/r/CarHacking

Photograph via snooOG

Car Hacking - The ECU and protocols like CANbus have become the heart and brain of most modern cars, but it has also become a locked down black box. This is a place for people interested in taking back control of the car they bought. New age hot rodders, ECOmodders, Security researchers, the curious, the paranoid, and the tinkerers are all welcome. We encourage the use of open source solutions and tools like arduino and rasberry pi.

Purpose:

  While the engine is the heart of the car, the ECU has become the ever-evolving, all-knowing brain. However, this brain is a closed, locked-down black box. This is a place for people interested in taking back control of the car they own or keeping others out. New age hot rodders, ECO modders, security researchers, the curious, the paranoid, and the tinkerer are all welcome. Discussion is not limited to the ECU, post any hacked DIY Aero, powertrain, suspension, or other car topics the community might like.  

Goals: The car hacking community is alive but fractured and decentralized, let's start by aggregating all of the many projects, and hackers. We would also like to encourage the use of Open source hardware and software. Our long term goal is to become the most technical car subreddit.  

Mod note: Most of my time is taken up building hardware, if a better person for the community comes along I would be willing to hand over the sub. We could also use help with our documentation/Wiki.  


Getting started

Resources

Related Sub Reddits

Tools

Technical Forums

Advocates

Other social media


Flair Filters

CAN LIN SWCAN J1850 PWM J1850 VPW ISO 9141 KWP 2000 Multiple No Protocol

/r/CarHacking

23,292 Subscribers

0

I have an idea about a cruise control that would be limited by a selected “fuel mileage “

I currently drive a 2014 Vw that has regular cruise control. My question is whenever I’m on a long trip (6 hours) I set the cruise control and my fuel mileage goes up about 10 L/100 km. So if I baby the pedal I can get a good 5.5-5.8 L/100 km but if I use the C/C every hill it gives it a lot of gas to keep the same speed. Well tbh I don’t care if it stays the same speed. I’d rather for example limit the rpm the cruise control is alowed to give and let the speed creep down and slowly increase once pass the hill

Sorry if formatting is weird I just found this community and really wanted to post asap (on my phone)

10 Comments
2024/04/03
22:36 UTC

5

SAE/ISO 21434 impact on existing scanners/protocols?

Once vehicle manufactures start complying with the above cybersecurity standards (2026+?), won't that require updates to all those vehicles scanners used by garages...and crooks?

I imagine it will no longer be possible to simply communicate with a vehicle to program new keys etc.

19 Comments
2024/04/03
16:50 UTC

28

Looking for a ISO of this DVD 📀 please

I'm looking for telematics DVD 📀 204 827 10 00 for NTG 4.0 HU anyone have a copy they can upload to drive or mega upload?

9 Comments
2024/04/03
12:45 UTC

6

Honda's CAN networks

Hi.

I'm gonna do some sniffing on CAN in my Honda Accord 2011, but after reading few articles in web I'm confused about B-CAN network.

  1. What speed is this finally? 33.3 or 125kbps?

  2. Is this single wire, so I use only HCAN and LCAN is grounded? Can it be handled by any can transceiver or need specific one for such single wire connection?

Any advice regarding sniffing CAN in Hondas would be appreciated!

Thank you!

3 Comments
2024/04/02
13:18 UTC

2

Tactrix Multi Frame Messaging

Hey guys, I'm trying to understand the format for sending long messages over ISO 15765 with the tactrix. I cannot find any information on how to format this, so I'm currently flashing my ECU, and I have to send a couple thousand bytes as a firmware block.

void sendFirmwareBlock(const std::vector<unsigned char>& block, int blockNumber) {
    if (!downloadRequested) return;

    PASSTHRU_MSG msg;
    memset(&msg, 0, sizeof(msg));
    msg.ProtocolID = ISO15765;
    msg.TxFlags = ISO15765_FRAME_PAD | CAN_29BIT_ID;

    
    msg.Data[0] = 0x18; 
    msg.Data[1] = 0xDA; 
    msg.Data[2] = 0x10; 
    msg.Data[3] = 0xF1; 
    msg.Data[4] = 0x1F;
    msg.Data[5] = 0xFF;
    msg.Data[6] = 0x36;
    msg.Data[7] = 0x01;

So this is what I have assuming I need to send the address in the message, then 1F FF for multi frame messaging, then 36 01 indicating transfer block 1. Would I then fill the firmware block of data within a singular msg.data point? does the tactrix API handle the rest of the multi frame messaging? or am I way off here?

8 Comments
2024/04/02
07:32 UTC

3

Anyone know of a website that may still have the Macchina M2 OBD2 or when it might be back in stock?

Or a device with similar capabilities?

1 Comment
2024/04/02
03:51 UTC

2

Remap for an Opel Astra with the Delco E88 ECU

Hi guys, I see this has never been talked about in here, and it concerns an ECU that is apparently not possible to remap. It is the Delco E88 ecu, which I have on my 2019 Opel Astra (1.4 Turbo 125 hp).

I asked a bunch of different remappers here in Belgium and the few who already responded say that some devs are working on it. Would anyone in here have more information about these researches? Why does it happen that that specific ECU isn't accessible yet 4 years after?

3 Comments
2024/04/01
21:00 UTC

1

Aftermarket Keyless Entry System Question

Hey yall so I have a 1998 BMW E36 328i Sedan and I installed a Keyless Entry System (Viper 3100V) everything works the siren sounding and the doors lock and unlocking but there is one thing when I lock the car the siren chirps twice and the alarm is not set and when I unlock it chirps once and the alarm is set when I shut the unlocked door the alarm goes off from the motion sensor and supposedly its supposed to chirp once when it locks and the alarm system is active and twice when you unlock it no alarm system active do anyone know what's going on?

5 Comments
2024/04/01
19:32 UTC

2

Jeep Uconnect predefined text messages : alter ?

Uconnect has a set of predefined messages that I use.

I don't want to alter the way I have things set up and use Google assistant or anything else.

I like the uconnect option - I just want to change the preset responses a little or add a short new one...

0 Comments
2024/04/01
15:00 UTC

0

Absolute beginner questions about how do I upload code to a car?

I have heard cars run on Linux and I want to try uploading an application with a Meltdown exploit to see what the a car's Linux kernel has in it.

  1. Are there any guides to making a physical test bed, I have a bit of budget to try this on real hardware that isn't my car?

  2. How do I upload to a car's main Linux machine?

1 Comment
2024/04/01
08:46 UTC

2

Arduino pops and bangs

I had an idea to make a car do pops without actually messing with the ECU. If we use and Arduino to be between the MAF and the ECU, while also reading the rpm and accelerator pedal position, and I program it when certain condition are met, instead of forwarding the MAF readings it send a value to mimic high air flow so the ECU will inject more fuel while the the throttle is almost 0 so we will have so much fuel with almost not air ! Thoughts?

4 Comments
2024/04/01
03:47 UTC

2

kess v2

is there any free/cheap alternative to ecm titanuim to edit files read by kess v2 5.017 chinise clone

0 Comments
2024/04/01
00:57 UTC

6

mitsubishi ECU disassembly. ghidra m32r processor language

0 Comments
2024/03/30
09:52 UTC

0

MHH Auto Contact

Hi. Does anyone have access to mhhauto? i need contact of user id SkyMoon,email or others will be fine. Need to buy some files from Him. Help me please.

thank you

6 Comments
2024/03/30
05:47 UTC

1

Caterpillar .Bin Encryption help

Hi Guys,

I know its not car related, but there seems to be a lot of intelligence in this group.

I was wondering if anyone could steer me in the right direction here?

I have removed an SRAM (IS65C256AL) from a CMS(Cat Monitoring System) caterpillar machine and was able to dump the .bin file using my T48 Programmer after lots of trial and error. I have attached a snip.

a bit of googling says they use a 1's complement encryption which i have heard of before. Does anyone know how i can do this? i have Notepad++ with Hex editor and also WinOLS but i am not sure how to proceed. I have viewed in ANSI and UTF-8 and there is nothing recognisable which is making me think it is encrypted.

For reference, I am trying to find a section in the .bin where different alarms are triggered(specifically engine oil pressure) to see if i can edit and drop the trigger point. It sounds like there are check sums that i will also need to work out if i am able to edit, but that is another Journey for me to go on.

TIA

5 Comments
2024/03/30
04:34 UTC

5

AWD VW or Volvo CAN dump request

Hi all - anyone who has an all wheel drive VW or Volvo, I'm looking for a CAN data dump from the high speed bus that includes the Haldex controller (Generation 4).

Basically I'm adapting a Gen 4 Haldex onto a different vehicle, and before I go making my own standalone controller (or buying one - but I like doing things the hard way), I'd like to see if I can fudge the data from the ECU, BCM, ABS etc. into it.

I have a Gen 4 Haldex from a 2011 Volvo S60, and another one from a 2011 VW Tiguan, so a dump from either would get me going

cheers

1 Comment
2024/03/28
23:24 UTC

3

Hacking the BMS can data for a Lexus UX300E battery pack

Hi so first of all, I'm pretty new to all this so go easy and explain like I'm 5.

I'm doing an EV conversion and have bought a battery pack from a crashed Lexus UX300E for very cheap. I'm trying to reuse the original BMS as it is well integrated into the battery infrastructure, controlling cooling fans, solenoids, coolant lines, heaters and a lot of different temperature sensors.

The BMS is separated into two units, the Main unit and the secondary unit. The main unit connects to all the auxiliary heating and cooling relays and sensors. The secondary unit connects to the battery cell taps and the temperature sensors.

I've done several canlogs of the main unit connected up and tried to see responses in the CAN data by heating temperature sensors and disconnecting different elements (battery cells, auxiliary items etc. but I'm struggling to find anything that gives me a clear idea of what the CANids are for. I've looked for a DBC files but there doesn't seem to be anything close to what I need. Does anyone have any recommendations on the way to approach this or any tips on how to interpret the data? I'm currently using SavvyCan and an Esp32 3S. There are two can buses, can 1 has most of the data, can 2 has about 5 IDs that don't change.

I've tried separating out the main and secondary units and comparing can logs but I don't get anything out of the secondary unit itself unless the main unit is connected.

I've also been recommended to try and send some ISO-TP requests but I need to know what these are, I've got Toyota tech stream and a Mongoose cable, if I were to fire this up and log the can on the mongoose, would this give me the necessary message to request data from the BMS? Thanks.

0 Comments
2024/03/28
20:05 UTC

23

How to bypass front crash impact sensors?

52 Comments
2024/03/27
23:31 UTC

0

Need a file From MHH AUTO

Hello i need "linea blocked ( Off 'Cancheck' )Code 3465 3465 Part No 7 640 387 316.rar" please help me :( fiat 323 mp3 my10 sb 08 radio blocked - MHH AUTO - Page 1

1 Comment
2024/03/27
20:44 UTC

1

Buik Radio Lock

Can anyone point me in the direction on how to unlock an 06 buik lucerne radio, it seems like something failry simple feel free to pm instead of posting.

0 Comments
2024/03/27
13:34 UTC

3

How Rolling code works?

Can anyone please explain how rolling codes in key fobs work? I am very confused. If each time the key fob sends different signal data, how is it not possible to replay attacks? If I capture the signal from the key fob, which is not near the car, and then attempt to replay it, shouldn't it work? Additionally, I also have a second key fob; how is it functioning? Every time I exchange the key fobs, the car still unlocks. How does this work?

2 Comments
2024/03/26
13:59 UTC

2

Carista OBD2 scanner blinker problem AUDI A3

Last year I took out a carista subscription for my Audi A3 2008 Sportback 8P. This allowed a maintenance report to be removed from my vehicle. The app also gave me the option to make other adjustments to the vehicle. I had chosen to turn my lights on automatically when the vehicle is open. But this left my indicator lights on when I turned on my driving lights/daylights. I have checked and unchecked every other adjustment, but unfortunately my blinkers now stay on when I turn on my daytime/driving lights. As a result, my vehicle will always be rejected at the Belgian car inspections. I've been having this problem for a year now and have tried everything.

Hopefully someone knows this problem and can help me. Otherwise, the vehicle can never be legally driven in Belgium again. :( RIP

Thanks for the effort!

Kind regards
Clone

1 Comment
2024/03/26
13:57 UTC

3

Good canbus data logger and simulator to inject canbus algorithms.

I'm seeking a tool capable of reading CAN and LIN data from both the OBD port and by directly tapping into the CAN wires. Specifically, I need data on button presses, throttle and brake pedal positions, RPM, and central locking status. After obtaining the data, I want to be able to add algorithms and inject them into the CANbus for testing purposes. Can you recommend a budget-friendly tool that can accomplish all of this without requiring the development of microprocessors or modules at this stage? I had a look at the canedge 2 but not sure if its capable of doing all this including testing my algorithm.

4 Comments
2024/03/26
07:55 UTC

1

Seat Leon FR 2010 Radio

Having problems with the media system on a seat Leon FR 2010, able to connect Bluetooth to the phone but the Bluetooth option in the centre console has disappeared when we click media nothing happens now and when we click phone it just mutes? It did previously show Bluetooth options on the centre radio console

6 Comments
2024/03/23
10:25 UTC

0

Kia from mass

Does any one know away to reenable kia connect? In any car sold from mass is permanently blocked from Kia connect. This is regardless of you live in a different state and have the car registered there.

0 Comments
2024/03/22
23:33 UTC

4

MHH Auto Legit? Happy to pay.

I recently got a mid-2000's Mercedes as a project car. Trying to get a copy of Xentry to actually communicate with the car and clear out codes as I fix stuff.

Seems like MHH auto has a lot of aio Xentry files. Is that place legit, and does anyone have any experience becoming am member and installing Xentry? Just trying to get this thing sorted out so I can get this car back on the road. I think it'd be a lot of fun to push some of the sensors and diagnostics with the software, as I hear that people have great success reprogramming Mercedes cars to do custom functions.

And no, I'm not asking for a download link. Just trying to figure out if it's a legit place before sending them $$$.

19 Comments
2024/03/21
22:00 UTC

7

KWP2000 decoding doc

I am working on a B-Tech project, we are working with OBD on bharatbenz BS6 truck sent request data, 87 15 F2 22 1D 2 FF FF FF FF CB got some response data like this "87, F2, 15, 62, 1D, 2, F7, 1, F4, 1, FC," we can not understand what this data really mean, all we got to know is that it works on kwp2000 protocol , can you provide documentation of KWP2000 to decode the packets or suggest community where i can ask such automobile / autosar queries/

7 Comments
2024/03/21
10:26 UTC

0

I want to start a car coding business , where can i learn for doing this ?

I would like to focus on mercedes car.

Where can i self learning or online teaching ?

Thanks

4 Comments
2024/03/21
06:27 UTC

1

Tuning a car with no support?

I've been researching this topic for about a month to no avail, but came across this sub so hopefully someone can point me in the right direction.

I have a 2013 Acura ILX with the 2.0L SOHC R20A1. This engine only came in the 2013-2015 Acura ILX in the US, 2008 Honda Stream RSZ (International), and EUDM 2007-2011 Honda CR-V. I haven't been able to find any companies offering a tune even though it is almost exactly like the r18 but with +.2 liters displacement and a better 3-stage intake.

Now I have a couple different ideas but I'm new to tuning so I'm not sure if any of these would work.

  1. Retrofit an ECU from either an r18 or a different model code of the r20 from an international Civic that does have tuning support. I've read from K-Series forums that there are reasons to not interchange ECU's from different models so I'm hesitant to try it.

  2. Hack the ECU myself. Again, haven't found any software that supports the r20a1 so I figure this will be either highly unlikely or highly expensive for what I want to do.

I could also just drop in an R18 motor but that wouldn't be very fun if I can conquer this obstacle😁

I definitely don't have the knowledge or experience that the guys in this sub have so forgive me for sounding like an amateur, not new to modding cars just tuning.

Thanks!

14 Comments
2024/03/20
23:11 UTC

Back To Top