NefMoto

I'm trying to sniff the so-called Bosch service mode(bench) protocol, but without success. I tried using Arduino, Tactrix, Scanmatik etc. Nothing. I tried connecting CAN H and CAN L with a 120 ohm resistor and got the same story. I tried changing the speed from 10.4kbps to 500kbps also. If someone has already sniffed it, please give me a hint what I'm doing wrong. I'm guessing the speed is higher than 500kbps but not sure.

It is probably serial through CAN transceiver.

I'm not sure I understand you. I would say that I did not understand anything :)

I only briefly looked as it was not what I was interested in, but it appeared to be a serial protocol, not CAN when checked with a logic analyser. It just happens to go through a CAN transceiver, but that does not mean it must use CAN protocol. I might be wrong, but that is what I thought based on a quick look. Hope this helps.

Ok, thanks, now it's clear.

Bench mode implementation varies a lot across tools
Some use CAN, others use ASC over CAN0
And even the  most switch bauds once the initial loader/handshake is done

Thanks but that was already clear for me. ASC seems work faster.
If I'm right, the seed key algorithm depends on the processor model.

Try with osciloscope to get info it is can or serial.
If is can try on 667kbit/s - bosch use also non-standard speeds. Depending to seended CAN frame, after init can be switched to 500 or 1000kbit/s.