Pages: [1]
Author Topic: Sniffing "Bench mode"  (Read 7399 times)
terminator
Sr. Member
****

Karma: +15/-4
Offline Offline

Posts: 425


« on: September 22, 2022, 08:42:51 AM »

I'm trying to sniff the so-called Bosch service mode(bench) protocol, but without success. I tried using Arduino, Tactrix, Scanmatik etc. Nothing. I tried connecting CAN H and CAN L with a 120 ohm resistor and got the same story. I tried changing the speed from 10.4kbps to 500kbps also. If someone has already sniffed it, please give me a hint what I'm doing wrong. I'm guessing the speed is higher than 500kbps but not sure.
Logged
jcsbanks
Full Member
***

Karma: +19/-3
Offline Offline

Posts: 146


« Reply #1 on: September 22, 2022, 08:48:03 AM »

It is probably serial through CAN transceiver.
Logged
terminator
Sr. Member
****

Karma: +15/-4
Offline Offline

Posts: 425


« Reply #2 on: September 22, 2022, 09:05:20 AM »

I'm not sure I understand you. I would say that I did not understand anything Smiley
Logged
jcsbanks
Full Member
***

Karma: +19/-3
Offline Offline

Posts: 146


« Reply #3 on: September 22, 2022, 01:12:05 PM »

I only briefly looked as it was not what I was interested in, but it appeared to be a serial protocol, not CAN when checked with a logic analyser. It just happens to go through a CAN transceiver, but that does not mean it must use CAN protocol. I might be wrong, but that is what I thought based on a quick look. Hope this helps.
Logged
terminator
Sr. Member
****

Karma: +15/-4
Offline Offline

Posts: 425


« Reply #4 on: September 22, 2022, 02:36:13 PM »

Ok, thanks, now it's clear.
Logged
nihalot
Full Member
***

Karma: +41/-3
Offline Offline

Posts: 117


« Reply #5 on: April 20, 2023, 11:18:18 AM »

Bench mode implementation varies a lot across tools
Some use CAN, others use ASC over CAN0
And even the  most switch bauds once the initial loader/handshake is done
Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MG1/MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU
terminator
Sr. Member
****

Karma: +15/-4
Offline Offline

Posts: 425


« Reply #6 on: April 26, 2023, 04:50:08 AM »

Thanks but that was already clear for me. ASC seems work faster.
If I'm right, the seed key algorithm depends on the processor model.
Logged
K2d33
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 7


« Reply #7 on: April 09, 2024, 12:52:55 AM »

Try with osciloscope to get info it is can or serial.
If is can try on 667kbit/s - bosch use also non-standard speeds. Depending to seended CAN frame, after init can be switched to 500 or 1000kbit/s.
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.026 seconds with 16 queries. (Pretty URLs adds 0s, 0q)