JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[redracer]

@jmccorm Josh, By the way... I finally put 2+2 together...

I wanted to comment on your thumbnail. That's a good trick of rotating your image according to the hour.

Sponsored

 

[jmccorm]

I wanted to comment on your thumbnail. That's a good trick of rotating your image according to the hour.

Nah... I didn't go THAT far with it! But a broken clock IS right twice a day.

True, I've got a rotated set of vehicle images, but I only update the rotation every once in a while when the mood strikes me. ?

 

[Tristan]

when you say hard turns, are you sending custom messages indicating turn angle? Remember, we have also found the turning force or rate of turn value. I would think that rate of turn would drive the pump pressures up more than just changing the wheel angle alone.

I'm not sending any custom or modified signals at this time .

 

[Tristan]

Thanks for your support, ideas and encouragement guys.

I was out of town this weekend so I couldn't do anymore testing. I will be messing with it over the next few days and will provide some updates.

 

[jmccorm]

Nothing too important today. I ran across some minor things of interest as I was straightening out one of my Tazers today.

Inside the Tazer utility, there's this function:

It looks like it is doing a UDS 0x22 (Read by ID) and, for a certain set of IDs, it stores all their values in a text file. So these are going to be all the configuration bits that Tazer cares about in the BCM.

Here's the list of BCM IDs they're backing up:

0122 0123 0124 0125 0126 0127 0130 0131 0132 0133 0134 0135 0136 0137 0138 0139 013A 013B 013C 013D 013E 013F 0140 0141 0142 0143 0144 0145 0146 0147 0148 0149 F010 F011 F012 F013​

There's a whole lot more IDs in the BCM than these. But this might be more interesting later down the line when we're directly dealing with some of the UDS features.

So I have myself a spare Tazer (it got lost, I purchased another, it got found) and it's acting up at the moment. But a cool side effect is that all of the model-specific features of the Tazer utility for Windows is 'unlocked'. Here's a screenshot...

I don't think any of that that applies to us? But this one might...

This kind of thing (remapped shift paddles) should be doable. It's just a matter of figuring out what signals the paddles give off, and then figuring out what configuration bits need to be set in the BCM to make it happen.

I believe the latter half of that has already been figured out with people using JScan and paddle kits to put those 392 shift paddles into their ordinary Wranglers.

ALSO: I really like the idea of an auto-upshift tool where you can set an RPM for each gear which the vehicle will automatically upshift when hit. But so few of us keep our automatic transmissions in manual mode. (If I didn't like listening to music when I drive, I might have been driving my auto in manual mode more often.)

I really wish the Wrangler had a small console with buttons that could be remapped to vehicle specific features. Kind of like the AUX switches, except these can be programmed to act as shortcuts to commonly used features.

 

[redracer]

I really wish the Wrangler had a small console with buttons that could be remapped to vehicle specific features. Kind of like the AUX switches, except these can be programmed to act as shortcuts to commonly used features.

Hey, this perfectly aligns with the first sentence on your first post of this thread!

We can do this!

 

[SPED1]

Ok I just skimmed through 10 + pages of this thread and my eyes are crossed now! I have a Gladiator and am looking to add a heads up display to the dash:
https://www.aliexpress.com/i/4000630804560.html
The unit plugs into the OBD as well as the steering column control modules 2 wires
The video instructions say to scotch lock tap into 2 wires of the steering column control module. Specifically the #12 white wire [line bus D594] and the #4 dark blue/white wire [can c+ D97]. I have always hated scotchlocks for anything! What I am looking for is whether I can use one of these empty ports of the can bus behind the glovebox. Each are 2 or 3 wire however. First question, is the second wire a ground? Example, the D97 can c+ out to the HUD the other wire to ground? Second question, what is the line bus D594? Is this even remotely possible to add this HUD without tapping wires and being plug and play for just more money?

Steve

 

[redracer]

First question, is the second wire a ground?

No, it's a differential signal. Can+ and Can- must both be connected.

What I am looking for is whether I can use one of these empty ports of the can bus behind the glovebox.

Yes, the only two can bus networks in the jeep exist behind the dash. The connectors that we have found would work for adapting the wiring to plug into the car star module.

 

[jmccorm]

Ok I just skimmed through 10 + pages of this thread and my eyes are crossed now! I have a Gladiator and am looking to add a heads up display to the dash:
https://www.aliexpress.com/i/4000630804560.html

Up until now, I wasn't even aware that device existed. WOW!

What I am looking for is whether I can use one of these empty ports of the can bus behind the glovebox. Each are 2 or 3 wire however. First question, is the second wire a ground? Example, the D97 can c+ out to the HUD the other wire to ground? Second question, what is the line bus D594? Is this even remotely possible to add this HUD without tapping wires and being plug and play for just more money?

CAN C+ and CAN C- are two separate signal wires and should not be in any way confused for positive or ground. You need the real deal. Yes, for the CAN C signals, if you have the right connector, you can capture it from behind the glovebox.

I think the reason they want you to use the OBD port is because it has both CAN C-, CAN C+... AND THEN: power, and ground. But there's one other thing they're looking for, and it's sneaky!

Second question, what is the line bus D594? Is this even remotely possible to add this HUD without tapping wires and being plug and play for just more money?

I asked myself, why would this thing be looking for two wires that go to the steering column when it has full access to the CAN C bus right there? The answer is that it's looking for the LIN BUS. So, yeah, mis-translation. It isn't a line bus.

I know next to nothing about the LIN bus, but it looks like they're pulling some of their data from there instead of CAN-C or CAN-IHS. Without a LIN bus connection, some or all of it's features won't work. But what wires do you need to connect to it? I don't know. All I can do is to refer you to a vehicle wiring diagram.

Does this help any?
ALSO: Welcome! I like your super-modded Wrangler!
BONUS: You are my favorite new user of the day for 03/08/2022!

 

[redracer]

My gosh! I just looked at the video on that product page and their install is horrendous! using a knife to strip factory wiring and just twisting wires together and covering with tape. NO!

I worry about products like this. As Josh said, if they are being sneeky and tying into different busses, then you have to start worrying about how much you trust said device. This could be a huge safety / security risk. And, coming from some vendor on Aliexpress does not give me confidence.

 

[jmccorm]

My gosh! I just looked at the video on that product page and their install is horrendous! using a knife to strip factory wiring and just twisting wires together and covering with tape. NO!

I think they had a special wiring harness that at least captured the CAN-C signals?

If not, wow, that is a bit scary. But you know, I think it might be possible to do a solid installation job of it. Just not quite like they showed. You can't be cavalier with any of the vehicle's major bus connections. I don't think they were being sneaky, but I'm hoping they came with some written directions that go beyond what was seen in the video.

Steve,

Earlier I mentioned a wiring diagram. If you're looking for other opportunities elsewhere in your car to intercept a LIN bus signal, the wiring diagram should give you an idea of what other places might be possible. Steering wheel would have to be the closest, but there should be other opportunities nearby. (Dimmer switch?)

On the plus side, if you get it installed, I'd think you'd be only one of a handful of people nationwide that's rolling around with one of these. So even if it isn't amazing, it's still a major conversation piece... hopefully for the better!

Robert,

You know... this might serve as a good starting point to creating one's own heads-up display. I believe Linux will automatically handle the reversing of video for situations like this.

 

[SPED1]

CAN C+ and CAN C- are two separate signal wires and should not be in any way confused for positive or ground. You need the real deal. Yes, for the CAN C signals, if you have the right connector, you can capture it from behind the glovebox.

I think the reason they want you to use the OBD port is because it has both CAN C-, CAN C+... AND THEN: power, and ground. But there's one other thing they're looking for, and it's sneaky!

Okay one problem? at a time. CAN C- CAN C+ on one plug? That would go into the port behind the glovebox?

Get rid of the OBD connection entirely? Power and ground off of an AUX switch?

I have wiring diagram access for the Gladiator. I will have to find the LIN bus wiring and see if I can plug and play that.

Are they tapping into the CAN C+ wire on the module to bypass the security gateway module?

Thanks for the help!

Steve

 

[SPED1]

ALSO: Welcome! I like your super-modded Wrangler!
BONUS: You are my favorite new user of the day for 03/08/2022!
[/QUOTE]

Thanks! It is in a pile of parts at this moment. The frame rotted a second time. The tub rotted out. I sourced a buddies 2005 for a frame [and 2 extra cylinders as well as an extra gear!] I had already bought a beautiful 99 tub from Colorado to swap over. Maybe this year I'll get it together!

Steve

 

[jmccorm]

Okay one problem? at a time. CAN C- CAN C+ on one plug? That would go into the port behind the glovebox?

Left hand side behind the glovebox. Special connector, two pins. One is CAN+, one is CAN-. You'd have to refer to the wiring diagram to know which is which (as I don't remember offhand).

Get rid of the OBD connection entirely? Power and ground off of an AUX switch?

My *opinion* is that you should use the OBD-II or the SGW connection as they designed. I see no problem there. Mind you, I haven't actually seen any install instructions, though. You could get power and ground off of an AUX switch, for sure. Or from that same OBD-II port like they probably intended. Either way.

Are they tapping into the CAN C+ wire on the module to bypass the security gateway module?

The OBD-II connection comes from the Secure Gateway Module. I don't think they're bypassing anything, more intercepting the CAN-C connections from there because it is more convenient (versus the glove box).

PS: I'd love it if you could take pictures (or scan) the documentation for us. Not a requirement, just a nice-to-have.

 

[SPED1]

I think they had a special wiring harness that at least captured the CAN-C signals?

If not, wow, that is a bit scary. But you know, I think it might be possible to do a solid installation job of it. Just not quite like they showed. You can't be cavalier with any of the vehicle's major bus connections. I don't think they were being sneaky, but I'm hoping they came with some written directions that go beyond what was seen in the video.

Steve,

Earlier I mentioned a wiring diagram. If you're looking for other opportunities elsewhere in your car to intercept a LIN bus signal, the wiring diagram should give you an idea of what other places might be possible. Steering wheel would have to be the closest, but there should be other opportunities nearby. (Dimmer switch?)

On the plus side, if you get it installed, I'd think you'd be only one of a handful of people nationwide that's rolling around with one of these. So even if it isn't amazing, it's still a major conversation piece... hopefully for the better!

Robert,

You know... this might serve as a good starting point to creating one's own heads-up display. I believe Linux will automatically handle the reversing of video for situations like this.

Such a nice piece in person. May not work with speaker upgrades.... Then the wiring is hack lol I knew going in I may not get it to work. If it's possible with like $100.00 worth of extra pigtails I am willing to play with it.

Sponsored