JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[MissAnnThorpe]

Nice. I just got my Pi talking to my 4xE earlier this past weekend. I am not connecting to the C network out of safety concerns for now, but I can read from the IHS network fine. If there was a way to physically disable transmit I might connect to both.

Mostly I just want to augment or replace UConnect since it's kinda shit and will never do all the things I want. Also actual security for the Jeep since the area isn't the safest. Currently Gnome wallpaper is my defense. Since my threat model is the chemically challenged that works, but it could be much better.

I am thinking I leave the doors unlocked but the stereo blasts at full volume if the doors are opened, and I am yards away. Better doors unlocked and someone scared away than a broken window. I had my Sahara less than a month before that happened the first time, and I had nothing but hand sanitizer inside. Was driving around in November with plastic over the window and glass everywhere.

Also, the charge controller seems to keep the 12V battery topped up, so knock yourself out when it's plugged in. You might want to confirm it with your own testing before a road trip or something, however.

Sponsored

 

[MissAnnThorpe]

Working on a small rust library to listen to and parse events. Right now only remote control events are implemented but the rest is just a matter of data entry. I'll publish it once it's a bit more useful. It has tests and a command line tool, but I'm writing a UI as well in a separate crate. Wireframing for that is in progress.

On a road trip RN and the "security system" has been super useful in less secure parking locations. People see "sentry mode" and avoid. Soon it won't be fake. Cameras, entry detection, and an alarm to make intruders reconsider their life decisions.

Added a hotspot as well. There's plenty of room behind the glove box for an old phone and a battery pack. F**k AT&T and Sirius XM Guardian. They won't see a dime from me. They want how much per GB? LOLno. Google Fi FTW. Unlimited data sims!

 

[MissAnnThorpe]

One thing I noticed writing the remote event parsing is there seems to be an error in this cell. App unlock and panic are both "$830000880000". I haven't tested with the app to figure out which is wrong yet and might not be able to since my 1 year trial is almost up. Not gonna renew for something so barely functional.

There is no loss for me, but somebody might want to fix it. Other than that, the data has been super, super, helpful so thanks, @jmccorm I will add you to the library's and app's credits. Library should be ready within the next few weeks, Thanksgiving permitting. Some sort of GUI app probably a month or two after.

 

[redracer]

One thing I noticed writing the remote event parsing is there seems to be an error in this cell. App unlock and panic are both "$830000880000". I haven't tested with the app to figure out which is wrong yet and might not be able to since my 1 year trial is almost up. Not gonna renew for something so barely functional.

There is no loss for me, but somebody might want to fix it. Other than that, the data has been super, super, helpful so thanks, @jmccorm I will add you to the library's and app's credits. Library should be ready within the next few weeks, Thanksgiving permitting. Some sort of GUI app probably a month or two after.

Hmm. I have most of my one year trial left so I'll try to figure out this inconsistent data... If I can find a moment.

Spare moments to tinker are so hard to come by with a 5yo and 10yo running the house. Lol.

 

[MissAnnThorpe]

Thanks @redracer. If you manage to find the charge controller's id, that'd be super useful as well. My HV battery sometimes never completes charging and I'm not sure why. It'll stay at 99% all night sometimes. That's not supposed to happen and I'm worried why it might be (is it overcharging, is my Jeep gonna catch fire or something).

 

[MissAnnThorpe]

Might be a silly question, but what's "ESS" @redracer ? Is that the hazard lights? Referring to this cell. I'm assuming that's from your older Jeep and I know the control panel is different for the 4xE.

 

[redracer]

Might be a silly question, but what's "ESS" @redracer ? Is that the hazard lights? Referring to this cell. I'm assuming that's from your older Jeep and I know the control panel is different for the 4xE.

Yes, ESS is the auto stop/start disable button for the non hybrid models.

 

[MissAnnThorpe]

It's a WIP still, but I published the rust crate I was working on over the holidays. It's probably enough for some basic alarm software, and there are some examples. I plan to tinker with it more when I have more time. I'll probably write a remote alarm app that depends on the crate. Currently the only alarm example simply runs a command when any doors are opened.

Thanks so much to everybody in this thread. I've included you in the credits. @jmccorm your profile seems to be private so I didn't link to it, but if you want me to hyperlink to your email or website or something from the readme, let me know.

Contributions, suggestions, and bug reporting is very welcome. Python and C bindings might be coming in the future but there are no immediate plans for that. The examples are written such that you should be able to dive right in regardless of what languages you're used to. There are assuredly bugs and the API is not yet stable, so don't use it in production, but it's hopeful that the crate will eventually make it there.

Note: I just published the crate, so the documentation is still processing as of writing. `cargo doc --all-features --open` can open a local copy in your browser if you run that from the repo's root.

 

[jmccorm]

I did a little repair work so I thought I'd post an update.

As a refresher, I never set out to have the kind of popular vehicle where car nuts (and parents) are ambushing me in parking lots and traffic lights to take a look at all the neat things someone can do with their vehicle. But between integrating the CAN bus features with the 120 RGB LED Halo light elements, things have gotten a little out of hand and a lot too fragile lately.

My solution is extremely over-engineered and advanced for what it really should be. There are a some occasional problems with a 3rd party board I use to detect if it is getting voltage from AUX3 or AUX4. (AUX3 turns on the Raspberry Pi. AUX4 turns on the Halos. The Raspberry Pi can shut either one off as it so chooses.)

Part of the fragility problem is that my wiring is a little suspect. And part of the fragility problem is with law enforcement. While city cops have zero problem with the 120 element RGB Halo headlights, the state Highway Patrol sees the lack of a definition for the word "blinking" [as in: "blinking is not allowed"] to mean any pattern of light that could offend them in some way.

A Highway Patrol officer told me that a single RGB halo element transitioning from "off-to-on" (0% to 100%) constitutes "blinking". That's all it took for his definition. Now, mind you, I could work with that by transitioning no lower than 30%, and so by his own definition, it would no longer be blinking. But then you'd have some other HiPo writing his own blanks for the missing ordinance that describes that blinking actually consists of something different. It's too fragile to work around it in ways that are still worth doing, IMHO.

But first and foremost, my weakest link is on the electronics side of things. The CAN bus itself? That part has been rock solid! Instead, it has been with a third party board I added that detects if I'm powering it on with AUX3 or AUX4. The second weakest link has been with my own lack of 'ruggedization skills' and making sure all my electrical connections (5VDC) are not fragile. Today I burned some magic smoke off of my Raspberry Pi, but somehow I got lucky and it managed to survive somehow.

A couple of weeks ago, I tamed down my RGB halos so that they're always ON and white. Then, by reading the CAN bus, if a left blinker or a light blinker is on (or both hazard lights), it temporarily turns the halos on either side yellow to match what their nearby turn signal is doing. That's been working out well. Sure, that means no more crazy parking-lot shows with 1 hour shutoff delays, but that's also going to allow me to get rid of that finicky power board solution I was just talking about.

With those out of the way, I think that things are going to run pretty ideal and stable. I'm really liking how (depending on ambient temperature) I can remote start the vehicle and it automatically knows to pump the cabin full of A/C or heat before I jump in. It's really comfy and I don't want to lose that. I'm also liking the 'black box digital recorder' that it has going on that's constantly monitoring every thing the Jeep's own computers broadcast to each other.

In the end, I still want to give my ringing endorsement of DIY CAN bus modifications and features to your own Wrangler. They can be worthwhile! Now that my health is returning, I'm hoping to spend less time wrestling with the fragility and getting back to some of the cool features we all were working on.

That's all I got!

BEFORE:

AFTER:

Surprisingly, I still haven't gotten a lift for my JLUR, but with the Sky-One Power Touch, any more lift means it's going to be smacking up against the top of the garage when I pull in for the night.

 

[Kindapointless]

So I have no clue how I haven't found this before. I have been working on using my arduino to do kind of the opposite, well thats how it started out anyways lol. I'm kind of dumb so my process is the same so please be patient. I'm scanning the bus and using triggers (button, state,etc) to fire relays. Hold up on dpad turn on front aux lights type of thing. I have purchased the auto cruise buttons and a 392 center stack, the buttons show button presses on network don't do anything on the actual network itself but does get picked up by my code and triggers. With chat gpts help I now have it looking at rpm and throttle to trigger exhaust state also.. all this works on the bench and twice in vehicle so far. My research isn't much but I could make a git hub if yall want it.

 

[jmccorm]

Another one of us. YES!

With chat gpts help I now have it looking at rpm and throttle to trigger exhaust state also.. all this works on the bench and twice in vehicle so far. My research isn't much but I could make a git hub if yall want it.

I'm curious in what way(s) you leveraged ChatGPT to give you some insights here. General coding assistance, or does it know something more in-depth here?

I'm also a bit interested in potentially adding those buttons back into my steering wheel (auto-cruise). I really didn't think about that, and adding some more buttons to the wheel would be really useful to me. That's why I went as far as adding 392 paddle shifters to my otherwise ordinary JLUR!

Come across any how-tos on adding the buttons back into the wheel?

 

[Kindapointless]

I haven't installed them yet in the wheel im waiting on my other paddle shift to arrive, so far all testing has been with the 392 center stack since its super easy to swap lol. I don't have cold weather or the super safety group so it's given me 5 extra buttons to play with so far. The exhaust button actually has a light on it that changes state on it that works even though 392 exhaust is controlled by the pcm which is odd. I have been probing chat gpts inputs from the get go it took my 3 seperate craptasticly written scripts, combined them, and produced from my pov pure magic. The more I have sounded out my project to it the more it has made suggestions and at this point seems to generally have a better idea of what I'm doing then I do. I was "talking" to it about adding controls for indidually addressable rbgw and It laid me out a secondary can network building off of this to "nodes" of arduino Nanos at each light to control individually and do crazy things like all rock lights and kc lights on the right fire yellow with turn input and all lights on back go red on stop. It supplied the code for the master and slaves in example form. I work from home and talk to this thing entirely too much lmao

 

[jmccorm]

THIS IS FOR ILLUSTRATION PURPOSES ONLY --
NOBODY PLEASE USE THESE INSTRUCTIONS.

I actually didn't expect ChatGPT to have any real knowledge about this specific configuration. It's limited, but color me surprised! It glosses over quite a few things (like two different CAN bus types and speeds) but it's a start.

[PROMPT TO CHATGPT IS BELOW]

Given the following configuration: A Raspberry Pi 3B A PiCAN2 bus interface card A 2021 Jeep Wrangler What is the appropriate method of initializing the Raspberry Pi to talk to the Jeep Wrangler via the SocketCAN utilities?

[RESPONSE FROM CHATGPT IS BELOW]

To initialize the Raspberry Pi to talk to the Jeep Wrangler via the SocketCAN utilities, you will need to follow these steps:

1. Connect the PiCAN2 bus interface card to the Raspberry Pi 3B using the appropriate interface cables.
   
   
2. Install the SocketCAN utilities on the Raspberry Pi by running the following command in the terminal:

sudo apt-get install can-utils

* Load the CAN driver for the PiCAN2 interface card by running the following command:

sudo modprobe can
sudo modprobe can-raw
sudo modprobe mcp251x

1. Check that the PiCAN2 interface card is recognized by running the following command:

sudo ifconfig -a

You should see a new interface called "can0" listed.

1. Configure the CAN bus settings by running the following command:

sudo ip link set can0 up type can bitrate 500000

Here we are setting the bitrate to 500000 which is the standard rate for CAN.

1. Check the status of the CAN interface by running the following command:

ifconfig can0

You should see "UP" and "RUNNING" in the output, indicating that the CAN interface is ready to use.

1. Now you can use the SocketCAN utilities to communicate with the Jeep Wrangler. For example, to send a CAN message with the ID 0x123 and the data bytes 0x11, 0x22, and 0x33, you can run the following command:

cansend can0 123#112233

You can also use the candump utility to monitor the CAN bus for incoming messages:

candump can0

Note that the specific details of how to communicate with the Jeep Wrangler over the CAN bus will depend on the specific protocol and message format used by the vehicle. You will need to consult the vehicle documentation or reverse engineer the protocol [lol] to determine how to construct and interpret CAN messages for your particular use case.

 

[jmccorm]

I have been probing chat gpts inputs from the get go it took my 3 seperate craptasticly written scripts, combined them, and produced from my pov pure magic. The more I have sounded out my project to it the more it has made suggestions and at this point seems to generally have a better idea of what I'm doing then I do. I was "talking" to it about adding controls for indidually addressable rbgw and It laid me out a secondary can network building off of this to "nodes" of arduino Nanos at each light to control individually and do crazy things like all rock lights and kc lights on the right fire yellow with turn input and all lights on back go red on stop. It supplied the code for the master and slaves in example form. I work from home and talk to this thing entirely too much lmao

You're inspiring me!

BTW, if you haven't already, check out my other thread where I use the Raspberry Pi to directly control a couple of RGB headlight halos (60 pixels per headlight). But now I've dumbed them down to glorified turn signals.

And, yes, that's the same Raspberry Pi that has access to the CAN bus and is, at the same time, reading the status of all those buttons you're looking into. Your idea is one that should work fine, with effort!

 

[Kindapointless]

You're inspiring me!

BTW, if you haven't already, check out my other thread where I use the Raspberry Pi to directly control a couple of RGB headlight halos (60 pixels per headlight). But now I've dumbed them down to glorified turn signals.

And, yes, that's the same Raspberry Pi that has access to the CAN bus and is, at the same time, reading the status of all those buttons you're looking into. Your idea is one that should work fine, with effort!

I'm reading through that right now actually. Chat gpt will surprise you, it's not perfect but it can clean up what you already have and help how things are implemented along with suggestions. Also don't forget about a gladiator headlight switch those have a extra button for the cargo light. I do alot of parades and want to do a cool light show so why not give a adress to every single light I put on, rock lights, kc lights everything.That was a seperate project that got merged lol. Btw check out the hooker blackheart attitude adjuster, I would swear it's a pi controlled stepper for 1400 bucks.

Sponsored