JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[kmkommes]

I signed up for this forum because of this thread alone. I am only on page 2 but I’ll make it through the thread today.

My background FWIW: I know CAN well. I worked at Oshkosh Corporation in the corporate electronics group designing and testing CAN systems. Everything from firetrucks to airport snowblowers to all military vehicles such as the JLTV. I worked on a few hybrid models as well. Now I work primarily on electric lawnmowers. I followed the money to get here. I designed the Gravely ProTurn EV. A $25,000 electric lawnmower. Go buy one.

In my spare time this past winter I created a RC version of this with an Arduino and a RC transmitter/receiver. It was my 1st arduino project and had this functional within a week. Video here. This mower is cable of 30mph if you know how to program it...

I’m pretty decent mechanically as well. Built this LS custom frame 1 ton TJ. https://www.pirate4x4.com/threads/ly6-nv4500-dana-60-tj-daily-driver-family-rig.940551/

Anyways
I am here because I have a 2022 Rubicon 4XE and plan on decoding the EPT Bus. The EPT bus is used for the e-Torque system and components.

EPT Bus Components
Assembly Shift Lever
Electric Brake Booster Module
Powertrain Control Module
Transmission Control Module
Power Inverter Module
Integrated Dual Charge Module
Occupant Restraint Controller Module
Battery Pack Control Module

I currently have a 3 day membership to www.techauthority.com. I’m off to learn as much as I can.

Sorry if I wasted time with this post. I'll add useful content soon. I am all about open source etc...

Sponsored

 

[NickJar]

I signed up for this forum because of this thread alone. I am only on page 2 but I’ll make it through the thread today.

My background FWIW: I know CAN well. I worked at Oshkosh Corporation in the corporate electronics group designing and testing CAN systems. Everything from firetrucks to airport snowblowers to all military vehicles such as the JLTV. I worked on a few hybrid models as well. Now I work primarily on electric lawnmowers. I followed the money to get here. I designed the Gravely ProTurn EV. A $25,000 electric lawnmower. Go buy one.

In my spare time this past winter I created a RC version of this with an Arduino and a RC transmitter/receiver. It was my 1st arduino project and had this functional within a week. Video here. This mower is cable of 30mph if you know how to program it...

I’m pretty decent mechanically as well. Built this LS custom frame 1 ton TJ. https://www.pirate4x4.com/threads/ly6-nv4500-dana-60-tj-daily-driver-family-rig.940551/

Anyways
I am here because I have a 2022 Rubicon 4XE and plan on decoding the EPT Bus. The EPT bus is used for the e-Torque system and components.

EPT Bus Components
Assembly Shift Lever
Electric Brake Booster Module
Powertrain Control Module
Transmission Control Module
Power Inverter Module
Integrated Dual Charge Module
Occupant Restraint Controller Module
Battery Pack Control Module

I currently have a 3 day membership to www.techauthority.com. I’m off to learn as much as I can.

Sorry if I wasted time with this post. I'll add useful content soon. I am all about open source etc...

Nice! You will be a great addition here!

 

[Nickb1907]

I signed up for this forum because of this thread alone. I am only on page 2 but I’ll make it through the thread today.

My background FWIW: I know CAN well. I worked at Oshkosh Corporation in the corporate electronics group designing and testing CAN systems. Everything from firetrucks to airport snowblowers to all military vehicles such as the JLTV. I worked on a few hybrid models as well. Now I work primarily on electric lawnmowers. I followed the money to get here. I designed the Gravely ProTurn EV. A $25,000 electric lawnmower. Go buy one.

In my spare time this past winter I created a RC version of this with an Arduino and a RC transmitter/receiver. It was my 1st arduino project and had this functional within a week. Video here. This mower is cable of 30mph if you know how to program it...

I’m pretty decent mechanically as well. Built this LS custom frame 1 ton TJ. https://www.pirate4x4.com/threads/ly6-nv4500-dana-60-tj-daily-driver-family-rig.940551/

Anyways
I am here because I have a 2022 Rubicon 4XE and plan on decoding the EPT Bus. The EPT bus is used for the e-Torque system and components.

EPT Bus Components
Assembly Shift Lever
Electric Brake Booster Module
Powertrain Control Module
Transmission Control Module
Power Inverter Module
Integrated Dual Charge Module
Occupant Restraint Controller Module
Battery Pack Control Module

I currently have a 3 day membership to www.techauthority.com. I’m off to learn as much as I can.

Sorry if I wasted time with this post. I'll add useful content soon. I am all about open source etc...

Can't wait to see what you start creating as a fellow 2022 4xe Rubi owner. BTW I need that lawnmower in my life. It takes me 2 hours to mow my backyard with my Ariens zero turn. Maybe you can merge a roborock with it.

 

[JustinB]

# 3honk.py
import time, os # MUST HAVE can-utils INSTALLED

os.system('cansend can1 620#10.03.00.00.00.00.00.00')
for i in range(0, 3): # HONK 3 TIMES
    print("HONK")
    os.system('cansend can1 620#2F.D0.AD.03.01.00.00.00') # HONK
    time.sleep(0.05)
    os.system('cansend can1 620#2F.D0.AD.03.00.00.00.00') # UNHONK
    time.sleep(0.1)
    i += 1

or if you prefer isotpsend

# 3honkisotp.py
import time, os

os.system('echo "10 03" | isotpsend -s 620 -d 504 -p 00: -P a can1')
for i in range(0,3):
    print("HONK")
    os.system('echo "2F D0 AD 03 01" | isotpsend -s 620 -d 504 -p 00:00 -P a can1')
    time.sleep(0.05)
    os.system('echo "2F D0 AD 03 00" | isotpsend -s 620 -d 504 -p 00:00 -P a can1')
    time.sleep(0.1)
    i += 1

Ok, I think I figured out the meeting place, just a little confused on the date.
#closeencountersofthethirdkindLOL

 

[Drdyer9051]

well fell down a rabbit hole today and found this..

we could use shifter buttons or wireless mouse, on our own menus displayed on the 8.4 by connecting our pi's to the display.....

 

[redracer]

I've been radio silent for a while on this as I've been busy with family life... but I have a run coming up this weekend so I've been putting in some time on this. attached is a screenshot of where I'm at, and I have more work to do this week. But, it's all functional! I setup a raspi camera on the front grill and used the HDMI adapters to connect the camera to the PI on my dash. The best part about this, is it's completely lag free.

This is the tkcan3.py on our github repository.

 

[redracer]

More Progress. I think that it's good enough for my first run. The code is quite ugly, as I hard coded a bunch of stuff. I just don't have the time to make this elegant at the moment.

I give to you tkcan4.py

https://github.com/rstellhorn/jeep-jl-powernet-scripts/blob/main/tkcan4.py

 

[redracer]

Well I got to do the Sierra Trek run this weekend and everything worked great. My Jeep survived the Fordice trail from camp down to the creek and back up. Man what a trail!

And my pi screen was immensely helpful! I used the front camera a lot and flipped back to look at temperatures every so often. I saw my power steering temp get as high as 209°... But it never caused the overheating alert that I have seen before. The pi camera with the fisheye lens gave a very helpful perspective on this difficult trail.

I have new ideas and more changes to code to come.

 

[MissAnnThorpe]

it's major problem appears to be that there's no direct source of power in the immediate area. (If I'm overlooking something, please, add what you know!)

There are two options I know of, at least. There's a small adapter you can get from a bunch of sources to tap the cigarette lighter from behind. There's also this wire harness and switch bank that provides power around that area inside the cabin.

If you've gone that far, you might as well temporarily yoink out the UConnect unit and run power up through the dash. Pretty safe to drill if you're careful once you've removed the head unit. I've got power going to a Pi with touchscreen mounted with a 20mm ball adapter and vesa bracket on a 67 designs arm.

 

[MissAnnThorpe]

apple car play is the culprit I believe. don't think android people are having issues with Uconnect

I can replicate the issue with my iPhone 16, Pixel 6 Pro, and Pixel 4. My guess would be Jeep f**ked up the USB PD implementation since it's pretty common and causes these elsewhere.

It's gonna be a bigger issue in the future since almost all phones, including newer iPhones, use the USB Power Delivery standard for charging.

I'm taking it to the dealership tomorrow to replicate the issue in front of the techs since it's been three times already, they "can't replicate" the issue, and I'm entirely out of tolerance.

 

[MissAnnThorpe]

Waveshare 2-Channel CAN adapter

Anybody try this on a pi4 running 64 bit RaspiOS? I am getting a failed SPI probe and I'm not sure if it's the driver in the 64 bit OS or a failed hat. I will probably rule the latter out tomorrow on another Pi unless somebody can confirm it does work on 64 bit RaspiOS.

[    9.314240] mcp251x spi0.0: MCP251x didn't enter in conf mode after reset
[    9.314422] mcp251x spi0.0: Probe failed, err=110
[    9.314443] mcp251x: probe of spi0.0 failed with error -110
[   10.329906] mcp251x spi0.1: MCP251x didn't enter in conf mode after reset
[   10.330087] mcp251x spi0.1: Probe failed, err=110
[   10.330110] mcp251x: probe of spi0.1 failed with error -110

My config.txt is

...
dtparam=spi=on
dtoverlay=mcp2515-can1,oscillator=16000000,interrupt=25
dtoverlay=mcp2515-can0,oscillator=16000000,interrupt=23

 

[redracer]

Anybody try this on a pi4 running 64 bit RaspiOS? I am getting a failed SPI probe and I'm not sure if it's the driver in the 64 bit OS or a failed hat. I will probably rule the latter out tomorrow on another Pi unless somebody can confirm it does work on 64 bit RaspiOS.

Yes, @jmccorm at first tried to use a Pi 4 and ran into lots of issues. If I remember right, he was able to get just one can bus online, but it would crash on bringing up the 2nd interface. He ended up going to a Pi 3

 

[MissAnnThorpe]

Since that time, we've found a low-cost source for Jeep's official CAN connectors.

Any chance this text in OP could be hyperlinked to this? I've been looking for those.

Yes, @jmccorm at first tried to use a Pi 4 and ran into lots of issues. If I remember right, he was able to get just one can bus online, but it would crash on bringing up the 2nd interface. He ended up going to a Pi 3

Thanks! That's useful. I'll try that tomorrow then, although one interface is probably all I need for what I want to do (read only, safe, simple stuff).

 

[redracer]

Any chance this text in OP could be hyperlinked to this? I've been looking for those.

I found it buried in this thread...

Mouser items received and tested!

The green CAN-IHS connector and the white CAN-C connector both plugged into their respective hubs without issue. They appeared identical to the factory connectors to the left and to the right of them. The keying was correct, so it was not possible to plug either one of them into the wrong bus. EXCELLENT!

Assembled using pre-wired terminals from an official Jeep CAN connector repair kit.​

The terminals (metal pins which go inside the connector) turned out to be a bit of a problem for me. I either don't have the right tools, or I don't have the right skills to create a solid crimp between the connector and a wire. So, to the best of my ability, I believe that these terminals are also correct. Total cost for both CAN bus connectors and terminals is $1.86 (plus the cost for wire).

I'll admit, my hardware skills could use some work, but I suspect many others are going to be equally unable to create a solid crimp to the terminal and then feed it into it's home inside the connector. I might be able to find some place local that could handle my own crimping, but is there a more universal solution? Some way to order the terminals already wired up, or... ?

I'm wondering if we should point people to the DLC (OBD-II) connector and bypass cables, or do we just make note of this as a hurdle when connecting directly to the CAN bus? Perhaps this isn't a problem that should be solved right now?

Thanks, all. And again, many thanks to Temperance for her keen eye and solid skills in locating just the right parts at Mouser! A+++

 

[redracer]

And...

I placed an order with Mouser. The items should be here tomorrow. Naturally, I'll let you know how it turns out. (Just to hedge my bets, I ordered another model of terminal in case the first one doesn't work out.) And thanks!

Line Number​	Mouser Part Number Customer Part Number Manufacturer Part Number Description​	Quantity Ordered​	Quantity Shipped​
1​	571-5-2138650-1 5-2138650-1 TE Connectivity Automotive Connectors US HTS:8536694040 ECCN:EAR99 COO:US​	10​	10​
2​	571-2-2138650-1 2-2138650-1 TE Connectivity Automotive Connectors US HTS:8538906000 ECCN:EAR99 COO:US	10​	10​
3​	571-5-963715-6 5-963715-6 TE Connectivity Automotive Connectors US HTS:8544200000 ECCN:EAR99 COO:DE	20​	20​
4​	571-1718760-2 1718760-2 TE Connectivity Automotive Connectors US HTS:8538908140 ECCN:EAR99 COO:DE	10​	10​

Note, later he discovered that the line item #3 part 5-963715-6 was not necessary.

... But I checked my order and I had the following...

​

Line Number​	Mouser Part Number Customer Part Number Manufacturer Part Number Description​	Requested Delivery Date(s)​	Estimated Shipment Date(s)​	Quantity​	Unit Price (USD)​	Extended Price (USD)​
1​	571-5-2138650-1 5-2138650-1 2P MQS Unsealed Plug​	JAN 04, 2022​	JAN 04, 2022​	10​	0.366​	3.66​
2​	1 571-2-2138650-1 2-2138650-1 2P MQS Unsealed Plg​	JAN 04, 2022​	JAN 04, 2022​	10​	0.381​	3.81​
3​	1 571-5-963715-6 5-963715-6 MQS REC CONT​	JAN 04, 2022​	JAN 04, 2022​	20​	0.153​	3.06​

Sponsored