JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[Ratbert]

Sounds like you had a button mapped to swaykill and were unknowingly triggering it after disabling cruise control post freeway?

Yep, it's supposedly disabled when cruise is on, but it apparently isn't...at least not in my rig.

Sponsored

 

[LanceMagnum]

So after some testing and coding I've got something that works pretty good. It's not as accurate as my original version that used a sensor reading to .1 psi but it's pretty close and a much simpler system (hardware-wise).

Unfortunately the frequency and timeliness of the TPMS updates is not great. It does seem to update every couple of psi or so, but I don't think the timing of detecting the change is very precise. It can also act like busses during rush hour - no updates for a bit then 2 updates just seconds apart. If I try and build a prediction curve from the values it does not perform well. I think with some better change point detection and filtering work it could be feasible but I've got another way from my existing project that works well so I'm using that.

If you look at the ARB performance graphs:

you can see the psi vs. cfm performance (solid lines). For the psi ranges I care about (0-60) it's close enough to a linear response I can make a simple prediction using the slope of the line:

(I also tried a polynomial regression but it's just not worth it)

Since I know the volume of my tires I just take the current psi and my setpoint psi and calculate how many cubic feet of air are needed to reach the setpoint, then use the average CFM over the interval to calculate how long it should take.

I'm curious how well the Jeep Tire Fill Alert feature works - do the newer sensors that go with the system provide better updates? Someday when I need new tires I might put in the newer sensors and see. I know the TFA feature also includes a new TPMS module but have no clue if they somehow talk to the sensors to put them into a 'mode' for more frequent or precise updating. Just guesses. From some reports I've read the factory feature does no better than +/- a psi anyway.

Time to be off to the beach!

 

[THAW]

Yep, it's supposedly disabled when cruise is on, but it apparently isn't...at least not in my rig.

I think swaykill is also only supposed to activate with the vehicle stopped. Seems to work properly on my rig... maybe a firmware version thing?

 

[Ratbert]

I think swaykill is also only supposed to activate with the vehicle stopped. Seems to work properly on my rig... maybe a firmware version thing?

Yep. I worked with ZAuto for a bit trying to diagnose the issue, but my wife eventually got fed up with it freaking her out. It's now in a drawer.

I'll try their latest update when I can.

 

[ROGER79]

Thank you!

My hope is that I can use those messages without enabling the sway bar. Here's to hoping...



The front and rear differential report their status separately. I don't know if it's in the same message or not, but there is locked and unlocked status. I don't personally need this information. I added an ARB air locker to the front axle on a Mojave which is activated by using a Rubicon off road panel switch. However, I developed an electronic module that spoofs the locker hall sensor status according to air pressure at the axle. It also turns the compressor on and activates the locker solenoid.

I got the control plan this noon

 

[Misterwrangler]

Regretfully, your hardware is almost certainly too old to be compatible with what we're working with. We're looking at 2018 and newer Wranglers, or the "JL" model. Before that was the "JK" model which used a completely different format (which is more likely that you'd share). Someone named BiggRanger created a spreadsheet with many of the values he found over time.

I am using a controller to run a WK2 steering pump that has the same wiring connections and it operates just like the JL-JT pump based on the Can C ABS and SAS messages.

I wanted to upgrade/install a JT pump as it is obviouslly more efficient but my controller, altrough it does communicate with the pump, can t start it.

If you guys can help please let me know what it would take and how much a software revision will cost.

 

[jdhunt0]

Is there any data on when the automatic headlights turn on? Mine seem to turn on a bit sooner than I would prefer. I assume I could add a resistor in with the sensor, but thought someone else might already know the value it activated at.

 

[Lapis]

Is there any data on when the automatic headlights turn on? Mine seem to turn on a bit sooner than I would prefer. I assume I could add a resistor in with the sensor, but thought someone else might already know the value it activated at.

I haven't tried it, but jScan has options for this, (Auto headlight ON/OFF threshold) values are in Volts, default on at 3.6V off at 2.8V

 

[jdhunt0]

I haven't tried it, but jScan has options for this, (Auto headlight ON/OFF threshold) values are in Volts, default on at 3.6V off at 2.8V

Thanks. I have asked for this feature to be added in the Tazer but never get a response. Wonder if I can use both?

 

[azjl#3]

so any chance this can be used to make a programable button on the screen to select a cooling fan program, say offroad, hiway, tow haul, stock?

 

[daverockville]

Some notes. I am using SavvyCan, which is good for this job despite crashing a lot. Also I am using DBC files, which work fairly well with bit flags etc, despite being a bit of a strange format and not being that readable. And using decimal.

BO_ 881 SwayBar: 8 Vector__XXX
SG_ SwayBarDisconnected : 8|1@0+ (1,0) [0|1] "" Vector__XXX
SG_ SwayBarInProgress : 9|1@0+ (1,0) [0|1] "" Vector__XXX
SG_ SwayBarLocked : 0|1@0+ (1,0) [0|1] "" Vector__XXX
SG_ SwayBarPosition : 7|4@0+ (1,0) [0|1] "" Vector__XXX

BO_ 623 Unknown: 8 Vector__XXX
SG_ SwayBarRequest : 14|1@0+ (1,0) [0|1] "" Vector__XXX

BTW this is on a 2024 Rubicon, so there is a chance it has changed from previous years.

Now how do we stop the sway bar disconnecting? I'm going to guess that the sway bar module is listening to one of the many speed packets eg 0x83. And when it sees 18 mph it reconnects.

So we could find what speed packet it uses, and then either use an in line hardware filter to stop or modify the speed message. Or we could try spamming the speed packet to see if we can drown out the actual speed. We would need to also look at the transfer case packet too so we could disconnect in 2WD.

Other options worth trying would be to use a UDS communication control to stop the sway bar from listening to anything at all.

Some notes. I am using SavvyCan, which is good for this job despite crashing a lot. Also I am using DBC files, which work fairly well with bit flags etc, despite being a bit of a strange format and not being that readable. And using decimal.

BO_ 881 SwayBar: 8 Vector__XXX
SG_ SwayBarDisconnected : 8|1@0+ (1,0) [0|1] "" Vector__XXX
SG_ SwayBarInProgress : 9|1@0+ (1,0) [0|1] "" Vector__XXX
SG_ SwayBarLocked : 0|1@0+ (1,0) [0|1] "" Vector__XXX
SG_ SwayBarPosition : 7|4@0+ (1,0) [0|1] "" Vector__XXX

BO_ 623 Unknown: 8 Vector__XXX
SG_ SwayBarRequest : 14|1@0+ (1,0) [0|1] "" Vector__XXX

BTW this is on a 2024 Rubicon, so there is a chance it has changed from previous years.

Now how do we stop the sway bar disconnecting? I'm going to guess that the sway bar module is listening to one of the many speed packets eg 0x83. And when it sees 18 mph it reconnects.

So we could find what speed packet it uses, and then either use an in line hardware filter to stop or modify the speed message. Or we could try spamming the speed packet to see if we can drown out the actual speed. We would need to also look at the transfer case packet too so we could disconnect in 2WD.

Other options worth trying would be to use a UDS communication control to stop the sway bar from listening to anything at all.

I recently discovered this thread which is absolutely fantastic! I have succeeded in connecting my Jeep to the CAN bus and see traffic through candump. I would like to install SavvyCAN but I don't know how to go about that. I see they have linux version will that work on Raspberry PI 4? Or what do I need to do? Also, any advice on how to decode or what tools to use is much appreciated?

 

[dstevens]

SavvyCAN runs on a PC - OSX, Linux or Windows. You need to transfer your CAN log from the Pi to the PC and make sure it is in a format that SavvyCAN can load.

If you get that done then get the DBC files from https://github.com/darksotmoon/jlcan and load into SavvyCAN. You should then be able to see some translated packets.

SavvyCAN is not very intuitive at times and crashes a lot but is very powerful at decoding the packets.

Also reference to the xls speadsheet on the first page.

Some of the logic I found is https://www.jlwranglerforums.com/fo...hs-uds-reverse-engineering.82139/post-2656759

 

[daverockville]

SavvyCAN runs on a PC - OSX, Linux or Windows. You need to transfer your CAN log from the Pi to the PC and make sure it is in a format that SavvyCAN can load.

If you get that done then get the DBC files from https://github.com/darksotmoon/jlcan and load into SavvyCAN. You should then be able to see some translated packets.

SavvyCAN is not very intuitive at times and crashes a lot but is very powerful at decoding the packets.

Also reference to the xls speadsheet on the first page.

Some of the logic I found is https://www.jlwranglerforums.com/fo...hs-uds-reverse-engineering.82139/post-2656759

This is awesome! Thank you so much. Using some of the info on this thread, earlier I used cansniffer and I am pretty sure the ID for window down or up is 2C2, I tried using cansend can0 2C2#1A907400 with no luck. I am connected to the bus through connectors behind glovebox. I look forward to using savvyCAN

 

[EVguy1]

So I joined here because someplace it says to ask any questions and your friendly. ;>)
I have a 2014 Ram 1500 with a Cummins 4 cylinder ISB170 swapped in front of the stock ZF 8 speed automatic. Its a fantastic truck but I have been fighting some last electronic bugs that keep it from being amazing. I think the modules and Canbus must be very similar to the Jeep stuff so I'm hoping to learn a bit about it here.
Before you kick me out ;>) I do also have a 2008 JKU with a TDI swapped into it, 28-32MPG.

 

[redracer]

So I joined here because someplace it says to ask any questions and your friendly. ;>)
I have a 2014 Ram 1500 with a Cummins 4 cylinder ISB170 swapped in front of the stock ZF 8 speed automatic. Its a fantastic truck but I have been fighting some last electronic bugs that keep it from being amazing. I think the modules and Canbus must be very similar to the Jeep stuff so I'm hoping to learn a bit about it here.
Before you kick me out ;>) I do also have a 2008 JKU with a TDI swapped into it, 28-32MPG.

I have heard that they use a very similar canbus for similar years. But, that you have a 2014 Ram, that is probably closer to the previous generation Wrangler, the JK. Unfortunately, I don't have any knowledge of the Can systems for those years.

Sponsored