GM Lan Single Wire CAN Bus Sniffing

[jezzab]

Just need to send the packets to keep the Nav on about every 1 second. Easy

First packet tells it to wake up
Second is pinged to it every second roughly to keep it alive

Ill see if I cant find the bytes again. Got them written down somethere (this was about a year ago but ive got em somewhere). I made a module to send the packets and it works well. Plus the board foxdie listed worked as well I mounted it inside the head unit with the VGA input on the side for my carpc when i had it in there

[ZerOne]

Ill see if I can scan NAV button on the steering wheel controls.
(Not sure if the Nav Gateway responds to the NAV button steering wheel command and tells the head unit to select the RGBs Input for the Nav, or if the head unit sees this packet, and responds to it (if the Nav unit is detected).

Ill also grab the HSV EDI button packet while I have everything connected.
(I think the EDI button has a slightly different resistor value than the Series I Phone Button,
as it behaved exactly like pressing the phone button on a Series I, but with the IQ unit in there,
It behaves completely different to the Phone Button.
(With the IQ unit, pressing the phone button from non HSV EDI steering wheel buttons, puts you in to the Phone Menu).
Pressing the EDI button on an IQ system prompts the IQ to enter EDI mode.

Might also try and scan for touch screen presses as well.

[ghodge]

Thanks Jezzab. The footprint for my goal seems to get bigger and bigger but for a sharper image, it would be worth it. Without going the RGBS route, I would have to look into theming XBMC to get everything sized to the point that I can see things clearly. Trying to read the text now through the composite input is difficult.

George

[jezzab]

Ill see if I can scan NAV button on the steering wheel controls.
(Not sure if the Nav Gateway responds to the NAV button steering wheel command and tells the head unit to select the RGBs Input for the Nav, or if the head unit sees this packet, and responds to it (if the Nav unit is detected).

Ill also grab the HSV EDI button packet while I have everything connected.
(I think the EDI button has a slightly different resistor value than the Series I Phone Button,
as it behaved exactly like pressing the phone button on a Series I, but with the IQ unit in there,
It behaves completely different to the Phone Button.
(With the IQ unit, pressing the phone button from non HSV EDI steering wheel buttons, puts you in to the Phone Menu).
Pressing the EDI button on an IQ system prompts the IQ to enter EDI mode.

Might also try and scan for touch screen presses as well.

I beg to differ Matti, on my S1 with IQ:

Pressing Phone with normal steering wheel controls and IQ goes to EDI
Pressing Mute with normal steering wheel controls and IQ goes to Phone (Holding will fire up Siri)

Ive gotta get around to logging the touch screen packets as I know they are sent because the EDI reads the packets over GMLAN for its menus. Be pretty cool for a CarPC if you wrote a little driver to read em and convert to mouse locations

Too many irons in the fire is my problem

[bryce007]

Hi All,

Just thought I'd chime in, ive been a long time reader of this thread - I've installed a carputer and integrated control of it via canbus using an arduino with canbus shield over usb serial.

I have a 2008 Calais with factory satnav - I originally went down the RGBS route and purchased the same VGA -> RGBS adaptor foxdie listed, I found the image quality to be very poor, and to get the image to position correctly on the screen (using the buttons on the converter) it would reset settings every time powered off. The device seemed to use about 2A while on, so powering it constantly was not an option.

The composite input is more than adequate for the stock unit's poor resolution. I have centrafuse running on my laptop (which has composite out via dock), scaled to 800x480, and the interface is fine to read. Colours are much nicer than with the RGBS converter.

I would still be interested if someone can find a decent, low cost RGBS converter however, as more buttons on the headunit are exposed on the GMLAN when it is in nav mode. I am also interested in developments with the ability of reading the touchscreen on the series 2 IQ systems.

[foxdie]

Just a quickie, managed to get a S1 head unit up and running on a bench unlocked

Before

vxr8-ehu-lockout.jpg

After

vxr8-ehu-unlocked.jpg

[doubledip]

good stuff Jase !!

[dstarkoff]

Good day! Soory by bad english... i have a Chevy Cruze... im twik a ELM327 adapter, connect to car and PC and listen bus on Putty. Im looked:

Code: Select all

>atma
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
000 RTR
000 RTR
000 RTR
000 RTR
000 RTR
0C0 RTR
0C0 RTR
0C0 RTR
0C0 RTR
0C0 RTR
0C0 RTR
0C0 RTR
0C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR
1C0 RTR

This is normally?

[dstarkoff]

Ohhh. Im using AU5790 and in "engine off" mode and using 115200 boudrate im listening my GMLAN without buffer error=) If engine on im have buffer error... why resolve is it?

[jezzab]

Found it! I knew I had the info on a laptop somewhere. Hmm but its not complete. I have another laptop I have to ressurect. Pretty sure you had to register the NAV first. I will add that down the bottom and someone can whittle out the ones you done need. Just cant find the finished code

Code: Select all

void navon()
{
Serial.println("NAV COMP ON");
can_send_29bit_message(0x102e2094, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02);
}

void navoff()
{
Serial.println("NAV COMP OFF");
can_send_29bit_message(0x102e2094, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02);
}

Serial.println("Register NAV..?");
//10 2E 20 94 01 00
can_send_29bit_message(0x102e2094, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02);
delay(100);
//10 2E 40 94 03
can_send_29bit_message(0x102e4094, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01);
delay(100);
//10 30 60 94 01 C0 00 03
can_send_29bit_message(0x10306094, 0x01, 0xC0, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x04);
delay(100);
//10 33 40 94 00
can_send_29bit_message(0x10334094, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01);
delay(100);
//10 2E 20 94 21 00
can_send_29bit_message(0x10220094, 0x21, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02);
delay(100);
//10 30 60 94 01 C0 00 03
can_send_29bit_message(0x10306094, 0x01, 0xC0, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x04);
delay(100);
//10 0A 60 94 0C 04 10 20 60 1A
can_send_29bit_message(0x100a6094, 0x0C, 0x04, 0x10, 0x20, 0x60, 0x1A, 0x00, 0x00, 0x06);
delay(100);
//10 2E 20 94 25 00
can_send_29bit_message(0x102e2094, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02);
delay(100);
//10 33 40 94 00
can_send_29bit_message(0x10334094, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01);