ABS Hacking

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

Figured I'd update. I've had things pop up. I was making some progress on the software side and then actually ran into an issue where my ABS module failed while braking into a corner. Apparently when it fails, it disables ABS, TCS, stability control, and brake biasing. Didn't realize this was an issue except I have a big brake kit so it meant my fronts got very little braking power....

So i was going into a corner and got on the brakes like I normally do, car was stopping great, then all of the sudden it stopped slowing down, then it locked up. Unfortunately by the time I realized what happened and looke down at my christmas tree of a dash, I slid into a pole. Vette isn't totalled, but it bent in the crash bar pretty good. Frame is straight, iv'e had a new crash bar welded on, engine is currently out of the car getting refreshed.

While I wait for soem parts to come in the mail, I'm actually improving on my VPW datalogging capabilities. Currently I'm working on a parser that can read and parse all VPW bus traffic in real time and attempt to decode packets that I am aware of. Trying to make something similar to other tools I've used for CAN which made hunting down PIDs much easier. I'll have an update once I get it working a bit better. Right now it parses .txt dumps from the raw dumps from the Pro VT device. Really rough draft at the moment, but I'm working on it actively because I have an additional side project that has some overlaps with this original intent of this project.

Because I know a lot of us are on multiple platforms (yuck windows, hehe), I am writing it in python. I often times grab my Macbook and go datalog, or might use windows or my linux machine to do it. Luckily serial ports are treated pretty uniformally in python and it has a basic library for GUIs.

I haven't written any GUI for a few years now, so I'm struggling trying to remember all the threading stuff again... ha...
Attachments
guiv1.png
guiv1.png (15.28 KiB) Viewed 2458 times
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: ABS Hacking

Post by antus »

Sucks about the crash, glad the car is not totaled and your ok too. That tool looks really good and interesting :thumbup:
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: ABS Hacking

Post by NSFW »

I've been jealous of the CAN people for their analysis tools for a long time, so I love what you've done with the VPW analyzer!

Sorry to hear about the crash, though.

In case a list of module IDs would help:

ID Module
--------- ----------------------------
$00-$1F Powertrain controllers

$00-$0F Integration/Manufacturer Expansion
$10-$17 Engine controllers
$18-$1F Transmission controllers

$20-$3F Chassis controllers

$20-$27 Integration/Manufacturer Expansion
$28-$2F Brake controllers
$30-$37 Sterring controllers
$38-$3F Suspension controllers

$40-$C7 Body controllers

$40-$57 Integration/Manufacturer Expansion
$48-$5F Restraints
$60-$6F Driver information/Diplays
$70-$7F Lighting
$80-$8F Enterntainment
$90-$97 Personal communications
$98-$9F Climate control (HVAC)
$A0-$BF Convenience (doos, Seats, Windows, etc.)
$C0-$C7 Security

$C8-$CB Electric Vehicle Energy Transfer System (EV-ETS)

$C8 Utility connection services
$C9 AC to AC conversion
$CA AC to DC conversion
$CB Energy storage management

$CC-$CF Future expansion

$D0-$EF Manufacturer specific

$F0-$FD Off-Board Testers/Diagnostic scan tools

$FE All nodes

$FF Null node
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

Well, heart break continues... Last friday, I pulled the oil pan on my 416 LS3 (stroker I built for my vette) to tighten bearing clearances a bit, oil pressure was a bit lower than I wanted since it was new. Was going to tighten things up a bit. Noticed my heads had some oil leaking past valve stem seals that I recently replaced, which suggests my valve guide wear was a bit a bit more than it should be (valve play). Pulled heads and found a crack in one of my sleeves all the way through... No signs of detonation... No power adders, no idea how this happened. Must've been a manufacturing defect in the block or something, but I bought it brand new when i built the engine.

Unfortunately for me, means that my 416 stroker is a paper weight :(... Right now I'm trying to figure out what I'm going to do, but it looks like I'll just go HPR 468 and make some fun power (mild cam setups on those things put down 675 whp and 630 wtq NA on 93 pump gas).

Anyway, I worked a bit more on my VPW tool. So far I'm just trying to build up some of the classes to make analysis a bit easier, then i'll have to figure out how to connect it to the VT pro.

Here's where I'm at right now. Bottom table is a raw dump of messages as they come in. Top table is a "summary" table. Basically it keeps only unique messages in it. You can see it keeps track of how many times a message is repeated.

This has the advantage of in real time ignoring repeated messages. I'm working on adding some configurability that will let you choose what a "unique" message is. IE only compare 2 first bytes of a payload instead of a complete matching message. This would make sniffing and looking for specific messages easier, as you can do an action in the car and see only the data part of message change.

Features I plan to have:
1) Configure how many bytes of payload are used to consider a message unique (right now it's all of them)
2) Priority filtering: Only show messages with priority less than a number
3) Ignore heart beat messages (checkbox to hide or show these on the fly). This could also be taken care of by #2
4) Add module names instead of addresses.
5) Be able to transmit a message back onto the bus

Thanks for the address you have. I found some documentation for most of those, but you've got some extra ones that'll help. I'd be curious if anyone has a good list of the functional target addresses.

I don't know if the contact on the VT Pro website is working. I was trying to get ahold of the current API/command list.
Default baud is ~38kbaud, and it does ascii mode. I'm not sure if it'll handle a fully loaded 1x mode VPW bus.
Also, is it possible to be able to do something like atma (read all bus traffic) while also being able to transmit on the bus with custom headers? With the default ELM command set, it seems you must cancel the ATMA, and then ATSH and send a message, and then ATMA again to do this. This means I could miss messages. This is obviously something I wouldn't want in a tool like this.
Attachments
Screen Shot 2020-12-14 at 7.11.51 AM.png
Screen Shot 2020-12-14 at 7.11.51 AM.png (126.42 KiB) Viewed 2384 times
In-Tech
Posts: 778
Joined: Mon Mar 09, 2020 4:35 pm
Location: California

Re: ABS Hacking

Post by In-Tech »

https://www.melling.com/3-23-18-new-cyl ... re-engine/
A bit off topic, LS3 specific sleeve. I am doing 3 blocks this week. I'll let ya know how it goes
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

Interesting. Stock bore on the LS3 is 4.065. Any idea the rough cost? I could slap a single sleeve in it... Block needs some other work, though, but its an option.
In-Tech
Posts: 778
Joined: Mon Mar 09, 2020 4:35 pm
Location: California

Re: ABS Hacking

Post by In-Tech »

https://www.summitracing.com/parts/mel-csl359f
~$35 at Summit for the sleeve
~$100 at the machine shop above all the other normal costs
2 of my blocks are pretty bad, the third is easily fixable with a sleeve. I figure it is worth a shot on the two as right now they are just mock up test fit transplant blocks.
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: ABS Hacking

Post by NSFW »

My C5 is on jack stands with a cracked sleeve as well. And a cracked block (all the water was in the oil pan) and a disintegrated piston (most of it was in the intake manifold). Apparently this car hacking stuff has side effects that nobody ever anticipated.

More seriously, the XPro does have a sniffing mode, Pete or Tazzi sent me the command to enable it, but I can't find it now. :(
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
User avatar
Gampy
Posts: 2330
Joined: Sat Dec 15, 2018 7:38 am

Re: ABS Hacking

Post by Gampy »

NSFW wrote:Apparently this car hacking stuff has side effects that nobody ever anticipated.
Especially when they start hacking themselves ... :(
NSFW wrote:My C5 is on jack stands with a cracked sleeve as well. And a cracked block (all the water was in the oil pan) and a disintegrated piston (most of it was in the intake manifold).
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

That's a bummer... Isn't yours a mostly stock build?

I blew my LS6 ~5 years ago, build a 416 LS3 and got car running just over 3 years ago, and here I am now...

I'm torn between salvaging as much of my rotating assembly as I can (it's all still good), but "only" getting to a 440 CI LS stroker. Or selling what I can and ponying up for the 468 CI LS stroker...

As I do this, I realize I'm going to have to get a bit more active on my side projects... I currently have a 90mm TB on it and need to figure out how to get around all the issues I had with running the NW102 DBW TBs... I had almost constant limp modes any time I went WOT. Some gen 3 incompatibility I guess. I've got a bench P59 ECU i'm going to sniff the control wires on and see wtf is going on.

I'm not sure how to get ahold of Tazzi for some of the commands. It would make my life a lot easier :)
Post Reply