J2534 Emulator

kur4o
Posts: 948
Joined: Sun Apr 10, 2016 9:20 pm

Re: J2534 Emulator

Post by kur4o »

1 request
15:55:39<[.H..]00 00 07 E0 27 01 [0006] FramePad

3 responses
15:55:39>[.H..]00 00 01 01 FE [0005] TxDone
15:55:39>[.H..]00 00 07 E0 [0004] TxDone
15:55:39>[.H..]00 00 07 E8 67 01 50 57 [0008]

I did some intensive testing. It seems the checkbyte is not the problem.

Managed to make it emulate in J1979 obd mode fine.

However other modes seems to need multiframe response that the emulator can`t handle good enough.
Wonder if the ini can be configured for multiframe response but have no clue.
ironduke
Posts: 579
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: J2534 Emulator

Post by ironduke »

I'm not trying to use J1979 but yeah that's not adding the extra byte.. With DPS that is an option but it doesn't even ask for the seed for some reason with J1979..
CAN and ISO15765 both add that extra byte and it is a problem if I'm trying to use either of those.
I'll get it, Thanks though.. slightly frustrating since I found something that will work 90% of the way.. lol

Edited.. Looks like J1979 adds the extra byte as well when I select that in DPS, weird.. I can probably write my code to ignore it, but won't be able to use DPS and most other gm software I would bet..
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: J2534 Emulator

Post by Tazzi »

kur4o wrote:1 request
15:55:39<[.H..]00 00 07 E0 27 01 [0006] FramePad

3 responses
15:55:39>[.H..]00 00 01 01 FE [0005] TxDone
15:55:39>[.H..]00 00 07 E0 [0004] TxDone
15:55:39>[.H..]00 00 07 E8 67 01 50 57 [0008]

I did some intensive testing. It seems the checkbyte is not the problem.

Managed to make it emulate in J1979 obd mode fine.

However other modes seems to need multiframe response that the emulator can`t handle good enough.
Wonder if the ini can be configured for multiframe response but have no clue.
How are you handling the multiframe response (flow control). Are you sending it back in one big frame, formatted the way it is expecting?
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
ironduke
Posts: 579
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: J2534 Emulator

Post by ironduke »

For multiline responses I found I can throw it all on one line with the responses it would normally see and that seems to work..

throw this file in the folder and you can run DPS and it will get a bunch of info but a LOT if it is wrong because an extra byte is thrown in a the end and I have to put 1 less byte for some of the reads..

for the seed I have the below code for a 2 byte seed.. only 1 byte is there but a second one gets added for some reason.. If I actually have a 2 byte seed there it errors out..
00 00 07 E0 27 01
00 00 07 E8 67 01 50
j25342emu.7z
(622 Bytes) Downloaded 371 times
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: J2534 Emulator

Post by Tazzi »

ironduke wrote:For multiline responses I found I can throw it all on one line with the responses it would normally see and that seems to work..

throw this file in the folder and you can run DPS and it will get a bunch of info but a LOT if it is wrong because an extra byte is thrown in a the end and I have to put 1 less byte for some of the reads..

for the seed I have the below code for a 2 byte seed.. only 1 byte is there but a second one gets added for some reason.. If I actually have a 2 byte seed there it errors out..
00 00 07 E0 27 01
00 00 07 E8 67 01 50
j25342emu.7z
You know what... that extra byte is looking very much like a CRC checksum...


nope, just a simple sum..
01,01,FE,01,20 = 0x121.... AND with 0xFF and we have 0x21 which is what you got at the end byte. From memory, one of the protocols requires checksum byte like that.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
ironduke
Posts: 579
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: J2534 Emulator

Post by ironduke »

OK, bear with me.. I just ran a few tests, I don't know what's going on but at least I'm more confused, lol.. That's good, right? Seems it's DPS triggering something funny, NOT dps's fault because it works fine with a real ecu.
with gm DPS it connects as CAN, then ISO15765 and I get an extra byte with both of them. I can even connect with J1979 with DPS and that gives me an extra byte as well..
With my own code and programs, no extra byte with any of that.. so????

DPS turns on loopback for starters, don't know why but it does, that is the echo of the command being sent and for some reason there is an extra byte at the end..
If I try turning on loopback with my own code I get a copy of the request being sent such as 00 00 07E0 1A 90 BUT now I cannot even get a reply.. something funny... I'll work on it some more but as long as I don't use loopback I think this will work nicely!!!

0000000008: Open DeviceID=00000002
0000000023: Version DevID=00000002
0000000039: Connect DevID=00000002 ProtID=00000006 Flags=00000000 BaudRate=500000
0000000074: Protocol=ISO15765
0000000077: CAN_29BIT_ID=11bit CAN_ID_BOTH=11bit Only
0000000090: ISO9141_NO_CHECKSUM=Interface ISO9141_K_LINE_ONLY=L-line & K-line
0000000136: StartMsgFilter ChannelID=00000001 FilterType=PASS_FILTER FilterID=00000001
0000000142: MaskMsg:FF FF FF FF
0000000152: PatternMsg:00 00 07 E8
0000000164: StartMsgFilter ChannelID=00000001 FilterType=FLOW_CONTROL_FILTER FilterID=00000002
0000000174: MaskMsg:FF FF FF FF
0000000184: PatternMsg:00 00 07 F0
0000000193: StartMsgFilter ChannelID=00000001 FilterType=PASS_FILTER FilterID=00000003
0000000208: MaskMsg:FF FF FF FF
0000000224: PatternMsg:00 00 05 E8
0000000238: Ioctl SET_CONFIG
0000000246: LOOPBACK=1
0000000259: Ioctl SET_CONFIG
0000000288: CAN_MIXED_FORMAT=1
0000000411: (TO=500) TxD[0]:00 00 07 E0 1A 90
0000000422: (TO=1500) RxD[0]:00 00 07 E0 1A 90 91
0000001085: (TO=500) TxD[0]:00 00 07 E0 1A C1
0000001091: (TO=500) RxD[0]:00 00 07 E0 1A C1 C2
0000001205: (TO=500) TxD[0]:00 00 07 E0 1A C2
0000001206: (TO=500) RxD[0]:00 00 07 E0 1A C2 C3
0000001333: (TO=500) TxD[0]:00 00 07 E0 1A C3
0000001338: (TO=500) RxD[0]:00 00 07 E0 1A C3 C4
0000001526: (TO=500) TxD[0]:00 00 07 E0 1A C4
0000001569: (TO=500) RxD[0]:00 00 07 E0 1A C4 C5
0000001726: (TO=500) TxD[0]:00 00 07 E0 1A C5
0000001727: (TO=500) RxD[0]:00 00 07 E0 1A C5 C6
0000001859: (TO=500) TxD[0]:00 00 07 E0 1A C6
0000001869: (TO=500) RxD[0]:00 00 07 E0 1A C6 C7
0000001898: DisConnect ChannelID=00000001
0000001907: Close DeviceID=00000002
User avatar
The1
Posts: 4694
Joined: Mon Jan 04, 2010 10:23 am

Re: J2534 Emulator

Post by The1 »

Nice work mate :thumbup:
navitel
Posts: 2
Joined: Fri Mar 22, 2019 8:23 am

Re: J2534 Emulator

Post by navitel »

ironduke wrote:I'm not trying to use J1979 but yeah that's not adding the extra byte.. With DPS that is an option but it doesn't even ask for the seed for some reason with J1979..
CAN and ISO15765 both add that extra byte and it is a problem if I'm trying to use either of those.
I'll get it, Thanks though.. slightly frustrating since I found something that will work 90% of the way.. lol

Edited.. Looks like J1979 adds the extra byte as well when I select that in DPS, weird.. I can probably write my code to ignore it, but won't be able to use DPS and most other gm software I would bet..
I have Emulator without the extra byte
Post Reply