Page 33 of 109
Re: ELM327 Software Development
Posted: Wed Nov 06, 2013 4:19 pm
by Tazzi
Jayme wrote:my adx sends... 0x6C 0x10 0xF1 0x22 0x11 0x72 0x01
and receives 0x6C 0xF1 0x10 0x62 0x11 0x72 XX XX
XX XX = 2 byte IAC steps
Perfect, Will add that into the fake pcm
Re: ELM327 Software Development
Posted: Wed Nov 06, 2013 4:45 pm
by delcowizzid
now that you have a cable youre like a kid with a fresh copy of GTA5 love it
Re: ELM327 Software Development
Posted: Wed Nov 06, 2013 5:45 pm
by Tazzi
delcowizzid wrote:now that you have a cable youre like a kid with a fresh copy of GTA5 love it
Haha sounds about right. Iv been coding like a mad man to get everything in there
To make life a little easier, Iv started putting in a "auto detect" function for the elm detection so it will find the comport and baud.
Re: ELM327 Software Development
Posted: Wed Nov 06, 2013 7:30 pm
by Tazzi
Hmm I cant figure out what Im doing wrong here.. im doing it exactly the way that was logged previously.
All the DPID's get setup, then:
Code: Select all
[15:30:54:152] Received: 6C 10 F1 2A 14 FE FD FC FB 35
[15:30:54:152] Received: 6C F1 10 7F 2A 14 FE FD FC FB 23 3F
[15:30:54:184] Received: 6C 10 F1 2A 24 FA F9 F8 FE 16
[15:30:54:184] Received: 6C F1 10 6A FE 00 00 00 00 00 00 6C
[15:30:54:199] Received: 6C F1 10 7F 2A 24 FA F9 F8 FE 23 9F
It sends the first frame requesting for them to be spammed out.. So I begin that
Then does the second request to spam the other tables.. Alright I do that too..
But tech2 displays: No communication with vehicle?
So some real basic coding that Im using to just loop it through:
Code: Select all
SerialPort1.WriteLine("7F 2A 14 FE FD FC FB 23")
System.Threading.Thread.Sleep(30)
Dim x = 0
Do
SerialPort1.WriteLine("6A FE 00 00 00 00 00 00")
System.Threading.Thread.Sleep(20)
SerialPort1.WriteLine("6A FD 00 00 00 00 00 00")
System.Threading.Thread.Sleep(20)
If x = 0 Then
SerialPort1.WriteLine("7F 2A 24 FA F9 F8 F7 23")
x += 1
System.Threading.Thread.Sleep(30)
End If
SerialPort1.WriteLine("6A FC 00 00 00 00 00 00")
System.Threading.Thread.Sleep(30)
SerialPort1.WriteLine("6A FB 00 00 00 00 00 00")
System.Threading.Thread.Sleep(30)
SerialPort1.WriteLine("6A FA 00 00 00 00 00 00")
System.Threading.Thread.Sleep(30)
SerialPort1.WriteLine("6A F9 00 00 00 00 00 00")
System.Threading.Thread.Sleep(30)
SerialPort1.WriteLine("6A F8 00 00 00 00 00 00")
System.Threading.Thread.Sleep(30)
SerialPort1.WriteLine("6A F7 00 00 00 00 00 00")
System.Threading.Thread.Sleep(45)
SerialPort1.DiscardInBuffer()
Loop
And header is set to 6CF110.. So I dont get what Im missing!!!
Re: ELM327 Software Development
Posted: Thu Nov 07, 2013 12:52 am
by Tazzi
hmm.. I may be missing frames during the DPID setup.. might be why its not working. I dont think the elm is quick enough.
Has to swap from monitor mode, then reset headers each time, set no response and fire off frame.
Have ordered another elm device, even if I get this working, Id be good to have one dedicated to monitoring and the other for sending for this reversing stuff. So might be a couple weeks before can progress with any of this reversing.
I did get it working for a moment by jumping in and out of the tables in the tech2, and it actually displayed info o the tech2 screen, but shortly after showed the "no communication detected" message again. Also tried using "valid" data instead of 00's but that doesnt seem to be the issue.
I do find it weird that the response to: 6C 10 F1 2A 14 FE FD FC FB (Tech2 Says: Start sending me info)
Is this: 6C F1 10 7F 2A 14 FE FD FC FB 23 (PCM Says: Acknowledged.. sending tables xyz)
Why is the mode response 7F and not a standard 40+ on the mode. And why is the end byte 23, not sure if this significant in any way.
Re: ELM327 Software Development
Posted: Thu Nov 07, 2013 11:05 am
by antus
7F is not a successful reply, its a general error (passed bad arguments usually). It can come back in response to any request, hence can not be request + 40 as it can apply to many different requests.
7F - no can do your 2A 14 FE FD FC FB because 23
http://www.fastfieros.com/tech/vpw_comm ... otocol.htm
23 = routine not complete (yeah thats not terribly helpful, but thats what its saying)
Re: ELM327 Software Development
Posted: Thu Nov 07, 2013 11:56 am
by Tazzi
Code: Select all
[15:30:54:152] Received: 6C 10 F1 2A 14 FE FD FC FB 35
[15:30:54:152] Received: 6C F1 10 7F 2A 14 FE FD FC FB 23 3F
[15:30:54:184] Received: 6C 10 F1 2A 24 FA F9 F8 FE 16
[15:30:54:184] Received: 6C F1 10 6A FE 00 00 00 00 00 00 6C
[15:30:54:199] Received: 6C F1 10 7F 2A 24 FA F9 F8 FE 23 9F
The above frames were captured by VX on a ls1 pcm he had on the bench, the PCM may have responded saying incomplete frame and generally error but it still started firing off the frames!
I thought thats what the 7F was implying, I just dont get whats happening in the logged data then, it sends off the first frames request.. which gets that response and the PID's begin to be fired off.
It could be the scantool is looking for a successful reply? Whereas VX scantool (or whatever was being used) may not care?
Maybe sending something like this will work: 6C F1 10 6A 14 FE FD FC FB XX
Removed the "routine incomplete" and general 7F error, should be a generic "all good" message I think?
Iv tried just sending off the data without a reply but the tech2 still says "Lost communication"
Doesnt look like the tech2 cares if the DPID's get a response back of not, it only looks for the response to the 2A mode (it pauses for a moment and waits)
Re: ELM327 Software Development
Posted: Thu Nov 07, 2013 12:28 pm
by Tazzi
Have got the elm to keep up with all the requests, responds back to all of them, and then gets to the 2A requests.. tried the new frame which failed, also tried without sending anything and still failed.
Tech2 just keeps sending through the DPID frame setups and then the 2A frames.. and repeats... Must be missing something.
Re: ELM327 Software Development
Posted: Thu Nov 07, 2013 12:44 pm
by antus
yeah it probably sends an invalid request and that it fails doesnt matter. when i was writing the ls1 flashtool, i botched block upload request and was receiving 7F, but then then the actual block transmit was correct and the pcm didnt care about the botched command. I didnt notice for the first couple of releases as it was working fine, but its fixed now to be technically correct. Thats how these things happen I guess. If the scan tool is doing dumb things, try reading or logging jaymes implementation. its correct and works well.
Re: ELM327 Software Development
Posted: Thu Nov 07, 2013 4:23 pm
by Tazzi
Yeah think I will need to have a look at jayme's. Or get another log of engine data from a scantool.. preferably from the tech2 to keep things simple.
Even then, it could all come down to the single elm isnt quick enough to get all this data out before the next request is sent. May put this reversing on hold and try out something else like the function requests and control rpm ect. I sure that could be useful for someone?