ECU - OBDII DTCs and PIDs

by **ZerOne** » Sun Apr 15, 2012 2:31 pm

Fantastic News !!!!
Im glad that I can be of some help....

I must admit, I am still trying to get my head around the packet header stuff.
(Ill keep steering at the data, read the posts here, and hopefully it will just click at some point)...

Anyway, here are some logs
Header Filter : AT CF 00 00 00 94
Mask Filter : AT CM 00 00 1F F8

Ignition Switch Off, Bus activated...
No Data...

Ignition Switch turned to Accessories from Off Position

Code: Select all: >at ma 0F FF E0 94 RTR 10 2E 20 94 01 00 10 2E 40 94 03 10 30 60 94 01 C0 00 03 10 33 40 94 00 0F FF E0 94 RTR 10 2E 20 94 01 00 10 30 60 94 01 C0 00 03 10 33 40 94 00 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 10 2E 20 94 21 00 0F FF E0 95 RTR 10 2E 20 94 20 00 10 0A 60 94 0C 04 0F 1A 3C 40 10 2E 20 94 24 00 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR

Nav Button pressed on Head unit (Not steering wheel controls)

Code: Select all: >at ma 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 10 2E 20 94 24 00 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR

Note with the above,
When the line 10 2E 20 94 24 00 was sent, was the same time that the radio stopped
displaying the "Do not use the navigation system whilst driving OK", and then displayed the GPS Map and location...
So I ??? think ??? this means that the Nav system is ready to take control (Powered up comepltely),
as before this is sent, you cannot do anything with the NAV system, I.E. enter any menus, or have anything meaningful displayed....

Turn the Ign switch from Accessories to the On position

Code: Select all: >at ma 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 10 30 A0 94 00 0C 82 41 7F D7 0F FF E0 94 RTR 10 30 A0 94 00 0C 82 81 7F D7 10 30 C0 94 C9 07 00 4E 61 76 69 67 10 30 C0 94 C8 02 61 74 69 6F 6E 0A 10 30 C0 94 C8 03 52 41 49 4C 57 41 10 30 C0 94 C8 04 59 20 50 41 52 41 10 30 C0 94 C8 05 44 45 0A 53 59 44 10 30 C0 94 C8 06 4E 45 59 20 5B 41 10 30 C0 94 C8 07 55 53 5D 0A 04 00 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR

This I ??? think ??? pushes the following to the cluster.

NAVIGATION (Big Font)
Railway Parade
Sydney [AUS]

Pressing the Steering Wheel NAV button at this point does nothing..
(Maybe I should scroll through the Cluster displays, and see if the NAV system pushes anything when the NAV screen is supposed to be displayed ????)

The following is Ign On, Map displayed, and pressing the MENU button (The knob opposite to the volume control, pressed in)
On the head unit....

Code: Select all: >at ma 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 10 30 A0 94 00 0C 82 81 7F D7 10 30 C0 94 C9 07 00 4E 61 76 69 67 10 30 C0 94 C8 02 61 74 69 6F 6E 0A 10 30 C0 94 C8 03 52 41 49 4C 57 41 10 30 C0 94 C8 04 59 20 50 41 52 41 10 30 C0 94 C8 05 44 45 0A 53 59 44 10 30 C0 94 C8 06 4E 45 59 20 5B 41 10 30 C0 94 C8 07 55 53 5D 0A 04 00 10 2E 20 94 24 00 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR

Note the 10 2E 20 94 24 00 is different from the above packets when the location was pushed to the cluster...
Dunno if this is anything significant ?????

Exiting the Navigation Menu (Returning back to the MAP display from the above operation)

Code: Select all: >at ma 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 10 2E 20 94 24 00 0F FF E0 94 RTR 0F FF E0 95 RTR 10 30 A0 94 00 0C 82 81 7F D7 10 30 C0 94 C9 07 00 4E 61 76 69 67 10 30 C0 94 C8 02 61 74 69 6F 6E 0A 10 30 C0 94 C8 03 52 41 49 4C 57 41 10 30 C0 94 C8 04 59 20 50 41 52 41 10 30 C0 94 C8 05 44 45 0A 53 59 44 0F FF E0 94 RTR 10 30 C0 94 C8 06 4E 45 59 20 5B 41 10 30 C0 94 C8 07 55 53 5D 0A 04 00 10 30 A0 94 00 0C 82 81 7F D7 10 30 C0 94 C9 07 00 4E 61 76 69 67 10 30 C0 94 C8 02 61 74 69 6F 6E 0A 10 30 C0 94 C8 03 52 41 49 4C 57 41 10 30 C0 94 C8 04 59 20 50 41 52 41 10 30 C0 94 C8 05 44 45 0A 53 59 44 10 30 C0 94 C8 06 4E 45 59 20 5B 41 10 30 C0 94 C8 07 55 53 5D 0A 04 00 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR

Note changing stuff in the Nav menu sort of did nothing....
I didnt test this thoroughly though.....
(I am kinda wondering if the headunit is sending raw commands to the NAV gateway, and it is rendering the menu options,
or if there is a packet sent that swaps between the Display Input, and a headunit rendered display ????)....

This probably is not the case... but I thought I might mention it, just in case ????

Finally, switching the Ignition switch from On to Off

Code: Select all: >at ma 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 10 30 60 94 01 F8 00 00 10 30 A0 94 00 0C 80 80 00 00 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR

I hope this helps....
Let me know what else I should try (Or if I goofed with the above, and should try things again)....

It feels nice to be of some assistance, even though Im a complete idiot when it comes to these things....
Cheers

by **tmk** » Mon Apr 16, 2012 12:44 am

ZerOne,

Sweet!

I think you are on to something with the 10 2E 20 94 24 00 packet being the mode switch for the head unit. I'll try experimenting and see what that does in my G8 today.

Also - These are cool multi packets.. Never seen any this long before to the DIC! I will also try this set of packets in the G8.

10 30 A0 94 00 0C 82 81 7F D7
10 30 C0 94 C9 07 00 4E 61 76 69 67 -> Navig
10 30 C0 94 C8 02 61 74 69 6F 6E 0A -> ation(LF)
10 30 C0 94 C8 03 52 41 49 4C 57 41 ->RAILWA
10 30 C0 94 C8 04 59 20 50 41 52 41 ->Y PARA
10 30 C0 94 C8 05 44 45 0A 53 59 44 ->DE(LF)SYD
10 30 C0 94 C8 06 4E 45 59 20 5B 41 ->NEY [A
10 30 C0 94 C8 07 55 53 5D 0A 04 00 ->US]?

As for the next round.. We may need to see if ECU 0x080 (Radio) and 0x06X get into the action. Should see button presses from 0x060 and not sure what the radio will show.

More progress. This is getting closer by the minute!

TMK

by **tmk** » Mon Apr 16, 2012 4:40 am

Ok.. Small Victory!

Sending this first
10 2E 20 94 24 00

And then this
0x4 0x19a 0x094 | 1 | 10 33 40 94 01

Seems to mute the center speaker - so maybe that enables the NAV audio?

0x4 0x19a 0x094 | 1 | 10 33 40 94 00

Seems to unmute it.

No switching of the screen yet. And sending the DIC text packets as you saw did not work on thr G8. So maybe it does not have the ability to take nav..

TMK

by **ZerOne** » Mon Apr 16, 2012 5:21 am

I dont know if this helps or not....

In regards to the above DIC messages, if the NAV gateway module is detected in the car, then the Cluster will have an extra mode, (Ie. trip computer, vehicle speed, settings, etc), that will display this information)....
When you enter this mode for the first time, and the navigation unit has not properly turned on, the cluster displays
Navigation in small font, in the upper area of the DIC.
When the map is displayed on the NAV screen (I.E. powered up completely), then the font changes to bold, and if the street name of the current location is known, then this will be displayed as well... (As per above message)

The above message will not be displayed if you are in another mode, (I.E. vehicle speed, etc)...

If you are displaying the vehicle speed, then this information will not be displayed.
I am not sure if pressing the MODE switch on the steering wheel prompts the NAV gateway to resend this information when this mode is called up, or whether it is simply cached by the cluster, and the cache is displayed when the Navigation mode is called.
(This is something that I should test for)....

Also, I have fitted a number of different clusters to my car, and I can confirm that all of them so far (I havent tried the G8 cluster, but I have tried an Omega cluster, which is the base of the base cluster, which in theory cannot hav NAV installed), and this message will display on all of the if the NAV gateway is detected...

Finally, I should test to see if once the NAV gateway has enabled the screen input, if it stays enabled without any further commands. (I can test this by pulling the electrical plug on the NAV gateway, once the NAV screen has been activated).

I will log the ECU (Radio 0x80) next, and will also try the above.
With the NAV audio, I can try setting a destination, and just before the destination is set, start logging.
The NAV whore will announce "The route is being calculated", when the destination is punched in, so will try and log this as well, as I dont think any of the above logs have been taken when the NV whore speaks.

Logging the button press results should also be interesting !!!!!

Will keep you posted

Cheers

by **tmk** » Mon Apr 16, 2012 11:28 am

Based on what you said I took another look..

I think this is how Nav registers to the DIC:

Registration
0x4 0x171 0x094 | 2 | 10 2E 20 94 01 00
0x4 0x172 0x094 | 1 | 10 2E 40 94 03
0x4 0x183 0x094 | 4 | 10 30 60 94 01 C0 00 03 - This is a DIC status message..
0x4 0x19a 0x094 | 1 | 10 33 40 94 00
0x4 0x171 0x094 | 2 | 10 2E 20 94 01 00
0x4 0x183 0x094 | 4 | 10 30 60 94 01 C0 00 03 - This is a DIC status message..

De registration
0x4 0x183 0x094 | 4 | 10 30 60 94 01 F8 00 00 - This is a DIC status message..
0x4 0x185 0x094 | 6 | 10 30 A0 94 00 0C 80 80 00 00 (This is a clear DIC type message.. I think)

I'll give it a go this week..

TMK

by **ZerOne** » Mon Apr 16, 2012 5:22 pm

Some more sniffing...

Header Filter : AT CF 00 00 00 80
Mask Filter : AT CM 00 00 1F FF

Ignition Switch Off, No Bus activity...

Press Power Button on Radio

Code: Select all: 0F FF E0 80 RTR 0F FF E0 80 RTR 10 01 20 80 00 10 0F 20 80 00 10 2E 80 80 00 01 10 2E 00 80 00 02 07 10 31 00 80 00 10 30 00 80 02 01 00 00 00 00 00 00 10 30 20 80 10 00 00 02 00 00 00 00 10 30 60 80 00 40 00 00 0F FF E0 80 RTR 10 08 C0 80 00 10 2E 80 80 00 02 10 31 00 80 00 10 01 20 80 01 10 2E 80 80 06 02 10 31 00 80 00 0F FF E0 80 RTR 10 0F 20 80 00 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR

Next, Press the NAV button on the Radio - Ign still Off....

Code: Select all: >at ma 0F FF E0 80 RTR 0F FF E0 80 RTR 10 2E 00 80 00 02 07 10 2E 00 80 00 02 00 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR

NOTE the above blips come through exactly the same time the Nav unit displayed PLEASE OBEY ALL DRIVING LAWS..
(The standard display that comes up whilst the NAV unit is powering up, which wont allow you to do anything until power up is complete)...

Pressing the MENU button knob (Knob next to volume control, pressing in on the Head Unit...

Code: Select all: Press Button In 10 2E 00 80 00 02 08 Release Button 10 2E 00 80 00 02 00

Scrolling down with the Menu button knob in the NAV menu

Code: Select all: 10 2E 00 80 00 0A 00 10 2E 00 80 00 02 00

Scrolling Up with the Menu button knob in NAV menu

Code: Select all: 10 2E 00 80 00 FA 00 10 2E 00 80 00 02 00

Pressing the Knob again in the NAV menu (To select a destination)...

Code: Select all: 10 2E 00 80 00 02 08 10 2E 00 80 00 02 00

Note the above is exactly the same, so this is just press MENU knob, not NAV specific....

Start Navigation - Address has been set, and NAV unit is calculating route

Code: Select all: >at ma 0F FF E0 80 RTR 0F FF E0 80 RTR 10 2E 00 80 00 02 01 0F FF E0 80 RTR 10 2E 00 80 00 02 00 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR

Press and Release Button 1, (Starting from LHS to RHS) underneath the LCD Screen.
(Buttons normally used to select a radio preset station....

Code: Select all: 10 2E 00 80 00 02 01 - Press 10 2E 00 80 00 02 00 - Release

Button 2

Code: Select all: 10 2E 00 80 00 02 02 - Press 10 2E 00 80 00 02 00 - Release

Button 3 (Im begining to see a pattern here Lol)

Code: Select all: 10 2E 00 80 00 02 03 10 2E 00 80 00 02 00

Button 4, 5, and 6 Pressed

Code: Select all: 10 2E 00 80 00 02 04 - Button 4 pressed 10 2E 00 80 00 02 05 - Button 5 pressed 10 2E 00 80 00 02 06 - Button 6 pressed

After all this, turn the ignition On (I was getting bored)

Code: Select all: >at ma 0F FF E0 80 RTR 0F FF E0 80 RTR 10 0A 80 80 10 09 09 28 0C 10 00 C0 80 01 80 10 08 C0 80 00 10 09 60 80 02 10 0E 20 80 00 00 0C 00 0C 00 10 0E 40 80 80 00 10 0A 80 80 10 09 08 3A 0C 10 0E 60 80 80 00 10 09 60 80 02 0F FF E0 80 RTR 10 0E 20 80 00 00 0C 00 0C 00 10 0E 60 80 80 00 10 09 60 80 02 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR 0F FF E0 80 RTR

Turn the Climate Control Off by pressing the Off button...
Lots of repeating crap here !!!!

Code: Select all: >at ma 10 30 A0 80 00 04 48 40 00 03 10 30 A0 80 00 04 48 80 00 03 10 30 A0 80 00 04 48 C0 00 03 10 30 A0 80 00 04 49 00 00 03 10 30 A0 80 00 04 49 40 00 03 10 30 A0 80 00 04 49 80 00 03 10 30 A0 80 00 04 49 C0 00 03 0F FF E0 80 RTR 10 30 A0 80 00 04 48 40 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 48 80 00 03 10 30 A0 80 00 04 48 C0 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 00 00 03 10 30 A0 80 00 04 49 40 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 80 00 03 10 30 A0 80 00 04 49 C0 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 0F FF E0 80 RTR 10 30 A0 80 00 04 48 40 00 03 10 30 A0 80 00 0C 87 81 80 15 10 30 A0 80 00 04 48 C0 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 00 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 40 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 0F FF E0 80 RTR 10 0E 20 80 00 00 8C 00 0C 00 10 30 A0 80 00 04 49 80 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 0E 20 80 00 00 0C 00 0C 00 10 30 A0 80 00 04 49 C0 00 03 10 30 A0 80 00 04 48 40 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 48 80 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 48 C0 00 03 10 30 A0 80 00 04 49 00 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 0F FF E0 80 RTR 10 30 A0 80 00 04 49 40 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 80 00 03 10 30 A0 80 00 04 49 C0 00 03 10 30 A0 80 00 04 48 40 00 03 0F FF E0 80 RTR 10 30 A0 80 00 04 48 80 00 03 10 30 A0 80 00 04 48 C0 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 00 00 03 10 30 A0 80 00 04 49 40 00 03 10 30 A0 80 00 04 49 80 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 C0 00 03 10 30 A0 80 00 04 48 40 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 48 80 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 0F FF E0 80 RTR 10 30 A0 80 00 04 48 C0 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 00 00 03 10 30 A0 80 00 04 49 40 00 03 10 30 A0 80 00 04 49 80 00 03 10 30 A0 80 00 04 49 C0 00 03 10 30 A0 80 00 04 48 40 00 03 10 30 A0 80 00 04 48 80 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 0F FF E0 80 RTR 10 30 A0 80 00 04 48 C0 00 03 10 30 A0 80 00 04 49 00 00 03 10 30 A0 80 00 04 49 40 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 80 00 03 10 30 A0 80 00 04 49 C0 00 03 10 30 A0 80 00 04 48 40 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 48 80 00 03 10 30 A0 80 00 04 48 C0 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 00 00 03 10 30 A0 80 00 04 49 40 00 03 10 30 A0 80 00 04 49 80 00 03 10 30 A0 80 00 04 49 C0 00 03 10 30 A0 80 00 04 48 40 00 03 10 30 A0 80 00 04 48 80 00 03 10 30 A0 80 00 04 48 C0 00 03 10 30 A0 80 00 04 49 00 00 03 10 30 A0 80 00 04 49 40 00 03 10 30 A0 80 00 04 49 80 00 03 10 30 A0 80 00 04 49 C0 00 03 10 30 A0 80 00 04 48 40 00 03 10 30 A0 80 00 04 48 80 00 03 10 30 A0 80 00 04 48 C0 00 03 10 30 A0 80 00 04 49 00 00 03 10 30 A0 80 00 04 49 40 00 03 10 30 A0 80 00 04 49 80 00 03 10 30 A0 80 00 04 49 C0 00 03 10 30 A0 80 00 04 48 40 00 03 10 30 A0 80 00 04 48 80 00 03 10 30 A0 80 00 04 48 C0 00 03 0F FF E0 80 RTR 10 30 A0 80 00 04 49 40 00 03 10 30 A0 80 00 04 49 80 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 04 00 00 10 30 A0 80 00 04 49 C0 00 03 10 30 A0 80 00 04 48 40 00 03 10 30 C0 80 45 02 01 39 32 2E 39 20 10 30 C0 80 44 02 46 4D 31 0 BUFFER FULL

More to come.....

by **ZerOne** » Mon Apr 16, 2012 5:34 pm

Ok, next was the Steering wheel button presses..

So as You know what buttons I am talking about...

Header Filter : AT CF 00 00 00 60
Mask Filter : AT CM 00 00 1F F0 (I am still not sure of how this mask stuff works....)

Ignition Switch Off, Bus silent.
Turn Radio On.

Code: Select all: >at ma 10 00 40 60 00 10 0D 00 60 00 00 00 00 0F FF E0 60 RTR 0F FF E0 60 RTR 10 02 00 60 00 10 00 40 60 00 0F FF E0 60 RTR 0F FF E0 60 RTR 0F FF E0 60 RTR 0F FF E0 60 RTR 0F FF E0 60 RTR 10 00 40 60 00 0F FF E0 60 RTR 0F FF E0 60 RTR 0F FF E0 60 RTR

Press the NAV button on the Steering Wheel (E3 HSV NAV Button)

Code: Select all: >at ma 10 00 40 60 00 0F FF E0 60 RTR 0F FF E0 60 RTR 10 0D 00 60 30 00 00 00 - Button Pressed 10 0D 00 60 00 00 00 00 - Button Released 0F FF E0 60 RTR 0F FF E0 60 RTR 0F FF E0 60 RTR 10 00 40 60 00 0F FF E0 60 RTR 0F FF E0 60 RTR

And the rest of the buttons

Code: Select all: 10 0D 00 60 20 00 00 00 - Telephone Mute Steering Wheel Button Pressed 10 0D 00 60 00 00 01 00 - Setting (LHS) Scroll Wheel Up 10 0D 00 60 00 00 00 00 - Setting (LHS) Scroll Wheel Up continued 10 0D 00 60 00 00 1F 00 - Setting (LHS) Scroll Wheel Down 10 0D 00 60 00 00 00 00 - Setting (LHS) Scroll Wheel Down continued 10 0D 00 60 01 00 00 00 - Setting (LHS) Scroll Wheel Press Button 10 0D 00 60 02 00 00 00 - Press LHS Audio Button (Upper Button) 10 0D 00 60 03 00 00 00 - Press LHS Trip Button (Lower Button) 10 0D 00 60 10 00 00 00 - Press EDI (E3 HSV) - same as bluetooth on other models 10 0D 00 60 00 00 00 01 - Volume Scroll Up (RHS) 10 0D 00 60 00 00 00 1F - Volume Scroll Down (RHS)

Bugger, I just realised I didnt log the MUTE button (RHS Scroll Wheel depressed)....

A little bit more to come...

by **jezzab** » Mon Apr 16, 2012 5:45 pm

Great stuff Matti. Hanging to see the commands that are sent to the head unit to enable the NAV input. Might have to do some playing this week and see if I can parrot some of your packets and make it flick over

by **ZerOne** » Mon Apr 16, 2012 5:46 pm

More NAV Unit logging

Header Filter : AT CF 00 00 00 94
Mask Filter : AT CM 00 00 1F F8

Warm start, Ignition off, radio off, but Lan still active, and Nav not powered down....

Code: Select all: >at ma 10 2E 20 94 01 00 10 2E 40 94 03 10 30 60 94 01 C0 00 03 10 33 40 94 00 0F FF E0 94 RTR 10 2E 20 94 21 00 10 30 60 94 01 C0 00 03 10 0A 60 94 0C 04 10 20 60 1A 10 2E 20 94 25 00 10 33 40 94 00 0F FF E0 94 RTR

Turn Ign To Accessories

Code: Select all: >at ma 10 2E 20 94 01 00 10 2E 40 94 03 10 30 60 94 01 C0 00 03 10 33 40 94 00 0F FF E0 94 RTR 10 2E 20 94 21 00 10 30 60 94 01 C0 00 03 10 0A 60 94 0C 04 10 20 60 1A 10 2E 20 94 25 00 10 33 40 94 00 0F FF E0 94 RTR 0F FF E0 95 RTR

Enter Nav menu, by pressing the MENU knob button on the radio...

Code: Select all: 10 2E 20 94 24 00

Trying to start the Navigation Demo (Does jack $h!t), but gave me this when it was selected.

Code: Select all: 10 2E 20 94 25 00

I ???? Think 10 2E 20 94 24 00 is sent when the NAV unit is in a menu,
and 10 2E 20 94 25 00 is when it returns to the MAP display...

I dont know the significance of this at the moment....

Setting the NAV whores volume (Voice)

Code: Select all: 10 33 40 94 01 0F FF E0 94 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 10 33 40 94 00 10 33 40 94 01 0F FF E0 94 RTR 0F FF E0 95 RTR 10 33 40 94 00 0F FF E0 94 RTR 0F FF E0 95 RTR 0F FF E0 94 RTR 0F FF E0 95 RTR 10 33 40 94 01 0F FF E0 94 RTR 0F FF E0 95 RTR 10 33 40 94 00 0F FF E0 94 RTR 0F FF E0 95 RTR 10 33 40 94 01

This was turning the volume up and down, however there was some lag when this was sent....
So I think you right in terms of these command muting and un-muting the speakers....

There is a sound setting where you can get the NAV unit to sound on the drivers, front, or all speakers.
I tried this setting, but there was no activity on the BUS that I could see when doing this.....
I tested the above again just to see if there were any different commands sent depending on this setting,
and i still got the same packets....
My current setting is NAV WHORE VOICE on all speakers...

Thats all I have got so far....

I will try and power up the NAV, and unplug the gateway sometime this week.
(Need to pull apart a bit of trim, no biggie, but the car is parked on a main road, so its a bit hard to do)....

I hope this helps ????????

by **jezzab** » Mon Apr 16, 2012 6:01 pm

Would be interesting to power up the head unit with the NAV module unplugged from the GMLAN so it is disabled and then plug it in and see if it enables the display. Logging at the same time as plugging it in of course

Welcome Anonymous !

ECU - OBDII DTCs and PIDs

GM Lan Single Wire CAN Bus Sniffing

Re: GM Lan Single Wire CAN Bus Sniffing

Re: GM Lan Single Wire CAN Bus Sniffing

Re: GM Lan Single Wire CAN Bus Sniffing

Re: GM Lan Single Wire CAN Bus Sniffing

Re: GM Lan Single Wire CAN Bus Sniffing

Re: GM Lan Single Wire CAN Bus Sniffing

Re: GM Lan Single Wire CAN Bus Sniffing

Re: GM Lan Single Wire CAN Bus Sniffing

Re: GM Lan Single Wire CAN Bus Sniffing

Re: GM Lan Single Wire CAN Bus Sniffing

Search

Main Menu

User Menu

Preset Styles

Login

View new posts

Who is online