GM Lan Single Wire CAN Bus Sniffing

[jezzab]

Ok I quickly set it up so it will send the functions above (quick and dirty hack)

registerNav()
delay(30);
navon()

when I scroll the wheel control up when in REAR AUX

When I start the head unit I go to NAV and it tells me that "FULL MAP NAVIGATION NOT AVAILABLE"

If I go to AUX and then send my commands and then press the NAV button it appears to go into it and is blank (Doesnt display the NOT AVAILABLE message). The DIC does not change to NAV or anything though it just stays at Rear Aux. The audio I was sending through the read aux was still playing but I didnt send the navaudio() function.

If i go to the Options menu NAV AUDIO menu now appears.

While I was in the "NAV" screen and I scrolled the wheel to send the commands it would read "Please Wait..." every time I scrolled the wheel (sending the commands).

Guess I really need to send something into the RGB input to test it. I might try sending the composite video in AUX and seeing if when I enable NAV mode it blanks the display meaning the RGB input is working

The head unit it obviously liking something that im sending to it. Pretty keen now to get some more time to do some more testing! Oh and I think a mate has put me onto a cheap VGA converter to output the correct signal and size to the headunit

[jezzab]

Ok. Just went out and played a video on AUX, fired up the nav packets and went to the NAV button and the screen is blank! w00t! So i think its working but cant test without an RGB input.

A friend suggested one of these may work to convert my car PC VGA output to RGBS:

http://www.ebay.com/itm/VGA-RGBS-CGA-AV ... 0705997170

Ill buy one and give it a shot

[ZerOne]

Ok, I am going to go out on a limb here....

The Ford BA ICC (Colour LCD Radio thingie), looks like it ??? MAY ??? the same LCD screen, and possibly the same limitations
at the VE Colour LCD Screen....

This was ripped off from a Doco I wrote for the BA Falcon, a looooong time ago (2007)

Windows Video Settings and Information
The BA ICC Screen requires the following settings in order for it to successfully display an image
Horizontal Resolution 640 pixels
Vertical Resolution 480 pixels
Horizontal Synchronisation Frequency of 15.75Khz
Vertical Refresh rate of 60Hz

At present, the best method for obtaining these settings in windows is by using a program called vga2tv.exe
This program was written by Paulo Sergio Coelho, and makes playing around with the BA ICC a breeze.

At this point in time, members are currently working on a more practical Video Synchronisation Circuit, which will allow for better picture quality,
and allow the Ford BA VICC Video connector to work with a larger range of video cards.
For the moment, the following Video Cards have been tested, and have been found to work with the Ford Falcon BA Premium Sound System Video Display.
ArcadeVGA - Quite possibly the very BEST video card to be used for this application, as no specific software is required for it to operate with the BA ICC Screen.
ATI Radeon 9200
ATI Radeon 9700 Pro
SiS 300
NVidia TNT2

This info was ripped from Fordmods,
http://www.fordmods.com/documents.php?d=38

Now, I don't know HOW much of this is applicable to the VE screen.
Unfortunately I cannot test this one, as the VGA connector on my NAV unit has been screwed in soo tight, that the thumb screws are bent,
and will no longer turn. (I would need to cut the harness or something, to get the NAV unit out, and access the thumb screws...)

[ZerOne]

Also, the NAV sound should mute all the other head unit sounds when the NAV WHORE starts speaking, and then the volume returns
back to a normal level when the WHORE stops speaking....

So if you are kinda hearing a mute effect when you are triggering the NAV Audio, then this is definitely a good sign

Jezzab, do you need to Press the [NAV] button on the headunit to get the Blank screen, or can you do this another way ????
I am now wondering like tmk if the NAV fascias have the top right button mapped as NAV (Via the EEPROM), and Normal fascias map this button as a power button ????

The EEPROM on the fascia is quite large, and the only use for it that I can find at the moment is the 2 Byte Link IDs...
So I am thinking that there MUST be a setting in there to flip the fascia from Standard to NAV ?????

Pity we dont have a Non Nav Fascia EEPROM dump...
I have the spare fascia, with an EEPROM socket soldered on to it, so I can quickly upload and test new EEPROM data, without desoldering the EEPROM...

(Almost Home time for me... Next time you hear from me will be to post up some more SW Logs)....

[ZerOne]

And now for some more logs....

Header Filter : AT CF 00 2E 00 00
Mask Filter : AT CM 03 FF 00 00

Ignition Switch Off, Bus activated...
No Data...

Turn the Ignition Switch to Acc

Code: Select all

>at ma
10 2E 20 94 01 00
10 2E 40 94 03
10 2E 80 80 00 01
10 2E C0 85 04 00
10 2E 20 94 01 00
10 2E C0 85 04 00
10 2E 20 94 21 00
10 2E 20 94 20 00
10 2E 00 80 40 02 00
10 2E 80 80 14 01
10 2E 80 80 14 01


Note: 10 2E 00 80 40 02 00 came up the same time the Bluetooth discovered the Phone

Pressing the NAV button with the Ign switch in Acc

Code: Select all

>at ma
10 2E 00 80 40 02 00
10 2E 80 80 14 01
10 2E 00 80 40 02 07
10 2E 80 80 14 02


Turning the Mode Knob (The one opposite the volume control) anti clockwise

Code: Select all

10 2E 00 80 40 FA 07
10 2E 00 80 40 02 07


Turning the Mode Knob (The one opposite the volume control) clockwise

Code: Select all

10 2E 00 80 40 0A 07
10 2E 00 80 40 02 07


Pressing the Mode Knob

Code: Select all

10 2E 00 80 40 02 08
10 2E 00 80 40 02 00


Show the NAV Map
Some Interesting Ones

Code: Select all

10 2E 20 94 25 00 - Show the NAV Map
10 2E 20 94 24 00 - Display the NAV menu, or display the Climate Control top bar


The Climate control top bar can be hidden, or shown when in NAV mode,
so as you can tell what temp the car is set to (I guess) ????
Interestingly enuf, 102e20942400 is also present when you go in to the NAV menu (Text mode)....

Some mappings of the Buttons underneath the LCD (Starting from LHS to RHS)

Code: Select all

10 2E 00 80 40 02 01 - Button 1 Pressed
10 2E 00 80 40 02 02 - Button 2 Pressed
10 2E 00 80 40 02 03 - Button 3 Pressed
10 2E 00 80 40 02 04 - Button 4 Pressed
10 2E 00 80 40 02 05 - Button 5 Pressed
10 2E 00 80 40 02 06 - Button 6 Pressed
10 2E 00 80 40 02 00 - Button Released


Some more interesting stuff.....
When the NAV stuff is not being displayed, the RHS buttons (NAV CD, Radio, and AUX send the following when pressed)

Code: Select all

10 2E 80 80 08 02 - Radio Button Pressed (Sends this packet twice)
10 2E 80 80 08 02

10 2E 80 80 14 02 - CD Button Pressed (Sends this packet twice)
10 2E 80 80 14 02

10 2E 80 80 1E 02 - Aux Button Pressed (Sends this packet twice)
10 2E 80 80 1E 02

10 2E 00 80 40 02 07 - NAV Button Pressed (Sends this and below Packet)
10 2E 00 80 40 02 00


When Pressing the NAV button, this returns back to the NAV screen, after which the above buttons stop sending anything !!!!!
(Apart from pressing the NAV button, which sends this)

Code: Select all

10 2E 00 80 40 02 00
10 2E 00 80 40 02 00
10 2E 20 94 25 00


Which must be its way of forcing the MAP display when the NAV button is pressed ????

Finally, Switching Ign switch to off position.

Code: Select all

10 2E 80 80 1E 01


I hope this helps ?????

[jezzab]

I've worked out that when you send the packet to enable the NAV mod you have 10 seconds before another must be sent. If you are in the NAV screen it will stay there and not kick you out if you don't send any more packets but if you go out and then try and go back in it will say that navigation is not available

Matti the reason that it didn't mute it was because I didn't send the NAV audio on packets. As TMKs listed there is an on packet and off packet. I'll give it a go but I'm confident it will work

The g8 off button can be remapped to NAV. This is wha was done by no limits to my mates head unit. Would be interesting if TMKs could flash a Holden fascia bin and link code into his g8 one

I've just sent a message to the owner of the G8 head unit fascia I uploaded if it was a NAV button or power button. I can't remember what was there when I did it. Hopefully it's OFF not NAV.

If not I can get another fascia bin off someone else that is definitely no NAV g8

[jezzab]

Confirmed. The G8 fascia bn I uploaded is non NAV

[ZerOne]

Schweeet !!!!!
Will upload the EEPROM to the spare fascia for some testing !

If the NAV button doesn't work, then at least we have a lead to work on...

[tmk]

Guys - Here are some of the things I have found while trying this..

When I send the NAVREG stuff - My dic turns into a Nav one. And no longer responds to onstar properly. IT does respond to Nav text packets. I had to pull the fuse and reboot it to sync back. Jezzab - Probably why the onstar DIC messages don't work on the Holdens eh?

Similar activity is seen with the radio. I get the NAV Audio menu option. The power button does seem to half map to the nav button - just does not send the packets to the nav unit or switch to component in. The bottom 6 buttons are dead fish.. Pretty lifeless. (I wonder if that changes with XM Radio? )

So - it seems the radio/dic can learn what it has hooked up to it. Interesting stuff .

And I AMAZED at the work you guys have done over the last 24 hours. AWESOME !

TMK

[jezzab]

Compiling code and uploading between tuning cars, sitting out the front of workshop at lunch time and testing inputs while driving to and from a meeting lol always a few minutes in a day lol

It could be TMK orbit could be my E3 dash. I could log a few packets from an IQ NAV system in an E3 GTS I have at work.

I found the aux input doesn't work to enable to test it and they have NAV built in to the radio I think. This one has EDi

Matti is going to test the G8 fascia on a Holden fascia and see if it maps the NAV button to power. I think it will. I did a quick compare yesterday and the code it quite different.

From some reading some have said they converting a G8 unit to Holden to use the RGBS input will "lose some of the functionality relating to the G8". Don't know what they are referring too but perhaps it's XM and OnStar