JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[cmartin]

Hi,

I got a CAN HAT with Rasberry Pi. Seems like it is handling well CAN data when I send CAN data from can0 to can1.

I know that this is mostly Jeep Wrangler, but I am testing with a Jeep Cherokee 2023.

Since I am starting, I thought using ODB II port to read either CAN C or CAN IHS; It would a good thing to try.

I used a voltmeter and read pin 6 and pin 14 for (CAN C), I get in both cases about 2.5V. I would have expected a reading of ~2.6V on High and ~2.3B on Low. Is this normal ?

Also, tried to read CAN data for both C and IHS, but I got nothing coming in on the Ras PI. I made sure the speed was 125 for ISH and 50 for standard.

Any suggestions as to what I could be doing wrong ?
Any other places I can try to read the CAN data beside the ODB II port? ... Remenber, this is Cherokee 2023.

I worked it out. Speed on IHS was the problem

Sponsored

 

[dstevens]

0x1CE byte 0 is key fob signal strength. Seems to be highest near the driver's door handle. This graph is from exiting the vehicle, walking down past the tailgate and then getting back in.

On the 2024 0x2F3 does not work like the previous model years. Have not tracked down a driver's seat belt signal yet but it might be 0x1D0 byte 2.

0x9B seems to have flags for the driver's door being opened, but it could be some derived behavior from opening the door.

 

[dstevens]

Away from Jeep for several weeks now, so can only look at logs. I have some basic functionality working, now I need to refine things. I found that when monitoring the ESS and TC buttons you can tell when a button is pressed but not know what the status of the system is (enabled or disabled).

I wrote a filter for the logs when weeds out the packets which do not change during the log including the packets using a counter and checksum. This dropped the number of unique packet ids from 350 down to 50. SavvyCAN has a feature which should do this but is live only and I've never had much success with it.

Then looking over old logs I immediately found for ESS there is a status bit in 0x137 which I had missed. And another in 0x340. So that should make the ESS and TC memory between driving cycles much better.

 

[dstevens]

Tx Address​	Rx Address​	Bus​	Module​
0x47E​	0x47F​	?​	Security Gateway​
0x620​	0x504​	CAN-IHS​	Body Control Module​
0x740​	0x4C0​	?​	RF hub​
0x742​	0x4C2​	?​	Instrument panel​
0x743​	0x4C3​	?​	Tire Pressure​
0x744​	0x4C4​	?​	Airbag​
0x747​	0x4C7​	CAN-C​	ABS​
0x749​	0x4C9​	?​	Electronic Shifter​
0x74A​	0x4CA​	CAN-IHS​	Sway bar​
0x74B​	0x4CB​	CAN-C​	Drive train FDC​
0x753​	0x4D3​	?​	Adaptive Cruise Control​
0x75A​	0x4DA​	?​	EPS​
0x762​	0x4E2​	?​	Park Assist​
0x763​	0x4E3​	?​	Steering Column​
0x783​	0x503​	?​	HVAC​
0x784​	0x504​	?​	Driver Door (?)​
0x785​	0x505​	?​	Passenger Door (?)​
0x792​	0x512​	CAN-IHS​	Unknown​
0x794​	0x514​	?​	Central Vision Processing​
0x7BC​	0x53C​	?​	Integrated Center Stack​
0x7BE​	0x53E​	?​	Amplifier​
0x7BF​	0x53F​	CAN-IHS​	Radio​
0x7E0​	0x7E8​	CAN-C​	PCM​
0x7E1​	0x7E9​	?​	TCM​
0x7E2​	0x7EA​	?​	Hybrid Control Processor​
0x7E7​	0x7EF​	?​	Battery Pack Control Module​

 

[dstevens]

Tx Address​	Rx Address​	Bus​	Module​
0x47E​	0x47F​	CAN-C​	Security Gateway​
0x620​	0x504​	CAN-C​	Body Control Module​
0x740​	0x4C0​	CAN-C​	RF hub​
0x742​	0x4C2​	CAN-C​	Instrument panel​
0x743​	0x4C3​	CAN-C​	Tire Pressure​
0x744​	0x4C4​	CAN-C​	Airbags​
0x747​	0x4C7​	CAN-C​	ABS​
0x749​	0x4C9​	CAN-C​	Electronic Shifter​
0x74A​	0x4CA​	CAN-IHS​	Sway bar​
0x74B​	0x4CB​	CAN-C​	Drive train FDC​
0x751​	0x4D1​	CAN-C​	Driver Presence​
0x753​	0x4D3​	CAN-C​	Adaptive Cruise Control​
0x75A​	0x4DA​	CAN-C​	EPS​
0x762​	0x4E2​	CAN-C​	Park Assist​
0x763​	0x4E3​	CAN-C​	Steering Column​
0x783​	0x503​	CAN-IHS​	HVAC​
0x784​	0x504​	?​	Driver Door (?)​
0x785​	0x505​	?​	Passenger Door (?)​
0x791​	0x511​	CAN-IHS​	Left blind spot​
0x792​	0x512​	CAN-IHS​	Unknown​
0x794​	0x514​	CAN-IHS​	Central Vision Processing​
0x799​	0x519​	CAN-IHS​	Right blind spot​
0x7AB​	0x52A​	CAN-C​	Assistance / telematics​
0x7BC​	0x53C​	CAN-C​	Integrated Center Stack​
0x7BE​	0x53E​	CAN-IHS​	Amplifier​
0x7BF​	0x53F​	CAN-IHS​	Radio​
0x7E0​	0x7E8​	CAN-C​	PCM​
0x7E1​	0x7E9​	CAN-C​	TCM​
0x7E2​	0x7EA​	CAN-C​	Hybrid Control Processor​
0x7E7​	0x7EF​	?​	Battery Pack Control Module​

Updated 3/26/2024

Engine Start Stop

Button
Two packets show the ESS button press.
0x297 CAN-C byte 6 = 0x24 when button pressed
0x2D3 CAN-IHC byte 0 = 0x24 when button pressed
Note both packets are nominally 1 Hz but will increase the rate when buttons are pressed.

Status
Two packets show the ESS status
0x137 CAN-C byte 6 bit 0 set when ESS disabled
0x340 CAN-IHC byte 5 bit 3 set when ESS disabled
0x137 is 10 Hz and 0x340 is 1 Hz

Traction Control

Button
0x2D3 CAN-IHS byte 7 bit 0 set when TC button pressed
0x2D3 is 1 Hz but will increase when the button is pressed

Status
0xDD CAN-C byte 6 bit 6 set when TC disabled
0xDD is 20 Hz

Autopark

Driver Door
Two packets show the driver door status.
0x9B CAN-C byte 3 bit 3 = 1 when driver door closed
0x2FA CAN-IHC byte 0 bit 0 = 1 when driver door opened
0x9B 50 Hz and 0x2FA 2 Hz.

Driver Seat Belt
0x1D0 CAN-C byte 2 bit 0 = 1 when driver seat belt buckled
0x1D0 1 Hz but will increase in frequency when something changes.

ESS/TC Memory
To retain ESS & TC between driving cycles (simplified somewhat)

• Continuously monitor the ESS and TC status using 0x137 and 0xDD
• After the engine has been on for 2 seconds, if the ESS or TC status is different from when the engine was switched off, wait for the next 0x2D3 (console button) packet.
• When the 0x2D3 packet arrives, alter and re-transmit with a ESS or TC button press if necessary.
• Save the ESS/TC status when the engine is switched off

This first attempt works ok for ESS but TC will self-enable when the transfer case is shifted. Probably the logic could be more complex where the TC switches back on in 2 hi at a certain speed.

 

[us3r1d]

I've only read the first 3 pages so far, but this thread is _amazing_.

My current goal is to connect a Raspberry Pi via the OBD port (I don't want to pull apart my dash yet) in order to stream telemetry to my own server and to replicate some features that will go away when FCA finally processes my privacy disconnect request on the cell modem. GPS coordinates are where I'm trying to start with that; kind of a homebrew version of SirusXM Guardian.

I'll finish reading the thread before I start asking questions.

 

[us3r1d]

I'll finish reading the thread before I start asking questions.

Finally had time to finish reading that; that's great.

(Though I don't trust _anything_ that comes out of ChatGPT or its ilk, so that's a problem with the most recent stuff.)

It also may not help me a lot, turns out, on account of I have a 2024 and so I guess I have the new Atlantis system instead of the PowerNet you've been working with.

I do have some ideas on securing your Pi installs while maintaining a wifi connection. I'll get that written when I'm on the computer; it's too much to type on my phone.

 

[us3r1d]

I do have some ideas on securing your Pi installs while maintaining a wifi connection. I'll get that written when I'm on the computer; it's too much to type on my phone.

So, this is what I do on my (rooted) android phone to allow me to ssh into it without having any externally-facing ports open; it also lets me ssh into it no matter what network it's on, even behind a NAT. It's what I intend to do on the Pi when I get it running in my Wrangler.

First, install "autossh"; there is an apt package for raspbian.

Next, switch the listener address in the sshd config file to either 127.0.0.1 or (if you also want to be able to plug into the Jeep's Pi on ethernet) to whatever non-routable IP you have assigned to eth0.

Then, you have to have a server running somewhere the Pi can reach. One that's only on your local wifi is fine, but a publicly-facing server will let this work from anywhere if you put a cell modem on the Pi.

I use this on my phone to manage the connection to the server:

AUTOS=`ps ax | grep autossh | grep -v grep | wc -l`

if [ ! 0 -lt $AUTOS ]
then
  autossh -f -N -M 0 -o "ServerAliveInterval 10" -o "ServerAliveCountMax 3" \
    -R 0.0.0.0:8022:0.0.0.0:8022 {server user}@{server}
fi

(You can call that from cron every minute to make sure it comes back if autossh dies.)

That will open a session on the server that carries a tunnel back to the Pi.

Then, from the server you can just run:

ssh -p 8022 {pi user}@localhost

That gives you a command shell on the Pi that can be accessed over the local wifi (or even the Internet) with no open listener ports.

Hope that's of use.

 

[us3r1d]

It also may not help me a lot, turns out, on account of I have a 2024 and so I guess I have the new Atlantis system instead of the PowerNet you've been working with.

I looked behind the glove box today, and it looks like the 2024 4xe has similar blocks of white and green canbus connectors to what was described earlier in this thread.

So if this is a new system, it's not _that_ different from the old one.

Sponsored