NefMoto

Technical => Reverse Engineering => Topic started by: Tb205gti on December 08, 2013, 12:24:45 PM



Title: CanBus "hacking"
Post by: Tb205gti on December 08, 2013, 12:24:45 PM
I need to have one thing clarified.. :)

In my car I have a display that used canbus to communicate, and I have some steering wheel buttons that communicate on the canbus network.
Now I also have CanBus in my ODB plug, it it possible to sniff the canbus messages sent by the steering wheel buttons using a canbus sniffer on the OBD plug?
Also can I sniff the messages sent to the display this way? or do I have to hook onto the connector for the buttons/display?

I'm removing the display in favor of an 7" android tablet, but I'd like to still be able to present the data the display used to - on the tablet.


Title: Re: CanBus "hacking"
Post by: dream3R on December 09, 2013, 02:50:34 AM
Yes but you'll most likely need to write your own code.

Also your car may have more than one canbus, and you'll need to know the spcs of them, speed, width and maybe bitiming.

Start by getting the kit, depending on your needs.  I went for a microcontroller setup, so it could be left connected, but you may use cables like the Lawicel CANUSB.  I stayed away from ELM.

Originally I wrote basic console code to capture traffic and log it to CSV, I them imported the data in-to SQL and parsed it using stored procedures.  This worked but was a bit long winded.  I then moved on-to a program called canhacker which I found was supported in Sardine-Can (CANUSB branch on github) and the arduino hardware I was using.  This really helped speed up the process.

Once you have said commands from the steering wheel module you'll need to write a custom application to listen for the commands and act on them.

The android will be more difficult but possible.  A bluetooth ELM adapter and some Java maybe, sorry I can't really help there.

If you can program it's a three month spare time project if you know nothing about CANBUS, if you can't program then it will be impossible.





Title: Re: CanBus "hacking"
Post by: Tb205gti on December 09, 2013, 01:02:18 PM
Yes but you'll most likely need to write your own code.

No worries, I'm fluent in C, C++ C#, Java, ML, F# and a few others :)
Only thing I'm not that fluent in is assembler..

Also your car may have more than one canbus, and you'll need to know the spcs of them, speed, width and maybe bitiming.

Ahh that might be the biggest trick then. Now where do I get that info from? The car is an Opel Insignia - it's more or less the same as the Buick Regal, so maybe it shares the same configuration as some GM vehicles?

Start by getting the kit, depending on your needs.  I went for a microcontroller setup, so it could be left connected, but you may use cables like the Lawicel CANUSB.  I stayed away from ELM.

I have an elm327 BT adapter, but I'm unsure if I can programm it directly, or if it just defines some "std. functions".

I have a few Arduinos laying around and some Netduino's..


Originally I wrote basic console code to capture traffic and log it to CSV, I them imported the data in-to SQL and parsed it using stored procedures.  This worked but was a bit long winded.

:) Yes the SQl bit is probably a bit overkill - but you need to use the tools you're familiar with I suppose. Was your script a bash script? or what do you mean by "console" ?

If only I can get data in CSV format I can always filter the unneeded packets away I guess.


I then moved on-to a program called canhacker which I found was supported in Sardine-Can (CANUSB branch on github) and the arduino hardware I was using.

Ahh Arduino.. What shiled did you use? The Sparkfun CanBus shield? What is the quality of it? Do you have any sketches to share?

  This really helped speed up the process.

Ahh yes. :) gatehring data and sorting in it is the first step.

Once you have said commands from the steering wheel module you'll need to write a custom application to listen for the commands and act on them.

The android will be more difficult but possible.  A bluetooth ELM adapter and some Java maybe, sorry I can't really help there.

Well I'm allready using an arduino to control the charging of the table once the car is turned off. (If power on the tablet goes below 20%, the arduino, asks the tablet to switch to HDMI output, then it starts charging it untill power has reached 40% - then it asks the tablet to disable HDMI and switch to interla panel. This is done to prevent the tablet screen from turning on while charging.
So I have the Arduino as the CANBus receiver, I just need to know what to listen for - then send "a command" to the tablet where an Android application uses the data to show on the screen.
I'd rather keep all CANBus on the arduino, and just use my own protocol between the arduino and the tablet.


If you can program it's a three month spare time project if you know nothing about CANBUS, if you can't program then it will be impossible.

I'm a senior developer, so I suppose I know how to program, and I have been working with embedded systems before - including some canbus programming - but that is 5+ years ago and I have forgotten all of it by now. :)


Title: Re: CanBus "hacking"
Post by: dream3R on December 09, 2013, 01:16:23 PM
Wow, quite a reply, I'll do my best :)



No worries, I'm fluent in C, C++ C#, Java, ML, F# and a few others :)
Only thing I'm not that fluent in is assembler..


Good!  It will be easy then.  I had to relearn C after 10+ years, pointers blew my brain.

Quote
Ahh that might be the biggest trick then. Now where do I get that info from? The car is an Opel Insignia - it's more or less the same as the Buick Regal, so maybe it shares the same configuration as some GM vehicles?

I have an elm327 BT adapter, but I'm unsure if I can programm it directly, or if it just defines some "std. functions".

I have a few Arduinos laying around and some Netduino's..


Google/Bitbashing?  Read up on can first, GM might use their own single wire version, I recall something about that.

Quote

:) Yes the SQl bit is probably a bit overkill - but you need to use the tools you're familiar with I suppose. Was your script a bash script? or what do you mean by "console" ?


It just outputted to a serial terminal, I used putty and saved the output to csv then pased it in SQL, much quicker than Excel..

Quote

Ahh Arduino.. What shiled did you use? The Sparkfun CanBus shield? What is the quality of it? Do you have any sketches to share?


Yes I've got that one in my car now.  Quality is good.  I'll attach a GM sketch that I stashed, not written by me.

Quote
Ahh yes. :) gatehring data and sorting in it is the first step.

Well I'm allready using an arduino to control the charging of the table once the car is turned off. (If power on the tablet goes below 20%, the arduino, asks the tablet to switch to HDMI output, then it starts charging it untill power has reached 40% - then it asks the tablet to disable HDMI and switch to interla panel. This is done to prevent the tablet screen from turning on while charging.
So I have the Arduino as the CANBus receiver, I just need to know what to listen for - then send "a command" to the tablet where an Android application uses the data to show on the screen.
I'd rather keep all CANBus on the arduino, and just use my own protocol between the arduino and the tablet.


I'm a senior developer, so I suppose I know how to program, and I have been working with embedded systems before - including some canbus programming - but that is 5+ years ago and I have forgotten all of it by now. :)

Sounds like you are 90% there.  The can shield plus sardinecan + canhacker will get you what you need, assuming the canbus is compatible.


Title: Re: CanBus "hacking"
Post by: aef on December 10, 2013, 12:03:50 AM
http://nefariousmotorsports.com/forum/index.php?topic=4401.0title=

check out the pdf file and the content.zip on theyr page