JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[redracer]

think of switching back to flip phone and doing away with apple phones.
apple car play is the culprit I believe. don't think android people are having issues with Uconnect
everyone wants to blame Jeep, but its on Apple and Uconnect.
month old Jeep and the Heat and Air are non responsive. until I reset fuse 97. then everything is normal. so It is radio not the jeep.

had simular problem with wifes 21 JL Rubicon Unlimited.
this is a known problem for years. yet they continue act like there is nothing wrong...

I'm not sure if an apple phone is to blame or not. I have had similar issues with my android phones. Usually for me it comes down to the cable that I'm using, as finding the right cable can be frustrating. Oh and more commonly the lint that has packed into the USB-C port on my various phones causes weirdness as it prevents the cables from seating all the way. I have noticed the same issues with my wife's iphones as well.

But, as for the no responsive heat and air... I do occasionally have this issue or at least one like it. I find that the center console that contains the radio and hvac buttons does not always start up immediately when starting the jeep, and I've had it not start at all on a few occasions. I keep thinking that this is an initialization timing issue for this module, as it just does not catch the wakeup command on the canbus. I have found that doing a full system reboot from the tazer module or jscan app will resolve this issue for a while. And, yes, it could also be a problem with the radio as well, as any canbus module misbehaving could affect other devices on the bus, especially as the bus uses coordinated timing for most of the messages being sent.

Sponsored

 

[redracer]

As for working with the 8" radio, have a look at our spreadsheet , on the UDS Modules page. There are some hints here that @jmccorm has found about his 8" screen by scanning through the UDS commands.... that is before he accidentally convinced his jeep that he was in a wreck. lol.

Perhaps for the 8", we need to start a diagnostics session first, which would simply be sending that command immediately before the reset command.

Services supported by Radio Module (7BF/53F) on can0:

Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL

Supported service 0x11: ECU_RESET

 

[Drdyer9051]

    # Change to an extended diagnostic session.
    # We need this in order to access and change the horn.
    os.system('cansend can1 620#02.10.03.00.00.00.00.00')
    time.sleep(0.1)

will try this before the cansend code

cansend can0 7BF#0211010000000000

standby....


edit.... do you need to put the . in between the zeros?

will try both ways and see if it makes a difference.

 

[jmccorm]

Perhaps for the 8", we need to start a diagnostics session first, which would simply be sending that command immediately before the reset command.

Services supported by Radio Module (7BF/53F) on can0:

Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL

Supported service 0x11: ECU_RESET

I don't know if an extended diagnostic session is required to do an ECU reset or not. But when you enter a diagnostic session, you immediately have to send whatever command it is you want to send. So run the following AS A SCRIPT:

#!/bin/bash​

# Change to an extended diagnostic session.​

cansend can0 7BF#02.10.03.00.00.00.00.00​

sleep 0.2​

# Send an ECU RESET to the uConnect Radio​

cansend can0 7BF#0211010000000000​

Please look that over for errors (wrong CAN interface, wrong address, etc.)

 

[Drdyer9051]

I don't know if an extended diagnostic session is required to do an ECU reset or not. But when you enter a diagnostic session, you immediately have to send whatever command it is you want to send. So run the following AS A SCRIPT:

#!/bin/bash​

# Change to an extended diagnostic session.​

cansend can0 7BF#02.10.03.00.00.00.00.00​

sleep 0.2​

# Send an ECU RESET to the uConnect Radio​

cansend can0 7BF#0211010000000000​

Please look that over for errors (wrong CAN interface, wrong address, etc.)

hey Josh,
do the . matter

one send command #02.10.
yet next send command 0210




#!/bin/bash
# Change to an extended diagnostic session.
cansend can0 620#02.10.03.00.00.00.00.00
sleep 0.2
# Send an ECU RESET to the uConnect Radio
cansend can0 7BF#02.11.01.00.00.00.00.00

 

[jmccorm]

hey Josh,
do the . matter

one send command #02.10.
yet next send command 0210

I believe the cansend command will accept either syntax.
If you like, you may remove the periods. It shouldn't make a difference.

 

[Drdyer9051]

tried with and without .'s

did not reset radio.

checked reading can0 with the doors program...
verified different number depending on which and how many doors open.
so I know read can0 is working.

 

[JustinB]

"My Jeep would be just perfect if only it would..."
This project started because I've said that to myself. Too many times.

PROJECT DESCRIPTION:

This project aims to reverse engineer the Wrangler's CAN bus and use that information to addresses numerous quality-of-life issues that can be solved "if only the Jeep's computer acted just a little bit differently" and to make mods that up until now have not been possible.

This thread is a continuation from redracer's original inspiration thread and my own project discussion here. This serves as a place for like minded individuals to reverse engineer CAN bus messages (and UDS functions), to seek guidance on related issues, and to put that knowledge to work.

It's been over four months since we started connecting to our own vehicle's CAN networks using a Raspberry Pi with a Waveshare 2-Channel CAN adapter. (Arduinos are welcome, too!) Since that time, we've found a low-cost source for Jeep's official CAN connectors.

We've decoded quite a number of CAN messages and started to get our feet wet in the world of Unified Diagnostic Services. We've managed to create tools including: a black box data recorder, a remote keyfob WiFi toggle, an automatic climate control for remote start, and more.

image of CAN-C and CAN-IHS bus connections (located behind the glovebox)​

Looking for tips to get started?
If you have questions, ASK! We're friendly!

If you're not yet ready to hook up your vehicle, but you'd like to simulate the real thing, @Drdyer9051 lists the steps necessary to configure a virtual CAN interface on a Raspberry Pi and play back authentic messages from one of our recorded CAN bus log files.

For those who are ready to connect their vehicle to a Raspberry Pi, this message offers tips on how to initialize your 2-channel Waveshare CAN adapter as well as a general introduction to working with the Wrangler's CAN-IHS and CAN-C bus.

We maintain an online spreadsheet with information on all the CAN bus messages that we've decoded, and you're welcome to access it. All that we ask, in return, is that you share anything new you might discover along the way. Sounds fair?

Third party contributions are welcome as long as your vehicle uses the same modern Chrysler/Dodge/Fiat/Jeep ECU with similar messages and message IDs.

TO VIEW OR DOWNLOAD THE SPREADSHEET:

2018+ Jeep Wrangler "JL"
CAN-C and CAN-IHS Message ID.xls

TO VIEW OR DOWNLOAD RASPBERRY PI CODE SAMPLES, VISIT OUR GITHUB REPOSITORY:

rstellhorn / jeep-jl-powernet-scripts
with special thanks to redracer, repository maintainer
​

All code samples assume that can0 is connected to the vehicle's CAN-IHS network, and can1 is connected to the vehicle CAN-C network. Use at your own risk, no promises or guarantees are given.

Have a question?
Feel free to jump right in and ask! We'll do our best to help you.

LAST UPDATED: March 5th, 2022

I see there's 35 tabs in this thread thus far, so there may be something that mentions this already.?. Additionally, I'm absolutely not a programmer and posting this thought/suggestion within this thread may further prove that, IDK, anyways kudos to y'alls BIG BRAINS.

What would be really really really cool. To have the ability to leave the vehicle's WiFi on when the vehicle is completely turned off. If there were a way to turn only that system on in a manner that conserves battery draw. The vehicle/Jeep would appear to be completely off (although we know it's never truly off - as it patently waits/senses an action from our FOB or from a Uconnect command via our phone app).

I have a data plan for my Jeep with AT&T ($15 a month unlimited). I also have a camper trailer. When I'm out in the wild camping for the weekend I like to set up the Firestick TV for the kids so they can be entertained during their downtime just before bed. (Which gives me and the lady a little adult time, yes I have my motives as well ) Also, I have a WiFi camera with night vision on the camper to monitor/record things happening at our site while we're sleeping, providing some peace of mind.

Verse having to turn my phone's hot spot on and leaving it in the camper, which does me no good if I want to walk down to the lake and have my phone on me, having everything connected to the Jeep's WiFi would provide me real-time campsite video regardless where I'm at on the campground. I would pay for that capability!!!

Something to consider.
Thanks for listening.
~justin

 

[redracer]

What would be really really really cool. To have the ability to leave the vehicle's WiFi on when the vehicle is completely turned off. If there were a way to turn only that system on in a manner that conserves battery draw. The vehicle/Jeep would appear to be completely off (although we know it's never truly off - as it patently waits/senses an action from our FOB or

Hmm, I would think that this would entail just keeping the radio awake, as it's the radio that hosts the hotspot.

I wonder if we start a UDS session with the radio and just hold it open, if that would be enough to keep it online.

 

[Drdyer9051]

its on my end.... cannot cansend

as a test....I just changed bitrate on can0 to 500000 and the blindspot became unavailable..
will diagnose further later...

 

[JustinB]

Hmm, I would think that this would entail just keeping the radio awake, as it's the radio that hosts the hotspot.

I wonder if we start a UDS session with the radio and just hold it open, if that would be enough to keep it online.

Ya. I really don't know.?. But thank you for your brainstorming response!

From a security stand point I certainly would not want a 'night creeper' to walk past my Jeep and see that the ignition's push button accessory/run light is on (even though the FOB is not in the Jeep) or that the radio's screen is on or lit, even if it's set to the dimmest setting. Aside from the battery draw from a dimly lit screen or ignition light, that alone may make the would be thief want to start tampering with the vehicle. Also, I would want to be able to activate my aftermarket alarm (Compustar Alarm) which is connected to the CAN/OBDII port.

If there was some way to activate the WiFi leaving no sign that anything else on the vehicle is running, except for my alarm's blinking LED of course.

Perhaps a specific sequence of pushing certain buttons in the vehicle, or pushing a specific sequence of buttons on the FOB could activate/deactivate the WiFi??? Obviously, I would not want WiFi on all the time, unless it's a very small battery draw.

 

[redracer]

If there was some way to activate the WiFi leaving no sign that anything else on the vehicle is running, except for my alarm's blinking LED of course.

Now that's the trick, isn't it...

I truthfully don't know how the radio will react to being kept alive. ... Hey, but I do know the command to tell the screen to shut off, thanks to the screen off button on the center stack. And as for the rest of the lights, they should all time out like normal, I hope.

The problem is, I only have the 7" uconnect with no cellular functions at all. I can test on my radio but it may behave differently than yours. It would be up to the others on this forum who have the 8" screen to test and troubleshoot any differences.

As for a fob sequence, that is totally doable. I believe that @jmccorm played with this for his remote wifi control of his Pi.

 

[JustinB]

Now that's the trick, isn't it...

I truthfully don't know how the radio will react to being kept alive. ... Hey, but I do know the command to tell the screen to shut off, thanks to the screen off button on the center stack. And as for the rest of the lights, they should all time out like normal, I hope.

The problem is, I only have the 7" uconnect with no cellular functions at all. I can test on my radio but it may behave differently than yours. It would be up to the others on this forum who have the 8" screen to test and troubleshoot any differences.

As for a fob sequence, that is totally doable. I believe that @jmccorm played with this for his remote wifi control of his Pi.

Welp, knowing how to get the screen to shut off is great, I think I recall doing that once, but again the ignition's accessory/run button was on; thus, its light and everything else in the background was on. Now keeping the WiFi on while everything else times out???

I have the 8.4 so if there's anything I can do or test I will, just let me know. Obviously, I'm limited to what's factory in the Jeep. However for your consideration; I do have a Tazer Mini that may be manipulated or work in conjunction with???. I also have auxiliary commands on my aftermarket alarm that are not in use e.g. the tailgate lift button [not needed on a Wrangler]. Perhaps with a push of the alarm's button could burst a 500mv signal as a command to activate the WiFi, or rather, activate a relay or timer that keeps the WiFi powered on for X amount of time???

Now I'm really getting beyond my pay grade, so I'll stop before I embarrass myself more.

 

[redracer]

Hmm, i tried the UDS keepalive on my 7" and it did not change the radio's behavior at all. Some more tinkering will be involved.

 

[Drdyer9051]

# 3honk.py
import time, os # MUST HAVE can-utils INSTALLED

os.system('cansend can1 620#10.03.00.00.00.00.00.00')
for i in range(0, 3): # HONK 3 TIMES
    print("HONK")
    os.system('cansend can1 620#2F.D0.AD.03.01.00.00.00') # HONK
    time.sleep(0.05)
    os.system('cansend can1 620#2F.D0.AD.03.00.00.00.00') # UNHONK
    time.sleep(0.1)
    i += 1

or if you prefer isotpsend

# 3honkisotp.py
import time, os

os.system('echo "10 03" | isotpsend -s 620 -d 504 -p 00: -P a can1')
for i in range(0,3):
    print("HONK")
    os.system('echo "2F D0 AD 03 01" | isotpsend -s 620 -d 504 -p 00:00 -P a can1')
    time.sleep(0.05)
    os.system('echo "2F D0 AD 03 00" | isotpsend -s 620 -d 504 -p 00:00 -P a can1')
    time.sleep(0.1)
    i += 1

Sponsored