GM Lan Single Wire CAN Bus Sniffing

[L18]

Hello all,
I own a Opel Astra 2005, and I was wondering if those Arb Id's are same for it too? I think it must have the same SWCAN line?

[foxdie]

Hi all,

I'm jumping on this bandwagon also. For the last month or so I've read this thread (and other similar threads on carmodder.com) multiple times over to try and grasp how to get into the world of GMLAN hacking, as well as other things such as EEPROM programming. Then about a week ago I pulled my finger out, bought a microcontroller and a CAN transceiver and started hacking away.

Firstly, a thank you to all who have contributed time and knowledge, this thread is full of useful information and help to get people on their way. It's helped me no end.

To give something back, I've started doing development work for accessing GMLAN with mbed LPC1768 development boards, it's called GMLAN Sniffer and in its current form it allows you to sniff GMLAN packets, display each packet in an easy to read format over a USB serial link, and filter packets to quieten down "the noise" (you know what I'm talking about, turn the ignition key on, BWAAAAAAARRGH all over the network), all controlled by keyboard shortcuts.

That project is stable and known-working as a sniffer, however I've had no look in sending packets back into the network (so far I've tried chime and DIC). I'm working on that slowly where I get time, that can be found under the unpublicised GMLAN Node project.

It's getting late here now and I thought I'd just introduce myself and what I've been up to. I'll be dropping questions in shortly but for now, greetings to you all

Kind regards,
Jason

[jezzab]

Sounds great Jason. Im pretty damn sure I have an NXP one of those boards kicking around. Might have to test it out

[foxdie]

Sounds great Jason. Im pretty damn sure I have an NXP one of those boards kicking around. Might have to test it out

It's worth a bit of time to tinker with if you get bored I forgot to prefix LPC1768 with NXP, mine is also the NXP board (not that I'm aware of any others).

Setting it up is rather simple, I'm using a SKPang CAN-Bus Breakout Board, it was cheap and seems to work fine for sniffing;



Sending back into the network I'm having great difficulty with. The mbed says it's transmitted it, however I cannot see any response from what I'm trying to do. I've tried checking and rechecking my wiring, making sure "point A to point B" is conducting with a multimeter, and testing numerous packets. So far I've tried sending the following;

• Various Chime packets
• DIC message to dash LCD
• Volume up / down sequence from steering wheel
• Lock / unlock doors

Nothing seems to work. I get the feeling the MCP2551 (being a two wire CAN transceiver) can only receive in a fault tolerant capacity but not transmit. It could also be the CAN controller on the mbed too.

As this chip is also used on the SparkFun CAN-Bus Shield, can someone else with this board confirm if they've been able to successfully send packets into the network?

[jezzab]

I've used the Sparkfun CANBus shield with my Arduino and had no problems at all

[foxdie]

I've used the Sparkfun CANBus shield with my Arduino and had no problems at all

Just to be crystal clear, you've been able to send packets successfully?

Can you outline exactly how you've modified your shield to get it to connect and send? Any termination modifications etc?

Oh and how you connected it? Directly to the bus or via the OBD-II port?

Just had a suspicion that pin 1 will only allow read-only access to the bus.

[foxdie]

Oh and how you connected it? Directly to the bus or via the OBD-II port?

Just had a suspicion that pin 1 will only allow read-only access to the bus.

I think I just ruled this out. I disconnected my head unit and tapped into the green SWCAN wire with the breakout board's screw terminals, no change unfortunately (reading packets yes, sending packets fail). This is starting to get a little demoralising.

If any good has come from this though, it's that messages can be listened into and actions can be done, for example you could see when the head unit is in REAR AUX mode and then capture the scroll wheel input to control a Raspberry Pi or something.

I think I need to start looking at J2411 / GMW3089 single wire CAN transceivers.

[jezzab]

I've used the Sparkfun CANBus shield with my Arduino and had no problems at all

Just to be crystal clear, you've been able to send packets successfully?

Can you outline exactly how you've modified your shield to get it to connect and send? Any termination modifications etc?

Oh and how you connected it? Directly to the bus or via the OBD-II port?

Just had a suspicion that pin 1 will only allow read-only access to the bus.

Connected to the OBDII port. Can Hi tied to can low. I can send make chimes, do door locks etc. I can even change the startup logo on the radio with a couple of packets. But that's another story altogether :p

I made a few little apps that did little things like make the door locks go up and down with the steering wheel scroll wheel. One that reads the outside temp and displays it on the DIC on the instrument cluster. And a few more

[foxdie]

Connected to the OBDII port. Can Hi tied to can low. I can send make chimes, do door locks etc. I can even change the startup logo on the radio with a couple of packets. But that's another story altogether :p

Well, I tried tying CAN_H to CAN_L and it made things worse, no packets received. This is understandable though, the MCP2551 won't have anything to differentiate against if both signals equal each other.

I'm interested in the startup logo change via CAN. I already know the location of both the logo and VIM addresses in the EEPROM (and how to enable it via reflashing the IC with a clip-on programmer).

I made a few little apps that did little things like make the door locks go up and down with the steering wheel scroll wheel. One that reads the outside temp and displays it on the DIC on the instrument cluster. And a few more

So far all I've written is read-only stuff, such as "turn on this LED when the steering wheel scroll wheel is depressed" etc once I crack being able to transmit packets I"ll be able to do a lot more too. It's maddening to be so short of the goal, but gives me time to daydream and use my imagination to come up with endless possibilities

One such thing I'm planning on coding on my mbed is auto-closure; Roll up the windows when the car lock button is double-pressed. I know how to do this, having already played with the building blocks. It's just time to assemble it.

[ghodge]

Without having looked at your hardware setup, I have to ask if you tried tying CANL to ground to turn your interface into a single-ended one? Make sure you understand your hardware first though.