VF CAN Stuff

[vsboost]

Hi All
Couldn't find a specific VF place to post this.
Decided to play around with some HSCAN stuff on a VF Calais-V
Using Raspberry pi 3 with a cheap ebay MCP2515 modified module connected to pin 6 & 14 on obd2 connector.

Will post what else i find, would love if people post up their findings.


DRL on/off
241#04ae680101
241#04ae680100

Front Right Indicator on/off
241#07ae024040000000
241#07ae024000000000

High Beam on/off
241#07ae020000020200
241#07ae020000020000

Left low beam on/off
241#07ae06017fff0000
241#07ae060100000000

Right low beam on/off
241#07ae060200007fff
241#07ae060200000000

Left front indicator on/off
241#07ae021010000000
241#07ae021000000000

Reverse lights on/off
241#07ae020000080800
241#07ae020000080000

Left stop light on/off
241#07ae1a017fff0000
241#07ae1a0100000000

Left rear indicator on/off
241#07ae022020000000
241#07ae022000000000

Right rear indicator on/off
241#07ae028080000000
241#07ae028000000000

[jezzab]

Guessing you logged the packets being sent by GDS2 as they are they are AE override commands. The ECUs will never send these, only scan tools for taking control of a module and testing it/linking it, etc. Looks like you don't need to send Tester Present to do it either, most do need it or even security access. They usually have a time out period but if Tester Present is being sent then it will hold until TP stops being recv'd.

Easier to read if you write it like this:

Code: Select all

0x241 07 AE 02 40 40 00 00 00


0x241 is the BCM send address (the response address will be 0x641 which is send address plus 0x400 or flip the 11th MSB)
07 is the data length for the frame (not the DLC as you havent listed that. That would be 08)
AE is the mode which is Device Control
02 is the CPID number. The process you wish to control
and 40 40 00 00 00 00 is the data. being 0x40 we are just flipping 1 bit in each byte [‭0100 0000‬]. You will see the other one is 80 [1000 0000] so they flip the 8th bit.

Positive responses are command + 0x40 so in this case 0xAE will respond with a positive response of 0xEE and the CPID:

Code: Select all

0x641 02 EE 02


You can always try and discover new bits to flip in a CPID that may not be implemented in the scantool/GDS for manufacture or inhouse use only, sometime you come up with some good stuff

[vsboost]

Nice explanation there jezzab,

Correct, those were logged via GDS2 and yes it does require tester

Code: Select all

0x241 01 3E

to be sent every so often otherwise it locks out after a while.

[jezzab]

There are a couple of Corporate CPIDs like FE and FD.

FD 40 will reboot most ECUs

Code: Select all

0x241 07 AE FD 40 40 00 00 00


Should do the trick on the BCM (they seem to double everything up)
And if you want a bit more of a visual reboot. Try it on the cluster/IPC:

Code: Select all

SWCAN
0x24C 03 AE FD 40
(technically you should be nice and comply with the GMW and pad the unused bytes)
0x24C 03 AE FD 40 AA AA AA AA


[vsboost]

There are a couple of Corporate CPIDs like FE and FD.

FD 40 will reboot most ECUs

Code: Select all

0x241 07 AE FD 40 40 00 00 00


Good to know,

Cheers

[jezzab]

No probs. Guess after spending 5 years of low level CAN bus programming, sniffing, making modules and reverse engineering GM modules I can ramble on :/
I'll leave ya to it Tom. Sounds like you have it all sorted

[vsboost]

No probs. Guess after spending 5 years of low level CAN bus programming, sniffing, making modules and reverse engineering GM modules I can ramble on :/
I'll leave ya to it Tom. Sounds like you have it all sorted

Ill know who to ask when i get stuck Have only been mucking around with it for a couple of weeks now, still getting my head around it.

Cheers