Pages: [1]
Author Topic: PQ25 steering column - stand alone work possibility. How to use in other car  (Read 1065 times)
.wide
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 2



Hello,

I want to use 6C1423510CE steering column in another car. I expect it needs CAN data to start work. Can some one help what data should be send to initiate work? Let say car has hardware to send CAN data.
I started some digging. For sure the easiest way is to find a car with this type column, switch off step by step CAN data and observe when power steering will not work. What about without a car? Can I find any DBC data for PQ25 platform or its universal stuff and (wide known) data from mk5 will be helpful as well?

Next step – firmware. I found information that changing firmware in steering racks/column are quite common. I found FRF file in web (FL-6R1909144AJ-3132.FRF) and just for fun now (but potential in future) want to check if its possible to change characteristic of steering. First problem is that VAGHelper can open only SGO file (if I’m right?), second is that this soft can’t edit characteristic. Only shows curves. I checked it with internal data for other cars. What I can do in this case?
Logged
prj
Hero Member
*****

Karma: +915/-428
Offline Offline

Posts: 5841



Next step – firmware. I found information that changing firmware in steering racks/column are quite common. I found FRF file in web (FL-6R1909144AJ-3132.FRF) and just for fun now (but potential in future) want to check if its possible to change characteristic of steering. First problem is that VAGHelper can open only SGO file (if I’m right?), second is that this soft can’t edit characteristic. Only shows curves. I checked it with internal data for other cars. What I can do in this case?
Start working on the control unit to obtain a full memory dump.
The data in the FRF is encrypted. The encryption algorithm is specific to each control unit.
Furthermore, usually automotive controllers have the data in them signed.
So you will need a working exploit to get unsigned data into the control unit.
After that you need to either manage to buy OEM data or you need to reverse the algorithms in it to understand how it works.

So you see, the cost of this is somewhere between 6 and 7 digits of $ currency.
You're not going to do it, if you need to ask.

As for running the rack in a different car - the method you described can be applied.
Maybe it'll even provide power assist without any CAN whatsoever, just not variable, only way to find out is test.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
.wide
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 2



Start working on the control unit to obtain a full memory dump.
The data in the FRF is encrypted. The encryption algorithm is specific to each control unit.
Furthermore, usually automotive controllers have the data in them signed.
So you will need a working exploit to get unsigned data into the control unit.
After that you need to either manage to buy OEM data or you need to reverse the algorithms in it to understand how it works.

So you see, the cost of this is somewhere between 6 and 7 digits of $ currency.
You're not going to do it, if you need to ask.
So it will be not (look that easy) like in this blog?
https://icanhack.nl/blog/vw-part1/
I expected that it would be possible to remove part of the code responsible for communication with the vehicle or change the CAN addresses so that they receive those sent by me.
Logged
prj
Hero Member
*****

Karma: +915/-428
Offline Offline

Posts: 5841



So it will be not (look that easy) like in this blog?
https://icanhack.nl/blog/vw-part1/
I expected that it would be possible to remove part of the code responsible for communication with the vehicle or change the CAN addresses so that they receive those sent by me.

You have a UDS controller, not TP2.0.
Yes the first entry point is always exploring the diagnostics interface, maybe something is left wide open (but newer controllers are a lot more locked down than stuff from 2008).

You're talking about a lot of stuff here.
What are your qualifications? Are you intimately familiar with reversing and able to read assembler?
If so, then if you find a way into the controller, then you will be able to do what you want to do given enough time.

If not, then you won't do it in even 10 years.
Either way, no point to take this any further. Start by obtaining a raw dump of the controller. Whether by probing the diags interface or by a physical access method (if either are present).
Logged

PM's will not be answered, so don't even try.
Log your car properly.
elias
Full Member
***

Karma: +17/-3
Offline Offline

Posts: 59



You should have started with researching first before even considering trying it yourself. Apparently, there is a project, which is doing exactly what you are trying to achieve and it seems
that most of the work was already done:
https://wiki.retropilot.org/index/vehicles/volkswagen-pq25-platform-retrofits/electrical-platforms-tl-dr

Contact this people, i assume its your best bet.
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.016 seconds with 16 queries. (Pretty URLs adds 0s, 0q)