JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[dstevens]

Where did you find or how did you arrive at the Tx and Rx address of each Module? Is it from the spreadsheet (first post on this thread), or does this come from another source?

A variety of sources with some confirmation using UDS 0x22 ReadDataByIdentifier. DIDs of 0xF18x will spit out part numbers for most modules.

Sponsored

 

[jmccorm]

I do have a 4xe, but haven't had time to get a Pi hooked up yet.

RPM is problematic as a proxy for temperature, though, since ambient air temperature varies so much?

I'm glad you asked that question. Actually, I'm thinking NO! Here's why:
Your coolant temperature is very much going to be associated with ambient temperature and will fluctuate seasonally, as you say. However, oil temperature is a very different beast. A vehicle's oil temperature is something that more easily stays within a very certain controlled range. (That range is dictated by optimum combustion temperatures, both minimum and maximum, which I want to guess my typical numbers are in the neighborhood of 175.)

Again, I'm not a 4xe person, but I thought I heard claim to some 4xe owners seeing the FOAM level improve in some situations when they told their vehicle (through the steering wheel controls) that they just performed an oil reset. Do you know if this is true or untrue? (If true, it would seem to point to Jeep actually using these same counters for their FOAM status calculations).

 

[jmccorm]

A variety of sources with some confirmation using UDS 0x22 ReadDataByIdentifier. DIDs of 0xF18x will spit out part numbers for most modules.

Darn it! I was trying to fish for any good resources you might have which other members of the group might take advantage from.

 

[us3r1d]

I'm glad you asked that question. Actually, I'm thinking NO! Here's why:

Interesting. I am not an expert.

I haven't encountered FORM yet, but out of curiosity I have tried to run in the 200 degree oil temp range that it takes to clear it and it is _hard_ to get the oil up into that range.

175 is actually around the highest it gets unless I keep the RPMs artificially high, so good guess on that.

Maybe you could come up with a viable calculation using just RPMs after all.

Again, I'm not a 4xe person, but I thought I heard claim to some 4xe owners seeing the FOAM level improve in some situations when they told their vehicle (through the steering wheel controls) that they just performed an oil reset. Do you know if this is true or untrue? (If true, it would seem to point to Jeep actually using these same counters for their FOAM status calculations).

Well, telling it you changed the oil is a 100% reset of the oil part of the FORM algorithm; since the whole point is to burn off fuel contaminating the oil, changing the oil restarts the whole thing from zero. So that's the expected behavior.

Of course, it logs that you've done that so you're probably playing dice with your warranty if you reset the oil life without having some receipts; the 4xe-specific forums have a few reports of Jeep denying warranty work for that.

 

[LanceMagnum]

Curious if anyone has a success story using the DLC (pins 6 & 14 for C bus) instead of plugging into the star connector behind the glovebox.

I've got a project where I only need read access and I can also use the power pin off the DLC to simplify things but I have yet to see any traffic detected. This is arduino-based and I have confirmed I my receiver code works in a test environment where I use another arduino as a sender at 500kbs. I know my wiring is good, proper readings for resistance across can+ and can-, properly shielded cable, common ground, etc.

Wondering if the SG is getting in the way or expects some kind of handshake when a device is connected. Anyway, I've got the plugs and terminals to go into the star connector and I'll try that next.

And thank you very much for the effort to reverse engineer all this stuff.

 

[LanceMagnum]

Follow-up question, how do you disconnect a connector from the star connection block?

I built a harness using the factory style connectors and terminals mentioned in this thread, and it had a satisfying 'click' when I inserted it but now I'm trying to remove it with no luck.

Pretty much exactly like the purple C bus wires going into the block on the left in this picture:

There is a sort of tab in the rear of the connector and pressing that either 'in' or 'out' does not seem to release it.

Any help appreciated!

 

[LanceMagnum]

Follow-up question, how do you disconnect a connector from the star connection block?

I did study a connector and looks like the tab in the back needs to be pressed towards the connector body to depress the locking tab.

 

[azjl#3]

still lost, but keep going.

 

[LanceMagnum]

A little fyi for those tapping into the Can C bus. The CAN convention uses yellow for C+ and green for C-. The way to remember this is yellow = sun = look up high and green = grass = look down low.

Now of course our jeeps have seen fit to not follow this convention - every JL wiring diagram I've looked at shows the solid yellow as C- and some other color (many cases yellow with a stripe) as C+ so just be careful out there!

 

[LanceMagnum]

Here's some background on my plans. A few years ago I built an 'auto-flate' project that uses a psi sensor, a pneumatic valve, and an Arduino to control my ARB compressor.

It behaves like a coin-op inflator you might find at a gas station - it will operate for a bit, pauses the compressor and takes a reading as compared to the setpoint, then does a calc on how much more to run for (knowing the CFM of my ARB single and volume of my KO2's), checks again, etc. Would usually make about 3 to 4 pauses along the way but hit the setpoint very nicely because the pressure sensor reads to .1 psi.

I see a way to do the same thing but using less hardware and without a need to pause to get the pressure reading - I plan on tapping into the can C bus and monitor the tire pressures. As it sees one corner getting filled up it will wait for the setpoint to be reached then stop the compressor (and beep the horn and/or flash a light). I have a 2020 so it does not include the Selective Fill Alert with the upgraded TPMS so the data updates may not be as frequent but that should be ok because I can make a prediction curve as the tire is inflating and extrapolate the time to stop if needed.

I'm using an Arduino MKR 1010 along with the MKR CAN hat (existing version uses a Nano IoT, very similar). It has wifi capability on the chip and actually publishes a simple web page to see how it's going (but totally optional to use).

Same technique can be used for deflate , obviously without getting the compressor involved, just some beeping and/or light flashing and/or displaying info on the web page.

I'll post updates as things progress, still trying to get a good tap into the can bus and see the traffic I'm initially interested in (0x261)

Web page is very crude but will be easy to make pretty.

 

[jeepingib]

I'm curious. I have a Tazer and enjoy the added capabilities it includes. I really like the idea of swaykill individual locker control etc. But I'm not fond of the steering wheel buttons being used for multiple purposes. I have accidentally set and engaged light show while driving and thought my Jeep was having a seizure. Is it possible to add an arduino controller to the network, and add physical buttons that the arduino can use to trigger Tazer commands?

 

[us3r1d]

Is it possible to add an arduino controller to the network, and add physical buttons that the arduino can use to trigger Tazer commands?

I'm just getting started with this, but I think the answer is "yes, but it wouldn't solve your problem"?

You can connect an arduino to the can bus.

You can add buttons/switches to an arduino.

But you can't make the Tazer listen for signals it doesn't already know about, so the arduino triggering the Tazer would be done by masquerading as the buttons the Tazer knows; this would mean you could still accidentally trigger it by hitting the actual buttons.

 

[Pareto Offroad]

You guys are super impressive. I love the work you're doing and it's so valuable to the community.

The stuff we make is usually derived from my own want's/needs and a lack in the market place. In that regard, this is an area of high interest.

I'd really like someone out there to have a open source Home Assistant setup that could interface with the work you guys are doing and bring in an easy to use interface that adds event driven automation relay support.

A screen to access all this where the rear view mirror currently lives (could also serve as a camera mirror) would be such a killer feature. I feel like it could address so many different needs.

Thoughts?

Keep up that amazing work ?

 

[LanceMagnum]

I'm just getting started with this, but I think the answer is "yes, but it wouldn't solve your problem"?

You can connect an arduino to the can bus.

You can add buttons/switches to an arduino.

But you can't make the Tazer listen for signals it doesn't already know about, so the arduino triggering the Tazer would be done by masquerading as the buttons the Tazer knows; this would mean you could still accidentally trigger it by hitting the actual buttons.

I agree with the above, I had the same thoughts.

I will also add that using an arduino will be more work than using a pi. Now there's many reasons a pi is an overkill solution but if you go the arduino route just be aware that if you need to access both can busses it's less 'out of the box'. The can shield I'm using for my prototype is a one bus solution (but plug and play). There are plenty of people out there adding 2 can transceivers to their arduino projects but it may be a little tedious to get it working reliably (but that's expected when you are hacking like this).

Oh, and one more interesting fact - one of the first things you learn in electronics is how 'dirty' a switch is when connected to a microcontroller. You'll need to 'debounce' the switch, thankfully this can be easily done in code if you want to minimize part count.

 

[us3r1d]

I'd really like someone out there to have a open source Home Assistant setup that could interface with the work you guys are doing and bring in an easy to use interface that adds event driven automation relay support.

I don't personally use HA for anything, since most of their integrations go through IoT cloud services rather than talking to devices locally (and not using any third-party services is a bugbear of mine).

I am working on a can bus to MQTT convertor for data logging, though, which would be helpful to anyone who wanted to log from their 4xe to HA.

A screen to access all this where the rear view mirror currently lives (could also serve as a camera mirror) would be such a killer feature. I feel like it could address so many different needs.

I like my rearview mirror where it is.

My plan is to install one if the mounting bar kits on the dash top, then mount my display on that.

I suspect that the factory cameras are connected directly to the uConnect head, so you probably couldn't grab that video fees over the vehicle network.

Sponsored