Software On ELM Street - OBD2 Software Development

Programs / Tools / Scripts
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

Woooo, got the tech2 going.. after some significant wriggling.

Sooo heres our first dump of the day (or night?)

Code: Select all

Frame, Count
120 40 B6 23 91 04 9F 03 91 , 51059, 
124 00 05 AD 00 B6 , 51059, 
300 04 00 40 00 00 44 00 00 , 5106, 
110 60 00 00 00 00 00 0D 00 , 51059, 
308 00 00 00 03 00 00 D2 , 5106, 
410 00 00 00 00 00 , 5106, 
480 00 00 02 A0 00 00 00 00 , 5106, 
348 10 00 00 00 00 00 , 2042, 
510 B0 00 00 4C CC C8 00 8C , 1021, 
7E0 02 1A 9A 00 00 00 00 00 , 1, 
7E8 03 7F 1A 78 00 00 00 00 , 9, 
7E8 04 5A 9A 83 02 00 00 00 , 1, 
7E0 02 1A CB 00 00 00 00 00 , 1, 
7E8 06 5A CB 05 7E 7C 1A 00 , 1, 
7E0 02 1A CC 00 00 00 00 00 , 1, 
7E8 06 5A CC 00 C0 1D 16 00 , 1, 
7E0 02 1A C1 00 00 00 00 00 , 1, 
7E8 10 0A 5A C1 39 32 31 37 , 1, 
7E0 30 00 00 00 00 00 00 00 , 5, 
7E8 21 39 34 37 30 00 00 00 , 1, 
7E0 02 1A C2 00 00 00 00 00 , 1, 
7E8 10 0A 5A C2 39 32 31 39 , 1, 
7E8 21 30 39 32 39 00 00 00 , 1, 
7E0 02 1A C3 00 00 00 00 00 , 1, 
7E8 10 0A 5A C3 39 32 31 37 , 1, 
7E8 21 39 34 37 31 00 00 00 , 1, 
7E0 02 1A C4 00 00 00 00 00 , 1, 
7E8 03 7F 1A 31 00 00 00 00 , 1, 
7E0 02 1A B0 00 00 00 00 00 , 1, 
7E8 03 5A B0 11 00 00 00 00 , 1, 
7E0 02 1A 98 00 00 00 00 00 , 1, 
7E8 10 0C 5A 98 48 30 30 30 , 1, 
7E8 21 30 30 32 32 34 38 00 , 1, 
7E0 02 1A 90 00 00 00 00 00 , 1, 
7E8 10 13 5A 90 36 47 31 5A , 1, 
7E8 21 4B 35 34 42 34 35 4C , 1, 
7E8 22 33 37 37 35 31 30 00 , 1, 
And corresponding values on the tech2:
Identifier: 8302
Partnumber: 92175386
Hardware number: 12590358
Software Version Number: 92179470
Engine Calibration: 92190929
System Calibration: 92179471
ECU diagnostic address: 11
Hardware key number: H000002258
VIN: 6G1ZK54B45L377510

Will come back and decode later.. generally the tech2 displays everything in order though. But those "flow control" frames throw me off a bit.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

Heres the filtered log (took out the general chatter) so we can see how each frame is requested and what the tech2 answers back

Code: Select all

 [22:47:30:157]   Received: 7E0 02 1A 9A 00 00 00 00 00 
 [22:47:30:190]   Received: 7E8 04 5A 9A 83 02 00 00 00 
 [22:47:30:370]   Received: 7E0 02 1A CB 00 00 00 00 00 
 [22:47:30:409]   Received: 7E8 03 7F 1A 78 00 00 00 00 
 [22:47:30:436]   Received: 7E8 06 5A CB 05 7E 7C 1A 00 
 [22:47:30:543]   Received: 7E0 02 1A CC 00 00 00 00 00 
 [22:47:30:581]   Received: 7E8 03 7F 1A 78 00 00 00 00  
[22:47:30:598]   Received: 7E8 06 5A CC 00 C0 1D 16 00 
 [22:47:30:784]   Received: 7E0 02 1A C1 00 00 00 00 00 
 [22:47:30:823]   Received: 7E8 03 7F 1A 78 00 00 00 00 
 [22:47:30:833]   Received: 7E8 10 0A 5A C1 39 32 31 37 
[22:47:30:834]   Received: 7E0 30 00 00 00 00 00 00 00 
[22:47:30:836]   Received: 7E8 21 39 34 37 30 00 00 00 
 [22:47:31:177]   Received: 7E0 02 1A C2 00 00 00 00 00 
 [22:47:31:212]   Received: 7E8 03 7F 1A 78 00 00 00 00 
 [22:47:31:221]   Received: 7E8 10 0A 5A C2 39 32 31 39 
[22:47:31:223]   Received: 7E0 30 00 00 00 00 00 00 00 
[22:47:31:224]   Received: 7E8 21 30 39 32 39 00 00 00 
 [22:47:31:530]   Received: 7E0 02 1A C3 00 00 00 00 00 
 [22:47:31:570]   Received: 7E8 03 7F 1A 78 00 00 00 00 
 [22:47:31:606]   Received: 7E8 10 0A 5A C3 39 32 31 37 
[22:47:31:607]   Received: 7E0 30 00 00 00 00 00 00 00 
[22:47:31:608]   Received: 7E8 21 39 34 37 31 00 00 00 
 [22:47:31:684]   Received: 7E0 02 1A C4 00 00 00 00 00 
 [22:47:31:709]   Received: 7E8 03 7F 1A 31 00 00 00 00 
 [22:47:34:153]   Received: 7E0 02 1A B0 00 00 00 00 00 
 [22:47:34:189]   Received: 7E8 03 7F 1A 78 00 00 00 00 
 [22:47:34:232]   Received: 7E8 03 5A B0 11 00 00 00 00 
 [22:47:34:377]   Received: 7E0 02 1A 98 00 00 00 00 00 
 [22:47:34:412]   Received: 7E8 03 7F 1A 78 00 00 00 00 
 [22:47:34:419]   Received: 7E8 10 0C 5A 98 48 30 30 30 
[22:47:34:420]   Received: 7E0 30 00 00 00 00 00 00 00 
[22:47:34:431]   Received: 7E8 21 30 30 32 32 34 38 00  
[22:47:34:724]   Received: 7E0 02 1A 90 00 00 00 00 00 
[22:47:34:759]   Received: 7E8 03 7F 1A 78 00 00 00 00 
[22:47:34:795]   Received: 7E8 10 13 5A 90 36 47 31 5A 
[22:47:34:796]   Received: 7E0 30 00 00 00 00 00 00 00 
[22:47:34:798]   Received: 7E8 21 4B 35 34 42 34 35 4C 
[22:47:34:799]   Received: 7E8 22 33 37 37 35 31 30 00 
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

Oh, Jayme, if theres anything you want me to be logging on the tech2 specifically, let me know!
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

When first clicking on the "v6 engine" tabe, the tech2 sends a whole heap of frames. Its also identifies the number of DTC's. My bench setup apparently has 12 (thought there would be more!!)

Code: Select all

7E0 01 20 00 00 00 00 00 00 
7E8 01 60 00 00 00 00 00 00 
7E0 02 1A 9A 00 00 00 00 00 
7E8 04 5A 9A 83 02 00 00 00 
7E0 03 A9 81 12 00 00 00 00 

After those initial frames.. the tech2 spams of a whole list of faults... (12 in total)

Code: Select all

5E8 81 C1 21 00 6F 00 00 00 
5E8 81 C1 55 00 27 00 00 00 
5E8 81 C1 01 00 6F 00 00 00 
5E8 81 C4 23 00 27 00 00 00 
5E8 81 22 29 00 7F 00 00 00 
5E8 81 21 22 00 7F 00 00 00 
5E8 81 21 27 00 7F 00 00 00 
5E8 81 C4 15 00 7F 00 00 00 
5E8 81 01 18 00 7F 00 00 00 
5E8 81 01 97 00 7F 00 00 00 
5E8 81 05 60 00 7F 00 00 00 
5E8 81 06 33 48 7F 00 00 00 
5E8 81 00 00 00 FF 00 00 00 
And finishes off with the standard 00,00,FF for end of faults.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

Calibration No.1 = 92179470
Verification No. 1 = 9C2F61F1

Code: Select all

7E0 02 09 04 00 00 00 00 00 
7E8 10 33 49 04 03 39 32 31 
7E0 30 00 00 00 00 00 00 00 
7E8 21 37 39 34 37 30 00 00 
7E8 22 00 00 00 00 00 00 39 
7E8 23 32 31 39 30 39 32 39 
7E8 24 00 00 00 00 00 00 00 
7E8 25 00 39 32 31 37 39 34 
7E8 26 37 31 00 00 00 00 00 
7E8 27 00 00 00 11 01 05 11 

7E0 02 09 06 00 00 00 00 00 
7E8 07 49 06 01 9C 2F 61 F1 
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

thats it for tonight. Going through some of the logs. Can clearly see that the tech2 does DPID setups then gets the ecu to spam off the desired pids. Be good to figure out how to request each gm specific pid as seen with VPW.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Jayme
Posts: 2585
Joined: Sat Feb 28, 2009 10:59 pm
Location: North Coast, NSW

Re: ELM327 Software Development

Post by Jayme »

yeah im keen on getting the DPID setup info and figure out how it works so I can make a CAN DPID adx for AVT. on my todo list is figuring out the can protocol so I know how to request any PID individually.... if you could give me a noob lesson on how to read CAN id appreciate it :P

VPW seems so easy.... I see can frames and all I see is chinese lol
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

The very general breakdown of CAN is:

Tech2 Sent: 7E0 02 09 06 00 00 00 00 00
ECU Sent: 7E8 07 49 06 01 9C 2F 61 F1

So in red we have the 11bit header... the header doesnt really mean "this frame is from the tech2".. rather.. the header 7E0 means send this information directly to the ecu. Where as in VPW, we have the destination, source and priority. But 11bit doesnt care about that, the correct header allows you to communicate solely to that device.

In blue is the DLC (data length code), this represents the number of bytes to follow.

And green, this is the actual data (2 bytes). where the 09 the "mode", and 06 is the "table/request". Thus mode 9 contains calibration information.. and under table 06 contains calibration No1 and verification No1.

Finally the pink, this is padding.. Im unsure whether this is the ELM device doing this.. or this is how the frames are actually being sent on the bus. I think from memory, most devices prefer frames padded out so they make the full frame length.

And the same can be done on the response from the ecu;
7E8 = reply header from ecu
07 = lengths of bytes to follow
49 = Mode + 0x40 (same as VPW)
06 = Table requested
01 9C 2F 61 F1 = data = 9C2F61F1 = Verification No.1

(Not sure what the extra 1 is at the front in the data section.. could just indicate 1 verification No.?)
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

There is a checksum at the end.. but the ELM doesnt display it (no matter what I do). Id assume the CAN controller/transceiver do this automatically.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
ejukated
Posts: 426
Joined: Wed Mar 04, 2009 10:52 am

Re: ELM327 Software Development

Post by ejukated »

my techii needs to "warm up" then the candi starts working. havent had a chance to open it up and see whats wrong, might be some cold solder joints.

It'd be awsome if the software could decode a DPID chain from the techii which would make adx creation a lot quicker. I'm away at the momemnt but I've got pretty much all the CAN controllers on the bench if you need any testing.