GM Lan Single Wire CAN Bus Sniffing

[ZerOne]

Hi there Iawza, and welcome to the forums !!!

The global A vehicle in which you speak, what model is it ????
(Sorry for my silly question, I am very new to the GM world, coming from local Ford Falcon vehicles)...

I am hoping that a lot of the ArbIDs are going to be shared.
For example, the Door Lock and Unlocking data we have works on both the Commodore/Pontiac G8, and an Impala SS, and I am sure many other models as well....

The chime function on the Commodore models is kinda weird / unique.
The chime examples posted up in the GMLan bible are for the different chimes the instrument cluster can make...
(Also, there is no side indicator relay, so a digitised click sound is played through the cluster speaker when the indicators are on)...

What is kinda weird is the above Park assist, the Radio makes the sounds for the distance away from an object.
(Its a kind of chime beep function, but it is directional)....

Ill try to explain that a bit better...
If you are parking, and you are approaching an object at the front drivers side of the car,
The front drivers side speaker will beep faster and faster you approach an object...
(I.E. you don't need to be really looking at the screen, you can sort of determine where the object is by listening to the direction of where the beep sound is coming from).....

So for example, the park assist beeps / chimes, I dont think they will be using the same ArbID as the existing chimes that have been worked out (such as low fuel, over speed, etc)....

Even with many of the ArbIDs in the GMLan bible, I can tell they will not be supported by any Commodore models.
(Examples include Digital TV, Seat Temperature (The Pontiac heated seats are not on the GMLan from memory)....

It will be interesting to see what works and what doesn't on different models though, and any log information will I am sure speed up the process...

Oh, and finally, I am hoping to release the SW GMLan header calculator in the next couple of days...
(I just need to make sure there are no bugs, and that it works properly under windows)....

Hopefully this helps newbies like myself to start playing around quickly, without having to do mental gymnastics trying to mask, shift, and calculate the header bytes for different ArbIDs...

Cheers
Matti

[ozatomic]

Hey guys another new member here. Got mysql VE CalaisV last year and have been interested in replacing the headunit and climate controls with a pc based system.

After doing some research have came across the GMLan Bible and this forum which has had some great information that I have been looking for. I have ordered myself some ELM329 chips which are the newer version of the ELM327 chips.

The only thing that i currently can't get my head around is how you are calculating the ArbID. Is there a simple formula for this?

Also ZerOne how is your little application coming along are you going to be releasing this as Open Source?

Anyway great work guys hope after i figure out this ArbID formula and my chips arrive in the mail i'll be able to help out more but untill then its a bit hard to log data

[lawza]

Thanks for the warm welcome! I'm working with a Buick Regal (Opel/Vauxhall Insignia), but the computer platform is shared between many, many cars and SUVs now. (Buick Lacrosse, Chevy Cruze, Chevy Malibu, Cadillac SRX, Chevy Equinox, GMC terrain, ...)

You have a good point about the chime arbID. I know that the chime in the Regal comes over the speaker regardless of type (seatbelt, door open, backing up...), and in fact the same chime mechanism and arbID activates when the turn signal is turned on to make a clicking noise. As you mention, the flasher module in this car has actually been replaced by software in the BCM! I think this still comes out from the stereo rather than a cluster speaker, though (the cluster doesn't appear to have a speaker inside). Makes it both easier and harder to hack.

Obviously not everything will be shared, but I was surprised how little is. It seems like many of the messages are not only not implemented, but have multiple meanings. I don't have my sheet in front of me, but I know that TMK's arb id for driver mirror position is occupied by something else on my car's bus (again, assuming I'm calculating things alright).

It's going to take a bit before I get up to speed - wrapping up with classes for the summer here - but I look forward to being a part of the community. I'm also trying to do a few other nifty hacks; today I pulled the EEPROM from the cluster in my car to see what features I can enable that the Opel has that the Buick doesn't.. apparently there's a way to edit the EEPROM over HS-CAN or SW-CAN (KWP2000?), but I can't figure all that out quite yet... I tried sniffing traffic from the Op-Com which claims to be able to read the VIN over SWCAN, but can't quite figure it out yet. Hopefully sniffing the traffic to the cluster with it out on the bench should help some.

[tmk]

Project update.. Openstar!

Since getting all the onstar turn by turn navigation stuff figured out.. I have been cobbling together my version of onstar.. I call it openstar..

Here is a (poorly drawn ascii) block diagram:

*Directions Setup web page*
^
|
V
*openstar processor*-> Directions from google api based on a endpoint and reported lat/long
^
| Updates with new directions ~5 seconds
V
*openwrt node in car with 3G connection * <-> GPS
^
| Displays turn by turn on DIC
V
*Arduino GM Lan gateway *

Had my first fully successful test run to work this morning!! I want to add a few display features (Nav Icons, the distance bar graphs, etc), I'll probably end up posting everything once I clean it up some.

Still hacking. Now with purpose!

TMK

[jezzab]

Nice work TMK

[jezzab]

Did some more testing. You don't need to register the nav to enable the display, just nav on every 5 secs. If you register it, it will say Please Wait on the screen. So maybe they are actually around the other way.

[tmk]

Which packet is that again? I'll give it a whirl again on the G8. Never had much luck but...

Updated the GM LAN bible. Added parking assist, the lock and unlock stuff and I think I have the nav attributes fully figured out. My Openstar turn by turn nav is working pretty slick. I'll post a video when I get some time to make it..

Still would like to be able to get the rear aux to switch via GM Lan and be able to control the backup camera.. Anybody have any captures with these systems in place?

TMK

[ZerOne]

I had a bit more of a play around with SW Can Sniffing today...
(Sorry I was going to do some last week, but the latest ubuntu updates destroyed my bluetooth support)...
I spent last night trying to sort it, and had a play today....

Some bad news first.
Jezza, I know you wanted to see if the window up / down functions were on the SW Can bus...
Looks like this stuff is not broadcast at all
(I was looking forward to some Arduino sheild fun to close the windows on a second arm)....
Looks like if we want this function, we will have to do it the ol fashioned way and use an output to drive a relay (For the front windows with auto up/down functionality), and a current sensing module for the back windows... (Dammm I know Volkswagen and Audi have had this feature available as a VAG programming option since the 2001 MKIV Golfs and Jettas)....

I logged a couple of other things (Will upload the logs tonight)...
Amongst the stuff logged.
Park Assist Enable packets (which are broadcast on a couple fo ArbIDs),
Park Assist Front Right, Middle and Left Max positions,
Park Assist Rear Right, Middle and Left Max Positions. (We should be able to work out the data format from the info we now have)...

Infotainment Enabled Packets (Looks like there is not a lot in there for us)....
And Security / Security Password data...

Will post it all up soon (Its on my other PC)....

[ZerOne]

Infotainment Operation Allowed

10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 80 C0 00 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
10 01 80 C0 CE 60 01
10 01 A0 C0 00 00
10 01 C0 40 07 65 14 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00

Platform Immobilisation Data

Ignition Switch Off...
10 01 80 C0 00 00 00
10 01 80 C0 00 00 00
10 01 80 C0 00 00 00
10 01 80 C0 00 00 00

Ignition Switch to Accessories
10 01 80 C0 00 00 00
10 01 80 C0 00 00 00
10 01 80 C0 00 00 00
10 01 80 C0 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 20 80 01
10 01 40 B0 04 00
10 01 A0 C0 00 00
10 01 80 C0 CE 60 01
10 01 C0 40 07 65 34 80 00 00 00 00
10 01 C0 40 07 65 34 80 00 00 00 00
10 01 80 C0 CE 60 01
10 01 C0 40 07 65 34 80 00 00 00 00
10 01 A0 C0 00 00
10 01 20 80 01
10 01 80 C0 CE 60 01
10 01 C0 40 07 65 D4 A0 E9 9A 72 9D
10 01 C0 40 07 65 D4 A0 E9 9A 72 9D
10 01 80 C0 CE 60 01
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 D4 A0 E9 9
BUFFER FULL

>
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 80 C0 00 00 04
0C 01 60 C0 07 66 00 00 00 00 00 00

Platform Immobiliser Password

10 01 80 C0 00 00 00
10 01 80 C0 00 00 00
10 01 80 C0 00 00 00
10 01 80 C0 00 00 00
10 01 80 C0 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 20 80 01
10 01 40 B0 04 00
10 01 80 C0 CE 60 01
10 01 A0 C0 00 00
10 01 C0 40 07 65 34 80 00 00 00 00
10 01 C0 40 07 65 34 80 00 00 00 00
10 01 80 C0 CE 60 01
10 01 C0 40 07 65 34 80 00 00 00 00
10 01 80 C0 CE 60 01
10 01 A0 C0 00 00
10 01 C0 40 07 65 D4 A0 3D 57 4E 07
10 01 20 80 01
10 01 80 C0 CE 60 01
10 01 C0 40 07 65 D4 A0 3D 57 4E 07
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 80 C0 CE 60 01
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00
0C 01 60 C0 07 66 00 00 00 00 00 00
10 01 A0 C0 00 00
10 01 C0 40 07 65 B7 80 00 00 00 00

Rear Park Assist Status..

Disable Park Assist (Gear Position Not in Drive or Reverse)
10 11 80 BB 0D
10 11 A0 BB 40

Enable Park Assist (Gear Position in Drive or Reverse)
10 11 80 BB 0C
10 11 A0 BB 20

[ZerOne]

Rear Left Hand Side Sensor (Moving towards an Object)
From No Bars to the 3rd Orange Bar)

Code: Select all

10 11 C0 BB 10 FF 00 00
10 11 E0 BB 10 FF 00 00
10 11 E0 BB 10 6F 04 00
10 11 C0 BB 00 FF 00 00
10 11 E0 BB 00 FF 00 00
10 11 C0 BB 10 FF 00 00
10 11 E0 BB 10 FF 00 00
10 11 E0 BB 10 6F 04 00
10 11 C0 BB 10 AF 06 00
10 11 C0 BB 10 8B 05 00
10 11 C0 BB 10 FF 00 00
10 11 E0 BB 10 7A 04 00
10 11 E0 BB 10 FF 00 00
10 11 C0 BB 10 5D 00 40
10 11 C0 BB 10 5B 00 40
10 11 C0 BB 10 58 00 30
10 11 C0 BB 10 55 00 30
10 11 C0 BB 10 53 00 30
10 11 C0 BB 10 50 00 30
10 11 C0 BB 10 4E 00 30
10 11 C0 BB 10 4C 00 30
10 11 C0 BB 10 49 00 30
10 11 C0 BB 10 47 00 30
10 11 C0 BB 10 45 00 30
10 11 C0 BB 10 43 00 30
10 11 C0 BB 10 40 00 30
10 11 C0 BB 10 3E 00 30
10 11 C0 BB 10 3C 00 20
10 11 C0 BB 10 39 00 20
10 11 C0 BB 10 37 00 20
10 11 C0 BB 10 35 00 20
10 11 C0 BB 10 33 00 20
10 11 C0 BB 10 31 00 20
10 11 C0 BB 10 2F 00 20
10 11 C0 BB 10 2D 00 20
10 11 C0 BB 10 2B 00 20
10 11 C0 BB 10 29 00 20
10 11 C0 BB 10 27 00 20
10 11 C0 BB 10 25 00 20
10 11 C0 BB 00 FF 00 00
10 11 E0 BB 00 FF 00 00


Rear Left Hand Side, 4th Red Bar displayed...

10 11 C0 BB 10 FF 00 00
10 11 E0 BB 10 FF 00 00
10 11 C0 BB 10 1E 00 10
10 11 C0 BB 00 FF 00 00
10 11 E0 BB 00 FF 00 00

Rear Middle, 4th Red Bar displayed...

10 11 C0 BB 10 FF 00 00
10 11 E0 BB 10 FF 00 00
10 11 C0 BB 10 1E 01 00
10 11 C0 BB 00 FF 00 00
10 11 E0 BB 00 FF 00 00

Rear Right Hand Side, 4th Red Bar Displayed...

10 11 C0 BB 10 FF 00 00
10 11 E0 BB 10 FF 00 00
10 11 C0 BB 10 1E 10 00
10 11 C0 BB 00 FF 00 00
10 11 E0 BB 00 FF 00 00

Front Right Hand Side, 4th Red Bar Displayed...

10 11 E0 BB 10 FF 00 00
10 11 E0 BB 10 1E 10 00
10 11 E0 BB 00 FF 00 00

Front Middle, 4th Red Bar Displayed...

10 11 E0 BB 10 1E 10 00
10 11 E0 BB 10 1E 11 00
10 11 E0 BB 10 1E 01 00
10 11 E0 BB 00 FF 00 00

Front Left Hand Side, 4th Red Bar Displayed....

10 11 E0 BB 10 FF 00 00
10 11 E0 BB 10 1E 00 10
10 11 E0 BB 00 FF 00 00