JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[jmccorm]

I'm trying my hand at a 'friendly get your attention' honk (as opposed to a long blaring honk). I don't think I have the cadence quite right. Everyone is welcome to try optimizing this 'nicehonk' script.

I was thinking of it automatically triggering when I flashed my brights?

#!/bin/bash
# An attempt at a polite attention-getting honk.
# Caedence feels wrong. Still seems a bit angry.
# Maybe someone can optimize our horn pattern?

# In case the CAN bus is asleep, we need to wake it up with a message.
# We're telling it that no button was pressed, which does the job nicely.
  cansend can0 2D3#0700000000000000 ; sleep 0.1

# Change to an extended diagnostic session.
# We need this in order to access and change the horn.
cansend can1 620#02.10.03.00.00.00.00.00 ; sleep 0.1

# Honk 0.05 seconds, rest 0.05 seconds
  cansend can1 620#05.2f.d0.ad.03.01.00.00 ; sleep 0.05
  cansend can1 620#05.2f.d0.ad.03.00.00.00 ; sleep 0.05

# Honk 0.15 seconds, rest 0.10 seconds
  cansend can1 620#05.2f.d0.ad.03.01.00.00 ; sleep 0.15
  cansend can1 620#05.2f.d0.ad.03.00.00.00 ; sleep 0.10

# Honk 0.05 seconds, rest 0.10 seconds
  cansend can1 620#05.2f.d0.ad.03.01.00.00 ; sleep 0.05
  cansend can1 620#05.2f.d0.ad.03.00.00.00 ; sleep 0.10

# Honk 0.05 seconds, rest 0.10 seconds
  cansend can1 620#05.2f.d0.ad.03.01.00.00 ; sleep 0.05
  cansend can1 620#05.2f.d0.ad.03.00.00.00 ; sleep 0.10

Sponsored

 

[r.stevens]

People… this is all fun and games until PowerNet is accidentally made sentient & the government & Stellantis force all of us to off-world our Jeeps to Saturn.

Just kidding. This is the most fascinating thread I’ve read here. I’m always in awe of and in debt to intelligent people; in particular to those in the medical research field who have developed pharmaceuticals that help keep my chronic disease in remission. Now because of all of your work I will hopefully someday be able to talk to my Jeep like Kirk on the bridge of the Enterprise… “Warp speed, Mr. Jeep.”

 

[Damenx]

People… this is all fun and games until PowerNet is accidentally made sentient & the government & Stellantis force all of us to off-world our Jeeps to Saturn.

Just kidding. This is the most fascinating thread I’ve read here. I’m always in awe of and in debt to intelligent people; in particular to those in the medical research field who have developed pharmaceuticals that help keep my chronic disease in remission. Now because of all of your work I will hopefully someday be able to talk to my Jeep like Kirk on the bridge of the Enterprise… “Warp speed, Mr. Jeep.”

That can actually be done. Node-Red running on Android has very good access to Google Assistant. Combine that with mqtt and another Node-Red instance on a Raspberry Pi and you could literally say "Hey google, roll the windows down" or query the vehicle and have a parameter read back to you. I think I can get this working with the known OBD2 PIDs in a day or so. I wish you could change the trigger word but "Hey Google" is the only option. Anyhow I'll start another discussion for that so it doesn't dilute this awesome thread.

 

[redracer]

I'm trying my hand at a 'friendly get your attention' honk (as opposed to a long blaring honk). I don't think I have the cadence quite right. Everyone is welcome to try optimizing this 'nicehonk' script.

I was thinking of it automatically triggering when I flashed my brights?

#!/bin/bash
# An attempt at a polite attention-getting honk.
# Caedence feels wrong. Still seems a bit angry.
# Maybe someone can optimize our horn pattern?

# In case the CAN bus is asleep, we need to wake it up with a message.
# We're telling it that no button was pressed, which does the job nicely.
  cansend can0 2D3#0700000000000000 ; sleep 0.1

# Change to an extended diagnostic session.
# We need this in order to access and change the horn.
cansend can1 620#02.10.03.00.00.00.00.00 ; sleep 0.1

# Honk 0.05 seconds, rest 0.05 seconds
  cansend can1 620#05.2f.d0.ad.03.01.00.00 ; sleep 0.05
  cansend can1 620#05.2f.d0.ad.03.00.00.00 ; sleep 0.05

# Honk 0.15 seconds, rest 0.10 seconds
  cansend can1 620#05.2f.d0.ad.03.01.00.00 ; sleep 0.15
  cansend can1 620#05.2f.d0.ad.03.00.00.00 ; sleep 0.10

# Honk 0.05 seconds, rest 0.10 seconds
  cansend can1 620#05.2f.d0.ad.03.01.00.00 ; sleep 0.05
  cansend can1 620#05.2f.d0.ad.03.00.00.00 ; sleep 0.10

# Honk 0.05 seconds, rest 0.10 seconds
  cansend can1 620#05.2f.d0.ad.03.01.00.00 ; sleep 0.05
  cansend can1 620#05.2f.d0.ad.03.00.00.00 ; sleep 0.10

Oh man, did I just jump when I ran that honk script!
Nice! But for politeness, perhaps just shorten it to just two honks, just like double tapping an old school horn button with your fist.

 

[jmccorm]

UPDATES:

• redracer provided a dump of his CAN log data, which should have his Tazer's idle increase command. I should be able to extract it and use it to enhance my "remote startup auto-HVAC" routine which produces a more cozy vehicle interior upon remote starts. I need to be sure to add in a fail-safe that restores the engine's normal idle speed in case the code exits prematurely, but that's the only strange quirk I'm expecting from it. (I read about it here in the forum happening to a Tazer user, actually!)
  
  
• Now that I have some CAN log data from another vehicle, I'll be updating the spreadsheet with anything new that I find from his vehicle that I'm not finding on my own. Be it new messages from installed options that I'm missing (all the traffic safety modules), or differences in the vehicle configuration bitmaps (like his manual versus my automatic). I'll be certain to check and see if his manual gearshift reports similar values to my automatic.
  
  
• I ran a script last night that went through all 256 possible OBD-II commands, and I logged which ones do and do not get a reply from the ECU. When I quickly glanced through the results, they appeared to be model-specific. (For example, no fuel system information on bank 2, almost certainly because my 2.0L Turbo-4 doesn't have a second fuel rail.) I'll be adding those results to the spreadsheet later. Perhaps a new tab makes sense? EDIT: I started work on this, see image.
  
  
  
  
  
  
• For those who missed it, the spreadsheet now lives on Google Docs. Everyone who uses that link automatically has access to read and download the spreadsheet. Rights to modify/add data are made available upon request to known members (or silent contributors).

Finally, if anyone knows someone at Stellantis/Jeep that might be willing to see if more vehicle CAN information might be made available to owner-enthusiasts/modders, it should would be appreciated!

Thanks, everyone.

 

[SmartStopStart.com]

That can actually be done. Node-Red running on Android has very good access to Google Assistant. Combine that with mqtt and another Node-Red instance on a Raspberry Pi and you could literally say "Hey google, roll the windows down" or query the vehicle and have a parameter read back to you. I think I can get this working with the known OBD2 PIDs in a day or so. I wish you could change the trigger word but "Hey Google" is the only option. Anyhow I'll start another discussion for that so it doesn't dilute this awesome thread.

For your example, you would need some extra electronics to roll the window down. The Wrangler is one of the few modern vehicles that still has direct window control not through the CANbus. The window switch modules do have some very limited smarts, but they are not network connected.

Kudos to all doing this challenging discovery work!

 

[jmccorm]

Anyhow I'll start another discussion for that so it doesn't dilute this awesome thread.

What you're doing sounds just as awesome. No obligation, but if you want to do some of your research work here (where we're assembling a group of people), I'm not going to mind one bit. But if you want to keep everything together and separate, absolutely no hard feelings either!

Kudos to all doing this challenging discovery work!

Thank you, and thanks everyone who's contributed so far!

Since you're here, there is one thing I've been curious about (if it's not an intrusion). Is your product CAN based, or (after a delay) do you sense the "ESS active" LED, and then pulse a trigger on the ESS button if needed to alter it's post-ignition status?

Based on what I understand so far, it seems as if it can be done both ways. But since your product covers more than one manufacturer, I'm assuming you too took the more straightforward electrical solution to solve the problem?

In any case, if you (or anyone else) find something in our efforts that you want to use, feel free to take it and run with it. There's no commercial restrictions attached to our effort, but we do ask everyone to share as well they're able.

Come to think of it... if you've got some skills or connections to make semi-rugged automotive products, I know that there are a number of us (and there will be more) who are itching for "productionized" hardware (either for Raspberry Pi or Arduino) that we can load our code onto and turn into products for everyday owners.

Things are growing in every direction, but hardware is one of the big unsolved problems that seems common to most people and will continue to be of importance going forward.

 

[jmccorm]

Python UDS library: udsoncan

This is something I've been wanting to dive into, but there's so much low-level work needing to be done, I really won't have a chance to use this anytime soon. udsoncan looks like a very well developed UDS library for Python. It seems to have both the Client side (which we'd use to communicate with the vehicle) and the Server side (which we could use to simulate the vehicle or to compare it's responses against).

URL: https://udsoncan.readthedocs.io/en/latest/udsoncan/services.html

I also happened to run across two more Python libraries but haven't had the chance to dig into them: python-can and python-OBD


A slow-paced YouTube primer on UDS from India

It's hard to find a good UDS primer. Much of what I've learned I've pulled from miscellaneous references and finally got the feel for what's going on. The only exception might be this series of YouTube videos. Unfortunately, it's from India (a small hearing barrier for me) and it goes a little too slow:


Links, Links and More "I'm Going to Hack You" Links

This page has a strong cybersecurity influence, but you can't deny that there are a ton of relevant links, and they seem to get more and more useful the further you go down the page:

https://github.com/jaredthecoder/awesome-vehicle-security


If anyone else has any links that look particularly promising (be it hardware, software, arduino, raspberry pi, windows, linux, or something entirely different) please share! ?

 

[SmartStopStart.com]

Since you're here, there is one thing I've been curious about (if it's not an intrusion). Is your product CAN based, or (after a delay) do you sense the "ESS active" LED, and then pulse a trigger on the ESS button if needed to alter it's post-ignition status?

Based on what I understand so far, it seems as if it can be done both ways. But since your product covers more than one manufacturer, I'm assuming you too took the more straightforward electrical solution to solve the problem?

In any case, if you (or anyone else) find something in our efforts that you want to use, feel free to take it and run with it. There's no commercial restrictions attached to our effort, but we do ask everyone to share as well they're able.

Come to think of it... if you've got some skills or connections to make semi-rugged automotive products, I know that there are a number of us (and there will be more) who are itching for "productionized" hardware (either for Raspberry Pi or Arduino) that we can load our code onto and turn into products for everyday owners.

Things are growing in every direction, but hardware is one of the big unsolved problems that seems common to most people and will continue to be of importance going forward.

SmartStopStart for Jeep is totally CAN based. I was the first out there with ESS override for Jeeps in 2016. The ESS override switch and associated LED are an integral part of a CANbus switch module, so there were no wires to tap into without physically modifying a closed module.

Yes, I am experienced at electronic product hardware development, including reliable automotive grade products. I am happy to answer specific questions if I am able. I do most of my CANbus design with Microchip controllers that have integrated CAN capability.

 

[jmccorm]

Examples of read-only parameters in JScan which may offer more opportunities to experimenters.

I've included screenshots from a number of Body Controller pages on JScan. Each of these items serves it's own purpose. Some aren't active on this vehicle. Some may be read-only because they're stored somewhere else. Some may be devices you can control. Some may be configuration switches that you can flip you make the vehicle do or not do certain things. Some may require a number of different switches to work (like I'm wondering might be the case with getting paddle shifters to work).

A warning: if you're making changes via the CAN bus, then what you're doing should be considered high-risk, high-reward. If you go down the path of writing to ANY of these, at least make sure you read what their values were before you changed them. And keep a record of what you change.

Going through these items, I see one that interests me. That would be Steering Wheel Temperature (in Celcius). If I read it on my vehicle and it turns out to be the real-deal, then this might be a good candidate for another auto-HVAC function that automatically turns off the steering wheel heater once it reaches 120F (or something).

There's another that says "auto wipers". Maybe the Wrangler has a moisture sensor and everything it needs to enable that feature. Maybe it doesn't. Or maybe it's referring to the feature where it automatically turns on your headlights if you're using your wipers. None of this is documented, so you'd have to figure it out for yourself.

I didn't see a whole lot of other juicy things in here (although the "Fuel Saver Settings Menu" piqued my curiousity). But I thought I'd include a few more pictures just to give you all more of an idea of what's out there.

In all honesty, I don't consider any of this the really good stuff. It's just a random batch from a list of images I saved a few weeks ago. The real discoveries are out there just waiting to be made.

 

[jmccorm]

Going through these items, I see one that interests me. That would be Steering Wheel Temperature (in Celcius). If I read it on my vehicle and it turns out to be the real-deal, then this might be a good candidate for another auto-HVAC function that automatically turns off the steering wheel heater once it reaches 120F (or something).

Too funny! I really didn't expect anything, but I went out to the vehicle just now and tried it. Sure enough, it reports the current temperature of the steering wheel, in increments of 0.5 celcius. The perfect ingredient for a routine which automatically shuts off the steering wheel warmer when it becomes too hot!

EDIT: Why didn't Jeep think of that? Information overload?

 

[jmccorm]

This appears to be the CAN IHS connector:
https://www.mouser.com/ProductDetail/571-5-2138650-1

...and I'm hoping that these are the terminals:
https://www.mouser.com/ProductDetail/571-5-963715-6

I placed an order with Mouser. The items should be here tomorrow. Naturally, I'll let you know how it turns out. (Just to hedge my bets, I ordered another model of terminal in case the first one doesn't work out.) And thanks!

Line Number​	Mouser Part Number Customer Part Number Manufacturer Part Number Description​	Quantity Ordered​	Quantity Shipped​
1​	571-5-2138650-1 5-2138650-1 TE Connectivity Automotive Connectors US HTS:8536694040 ECCN:EAR99 COO:US​	10​	10​
2​	571-2-2138650-1 2-2138650-1 TE Connectivity Automotive Connectors US HTS:8538906000 ECCN:EAR99 COO:US	10​	10​
3​	571-5-963715-6 5-963715-6 TE Connectivity Automotive Connectors US HTS:8544200000 ECCN:EAR99 COO:DE	20​	20​
4​	571-1718760-2 1718760-2 TE Connectivity Automotive Connectors US HTS:8538908140 ECCN:EAR99 COO:DE	10​	10​

 

[Temperance]

Examples of read-only parameters in JScan which may offer more opportunities to experimenters.

I ordered a scanner to use with JScan which I should get tomorrow. I poked around in the sample data but unfortunately it does not have the sway bar module. Can you screen shot that module's pages for me?

 

[redracer]

Here is the sway bar pages... I also just did a can capture of cycling through the sway bar modes and locker modes.

 

[redracer]

I ordered a scanner to use with JScan which I should get tomorrow. I poked around in the sample data but unfortunately it does not have the sway bar module. Can you screen shot that module's pages for me?

also, looks like I found most of the can data around the sway bar and lockers...

0x26F 00 40 FF FF FF 7F 7F 7F Sway Bar Request - unlock / lock toggle - need to test this.
0x371 51 02 00 00 00 00 00 00 sway bar unlock in progress
0x371 70 01 00 00 00 00 00 00 sway bar unlocked
0x371 42 02 00 00 00 00 00 00 sway bar lock in progress
0x371 61 00 00 00 00 00 00 00 sway bar locked

0x2C2 14 B3 78 00 Locker unlocked
0x25D 23 FC 00 00 7F 7F 7F 7F Rear Locker Request
0x2C2 14 B3 77 00 Locker (s) locked , not sure if this designates rear only or any
0x25D 13 FC 00 00 7F 7F 7F 7F Front + Rear Locker Request
0x277 ??? this seems related to locker operation, but I can't correlate the changes yet.
0x25D 43 FC 00 00 7F 7F 7F 7F Unlock both request

I have not found the front locker status yet, or the correct front / rear locker status yet. need more seat time with cansniffer.

Sponsored