Software On ELM Street - OBD2 Software Development
Re: ELM327 Software Development
Looks like its all the 7E0 and 7E8 messages that are of interest there.
And I think they make use of advanced PID requesting where you can request more the 1 PID at a time using a single frame.
And I think they make use of advanced PID requesting where you can request more the 1 PID at a time using a single frame.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
-
- Posts: 2885
- Joined: Sun Aug 02, 2009 9:16 pm
- Location: Bayside, Melbourne, Victoria
- Contact:
Re: ELM327 Software Development
It looks like to receive vin you need to send;
12 00 05 00 07 E0 1A 90
For some reason it has weird numbers before response!
Different cal's can be;
12 00 05 00 07 E0 1A C2-C3-C4-C5 & C6
Or 12 00 05 00 07 E0 1A C9 & CA
Another is;
12 00 05 00 07 E2 1A C2-C3 & C4
To Request Seed;
12 00 05 00 07 E0 27 01
Answer to request;
02 00 01 07 00 07 E8 67 01 XX XX
To unlock a ECM it sent;
12 00 07 00 07 E0 27 02 XX XX
& received;
02 00 01 05 00 07 E8 67 02
But there's a hell of a lot more sent before reading entire bin!
EDIT: added the seed request line!
12 00 05 00 07 E0 1A 90
For some reason it has weird numbers before response!
Different cal's can be;
12 00 05 00 07 E0 1A C2-C3-C4-C5 & C6
Or 12 00 05 00 07 E0 1A C9 & CA
Another is;
12 00 05 00 07 E2 1A C2-C3 & C4
To Request Seed;
12 00 05 00 07 E0 27 01
Answer to request;
02 00 01 07 00 07 E8 67 01 XX XX
To unlock a ECM it sent;
12 00 07 00 07 E0 27 02 XX XX
& received;
02 00 01 05 00 07 E8 67 02
But there's a hell of a lot more sent before reading entire bin!
EDIT: added the seed request line!
Last edited by VX L67 Getrag on Thu Oct 17, 2013 4:40 pm, edited 1 time in total.
- delcowizzid
- Posts: 5493
- Joined: Sat Feb 28, 2009 8:38 pm
- Location: Wellington NZ
- Contact:
Re: ELM327 Software Development
great to see you testing VX im out untill the vt comes out of the tow yard some people needa learn how to drive first v8 the guys owned and now it looks destined for the scrap yard LOL
If Its Got Gas Or Ass Count Me In.if it cant be fixed with a hammer you have an electrical problem
Re: ELM327 Software Development
What on earth were you capturing at the beginning?! I think it will have something to do with whatever cable you were using and the extra data that the standard elm doesnt get.VX L67 Getrag wrote:It looks like to receive vin you need to send;
12 00 05 00 07 E0 1A 90
For some reason it has weird numbers before response!
Different cal's can be;
12 00 05 00 07 E0 1A C2-C3-C4-C5 & C6
Or 12 00 05 00 07 E0 1A C9 & CA
Another is;
12 00 05 00 07 E2 1A C2-C3 & C4
To unlock a ECM it sent;
12 00 07 00 07 E0 27 02 XX XX
& received;
02 00 01 05 00 07 E8 67 02
But there's a hell of a lot more sent before reading entire bin!
Good stuff there!
So for the vin, we use a header of 7E0, and then send off: 1A 90 (hopefully works as is without the extra stuff)
And also firing off 2702 per usual to send a key and the 02 response meant accepted (i think?) or already unlocked?
Im guessing there must have been a frame before that one to "request" the seed from the pcm, then it fires off the unlock code.
And this was on the 11bit high or low?
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
-
- Posts: 2885
- Joined: Sun Aug 02, 2009 9:16 pm
- Location: Bayside, Melbourne, Victoria
- Contact:
Re: ELM327 Software Development
Yeah that was logging a descent cable.... LOL AVT!
I tried logging the car VE SS s2 on can11 hi but had buffer full messages!
Really need to be able to export the frame count screen to make it easier the 16 or more screen captures was a pita!
Did a bit of ls1 data logging too so it may help another thread, will put up later!
I tried logging the car VE SS s2 on can11 hi but had buffer full messages!
Really need to be able to export the frame count screen to make it easier the 16 or more screen captures was a pita!
Did a bit of ls1 data logging too so it may help another thread, will put up later!
Re: ELM327 Software Development
Yeah I imagine there would be alot of buffer full messages in the VE. Soooo much info sent at one time. Would only get a few messages at a time before buffer full occurs. Thats where we definitely need a filter added.VX L67 Getrag wrote:Yeah that was logging a descent cable.... LOL AVT!
I tried logging the car VE SS s2 on can11 hi but had buffer full messages!
Really need to be able to export the frame count screen to make it easier the 16 or more screen captures was a pita!
Did a bit of ls1 data logging too so it may help another thread, will put up later!
Ill work on the frame count export tomorrow afternoon once I have some free time again. Its even annoying to have to load up 18 pictures let alone crop and save 18 images haha.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
-
- Posts: 2885
- Joined: Sun Aug 02, 2009 9:16 pm
- Location: Bayside, Melbourne, Victoria
- Contact:
Re: ELM327 Software Development
It would also be good if it's not too much trouble for it to work in winXP, but if it's too hard its ok!
I noticed that if I disconnect to change protocols it can't find elm again & needs a lot of stuffing around!
With LS1 logging the Scan tool wouldn't connect to bench PCM unless it had power fed back down usb?
Here's the data list of scan tool for ls1;
RPM
TPS(v)
TPS(%)
Desired Idle
Coolant Temp
Start CLNT
Intake Air Temp
Map(kPa)
Mao(v)
MAF(gm/sec)
MAF(Hz)
TCC Duty(%)
Spark Adv
Baro(kPa)
Baro(v)
Evap Purge(%)
Ignition 1(v)
Inj Pw B1(mS)
Inj Pw B2(mS)
Knock Retard
Knock Present
Des IAC g/sec
VEH Speed
A/c Hi Side(v)
A/c Hi Side(PSI)
A/c Request
A/c Relay
A/C Status
PRNDL Switch
Current Gear
Oil Pressure(v)
Time(0:00)
TCC Pwm Enabled
Open/Closed Loop
TCC Brake Switch
Ign Cycle DTC
IC Fault Cyl 1
IC Fault Cyl 2
IC Fault Cyl 3
IC Fault Cyl 4
IC Fault Cyl 5
IC Fault Cyl 6
IC Fault Cyl 7
IC Fault Cyl 8
The log's attached for what it picked up!
It only found chatter on VPW J1850 which I guess is normal for this PCM?
I noticed that if I disconnect to change protocols it can't find elm again & needs a lot of stuffing around!
With LS1 logging the Scan tool wouldn't connect to bench PCM unless it had power fed back down usb?
Here's the data list of scan tool for ls1;
RPM
TPS(v)
TPS(%)
Desired Idle
Coolant Temp
Start CLNT
Intake Air Temp
Map(kPa)
Mao(v)
MAF(gm/sec)
MAF(Hz)
TCC Duty(%)
Spark Adv
Baro(kPa)
Baro(v)
Evap Purge(%)
Ignition 1(v)
Inj Pw B1(mS)
Inj Pw B2(mS)
Knock Retard
Knock Present
Des IAC g/sec
VEH Speed
A/c Hi Side(v)
A/c Hi Side(PSI)
A/c Request
A/c Relay
A/C Status
PRNDL Switch
Current Gear
Oil Pressure(v)
Time(0:00)
TCC Pwm Enabled
Open/Closed Loop
TCC Brake Switch
Ign Cycle DTC
IC Fault Cyl 1
IC Fault Cyl 2
IC Fault Cyl 3
IC Fault Cyl 4
IC Fault Cyl 5
IC Fault Cyl 6
IC Fault Cyl 7
IC Fault Cyl 8
The log's attached for what it picked up!
It only found chatter on VPW J1850 which I guess is normal for this PCM?
- Attachments
-
- 131017 ls1 vpw j1850 eng data.txt
- (49.81 KiB) Downloaded 226 times
-
- Posts: 2885
- Joined: Sun Aug 02, 2009 9:16 pm
- Location: Bayside, Melbourne, Victoria
- Contact:
Re: ELM327 Software Development
Here's the buffer filling with just monitoring chatter on the ve ss s2!
- Attachments
-
- listen ve ss.txt
- (99.9 KiB) Downloaded 218 times
-
- listen ve ss monitor.txt
- (220.69 KiB) Downloaded 206 times
Re: ELM327 Software Development
VX, do you know what .net framework you have installed? 2.5,3,3.5?
Currently the app is setup for 3.5 I think. I can drop it further if need be... I think haha.
Also, to swap between protocols after your initial setup.. Click disconnect, then change the baud to 115200 and try to connect. This is because when we first connect.. we change the elms baud rate to 115200.
And wow.. theres alot of stuff going on there. Would love to understand exactly whats going on with the scantool diagnostic requests. I can see it setups up the PID requests. Then gets the pcm to keep pumping out responses corresponding to what was setup. Could get some real smooth data readings from that!
Currently the app is setup for 3.5 I think. I can drop it further if need be... I think haha.
Also, to swap between protocols after your initial setup.. Click disconnect, then change the baud to 115200 and try to connect. This is because when we first connect.. we change the elms baud rate to 115200.
And wow.. theres alot of stuff going on there. Would love to understand exactly whats going on with the scantool diagnostic requests. I can see it setups up the PID requests. Then gets the pcm to keep pumping out responses corresponding to what was setup. Could get some real smooth data readings from that!
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
-
- Posts: 2885
- Joined: Sun Aug 02, 2009 9:16 pm
- Location: Bayside, Melbourne, Victoria
- Contact:
Re: ELM327 Software Development
I believe it should be 3.5 at least as that is what tuning programs need, but there was 2 laptops I was using the XP today for first time & opened up but wouldn't connect & then there's the win7 I used for all stuff earlier than today & some of today!
Yeah I tried with having it at 115200 after initial connect but still had issues with your program connecting & then further with monitor wouldn't show cleanly!
Yeah a lot of stuff going on with all of that & having some insight would be awesome!
Yeah I tried with having it at 115200 after initial connect but still had issues with your program connecting & then further with monitor wouldn't show cleanly!
Yeah a lot of stuff going on with all of that & having some insight would be awesome!