GM Lan Single Wire CAN Bus Sniffing

[tek1229]

Hello all, I apologize if you feel I am hijacking this thread but I had found this forum looking for information and some helpful hints as I explore my gmlan system in my truck, adding navigation radio and backup cameras.. Have read this entire thread and I have taken some notes and will be experimenting and hopefully learning as I'm going. Please don't think I will be asking for all the answers, lol.. I heard mention of this GMW3110 document and that it contains quite a bit of information in helping understand the bus and the protocols.. Does anyone have it? or know of a location where it will not cost me an arm and a leg to get?

So far I have the door locks figured out, can activate remote start using the RKE or Onstar commands.. Learning this 29 bit header is confusing, but I am getting the hang of it.. Really want to research 11 bit and see what else I can work with..

thanks, Sorry don't really have a lot to offer, hopefully in the future I can help out.. I am a GM dealer Tech, if someone needs some info I have access to, let me know.. tek1229

[nfsve]

acca
if you take a look at the 2515 datasheet you can see what all the registers do. MCP2515 is an external Can processor that can communicate via SPI to the main processor be it arduino or PIC. This chip is also inside some of the top tools like the NeoFire,
The first half of your code reads the CANINTF register. This is an 8 bit wide register (1 byte). First line puts that byte into a memory location called flags. 2nd line 'and' s it with 1 hex 00000001 which removes all binary bits execpt for the LSB. It then checks if it is one. So the top 2 lines check it Receive buffer 0 has interrupted. If it has it looks like it runs the rendermessage subroutine and sends it 61 in hex. It then clears the Interrupt flag ready for the next shot.

The second half does the same thing with Receive buffer 1. .... ands it with 2.. 00000010 to check if the 2nd bit (rXB1) is set. If so run Rendermessage subroutine and send it 0x71, then clear int flag to go again.

[acca]

Ok
If i understand everything, there is two reception buffers

But i still can't intercept text sent to the display

Thank you very much

acca
if you take a look at the 2515 datasheet you can see what all the registers do. MCP2515 is an external Can processor that can communicate via SPI to the main processor be it arduino or PIC. This chip is also inside some of the top tools like the NeoFire,
The first half of your code reads the CANINTF register. This is an 8 bit wide register (1 byte). First line puts that byte into a memory location called flags. 2nd line 'and' s it with 1 hex 00000001 which removes all binary bits execpt for the LSB. It then checks if it is one. So the top 2 lines check it Receive buffer 0 has interrupted. If it has it looks like it runs the rendermessage subroutine and sends it 61 in hex. It then clears the Interrupt flag ready for the next shot.

The second half does the same thing with Receive buffer 1. .... ands it with 2.. 00000010 to check if the 2nd bit (rXB1) is set. If so run Rendermessage subroutine and send it 0x71, then clear int flag to go again.

[Sleepy]

acca
It appears that your code is working correctly. maybe the display data isnt on the single wire bus? The can messages do not match up to the gmlan bible because your vehicle is one of the new global a (global architecture) vehicles. GM has changed the messaging for this new system. The good news is that once every platform has changed to global a (which is the plan) it will be standardized. I have successfully used some of your data to bench test a 2010 Cadillac SRX radio (also global a). specifficaly the VIN which was found in a preveous post and the ignition state 10242040. Perhaps we should start another gmlan bible for global a. I would not be to much help with this though as I do not have one of these vehicles. That being said I am trying to get the radio I have to go into low current mode. I can use the ignition state to get it to turn off and the bus will go to sleep but the radio still draws two amps. I am assuming that after the RAP or the door is opened there is a message sent by the BCM to turn it off. I would greatly appreciate it if you could post a log of turning the ignition off opening the door and waiting for the bus to go silent.

Here are some links to info about global a
http://www.vector.com/portal/medien/cmc/events/commercial_events/VectorCongress_2012/VeCo12_6_Keynote_1_Peti_Lecture.pdf
http://www.sandyblogs.com/techlink/feb2010techlink.pdf

[acca]

Thank you very much sleepy

I'm sorry but for the moment i don't have time to log this.

I'll do it as soon as i have the time

don't hesitate to ask again if i forget

regards

[Sleepy]

Thanks acca.
I found a site with a couple global a messages listed on it. I don't think it helps you to much, but here it is.
http://vehicle-reverse-engineering.wiki ... GM_GlobalA

[tiburon]

acca,

Can you tell my how you wired the spark fun board to work? Am I just splicing the cable going into the board to reroute pins or do I need to actually do some soldering on the board?

Thanks

[acca]

Hi

you can use db9 plug or soldier to CANh and CANL pins on the board

[Hank303]

Hey guys,

Great work on the GMLAN research!

I'm trying to write a GMLAN protocol module for python-can for use with my Lawicel canusb. It works great for sending & receiving CAN messages, but I'd like to break out the GMLAN fields in the arbitration IDs.

Anyone have a 2010 or newer version of the GMW 3110? There were a few links earlier in the thread, but they're all dead now.

I appreciate any help and will of course post my code when done.

Hank

[McJ]

Hi All,

I just found this place, and got really excited. Years and years ago (2010?) i built a homebrew SWCAN bus sniffer pilfered from industrial samples and junk box bits and pieces. Back then, there was virtually nobody else with any info, and wow has it blossomed!

Anyway, I wanted to say hi, and i have some stuff to share. Indeed it seems you already have some of it, as i was the one who wrote the post that the "chime" section of the GMLAN bible was taken from (with credit, which I'm even happier about!)

Looking forward to sharing and learning more great knowledge

-Jesse