OBDX Development - Developer Tools and Suggestions

[In-Tech]

Do check and compare timings. the UDS spec does say timing can be required and set by the vendor as part of the security process. I took that to mean a failure lockout, but it could be relevant to sending the key, too.

Oy, Yes Sometimes by the tic's. So far, I have not found that to be true with OBD2 protocol in the US due to the rules of OBD2 strictness. Always a good thing to remember though, thanks for that.

I think we are on to something and really feel close on the Ford stuff, it will just get better

[kur4o]

Can anyone try putting these seeds into your Ford algorithm just to see if FCA copied Ford !!

<7E8,82,50,85,0,0,0,0,0,> 2008 aspen
<7E0,82,27,5,0,0,0,0,0,>
<7E8,84,67,5,C7,44,0,0,0,>
<7E0,84,27,6,F5,2A,0,0,0,>
<7E8,83,67,6,34,44,0,0,0,>
<7DF,82,3E,2,0,0,0,0,0,>
<7E0,810,8,34,80,0,0,0,0,>


TX: 27 01 28 <- Request EEPROM access
RX: 67 01 F8 2C 8C <- Seed=0xF82C
TX: 27 02 B6 98 77 <- Key=0xB698
RX: 67 02 69 <- Key accepted


TX: 27 05 CS <- Request Flash access
RX: 67 05 41 55 CS <- Seed=0x4155
TX: 27 06 59 29 CS <- Key=0x5929
RX: 67 06 CS <- Key accepted

acln99,

can you log some other data for me.
An ngc4 log with these messages.
00 00 07 E0 1A 87
00 00 07 E0 1A 9C

[acln99]

For what its worth -- maybe nothing -- NGC4 also has single a message that appears before every seed request.

608, 8 FF 0 0 0 1E 0 0 0
308, 8 0 0 0 6 0 0 FF FF
7E8, 8 2 50 85 0 0 0 0 0
7E0, 8 2 27 5 0 0 0 0 0
7E8, 8 4 67 5 41 CD 0 0 0
7E0, 8 4 27 6 1A 7 0 0 0
7E8, 8 3 67 6 34 CD 0 0 0

[acln99]

acln99,

can you log some other data for me.
An ngc4 log with these messages.
00 00 07 E0 1A 87
00 00 07 E0 1A 9C

I will try !! Are - these the commands that need to be sent ? ie 1A 87 ?? ( I'm no expert )

I can test on NGC3 - SCI right away. NGC4 will be more work as I only used ESP32 to sniff HPtuner connection. ( 3 years ago and need to dig it out again )

[acln99]

Kur4o - In case it helps you...

attached is a log from 2008 Ram NGC4 - I did years ago. Again simple sniff of HPT connecting and downloading Flash...

[acln99]

Kur4o - so far -attached is log from testing the commands on NGC3 -

No response - log shows that 27 01 does work and a few other commands.

I tried both 1A 87 A1 and just 1A 87

Hope to try NGC4 soon.
I believe for NGC4 I have to send complete 07E0,8, 2 , 1A 87 0 0 0 0 0 ( never did this before ! )

What are these commands supposed to do ?

[kur4o]

I am trying to emulate a dodge pcm, and log some chrysler app to extract some data.

1a 87 and 1a 9c are some pcm info request like, vin, p/n and so on. I need the format being send from pcm.

With ngc3 we can also do some testing, but with CAN protocol used by ngc4 will be much easier. SCI logs and message format is not widely popular and will need extra lead time.

[acln99]

Here is log / test on NGC4 - It works with basic Elm327 !!

>ATDP
USER1 (CAN 11/500)

>09 02
014
0: 49 02 01 32 42 33
1: 4B 41 37 33 57 31 39
2: 48 35 36 30 30 37 30

>1A 87
016
0: 5A 87 02 08 08 67
1: FF 0D 4F 09 13 01 36
2: 38 30 30 34 33 30 32
3: 41 44 00 00 00 00 00

>1A 9c
015
0: 5A 9C 01 02 08 08
1: 67 FF 09 13 01 36 38
2: 30 30 34 33 30 32 41
3: 44 44 00 00 00 00 00

>

[acln99]

Have already done a lot of the PCI investigation for PCM at least. Remember have a CCD / PCI translator.
What we need now is NGC3 ( or NGC4 ) seed algorithm so we can finally write EEprom to disable SKIM / chg VIN . Already know where but can't get to "How".
After that maybe de-cipher flash but this isn't really needed as HPT does this for NGC3/4 . We know a lot about SBEC3 flash but not everything. Not sure if NGC has config options in Flash like SBEC does.



This pic was with engine OFF so no RPM, temps etc ....

PCI.jpg (106.38 KiB) Viewed 1416 times

[Gampy]

I can do NGC4 testing, I have an NGC4 vehicle setting no more then 6 feet from me at this very moment.

Unfortunately as stated in another thread I am sick and this damn nurse will not allow me to set here for more then a few minutes between naps.

And I'm pissed because I cannot play too, this is exactly why I got involved with Automotive computers in 2018 when I found this place and got involved with PCMHammer.
Christmas 2017 my wife bought me this SparkFun OBDII UART VCI hoping it would pull me out of the slump I was in after hearing the devastating news about my health or lack thereof ... It worked, for I found this place almost a year later.

And now I'm missing being involved in all the fun ...

And as the nurse is screaming at me right now

The longer you set there running yourself down the longer you'll be sick and the longer I have to hover over you, now I don't mind hovering over you as much as you do, so what do you want to do.

How can one argue that!

-Enjoy