JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[Drdyer9051]

    # Change to an extended diagnostic session.
    # We need this in order to access and change the horn.
    os.system('cansend can1 620#02.10.03.00.00.00.00.00')
    time.sleep(0.1)

will try this before the cansend code

cansend can0 7BF#0211010000000000

standby....


edit.... do you need to put the . in between the zeros?

will try both ways and see if it makes a difference.

Sponsored

 

[jmccorm]

Perhaps for the 8", we need to start a diagnostics session first, which would simply be sending that command immediately before the reset command.

Services supported by Radio Module (7BF/53F) on can0:

Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL

Supported service 0x11: ECU_RESET

I don't know if an extended diagnostic session is required to do an ECU reset or not. But when you enter a diagnostic session, you immediately have to send whatever command it is you want to send. So run the following AS A SCRIPT:

#!/bin/bash​

# Change to an extended diagnostic session.​

cansend can0 7BF#02.10.03.00.00.00.00.00​

sleep 0.2​

# Send an ECU RESET to the uConnect Radio​

cansend can0 7BF#0211010000000000​

Please look that over for errors (wrong CAN interface, wrong address, etc.)

 

[Drdyer9051]

I don't know if an extended diagnostic session is required to do an ECU reset or not. But when you enter a diagnostic session, you immediately have to send whatever command it is you want to send. So run the following AS A SCRIPT:

#!/bin/bash​

# Change to an extended diagnostic session.​

cansend can0 7BF#02.10.03.00.00.00.00.00​

sleep 0.2​

# Send an ECU RESET to the uConnect Radio​

cansend can0 7BF#0211010000000000​

Please look that over for errors (wrong CAN interface, wrong address, etc.)

hey Josh,
do the . matter

one send command #02.10.
yet next send command 0210




#!/bin/bash
# Change to an extended diagnostic session.
cansend can0 620#02.10.03.00.00.00.00.00
sleep 0.2
# Send an ECU RESET to the uConnect Radio
cansend can0 7BF#02.11.01.00.00.00.00.00

 

[jmccorm]

hey Josh,
do the . matter

one send command #02.10.
yet next send command 0210

I believe the cansend command will accept either syntax.
If you like, you may remove the periods. It shouldn't make a difference.

 

[Drdyer9051]

tried with and without .'s

did not reset radio.

checked reading can0 with the doors program...
verified different number depending on which and how many doors open.
so I know read can0 is working.

 

[JustinB]

"My Jeep would be just perfect if only it would..."
This project started because I've said that to myself. Too many times. ?

PROJECT DESCRIPTION:

This project aims to reverse engineer the Wrangler's CAN bus and use that information to addresses numerous quality-of-life issues that can be solved "if only the Jeep's computer acted just a little bit differently" and to make mods that up until now have not been possible.

This thread is a continuation from redracer's original inspiration thread and my own project discussion here. This serves as a place for like minded individuals to reverse engineer CAN bus messages (and UDS functions), to seek guidance on related issues, and to put that knowledge to work.

It's been over four months since we started connecting to our own vehicle's CAN networks using a Raspberry Pi with a Waveshare 2-Channel CAN adapter. (Arduinos are welcome, too!) Since that time, we've found a low-cost source for Jeep's official CAN connectors.

We've decoded quite a number of CAN messages and started to get our feet wet in the world of Unified Diagnostic Services. We've managed to create tools including: a black box data recorder, a remote keyfob WiFi toggle, an automatic climate control for remote start, and more.

image of CAN-C and CAN-IHS bus connections (located behind the glovebox)​

Looking for tips to get started?
If you have questions, ASK! We're friendly!

If you're not yet ready to hook up your vehicle, but you'd like to simulate the real thing, @Drdyer9051 lists the steps necessary to configure a virtual CAN interface on a Raspberry Pi and play back authentic messages from one of our recorded CAN bus log files.

For those who are ready to connect their vehicle to a Raspberry Pi, this message offers tips on how to initialize your 2-channel Waveshare CAN adapter as well as a general introduction to working with the Wrangler's CAN-IHS and CAN-C bus.

We maintain an online spreadsheet with information on all the CAN bus messages that we've decoded, and you're welcome to access it. All that we ask, in return, is that you share anything new you might discover along the way. Sounds fair?

Third party contributions are welcome as long as your vehicle uses the same modern Chrysler/Dodge/Fiat/Jeep ECU with similar messages and message IDs. ?

TO VIEW OR DOWNLOAD THE SPREADSHEET:

2018+ Jeep Wrangler "JL"
CAN-C and CAN-IHS Message ID.xls

TO VIEW OR DOWNLOAD RASPBERRY PI CODE SAMPLES, VISIT OUR GITHUB REPOSITORY:

rstellhorn / jeep-jl-powernet-scripts
with special thanks to redracer, repository maintainer
​

All code samples assume that can0 is connected to the vehicle's CAN-IHS network, and can1 is connected to the vehicle CAN-C network. Use at your own risk, no promises or guarantees are given.

Have a question?
Feel free to jump right in and ask! We'll do our best to help you.

LAST UPDATED: March 5th, 2022

I see there's 35 tabs in this thread thus far, so there may be something that mentions this already.?. Additionally, I'm absolutely not a programmer and posting this thought/suggestion within this thread may further prove that, IDK, anyways kudos to y'alls BIG BRAINS.

What would be really really really cool. To have the ability to leave the vehicle's WiFi on when the vehicle is completely turned off. If there were a way to turn only that system on in a manner that conserves battery draw. The vehicle/Jeep would appear to be completely off (although we know it's never truly off - as it patently waits/senses an action from our FOB or from a Uconnect command via our phone app).

I have a data plan for my Jeep with AT&T ($15 a month unlimited). I also have a camper trailer. When I'm out in the wild camping for the weekend I like to set up the Firestick TV for the kids so they can be entertained during their downtime just before bed. (Which gives me and the lady a little adult time, yes I have my motives as well ) Also, I have a WiFi camera with night vision on the camper to monitor/record things happening at our site while we're sleeping, providing some peace of mind.

Verse having to turn my phone's hot spot on and leaving it in the camper, which does me no good if I want to walk down to the lake and have my phone on me, having everything connected to the Jeep's WiFi would provide me real-time campsite video regardless where I'm at on the campground. I would pay for that capability!!!

Something to consider.
Thanks for listening.
~justin

 

[redracer]

What would be really really really cool. To have the ability to leave the vehicle's WiFi on when the vehicle is completely turned off. If there were a way to turn only that system on in a manner that conserves battery draw. The vehicle/Jeep would appear to be completely off (although we know it's never truly off - as it patently waits/senses an action from our FOB or

Hmm, I would think that this would entail just keeping the radio awake, as it's the radio that hosts the hotspot.

I wonder if we start a UDS session with the radio and just hold it open, if that would be enough to keep it online.

 

[Drdyer9051]

its on my end.... cannot cansend

as a test....I just changed bitrate on can0 to 500000 and the blindspot became unavailable..
will diagnose further later...

 

[JustinB]

Hmm, I would think that this would entail just keeping the radio awake, as it's the radio that hosts the hotspot.

I wonder if we start a UDS session with the radio and just hold it open, if that would be enough to keep it online.

Ya. I really don't know.?. But thank you for your brainstorming response!

From a security stand point I certainly would not want a 'night creeper' to walk past my Jeep and see that the ignition's push button accessory/run light is on (even though the FOB is not in the Jeep) or that the radio's screen is on or lit, even if it's set to the dimmest setting. Aside from the battery draw from a dimly lit screen or ignition light, that alone may make the would be thief want to start tampering with the vehicle. Also, I would want to be able to activate my aftermarket alarm (Compustar Alarm) which is connected to the CAN/OBDII port.

If there was some way to activate the WiFi leaving no sign that anything else on the vehicle is running, except for my alarm's blinking LED of course.

Perhaps a specific sequence of pushing certain buttons in the vehicle, or pushing a specific sequence of buttons on the FOB could activate/deactivate the WiFi??? Obviously, I would not want WiFi on all the time, unless it's a very small battery draw.

 

[redracer]

If there was some way to activate the WiFi leaving no sign that anything else on the vehicle is running, except for my alarm's blinking LED of course.

Now that's the trick, isn't it...

I truthfully don't know how the radio will react to being kept alive. ... Hey, but I do know the command to tell the screen to shut off, thanks to the screen off button on the center stack. And as for the rest of the lights, they should all time out like normal, I hope.

The problem is, I only have the 7" uconnect with no cellular functions at all. I can test on my radio but it may behave differently than yours. It would be up to the others on this forum who have the 8" screen to test and troubleshoot any differences.

As for a fob sequence, that is totally doable. I believe that @jmccorm played with this for his remote wifi control of his Pi.

 

[JustinB]

Now that's the trick, isn't it...

I truthfully don't know how the radio will react to being kept alive. ... Hey, but I do know the command to tell the screen to shut off, thanks to the screen off button on the center stack. And as for the rest of the lights, they should all time out like normal, I hope.

The problem is, I only have the 7" uconnect with no cellular functions at all. I can test on my radio but it may behave differently than yours. It would be up to the others on this forum who have the 8" screen to test and troubleshoot any differences.

As for a fob sequence, that is totally doable. I believe that @jmccorm played with this for his remote wifi control of his Pi.

Welp, knowing how to get the screen to shut off is great, I think I recall doing that once, but again the ignition's accessory/run button was on; thus, its light and everything else in the background was on. Now keeping the WiFi on while everything else times out???

I have the 8.4 so if there's anything I can do or test I will, just let me know. Obviously, I'm limited to what's factory in the Jeep. However for your consideration; I do have a Tazer Mini that may be manipulated or work in conjunction with???. I also have auxiliary commands on my aftermarket alarm that are not in use e.g. the tailgate lift button [not needed on a Wrangler]. Perhaps with a push of the alarm's button could burst a 500mv signal as a command to activate the WiFi, or rather, activate a relay or timer that keeps the WiFi powered on for X amount of time???

Now I'm really getting beyond my pay grade, so I'll stop before I embarrass myself more. ?‍

 

[redracer]

Hmm, i tried the UDS keepalive on my 7" and it did not change the radio's behavior at all. Some more tinkering will be involved.

 

[Drdyer9051]

# 3honk.py
import time, os # MUST HAVE can-utils INSTALLED

os.system('cansend can1 620#10.03.00.00.00.00.00.00')
for i in range(0, 3): # HONK 3 TIMES
    print("HONK")
    os.system('cansend can1 620#2F.D0.AD.03.01.00.00.00') # HONK
    time.sleep(0.05)
    os.system('cansend can1 620#2F.D0.AD.03.00.00.00.00') # UNHONK
    time.sleep(0.1)
    i += 1

or if you prefer isotpsend

# 3honkisotp.py
import time, os

os.system('echo "10 03" | isotpsend -s 620 -d 504 -p 00: -P a can1')
for i in range(0,3):
    print("HONK")
    os.system('echo "2F D0 AD 03 01" | isotpsend -s 620 -d 504 -p 00:00 -P a can1')
    time.sleep(0.05)
    os.system('echo "2F D0 AD 03 00" | isotpsend -s 620 -d 504 -p 00:00 -P a can1')
    time.sleep(0.1)
    i += 1

 

[kmkommes]

I signed up for this forum because of this thread alone. I am only on page 2 but I’ll make it through the thread today.

My background FWIW: I know CAN well. I worked at Oshkosh Corporation in the corporate electronics group designing and testing CAN systems. Everything from firetrucks to airport snowblowers to all military vehicles such as the JLTV. I worked on a few hybrid models as well. Now I work primarily on electric lawnmowers. I followed the money to get here. I designed the Gravely ProTurn EV. A $25,000 electric lawnmower. Go buy one. ?

In my spare time this past winter I created a RC version of this with an Arduino and a RC transmitter/receiver. It was my 1st arduino project and had this functional within a week. Video here. This mower is cable of 30mph if you know how to program it...

I’m pretty decent mechanically as well. Built this LS custom frame 1 ton TJ. https://www.pirate4x4.com/threads/ly6-nv4500-dana-60-tj-daily-driver-family-rig.940551/

Anyways
I am here because I have a 2022 Rubicon 4XE and plan on decoding the EPT Bus. The EPT bus is used for the e-Torque system and components.

EPT Bus Components
Assembly Shift Lever
Electric Brake Booster Module
Powertrain Control Module
Transmission Control Module
Power Inverter Module
Integrated Dual Charge Module
Occupant Restraint Controller Module
Battery Pack Control Module

I currently have a 3 day membership to www.techauthority.com. I’m off to learn as much as I can. ?

Sorry if I wasted time with this post. I'll add useful content soon. I am all about open source etc...

 

[NickJar]

I signed up for this forum because of this thread alone. I am only on page 2 but I’ll make it through the thread today.

My background FWIW: I know CAN well. I worked at Oshkosh Corporation in the corporate electronics group designing and testing CAN systems. Everything from firetrucks to airport snowblowers to all military vehicles such as the JLTV. I worked on a few hybrid models as well. Now I work primarily on electric lawnmowers. I followed the money to get here. I designed the Gravely ProTurn EV. A $25,000 electric lawnmower. Go buy one. ?

In my spare time this past winter I created a RC version of this with an Arduino and a RC transmitter/receiver. It was my 1st arduino project and had this functional within a week. Video here. This mower is cable of 30mph if you know how to program it...

I’m pretty decent mechanically as well. Built this LS custom frame 1 ton TJ. https://www.pirate4x4.com/threads/ly6-nv4500-dana-60-tj-daily-driver-family-rig.940551/

Anyways
I am here because I have a 2022 Rubicon 4XE and plan on decoding the EPT Bus. The EPT bus is used for the e-Torque system and components.

EPT Bus Components
Assembly Shift Lever
Electric Brake Booster Module
Powertrain Control Module
Transmission Control Module
Power Inverter Module
Integrated Dual Charge Module
Occupant Restraint Controller Module
Battery Pack Control Module

I currently have a 3 day membership to www.techauthority.com. I’m off to learn as much as I can. ?

Sorry if I wasted time with this post. I'll add useful content soon. I am all about open source etc...

Nice! You will be a great addition here!

Sponsored