GM Lan Single Wire CAN Bus Sniffing

[brentsten]

I'm a little late jumping in here, I've been trying to decipher all this information for about a month now following several blogs that have actually already been listed in this thread. This seems to be the most active area, so I'm posting here for some insight.

I have a 2009 G8 and I've been playing around sniffing and injecting packets on the GMLAN bus, but I'm kind of confused with your terminology, but then again I think I'm using a different software than most. I'm streaming data from inside the car on my laptop.
I'm using the PEAK PCAN-USB adapter found here: http://www.peak-system.com/Produktdetai ... wUid%5D=16 connected to an OBD2 adapter that I made up. I've connected the 2 grounds as well as CAN L to ground on the OBD connector, and the CAN H to GMLAN pin 1 on the OBD connector.
I'm also using PEAK's PCAN-View software to sniff the bus. The default is for high speed can, but there is a setting in the program to change to 33.33 kbps which I'm currently set at.

So far I've been able to map the steering wheel controls and send the commands from my laptop to operate the controls. I'm having a little trouble understanding the ArbIDs though. I understand that (for instance) 10 0D 00 60 is where the radio ID lies and the the next 8 bits are the command ie. 00 00 00 01 would be volume up. Can someone clarify the header filter and mask filter?

Also to Quote TMK:
"I see the icon here: 0x4 0x182 0x094 | 4 | 10 30 40 94 06 40 01 16 - Same as onstar! (See the GMLAN bible)
I see the aux nav display info here: 0x4 0x148 0x094 | 4 | 10 29 00 94 00 00 00 00 - Same as onstar and in the GMLAN bible.. That's the bar graph stuff."

I can't see anywhere to insert the 0x- 0x--- 0x--- format. Only the XX XX XX XX format. Here are a couple screenshots of what I'm working with to help clarify.
This is my main screen when sniffing. (top portion is receive, bottom is predefined transmit commands I've made)

Main.png

This is the window I get when I want to transmit code:

Transmit.png

Maybe the software I'm using isn't well enough defined for the commands I want to send?

[ZerOne]

Hi Brensten, and Welocme to the forums

Ill be honest with you, Im very very new to all this too, and if it wasnt for TMK telling me exactly what to do, then I would be sitting by the sidelines, with absolutely nothing to contribute....

I had a quick skim of your post, and normally when TMK notes something as 0x??, then 0x part simply stand for HEX.
So when he says 0xFF, or 0x10, he is saying a Hexadecimal value of FF, or 10, which converted to Decimal would be 255, or 16....

Buuuuuuuuut having said that, the value that you have shown above 0x4 0x148 0x094, the 0x148 looks like the number is in decimal ????
TMK the guru would be the best person to explain this, (I dont want to polute the thread with any wrong information, as that will probably make things a lot more complicated for people like myself to understand)...

(I will need a bit of time to look over things, and hopefully switch to a higher gear in my brain, as this stuff is VERY VERY complicated for me, fun yes, but complicated)....

Apart from that, it looks like your software does support everything, which is a very good thing..
(Again, I am defintely no expert on this, Im just following the path that TMK the guru is leading us through, and enjoying the scenery at this stage

Heopfully things will become more and more clear us we all learn...

(P.S. Im going to test the G8 Fascia EEPROM in about an hours time, will let everyone know what I find !!!!!)

[ZerOne]

Bugger,

The G8 Fascia EEPROM was a total bust...

The LCD fascia has the security light flashing when it is plugged in, but it doesnt power up.
(Same symptoms as when the fascia EEPROM is missing, only the EEPROM is there)....

I am not sure if the problem may be the SW version that I have for the Main unit, or Fascia.
(The Main unit SW version is very old, circa 2006), and the fascia is not much newer (possibly 2007, 2008)...
The SW version may not recognise the fascia EEPROM settings as valid, (The SW version is pre G8)....

I am HOPING that it is only the SW version, and that this is not a show stopper.
I do have a fairly new Main unit, that I have never powered up or tested (Or dumped the ROM from), which might offer some hope....
The only thing is I bought the main unit for $20 au, so its status is questionable at best....

When I get some time, I will have a play...

[brentsten]

I think I have it figured out.. the first 0x4 would be the priority, the 0x148 refers to the ArbID and 0x094 refers to the ecu. At least this is what it appears to be when looking at the gmlan Bible. My program only allows input for the header in hex (Arbid followed by ecu)so it kind of simplifies things, but is a bit of a pain to reference back and forth. I just can't set the priority, not sure what it defaults to or if its even important.

[tmk]

Brentsten,

The priority occupy the 29th to 26th bit of the header - so if you can set a 29 bit header, you can set priority.

Been playing with Onstar nav DIC displays.. It's fighting me all the way but I am winning some battles. Hope to post some stuff this weenend for everybody!

(Anybody have luck getting the dorr lock/unlock arb/ecu commands to actually work?)

TMK

[ZerOne]

The Bluetooth adapter that I got came with a quick guide to get you started.
(Unfortunately I left it in the car).
This included the remote control commands (Lock, Unlock, Boot Release, and Panic alarm).
When I go to the car today, I will pull it out and post up the values as they did work.
(It was one of the first things I ever got working using the adaptor).

It looks like REMOTE START might be there as well, as when I started incrementing the data bytes to see
what would happen, around 05 or 06 Nothing did happen, and the data bytes kind of followed the button numbers
on the remote control.
Going from memory, 01 was lock, 02 was unlock drivers door only, 03 was unlock all doors, 04 was boot release,
05 did nothing (From memory), and then at some number before 0A, I set the Panic alarm.
(Which needed the key to be turned in the ignition to switch it off, the remote control couldn't reset it)....

The Aussie models did not have the remote start option on the remote control, and looks like the option is not enabled in
whatever module(s) look after that function.
(You U.S. guys get all the fun stuff !!!), so I am taking a wild punt, and guessing that is what these location may be for ?????

I will post the information up in the next couple of hours...

Cheers

[jezzab]

The Bluetooth adapter that I got came with a quick guide to get you started.
(Unfortunately I left it in the car).
This included the remote control commands (Lock, Unlock, Boot Release, and Panic alarm).
When I go to the car today, I will pull it out and post up the values as they did work.
(It was one of the first things I ever got working using the adaptor).

It looks like REMOTE START might be there as well, as when I started incrementing the data bytes to see
what would happen, around 05 or 06 Nothing did happen, and the data bytes kind of followed the button numbers
on the remote control.
Going from memory, 01 was lock, 02 was unlock drivers door only, 03 was unlock all doors, 04 was boot release,
05 did nothing (From memory), and then at some number before 0A, I set the Panic alarm.
(Which needed the key to be turned in the ignition to switch it off, the remote control couldn't reset it)....

The Aussie models did not have the remote start option on the remote control, and looks like the option is not enabled in
whatever module(s) look after that function.
(You U.S. guys get all the fun stuff !!!), so I am taking a wild punt, and guessing that is what these location may be for ?????

I will post the information up in the next couple of hours...

Cheers

In the E38 and similar computers (VE SS, HSV etc) you can enable remote start in the tune. This MAY allow the ECM to listen for the packets

[jezzab]

w00t!

Finally the ArbID (Destination), Priority and ECU (Source) etc clicked. I understand now (finally!) how its broken down. Not as bad as I thought. I modified your 29Byte excel spreadsheet TMK. I made the first binary line down to 6bits (=HEX2BIN(xx,6) instead of displaying the 8 and I did a new row so I can input the binary and convert it back into a hex header.

Also worked out how the program does filtering etc and can now load in just a test one Outside_Temp. I can read and convert it correctly etc. I can only send a chime and that is all working well. Need to sort out finding a few more diagnostic headers for a few things.

Oh and I worked out why my Arduino scanner was dropping packets. I only had it on 9600 baud. Ramped it up to 115200 and she fills the log files pretty quick now lol

Finally some nice progress and understand more of what is going on

[ZerOne]

As promised,

00 80 B0 02 01 - Lock Doors (CAN ID 4, Keyfob Control)
00 80 B0 02 02 - Unlock Door(s) (CAN ID 4, Keyfob Control)
00 80 B0 02 03 - Unlock Door(s) - Not sure if this one is just drivers, or all doors...

Changing the last digits seem to be the remote control button number....

Glad you understand the packets Jezzab, Im going to print out the bible and sit and stare at the pages...
Hopefully something sinks in to my thick skull, apart from the alcahol that I am drinking....

[jezzab]

Matti, read this link:

http://www.canbushack.com/blog/index.ph ... &tb=1&pb=1
And open the bible and go to the 29bit Header worksheet

Took me 2 beers lol