GM Lan Single Wire CAN Bus Sniffing

[jezzab]

K.. Looking at what you posted - I think I clipped the DIC stuff only here:

*Head: 1028A080 Length: 2 Message: 0 0
*Head: 1030C080 Length: 8 Message: 45 2 1 56 6F 6C 75 6D
*Head: 1030C080 Length: 8 Message: 44 2 65 20 31 30 4 0
*Head: 1030A080 Length: 6 Message: 0 4 48 C0 0 3
*Head: 1030A080 Length: 6 Message: 0 4 49 40 0 3
*Head: 10306060 Length: 4 Message: 0 97 0 1
*Head: 1030C080 Length: 8 Message: 44 2 65 20 31 31 4 0
*Head: 10306060 Length: 4 Message: 0 91 0 7
*Head: 1030C080 Length: 8 Message: 44 2 65 20 31 31 4 0
*Head: 1030A080 Length: 6 Message: 0 4 48 40 0 3
*Head: 1030A080 Length: 6 Message: 0 4 49 0 0 3
*Head: 10306060 Length: 4 Message: 0 95 0 1
*Head: 10306060 Length: 4 Message: 0 94 0 1
*Head: 1030C080 Length: 8 Message: 45 2 1 56 6F 6C 75 6D
*Head: 1030A080 Length: 6 Message: 0 4 49 0 0 3
*Head: 1030C080 Length: 8 Message: 44 2 75 78 4 0 0 0
*Head: 1028A080 Length: 2 Message: 0 0
*Head: 1028A080 Length: 2 Message: 0 0
*Head: 1028A080 Length: 2 Message: 0 0

Also - it looks like your scanner is dropping packets?

http://gmlanhack.blogspot.com/2010/12/untested-clarification-of-pontiac-g8.html

I think your newer DIC needs all 3 arbIDs - My old (2008 Pontiac) one didn't.

Arbitration ID 0x183 : Arb_Text_Display_Status
Packet Size: 4 bytes
29bit CAN header
header: 0x10306060

Arbitration ID 0x185 : Arb_Text_Req_Set_Disp_Parameters
Packet Size: 6 bytes
29bit CAN header
header: 0x1030A080

Arbitration ID 0x186: Arb_Text_Req_Set_Display_Text
Packet Size: 8 bytes.
29bit CAN header
header: 0x1030C080

There is another way maybe but I'd like to PM you on that. PM me because I don't have PM yet here..

TMK

Yeah I reckon its dropping a few packets. I dont know if the Arduino to Serial is fast enough.

I had tried sending the 0x10306060 before the
0x1030C080 but i hadnt tried sending 0x1030A080

So ill try all 3 tonight.

Thanks for the help mate

[TazzI]

Anychance someone could explain what is the "header"?

Is the header like the location is it coming from, and the message the command (instructions) it sends?

[jezzab]

Can I send the 4 byte packet with the 29bit function by padding the remainder with 0x00 to fill the 8 bytes? Ive tried it with padding and its still doesnt work so maybe the padding is a no no.

Code: Select all

        can_send_29bit_message(0x10306060,0x00,0x97,0x00,0x01,0x00,0x00,0x00,0x00);
        can_send_29bit_message(0x1030A080,0x00,0x04,0x48,0x40,0x00,0x03,0x00,0x00);
        can_send_29bit_message(0x1028A080,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00);
        can_send_29bit_message(0x1030C080,0x45,0x01,0x53,0x63,0x72,0x55,0x70,0x04);
        can_send_29bit_message(0x10306060,0x00,0x91,0x00,0x07,0x00,0x00,0x00,0x00);


[tmk]

Tazzi - A great explanation of GM LAN 29 bit packets here -
http://www.canbushack.com/blog/index.ph ... &tb=1&pb=1

Basically 3 bit priority + 13 bit function + 13 bit sender address.

As for the DIC send jezzab - try this?

can_send_29bit_message(0x10306060,0x00,0x92,0x00,0x01) - 4 Byte - sequence 1;
sleep(10us)
can_send_29bit_message(0x1030C080,0x45,0x01,0x53,0x63,0x72,0x55,0x70,0x04); - Dic text.
sleep(10us)
can_send_29bit_message(0x10306060,0x00,0x92,0x00,0x07) - 4 Byte - sequence 1;
sleep(10us)
can_send_29bit_message(0x1030A080,0x00,0x04,0x48,0xC0,0x00,0x03; - 6 Byte. The sequence should match 0x91 above.
sleep(10us)

Here is a cut paste from my blog - See the sequence numbers incrementing - I think thats the trick - that 3 bit sequence - like the DIC keeps a stack:

HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 92 00 01
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 34 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 92 00 07
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | C2 04 48 C0 00 03

HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 93 00 01
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 35 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 93 00 07
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | C2 04 49 00 00 03

HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 94 00 01
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 36 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 94 00 07

Need to send a num of bytes too to the CAN controller - it's part of the header and the DIC might ignore 0 padded.

We are close my friend - This weekend I'll fire up my arduino too..

TMK

[jezzab]

That's the problem the function requires all of the fields to be filled. If its short it won't compile. I'll try your suggestions with the end padded out and if that doesn't work I'll have another crack and trying to make a new function

EDIT: I tried the code with padding very very quickly and it does do something, just not what we want lol. I set when you press the scroll wheel to send the commands. It flickers the up and down arrow if you press it repetitively and sometimes goes from "Rear Aux" to "earAux" with the down arrow displayed.

Oh well, atleast something is happening lol. We're close, real close now

[ghodge]

tmk,

A couple of months ago I was logging some sniffing session hoping to catch any messages when the preset buttons on the radio are pressed. Other than seeing display information from the XM Radio box (i.e. radio station genre being sent) I was not successful. Have you had any luck seeing the actuation of those buttons on GMLAN?

george

[jezzab]

tmk,

A couple of months ago I was logging some sniffing session hoping to catch any messages when the preset buttons on the radio are pressed. Other than seeing display information from the XM Radio box (i.e. radio station genre being sent) I was not successful. Have you had any luck seeing the actuation of those buttons on GMLAN?

george

I havent tried sniffing any other buttons bar the ones that have already been done in the program

[tmk]

George - I was able to see lock/unlock, all the steering wheel controls, detect the mode the radio was in.. I don't have XM in my 08.. Can't sniff what you don't have..

I probably could have done the HVAC stuff, but I had no need. I was able to decode a good amount of the status messages, like TPMS, RPM, speed, Air temp, gear, etc. I should type that up.

TK

[tmk]

Looking at this.. And some other logs - not sure the 10 30 60 60 needs to be sent.. I think the car/DIC/something sends it..

[ghodge]

Jezzab, I'm sure that with more people "sniffing", we'll uncover a lot.

Tmk, I haven't tried locking/unlocking yet but thanks for that link you provided to explain the 29 bit messages. In the comments section, someone with a 2006 Commodore was able to figure out how to control the chiming. After I get my BeagleBoard working with the car, I'll start playing with the chimes.