Raspberry Pi Zero models, but if I was looking for a Raspberry Pi in the current market, unless someone else knows of a reason why not, I'd seriously consider one.

Perhaps the only real limitation is that the Raspberry Pi Zero 2 W only has 512MB of RAM... no idea how that affects the performance for gathering real-time data of both CANBuses

 

[Drdyer9051]

Perhaps the only real limitation is that the Raspberry Pi Zero 2 W only has 512MB of RAM... no idea how that affects the performance for gathering real-time data of both CANBuses

the Pi ZeroW (non-2) also has 512MB ... the hat I am using is just a single CANBus..... it runs one just fine.

 

[jmccorm]

Perhaps the only real limitation is that the Raspberry Pi Zero 2 W only has 512MB of RAM... no idea how that affects the performance for gathering real-time data of both CANBuses

More than enough to get going, actually.

Speaking in general terms, having only 512MB of RAM is something that starts to become a factor when you're running applications under it's windows-like graphical user interface. If most of your work is text-oriented (like this is) and you're working from the command line, then you've got plenty of memory to burn.

All the CAN bus stuff we've been doing so far? At peak? I don't know. 50mb? It doesn't demand much memory at all, and the code is pretty simple and straightforward so we don't have large tools (with big memory footprints) to wrestle with.

Even if you are using the graphical user interface, if all you have open are a bunch of terminal windows, it isn't going to be much of a problem. Running a web browser? That should significantly increase your memory consumption.

If you exhaust memory, up to a point, the operating system will use a portion of your SD card as slow memory. Things can start to get slower and more bogged down, but they won't immediately break when you run out of RAM. This is all very much like Windows.

Starting with a Raspberry Pi Zero 2 W isn't bad, particularly for the price right now. But if you've got the extra money, you know you're going to be doing a lot of work in the graphical interface, and you've got the extra cash for it, you can go for what otherwise would have been an experimenter's first choice with a Raspberry Pi 3 or 4.

The other advantage of these more expensive Raspberry Pis?
More USB ports!

 

[CaJLMetalHead]

More than enough to get going, actually.

Speaking in general terms, having only 512MB of RAM is something that starts to become a factor when you're running applications under it's windows-like graphical user interface. If most of your work is text-oriented (like this is) and you're working from the command line, then you've got plenty of memory to burn.

All the CAN bus stuff we've been doing so far? At peak? I don't know. 50mb? It doesn't demand much memory at all, and the code is pretty simple and straightforward so we don't have large tools (with big memory footprints) to wrestle with.

Even if you are using the graphical user interface, if all you have open are a bunch of terminal windows, it isn't going to be much of a problem. Running a web browser? That should significantly increase your memory consumption.

If you exhaust memory, up to a point, the operating system will use a portion of your SD card as slow memory. Things can start to get slower and more bogged down, but they won't immediately break when you run out of RAM. This is all very much like Windows.

Starting with a Raspberry Pi Zero 2 W isn't bad, particularly for the price right now. But if you've got the extra money, you know you're going to be doing a lot of work in the graphical interface, and you've got the extra cash for it, you can go for what otherwise would have been an experimenter's first choice with a Raspberry Pi 3 or 4.

The other advantage of these more expensive Raspberry Pis?
More USB ports!

I could always get greedy and order a Raspberry Compute Module 4 with 8GB of RAM.. LOL

 

[redracer]

I have locked down a few temperature values...
0x127 has IAT, Coolant temp, and Baro Pressure.

I'm now hunting 4x4 status and the power steering pump temp / pressure / etc...
I did a capture of shifting all the way to 4-low and back, then I turned the wheel lock to lock several times. These values look to be interesting...

 

[jmccorm]

I have locked down a few temperature values...
0x127 has IAT, Coolant temp, and Baro Pressure.

I did a capture of shifting all the way to 4-low and back, then I turned the wheel lock to lock several times. These values look to be interesting...

Wow, that tool is everything that I had hoped Savvy CAN was going to be and more. Those are some really nice sharp useful images to help you associate what's doing what, and you've wasted no time in using it to make new findings!

And I see you're making even more! Awesome!

I had to go back and find that email where you talked about that Automated CAN Payload Reverse Engineering program. I had assumed that it was an X-Windows program but now I see that it doesn't necessarily have to be, since it outputs to a PDF file.

Mighty good stuff, all around!

 

[jmccorm]

Wow, that tool is everything that I had hoped Savvy CAN was going to be and more. Those are some really nice sharp useful images to help you associate what's doing what, and you've wasted no time in using it to make new findings!

Oh! If you see me making edits to some of your work, don't mind me. I realize along the way I made a few mistakes and set some bad examples (like occasionally misusing "bitmask" wheren I should have used "bitmap"). You're doing just fine and I'm still struggling with the best way to present things.

 

[jmccorm]

Any thoughts on switching numerical representation standards?

Up until now, I've used numerical prefixes dating back to the 80s, where #16 would be a literal decimal number 16, and $16 would be the hexadecimal number 16 (which is really decimal 22).

I'd like to propose we go with a more modern handling of it, and use a 0x prefix for hexadecimal and a 0b prefix for binary. Because hexadecimal is so common, I'd also like to require that decimal numbers be preceded by 0d to avoid any confusion. Any variable would be proceeded with a dollar sign, such as $value.

I'd also propose a single exception, which is for mathematical formula. Unless a unit prefix is given, all numbers are assumed to be decimal, for example:

( ($value - 40) * (9/5) + 32 )​

Would be interpreted entirely as a decimal math operation.​

Any other time, if a number does not have a prefix, it is considered an incomplete representation. And any time we need to talk about real-world items, we can also spell out the words (and it would be assumed as decimal), such as "the twenty-first pin" or "the number two cylinder".

Thoughts?

 

[redracer]

Any thoughts on switching numerical representation standards?

Up until now, I've used numerical prefixes dating back to the 80s, where #16 would be a literal decimal number 16, and $16 would be the hexadecimal number 16 (which is really decimal 22).

I'd like to propose we go with a more modern handling of it, and use a 0x prefix for hexadecimal and a 0b prefix for binary. Because hexadecimal is so common, I'd also like to require that decimal numbers be preceded by 0d to avoid any confusion. Any variable would be proceeded with a dollar sign, such as $value.

I'd also propose a single exception, which is for mathematical formula. Unless a unit prefix is given, all numbers are assumed to be decimal, for example:

( ($value - 40) * (9/5) + 32 )​

Would be interpreted entirely as a decimal math operation.​

Any other time, if a number does not have a prefix, it is considered an incomplete representation. And any time we need to talk about real-world items, we can also spell out the words (and it would be assumed as decimal), such as "the twenty-first pin" or "the number two cylinder".

Thoughts?

This all sounds good. The decimal 0d will take getting used to, but it's good

Another suggestion, we need to standardize the way we represent the can data fields or words. For example python treats every data hex pair uniquely and address them starting with 0. In our datasheet I've been calling them word 1, word 2, etc... What is the appropriate term or variable to represent this?

Sponsored