Software On ELM Street - OBD2 Software Development

Programs / Tools / Scripts
User avatar
Tazzi
Posts: 3437
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Looks like its all the 7E0 and 7E8 messages that are of interest there.
And I think they make use of advanced PID requesting where you can request more the 1 PID at a time using a single frame.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
VX L67 Getrag
Posts: 2885
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: ELM327 Software Development

Post by VX L67 Getrag »

It looks like to receive vin you need to send;
12 00 05 00 07 E0 1A 90

For some reason it has weird numbers before response!

Different cal's can be;
12 00 05 00 07 E0 1A C2-C3-C4-C5 & C6

Or 12 00 05 00 07 E0 1A C9 & CA

Another is;
12 00 05 00 07 E2 1A C2-C3 & C4

To Request Seed;
12 00 05 00 07 E0 27 01
Answer to request;
02 00 01 07 00 07 E8 67 01 XX XX

To unlock a ECM it sent;
12 00 07 00 07 E0 27 02 XX XX
& received;
02 00 01 05 00 07 E8 67 02

But there's a hell of a lot more sent before reading entire bin!

EDIT: added the seed request line!
Last edited by VX L67 Getrag on Thu Oct 17, 2013 4:40 pm, edited 1 time in total.
User avatar
delcowizzid
Posts: 5493
Joined: Sat Feb 28, 2009 8:38 pm
Location: Wellington NZ
Contact:

Re: ELM327 Software Development

Post by delcowizzid »

great to see you testing VX im out untill the vt comes out of the tow yard some people needa learn how to drive first v8 the guys owned and now it looks destined for the scrap yard LOL
If Its Got Gas Or Ass Count Me In.if it cant be fixed with a hammer you have an electrical problem
User avatar
Tazzi
Posts: 3437
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

VX L67 Getrag wrote:It looks like to receive vin you need to send;
12 00 05 00 07 E0 1A 90

For some reason it has weird numbers before response!

Different cal's can be;
12 00 05 00 07 E0 1A C2-C3-C4-C5 & C6

Or 12 00 05 00 07 E0 1A C9 & CA

Another is;
12 00 05 00 07 E2 1A C2-C3 & C4

To unlock a ECM it sent;
12 00 07 00 07 E0 27 02 XX XX
& received;
02 00 01 05 00 07 E8 67 02

But there's a hell of a lot more sent before reading entire bin!
What on earth were you capturing at the beginning?! I think it will have something to do with whatever cable you were using and the extra data that the standard elm doesnt get.

Good stuff there!
So for the vin, we use a header of 7E0, and then send off: 1A 90 (hopefully works as is without the extra stuff)

And also firing off 2702 per usual to send a key and the 02 response meant accepted (i think?) or already unlocked?
Im guessing there must have been a frame before that one to "request" the seed from the pcm, then it fires off the unlock code.

And this was on the 11bit high or low?
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
VX L67 Getrag
Posts: 2885
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: ELM327 Software Development

Post by VX L67 Getrag »

Yeah that was logging a descent cable.... LOL AVT!

I tried logging the car VE SS s2 on can11 hi but had buffer full messages!

Really need to be able to export the frame count screen to make it easier the 16 or more screen captures was a pita!

Did a bit of ls1 data logging too so it may help another thread, will put up later!
User avatar
Tazzi
Posts: 3437
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

VX L67 Getrag wrote:Yeah that was logging a descent cable.... LOL AVT!

I tried logging the car VE SS s2 on can11 hi but had buffer full messages!

Really need to be able to export the frame count screen to make it easier the 16 or more screen captures was a pita!

Did a bit of ls1 data logging too so it may help another thread, will put up later!
Yeah I imagine there would be alot of buffer full messages in the VE. Soooo much info sent at one time. Would only get a few messages at a time before buffer full occurs. Thats where we definitely need a filter added.

Ill work on the frame count export tomorrow afternoon once I have some free time again. Its even annoying to have to load up 18 pictures let alone crop and save 18 images haha.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
VX L67 Getrag
Posts: 2885
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: ELM327 Software Development

Post by VX L67 Getrag »

It would also be good if it's not too much trouble for it to work in winXP, but if it's too hard its ok!

I noticed that if I disconnect to change protocols it can't find elm again & needs a lot of stuffing around!

With LS1 logging the Scan tool wouldn't connect to bench PCM unless it had power fed back down usb?

Here's the data list of scan tool for ls1;
RPM
TPS(v)
TPS(%)
Desired Idle
Coolant Temp
Start CLNT
Intake Air Temp
Map(kPa)
Mao(v)
MAF(gm/sec)
MAF(Hz)
TCC Duty(%)
Spark Adv
Baro(kPa)
Baro(v)
Evap Purge(%)
Ignition 1(v)
Inj Pw B1(mS)
Inj Pw B2(mS)
Knock Retard
Knock Present
Des IAC g/sec
VEH Speed
A/c Hi Side(v)
A/c Hi Side(PSI)
A/c Request
A/c Relay
A/C Status
PRNDL Switch
Current Gear
Oil Pressure(v)
Time(0:00)
TCC Pwm Enabled
Open/Closed Loop
TCC Brake Switch
Ign Cycle DTC
IC Fault Cyl 1
IC Fault Cyl 2
IC Fault Cyl 3
IC Fault Cyl 4
IC Fault Cyl 5
IC Fault Cyl 6
IC Fault Cyl 7
IC Fault Cyl 8

The log's attached for what it picked up!
It only found chatter on VPW J1850 which I guess is normal for this PCM?
Attachments
131017 ls1 vpw j1850 eng data.txt
(49.81 KiB) Downloaded 226 times
VX L67 Getrag
Posts: 2885
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: ELM327 Software Development

Post by VX L67 Getrag »

Here's the buffer filling with just monitoring chatter on the ve ss s2!
Attachments
listen ve ss.txt
(99.9 KiB) Downloaded 218 times
listen ve ss monitor.txt
(220.69 KiB) Downloaded 206 times
User avatar
Tazzi
Posts: 3437
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

VX, do you know what .net framework you have installed? 2.5,3,3.5?
Currently the app is setup for 3.5 I think. I can drop it further if need be... I think haha.

Also, to swap between protocols after your initial setup.. Click disconnect, then change the baud to 115200 and try to connect. This is because when we first connect.. we change the elms baud rate to 115200.


And wow.. theres alot of stuff going on there. Would love to understand exactly whats going on with the scantool diagnostic requests. I can see it setups up the PID requests. Then gets the pcm to keep pumping out responses corresponding to what was setup. Could get some real smooth data readings from that!
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
VX L67 Getrag
Posts: 2885
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: ELM327 Software Development

Post by VX L67 Getrag »

I believe it should be 3.5 at least as that is what tuning programs need, but there was 2 laptops I was using the XP today for first time & opened up but wouldn't connect & then there's the win7 I used for all stuff earlier than today & some of today!

Yeah I tried with having it at 115200 after initial connect but still had issues with your program connecting & then further with monitor wouldn't show cleanly!

Yeah a lot of stuff going on with all of that & having some insight would be awesome!
Post Reply