Pages: [1]
Author Topic: Custom can-bus values  (Read 13437 times)
andrew
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 10


« on: March 03, 2016, 11:14:20 AM »

Hello, does somebody knows or can point to way to enable/modify/or put ECU values into its can-messages ?
.. like Boost (vag can-id 0x555) which is available not in all turbo MED9x

thanks
« Last Edit: March 03, 2016, 12:59:38 PM by andrew » Logged
fknbrkn
Hero Member
*****

Karma: +176/-18
Offline Offline

Posts: 1401


mk4 1.8T AUM


« Reply #1 on: March 03, 2016, 12:38:03 PM »

yes, they are stored in ram locations
so any tweaks available here
Logged
dream3R
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 1194


« Reply #2 on: May 16, 2016, 05:46:12 PM »

Hello, does somebody knows or can point to way to enable/modify/or put ECU values into its can-messages ?
.. like Boost (vag can-id 0x555) which is available not in all turbo MED9x

thanks

There is a function read the FR it's called embassies iirc
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
nihalot
Full Member
***

Karma: +40/-3
Offline Offline

Posts: 116


« Reply #3 on: July 13, 2016, 01:53:53 AM »

hey
did you have any success in adding boost pressure 0x555 to canbus??

regards
Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU
jochen_145
Full Member
***

Karma: +9/-4
Offline Offline

Posts: 177


« Reply #4 on: September 12, 2017, 05:55:27 AM »

Same question again:

I like to activate Motor_07 and Motor_05 message on CAN-bus of a MK1 Audi TT with ME7.5

Taking a look into FR, the activation should be done by CW_CAN_S, witch should be a 16bit binery value.
A2L tells differend, CW-CAN_S are 4 times awailible but only in 8bit size..
But all CW_CAN_S values are set to 0xff, so at the end, all CAN-values are enabled.
But why are they not on CAN-bus ?

Quote
yes, they are stored in ram Locations so any tweaks available here
So I Need to tweak E2 to activiate Motor_05 and Motor_07 too ?

Could this be done by coding ?

Anyone ever worked on this and can give advice ?

BR

Logged
fknbrkn
Hero Member
*****

Karma: +176/-18
Offline Offline

Posts: 1401


mk4 1.8T AUM


« Reply #5 on: September 12, 2017, 06:01:20 AM »

there is no way to add this by coding
Logged
jochen_145
Full Member
***

Karma: +9/-4
Offline Offline

Posts: 177


« Reply #6 on: September 12, 2017, 08:30:16 AM »

Sad

any other idea to active the Motor_07 message ?

In FR, there seems also a value SY_CAN_Config responcible for different kind of CAN Messages. But I cannot find SY_CAN_Config in A2L ..

No more idea yet, CW_CAN_S should be the right value, but this seems not to work, or got the wrong address in A2L
Logged
nubcake
Sr. Member
****

Karma: +53/-4
Offline Offline

Posts: 401


« Reply #7 on: September 19, 2017, 02:52:16 AM »

Sad

any other idea to active the Motor_07 message ?

In FR, there seems also a value SY_CAN_Config responcible for different kind of CAN Messages. But I cannot find SY_CAN_Config in A2L ..

No more idea yet, CW_CAN_S should be the right value, but this seems not to work, or got the wrong address in A2L

SY_CAN_Config is a compile-time option, can't be changed in a "ready" binary.
CW_CAN_S won't do that either. You have to research the format of said CAN frame (FR should have this info), then disassemble the binary to find where CAN communication is, then manually add the code for filling out and sending said message. Not an easy task, but totally doable.
Logged
jochen_145
Full Member
***

Karma: +9/-4
Offline Offline

Posts: 177


« Reply #8 on: September 20, 2017, 02:39:13 AM »

Quote
SY_CAN_Config is a compile-time option, can't be changed in a "ready" binary.

Thanks, this is the info I was missing and I donĀ“t want do read  Sad

An new compilation is not a task of mine, so no Motor_07 message availibe on my ECU..

Good to know for someone else, who has the same idea and  is looking for that info
Logged
fknbrkn
Hero Member
*****

Karma: +176/-18
Offline Offline

Posts: 1401


mk4 1.8T AUM


« Reply #9 on: September 27, 2017, 10:04:52 AM »

there is 2 or 3 unused bytes in ecu outgoing can-bus messages
any value can be added here if you good with ida things Smiley
Logged
jochen_145
Full Member
***

Karma: +9/-4
Offline Offline

Posts: 177


« Reply #10 on: September 30, 2017, 01:59:41 AM »

I never worked on this yet..

IDA-things normaly needs new compilation and if you need to re-compile, you can also active Motor_07 ID AFAIK.
As long as it needs to have a new complilation for that function, I am out so fare Sad


btw and a bit OT.:
I know for other SW, if you re-compile, you will get new addresses and a new *.A2L.
If someone chance the ME7 Software with some additional code, I expact the same, and original A2L or Damos wil not work..
Am I true with this ?
Logged
prj
Hero Member
*****

Karma: +903/-420
Offline Offline

Posts: 5789


« Reply #11 on: September 30, 2017, 04:39:49 AM »

I never worked on this yet..

IDA-things normaly needs new compilation and if you need to re-compile, you can also active Motor_07 ID AFAIK.
As long as it needs to have a new complilation for that function, I am out so fare Sad


btw and a bit OT.:
I know for other SW, if you re-compile, you will get new addresses and a new *.A2L.
If someone chance the ME7 Software with some additional code, I expact the same, and original A2L or Damos wil not work..
Am I true with this ?

You either:
a) Have source code for ME7, which I doubt
or
b) Couldn't hack your way out of a paper bag and need to do some serious reading.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
jochen_145
Full Member
***

Karma: +9/-4
Offline Offline

Posts: 177


« Reply #12 on: September 30, 2017, 07:19:52 AM »

You either:

Ehmm yes, that is what I worte Sad

Quote
I know for other SW, if you re-compile, you will get new addresses and a new *.A2L.
If someone chance the ME7 Software with some additional code, I expact the same, and original A2L or Damos wil not work..
can confirm to this ?
Logged
fknbrkn
Hero Member
*****

Karma: +176/-18
Offline Offline

Posts: 1401


mk4 1.8T AUM


« Reply #13 on: September 30, 2017, 10:08:59 AM »

ida is not compiler but dissasembler

and again you cant compile whole binary if you havent sources for that

with ida you can understand how the ecu handles can-bus data, write some code in asm, compile it and change/add it in your file thru hex editor
Logged
jochen_145
Full Member
***

Karma: +9/-4
Offline Offline

Posts: 177


« Reply #14 on: October 01, 2017, 09:36:06 AM »

Thanks again for your explanation  Smiley

Ok, if I unterstand you right, you just wirte your own code, compile and add the code in hex via editor to the original code. (so, you A2L will not change in this case, good to know !)

But I also need to twique the original code, to jump into the new code and jump back to original, witch will be also done in hex-editor, base on the research of IDA?!

At the end,
if you allready have your own code or twique the original code to use unused space in e.g. Motor_06, Byte 6 (0x488), I can take over this hex-code via hex-editor in my APP software ?
I think CAN-haendler will be the same in all software...
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.023 seconds with 17 queries. (Pretty URLs adds 0s, 0q)