/r/CarHacking

Photograph via snooOG

Car Hacking - The ECU and protocols like CANbus have become the heart and brain of most modern cars, but it has also become a locked down black box. This is a place for people interested in taking back control of the car they bought. New age hot rodders, ECOmodders, Security researchers, the curious, the paranoid, and the tinkerers are all welcome. We encourage the use of open source solutions and tools like arduino and rasberry pi.

Purpose:

  While the engine is the heart of the car, the ECU has become the ever-evolving, all-knowing brain. However, this brain is a closed, locked-down black box. This is a place for people interested in taking back control of the car they own or keeping others out. New age hot rodders, ECO modders, security researchers, the curious, the paranoid, and the tinkerer are all welcome. Discussion is not limited to the ECU, post any hacked DIY Aero, powertrain, suspension, or other car topics the community might like.  

Goals: The car hacking community is alive but fractured and decentralized, let's start by aggregating all of the many projects, and hackers. We would also like to encourage the use of Open source hardware and software. Our long term goal is to become the most technical car subreddit.  

Mod note: Most of my time is taken up building hardware, if a better person for the community comes along I would be willing to hand over the sub. We could also use help with our documentation/Wiki.  


Getting started

Resources

Related Sub Reddits

Tools

Technical Forums

Advocates

Other social media


Flair Filters

CAN LIN SWCAN J1850 PWM J1850 VPW ISO 9141 KWP 2000 Multiple No Protocol

/r/CarHacking

27,120 Subscribers

0

How will I know?

So, I have a 2020 Kia Soul and for sometime I have felt the computer has been screwed. I took it last year for an oil change and the dealership said it was the battery, at 14%, I thought no way. So I took it to a mechanic, he said the battery was at 78%. So I'm thinking that Kia is Lying. I take it back and then my husband gets swindled, mine youni would have caved in sooner than him, by Kia and just gets the battery. This was 2-17-24. Recently my transmission was going anai heard a metalic sound from the engine. My mechanic says take it to Kia, see what diagnostic they can do to pinpoint. I Do, and they say it the transmission, and a faulty battery, again. I called Kia to inquire what kind of diagnostic they do and can I have a report to show me. "there is no report, the mechanic can hear a metailtic sound when you go on or above 1800 RPM. I'm like " No report, for $150 you have nothing to back up what you are saying." The I go in a out the battery needing replacement only after 9 months. So, I take it to my mechanic, have him fix the transmission, and then it's back to Kia for a new warranty battery. But when I decided to clean off the dead bugs and Garage grim from the last week I noticed what in the picture. This is taken on the side of the engine, you can see ethe seam from metalic panel to plaatic panel, driver side of the car. My questions is 1- would some device addee to the computer rmcayse a battery to drain so quickly? Is there proof somewhere I can look to see if I'm hacked? Second aren't these .arms to precise in the metal panel to be something sprayed or poured on to? Should I be cautious in driving my vehicle ?

0 Comments
2024/11/09
18:43 UTC

0

Step 3 failed

why does this function fail? This is the only one that fails, any idea why? I cannot program a key for this car

2 Comments
2024/11/09
17:58 UTC

11

My car has a USB port for tuning

Complete noob to anything like this but ready to learn and have dealt with similar stuff, how do I tune?

28 Comments
2024/11/09
16:36 UTC

0

2024 autel km100

i’m using an autel km100 but i cannot go to universal key as 2024 is not supported. I’m new to programming but how would i continue to do this process?

2 Comments
2024/11/09
15:24 UTC

2

Assistance needed with interpretation of Transport Protocol / Diagnostic messages SAE J1939

Assistance needed with interpretation of Transport Protocol / Diagnostic messages SAE J1939

Hello Community,

 

as stated in the title I need some assistance with interpreting a diagnostic message.

 

First off all some background. I have a workbench setup where I have connected a dashboard instrument cluster of a commercial truck via some CAN BUS connectors to my PC. I can send various messages and the gauges etc. react on the messages. What I get constantly is, that the dash board is sending a TPM message followed by six payload messages.

 

Based on the first message from Id 0x18ECFF17 with the data 20 2A 00 06 FF CA FE 00

 

I understand that I have a Broadcast Announce Message (BAM), that has a Size of 42, has 6 Packets, and belongs to the PGNumber 65226. This message belongs to Transport Protocol - Connection Management (TPCM). From my understanding PGN 65226 belongs to Diagnostic Message 1 (DM1) Active Diagnostics Trouble Codes. So my instrument cluster is trying to tell me that it has some trouble codes.

 

And then I receive six messages (from 0x18EBFF17) , that in my understanding belong to the Transport Protocol - Data Transfer (TPDT). I get following messages:

 

01 C0 FF 13 F8 24 FE 23

02 F4 E4 FD 23 F5 04 FE

03 23 F6 04 FE 23 F5 84

04 FE 23 F7 24 FE 23 F7

05 64 FE 23 F8 44 FE 53

06 F5 24 FE 53 F5 A4 FE

 

I now the first byte is the counter, but from here I struggle how to interpret/decode the payload of this multi packet message, and how to understand the content.

 

So can anybody help me and explain or hint to me (or at least point me to some more detailed guide) how to read the message so I can understand the content of the diagnostic codes? And also if there are these diagnostic codes, can I also "delete" them?

 

So far I wasn't acting in the area of multi packet messages and diagnostic messages, I tried to understand this but the sources I tried to read didn't really enlighten me and I got only partially understanding and missing some final bit of information here. I appreciate your assistance.

 

Greetings and thanks in advance

Kowalski911

0 Comments
2024/11/09
14:47 UTC

2

BMW E90 DSC disable via canbus

In the E90, the ABS/DSC unit receives the DSC disable command via the bus. Does anyone happen to know that command?

7 Comments
2024/11/09
06:05 UTC

0

Aston Martin Spanish Oak Flash Tool

The Aston Martin Spanish Oak Flash Tool is a specialized utility designed for reading and writing the flash memory of Aston Martin EEC-VI Powertrain Control Modules (PCMs). Developed specifically to support the unique demands of Aston Martin’s V8 and V12 engines during the Ford ownership years, this tool seamlessly interfaces with the Ford-engineered EEC-VI PCMs found in these iconic vehicles.

With the Spanish Oak Flash Tool, users can perform binary readouts and writes on Aston Martin models equipped with either single PCM (V8 engines) or dual PCM setups (V12 engines). This powerful functionality enables precise data extraction and programming, catering to both enthusiasts and professionals seeking control over the sophisticated systems within Aston Martin’s V8 and V12 engines.

Key Features:

  • Dual PCM Support: Compatible with dual PCM configurations in Aston Martin V12 models, alongside single PCM applications in V8 models.
  • Binary Read/Write Capability: Read a full binary image of the PCM flash memory and flash back updated or custom binary files for customization or restoration.
  • Dedicated to Ford EEC-VI Architecture: Tailored to Aston Martin’s EEC-VI Ford PCMs, ensuring accurate and reliable communication with the engine management system.

Aston Martin Spanish Oak Flash Tool – Tester Present

0 Comments
2024/11/08
07:53 UTC

0

Ghost mode?

Has anyone figured out the method to blackout all lights exterior and interior when engaging drive or any other condition? Obviously for surveillance. Ultimately want this S an obd2 solution, but hard tapping is an option. I gather a gateway device (2 channel) would allow me to parse out the packets that contain the lighting codes, then nullify them and pass back into the main channel. Challenge: Location of tap Detective the packet, segment and code.

Modern vehicles, Cherokee seems especially hard

Anyone done this?

18 Comments
2024/11/06
00:39 UTC

0

How do I get into mhh?

I’ve sent an email for code but haven’t heard anything in weeks. Anyone have any tips? I need to download a program off there

7 Comments
2024/11/05
01:56 UTC

6

Which firmware to flash and which software to use with this USB CANable device?

5 Comments
2024/11/04
23:32 UTC

0

Can't understand codes

Hi everybody, I am currently doing a kind of scanner, communicating with a elm327.
I am not understanding the responses I am having, it is not simple hexadecimal information as I understand, I also understan that 0d3e is something like a line jump or so, can someone explain me what the responses mean?

Enviando comando: ATE0
Notificación recibida: 0d3e
Enviando comando: 0100
Notificación recibida: 3431203030203830203030203030203031200d
Notificación recibida: 0d3e
Enviando comando: 03
Notificación recibida: 3433203030200d
Notificación recibida: 0d3e
Enviando comando: 07
Notificación recibida: 3437203030200d
Notificación recibida: 0d3e
Enviando comando: 0A
Notificación recibida: 0d3e
Enviando comando: 0101
Notificación recibida: 3431203031203030203037204535203030200d
Notificación recibida: 0d3e
Enviando comando: 012F
Notificación recibida: 3431203246203446200d
Notificación recibida: 0d3e
Enviando comando: 0105
Notificación recibida: 3431203035203439200d
Notificación recibida: 0d3e
Enviando comando: 0152
Notificación recibida: 0d3e

1 Comment
2024/11/04
17:30 UTC

0

AllData/Identifix/ProDemand Free or Cheap?

I can’t seem to obtain a registration code for Mhhauto, but I’m looking for AllData updated crack/login/key. I see things in there that look like it may be the real deal I just have no access..

I really want Alldata, however I’d suppose any would really work. Could anyone by chance help with this, I’ve been out of the hacking game for some years, so I’m not really sure all the details on what’s popping when it comes to legitimacy of these sites and users.

I’d greatly appreciate it, PMs are also accept, i know it’s out there somewhere

5 Comments
2024/11/04
16:57 UTC

3

newer GMWs? TCU integration for GM Global A

I am looking to implement TCU CANbus integration with a standalone ECU on 2013 Malibu which is a GM Global A vehicle. I have some amazing GM PDFs like GMW8762 but neither of them seem to cover for instance 0x199 ID? Also 0xD5 0xD7 0xD9 etc.

All the GMWs I have a 2011 and older, did GM stop publish those or am I just failing to locate newer editions? Are there any relevant DBC files available for direct injected era of GM?

7 Comments
2024/11/04
13:56 UTC

2

Help! Using MCP2515 and ESP32 to read CAN bus.

Hi folks, I'm new to microcontrollers and for my first project I wanted to attempt to read CAN over OBD2. I initially wanted to ensure I can communicate over the CAN bus so I set up two esp32s to try and communicate. I followed this tutorial with the only difference being I didn't have a temperature probe but instead just send arbitrary data.

Unfortunately I cannot get the receiver to receive anything. I am unsure if it's an issue with the tx or rx side but on the tx side I get a return value from the send function that implies it was transmitted.

Would anyone on here be able point me in the right direction as I can't figure out where I'm going wrong. I'm aware that the esp32 only needs a transceiver to communicate over can but I would ideally like to make it work with the hardware I already have.

5 Comments
2024/11/04
08:50 UTC

1

Codes Obd-II

Hey, I want to comunícate via ble to a elm327 and send commands, I want to understand what kind of commands are compatible, I did a research already but I can’t fully understand. Can someone recommend me a path to study?

1 Comment
2024/11/03
03:15 UTC

2

remote control possible?

I am wondering if it's possible to design an app which enables me to change some stuff in my car, like starting it, climate controll, locking/unlocking..

Or at least - how to implement those features in the car. Programming an app would not be that hard for me, but everything relating car is quite a mystery.

Does anybody know what would be needed for this sort of project? How do I find out whether certain buttons are mechanic or electrical powered?

Thanks!

1 Comment
2024/11/02
21:57 UTC

2

MDI2 sps for GM

Dear all Any body here can advice me how can i subscripe to mdi2 software without spending a lot of money for every vin i have workshop in the middle east Thanks in advance

2 Comments
2024/11/02
20:10 UTC

1

Getting around hacking my VW T5

A number of questions that I hope you knowledgeable lot can answer. I'm doing an EV conversion on a VW T5 1.9L from 2005. In doing so I'll need to have the canbus hacked. 1st - where's best to take some running vehicle can logs from? I can hack into wiring if needs be but if there's a nicer location elsewhere to get the necessary CAN data that'd be great.

2nd - in doing so I'm thinking of buying a 2nd hand dash and bench testing the setup with this first, at the same time I might upgrade to a MFA display, any idea if a display from a Golf or other VAG vehicle can be retrofitted to the T5 dashpod? I've found videos of new MFA displays being fitted but nothing clear on whether other vehicle MFAs will swap into place.

3rd - I've read the can systems on these vans are "older" that those used on the cars if the same era, what likely differences will I encounter?

4th - If I playback a canlog using savvycan from a similar VW vehicle to my van without the engine running, should I see the dash react in the same way as if it were in the running vehicle?

5th - not sure yet but there'll likely be more!

6th - oh yeah, can I playback a canlog over the ODB2 port? It's a k-line port to the gateway so I suspect not but worth asking...

Thanks, I'm aware these are all things I can answer myself but my time is short and the knowledge here is really great and I'll likely get a much better and clearer answer asking here than I would messing around in the van whilst trying to 2nd guess if an issue is my can log setup or not.

7 Comments
2024/11/02
08:08 UTC

0

Do cracked programs still have test plans?

If I got an old copy of gds2,ids, etc. When navigating fault codes does it still provide the own test plan? Or is that blocked since it’s not officially on the server?

0 Comments
2024/11/02
03:41 UTC

3

Beginner: Can an ODB-II port device speed govern?

Hi all, I'm basically trying to find out if most modern cars will allow you to govern speed or not using the ODB-II port. This could be done either by setting a max speed, max throttle, or lightly hitting the brake, but I'm wondering if the physical pedals will override and stop these approaches from working?

9 Comments
2024/11/01
21:48 UTC

4

What are these components?

Can anyone identify these components in this homemade repeater?

5 Comments
2024/11/01
21:25 UTC

3

Seeking help obtaining Volvo immobilizer security PIN

Not really a "hack" request here but I am trying to obtain the immobilizer PIN for my 2009 Volvo XC70 (P3 platform) as I need to lower the security for the radio system. I'm marking it as "key fob" because that uses the same PIN so it seems to be the closest flair option.

There are 2 programs I know of that can do this - P3 Tool and VDASH - which are both not working for me. The dev for P3 Tool confirmed it will not work for my year model (awesome) and VDASH gives me a "Read Error 581" when running the decode PIN task. I've reached out to VDASH support twice so far and still waiting on an answer.

If anyone here happens to have experience with Volvo PIN stuff, I am hoping to find alternative methods to getting this PIN or suggestions on how to avoid that read error. Volvo's own software (VIDA) can technically do it, but from what I've read sounds like it needs additional software that only the dealer will know about so it seems like that option isn't feasible. And, dealers can only lower it until it leaves the shop, at which point they have to put it back which defeats my purpose here.

This is the only thing I need to restore functionality to my radio, which I really miss having.

5 Comments
2024/10/31
19:11 UTC

4

Dodge Dart CAN PIDs

Hi guys! My first post here, I bought a chinese carplay retrofit box. It works overall but I can't switch back to the OEM screen. They said it's a firmware issue and asked if I can provide them PIDs to make correct firmware for Dart. I have a Journey firmware.

Could someone help me getting these or share (maybe paid)?

It seems that Dart shares the same PIDs as Fiat 500 so they'll work too.

I have some but it's not enough.

The PIDs are these

Buttons front left side of steering wheel:

0814C035#00 00 00 00 00 10 0C FF

0814C035#00 00 00 00 00 04 0C FF

Thank you!

0 Comments
2024/10/30
22:04 UTC

0

ABS, ESP, etc. light on cluster

Hello it's me again, is there anyone who has a knowledge about ABS, ESP or other lights on the cluster and how to turn them on in some situations? I've already found that the ABS light can be found on KOMBI_01, I tried to send a message with 1 on the byte that is used to display ABS light, but nothing happened. Is there anyone who can help me?

Thanks in advance

9 Comments
2024/10/30
21:56 UTC

16

Car Stolen, now working on educating the community.

Hi Guys,

Unfortunately me and a few others in my local community have had their car stolen in the neighbourhood via relay attack.

Im a military veteran and know a little bit about comms and radio frequencies. It's now something that I'm keen to understand/teach myself how this occurs and also teach the local community how to prevent this from happening in the future. Is it very costly or too technical for average folk to understand? If anyone knows of any good reading material, software or hardware which could help me setup something to show my community that would be great.

Thank you!

33 Comments
2024/10/30
11:11 UTC

3

Transmitting on the CAN Bus (Beginner)

Hi all, beginner here looking for some advice.

I'm trying to transmit onto the bus and cause the high-beams to activate / deactivate, for example. I am not up to anything mischievous, this is just a proof of concept idea.

If I've found the right Arbitration ID and correct bytes to send onto the bus to activate the high-beams, is that all that's needed to send properly onto the bus? This is also assuming I am sending from behind the gateway.

In my tests, I have not been able to get my message to trigger a change of the lights. I believe I'm sending on to the bus correctly, but I see messages coming from the ECU (Arb ID #140) that controls that function also repeatedly sending that the high-beams are off. So, I can see pairs of messages going: mine saying they are on, and the real ECU saying they are off.

I've tried playing with the timing I am sending the messages, thinking I can overwhelm the messages that are saying the high-beams are off and get the system to respect my message. This hasn't worked.

I'm wondering if I'm missing something fundamental about the CAN Bus - if two sources are sending the sending the same Arbitration ID but different data, who wins? Is there some way to make my message the dominant one?

If I'm doing everything right, then maybe I have the wrong arbitration ID or data bytes. I'm just not sure which area I am messing up (or both!)

Thanks for your advice! I feel like I'm close but missing something key to the process.

7 Comments
2024/10/30
02:55 UTC

0

NERS

Anyone got an offline version of ners?

1 Comment
2024/10/29
18:51 UTC

0

Download a file from https://www.cartechnology.co.uk 🙏

Hello, someone help with downloading the following file: https://www.cartechnology.co.uk/attachment.php?aid=202759 from topic https://www.cartechnology.co.uk/showthread.php?tid=95569 and send it to pavelppp888@abv.bg.

Thanks a lot! 🙏

4 Comments
2024/10/29
11:31 UTC

Back To Top