J2534 Emulator

Posts: 382
Joined: Sun Apr 10, 2016 9:20 pm

Re: J2534 Emulator

Postby kur4o » Mon Oct 11, 2021 10:46 pm

1 request
15:55:39<[.H..]00 00 07 E0 27 01 [0006] FramePad

3 responses
15:55:39>[.H..]00 00 01 01 FE [0005] TxDone
15:55:39>[.H..]00 00 07 E0 [0004] TxDone
15:55:39>[.H..]00 00 07 E8 67 01 50 57 [0008]

I did some intensive testing. It seems the checkbyte is not the problem.

Managed to make it emulate in J1979 obd mode fine.

However other modes seems to need multiframe response that the emulator can`t handle good enough.
Wonder if the ini can be configured for multiframe response but have no clue.

Posts: 334
Joined: Thu Feb 13, 2020 11:32 pm

Re: J2534 Emulator

Postby ironduke » Tue Oct 12, 2021 1:00 am

I'm not trying to use J1979 but yeah that's not adding the extra byte.. With DPS that is an option but it doesn't even ask for the seed for some reason with J1979..
CAN and ISO15765 both add that extra byte and it is a problem if I'm trying to use either of those.
I'll get it, Thanks though.. slightly frustrating since I found something that will work 90% of the way.. lol

Edited.. Looks like J1979 adds the extra byte as well when I select that in DPS, weird.. I can probably write my code to ignore it, but won't be able to use DPS and most other gm software I would bet..

User avatar
Posts: 2548
Joined: Thu May 17, 2012 8:53 pm
Location: WA

Re: J2534 Emulator

Postby Tazzi » Tue Oct 12, 2021 9:56 am

kur4o wrote:1 request
15:55:39<[.H..]00 00 07 E0 27 01 [0006] FramePad

3 responses
15:55:39>[.H..]00 00 01 01 FE [0005] TxDone
15:55:39>[.H..]00 00 07 E0 [0004] TxDone
15:55:39>[.H..]00 00 07 E8 67 01 50 57 [0008]

I did some intensive testing. It seems the checkbyte is not the problem.

Managed to make it emulate in J1979 obd mode fine.

However other modes seems to need multiframe response that the emulator can`t handle good enough.
Wonder if the ini can be configured for multiframe response but have no clue.


How are you handling the multiframe response (flow control). Are you sending it back in one big frame, formatted the way it is expecting?
Your Local Aussie Reverse Engineer
Site:www.envyouscustoms.com
Mob:+61406 140 726
Image

Posts: 334
Joined: Thu Feb 13, 2020 11:32 pm

Re: J2534 Emulator

Postby ironduke » Tue Oct 12, 2021 10:04 am

For multiline responses I found I can throw it all on one line with the responses it would normally see and that seems to work..

throw this file in the folder and you can run DPS and it will get a bunch of info but a LOT if it is wrong because an extra byte is thrown in a the end and I have to put 1 less byte for some of the reads..

for the seed I have the below code for a 2 byte seed.. only 1 byte is there but a second one gets added for some reason.. If I actually have a 2 byte seed there it errors out..
00 00 07 E0 27 01
00 00 07 E8 67 01 50

j25342emu.7z
(622 Bytes) Downloaded 7 times

User avatar
Posts: 2548
Joined: Thu May 17, 2012 8:53 pm
Location: WA

Re: J2534 Emulator

Postby Tazzi » Tue Oct 12, 2021 11:42 am

ironduke wrote:For multiline responses I found I can throw it all on one line with the responses it would normally see and that seems to work..

throw this file in the folder and you can run DPS and it will get a bunch of info but a LOT if it is wrong because an extra byte is thrown in a the end and I have to put 1 less byte for some of the reads..

for the seed I have the below code for a 2 byte seed.. only 1 byte is there but a second one gets added for some reason.. If I actually have a 2 byte seed there it errors out..
00 00 07 E0 27 01
00 00 07 E8 67 01 50

j25342emu.7z


You know what... that extra byte is looking very much like a CRC checksum...


nope, just a simple sum..
01,01,FE,01,20 = 0x121.... AND with 0xFF and we have 0x21 which is what you got at the end byte. From memory, one of the protocols requires checksum byte like that.
Your Local Aussie Reverse Engineer
Site:www.envyouscustoms.com
Mob:+61406 140 726
Image

Posts: 334
Joined: Thu Feb 13, 2020 11:32 pm

Re: J2534 Emulator

Postby ironduke » Tue Oct 12, 2021 12:44 pm

OK, bear with me.. I just ran a few tests, I don't know what's going on but at least I'm more confused, lol.. That's good, right? Seems it's DPS triggering something funny, NOT dps's fault because it works fine with a real ecu.
with gm DPS it connects as CAN, then ISO15765 and I get an extra byte with both of them. I can even connect with J1979 with DPS and that gives me an extra byte as well..
With my own code and programs, no extra byte with any of that.. so????

DPS turns on loopback for starters, don't know why but it does, that is the echo of the command being sent and for some reason there is an extra byte at the end..
If I try turning on loopback with my own code I get a copy of the request being sent such as 00 00 07E0 1A 90 BUT now I cannot even get a reply.. something funny... I'll work on it some more but as long as I don't use loopback I think this will work nicely!!!

0000000008: Open DeviceID=00000002
0000000023: Version DevID=00000002
0000000039: Connect DevID=00000002 ProtID=00000006 Flags=00000000 BaudRate=500000
0000000074: Protocol=ISO15765
0000000077: CAN_29BIT_ID=11bit CAN_ID_BOTH=11bit Only
0000000090: ISO9141_NO_CHECKSUM=Interface ISO9141_K_LINE_ONLY=L-line & K-line
0000000136: StartMsgFilter ChannelID=00000001 FilterType=PASS_FILTER FilterID=00000001
0000000142: MaskMsg:FF FF FF FF
0000000152: PatternMsg:00 00 07 E8
0000000164: StartMsgFilter ChannelID=00000001 FilterType=FLOW_CONTROL_FILTER FilterID=00000002
0000000174: MaskMsg:FF FF FF FF
0000000184: PatternMsg:00 00 07 F0
0000000193: StartMsgFilter ChannelID=00000001 FilterType=PASS_FILTER FilterID=00000003
0000000208: MaskMsg:FF FF FF FF
0000000224: PatternMsg:00 00 05 E8
0000000238: Ioctl SET_CONFIG
0000000246: LOOPBACK=1
0000000259: Ioctl SET_CONFIG
0000000288: CAN_MIXED_FORMAT=1
0000000411: (TO=500) TxD[0]:00 00 07 E0 1A 90
0000000422: (TO=1500) RxD[0]:00 00 07 E0 1A 90 91
0000001085: (TO=500) TxD[0]:00 00 07 E0 1A C1
0000001091: (TO=500) RxD[0]:00 00 07 E0 1A C1 C2
0000001205: (TO=500) TxD[0]:00 00 07 E0 1A C2
0000001206: (TO=500) RxD[0]:00 00 07 E0 1A C2 C3
0000001333: (TO=500) TxD[0]:00 00 07 E0 1A C3
0000001338: (TO=500) RxD[0]:00 00 07 E0 1A C3 C4
0000001526: (TO=500) TxD[0]:00 00 07 E0 1A C4
0000001569: (TO=500) RxD[0]:00 00 07 E0 1A C4 C5
0000001726: (TO=500) TxD[0]:00 00 07 E0 1A C5
0000001727: (TO=500) RxD[0]:00 00 07 E0 1A C5 C6
0000001859: (TO=500) TxD[0]:00 00 07 E0 1A C6
0000001869: (TO=500) RxD[0]:00 00 07 E0 1A C6 C7
0000001898: DisConnect ChannelID=00000001
0000001907: Close DeviceID=00000002

User avatar
Posts: 4555
Joined: Mon Jan 04, 2010 10:23 am

Re: J2534 Emulator

Postby The1 » Wed Oct 13, 2021 8:02 am

Nice work mate :thumbup:

Previous

Return to Tool Development

Who is online

Users browsing this forum: No registered users and 1 guest