Current Status on E38, E67, etc.. Hacking Toys

[Meistro]

New thread started here for T43 disassembly. Sorry about the hijack Meistro!
viewtopic.php?f=26&t=8409

No worries!!


I just got my raspberry pi reading my E67 idle messages!! Yay!!

[Meistro]

Using the raspi is better for me I think because I can leave it powered up to the bench E67 all the time allowing me to SSH into it to mess around. I can even use a gpio pin to toggle the ignition power with relay if I need to. There's also a crapload of Linux libraries already out there to decode this. thats my next step, running this through log analyzer to see what I get.

(1701041784.991141) can0 1C1#122A122A
(1701041784.991359) can0 2C5#122A03201FFF
(1701041784.991623) can0 3C1#0765040000000000
(1701041784.991890) can0 3D1#704E800000000000
(1701041784.992158) can0 3E9#8000400000008000
(1701041785.003027) can0 0C9#00000007004100
(1701041785.003277) can0 191#1625162516250000
(1701041785.015533) can0 0C9#0000000A004100
(1701041785.015784) can0 191#1625162516250000
(1701041785.015955) can0 1A1#001042
(1701041785.016136) can0 1C1#122A122A
(1701041785.028033) can0 0C9#0000000D004100
(1701041785.028284) can0 191#1625162516250000
(1701041785.040537) can0 0C9#00000000004100
(1701041785.040788) can0 191#1625162516250000
(1701041785.040958) can0 1A1#001042
(1701041785.041139) can0 1C1#122A122A
(1701041785.041357) can0 2C5#122A03201FFF
(1701041785.053036) can0 0C9#00000007004100
(1701041785.053287) can0 191#1625162516250000
(1701041785.065542) can0 0C9#0000000A004100
(1701041785.065793) can0 191#1625162516250000
(1701041785.065970) can0 1A1#001042
(1701041785.066144) can0 1C1#122A122A
(1701041785.078038) can0 0C9#0000000D004100
(1701041785.078290) can0 191#1625162516250000
(1701041785.090544) can0 0C9#00000000004100
(1701041785.090802) can0 191#1625162516250000

[hjtrbo]

Very cool. I'm glad your doing e67. That's what I have too and have always wanted to do similar to what you're doing. I'll be following your progress with great interest, and most likely forking your work if you choose to make your tools public .

I'm not sure if you've been given or found this document but it may help you out when it comes time to start writing code to interact with the ECM.

[Meistro]

Very cool. I'm glad your doing e67. That's what I have too and have always wanted to do similar to what you're doing. I'll be following your progress with great interest, and most likely forking your work if you choose to make your tools public .

I'm not sure if you've been given or found this document but it may help you out when it comes time to start writing code to interact with the ECM.

Thanks! I do have that file and it appears to have useful info although I haven't absorbed any of it yet.

I think tonight I'm gonna log the bus activity during an HP tuners "read entire" with the idle messages filtered out and see what I get. That should get me something to run through the decoder databases I found to identify traffic. I found something called SavvyCan that can load specific databases and decode log based on values already discovered by community. That's the idea anyway.

A cool thing I can do on the raspberry pi is play back a log file to the can bus. I'm assuming I'll need to sift through the log and see where the ECU is responding or requesting feedback and eliminate those messages. Regardless it hopefully should help shed light on some operations going on , on the bus during a read.

I didn't license this ECU on hpt yet because I want to try to get vin changed first because I'm pretty sure hpt won't let me change it to a 2004 p59 vin. Plus the fact that it'll cost me $200 in credits. One credit for the current ECU vin and one for new vin. I'm okay with burning one credit on this but not two.

[kur4o]

A much better way to spend $200 cash is to get a MDI clone. It will be your ultimate tool for playing around with CAN pcms. And it will allow you to do much more that you can imagine.

[hjtrbo]

I second that, you're on the cusp of ditching HP for good! GDS2 is around the web.

[ironduke]

I second that, you're on the cusp of ditching HP for good! GDS2 is around the web.

so is tech2win and other goodies that work well with the mdi..

I'm told it works with other manufacturers but I haven't tried past some toyota and ford software and that was diagnostics only, no programming.

[Meistro]

A much better way to spend $200 cash is to get a MDI clone. It will be your ultimate tool for playing around with CAN pcms. And it will allow you to do much more that you can imagine.

Like this one?

https://www.amazon.com/VXDIAG-Tech2Win- ... CRTSD&th=1

[Meistro]

Hey wait, wouldn't the one I just purchased a couple months ago work?

OBDX Pro VX
Key Features
1.8m (~6ft) USB Cable
Supports USB, Bluetooth and Wifi connections
Capable of Advanced Diagnostics or Tuning when used with supporting software
Supported by LS Droid & PCM Hammer
Supports 4x high-speed programming
Read & clear ‘Check Engine’ light using free applications
Supports ELM327 OBD2 Applications(Windows PC, Android & IOS)
Supports J2534 programming
Free firmware updates

[ironduke]

Hey wait, wouldn't the one I just purchased a couple months ago work?

OBDX Pro VX
Key Features
1.8m (~6ft) USB Cable
Supports USB, Bluetooth and Wifi connections
Capable of Advanced Diagnostics or Tuning when used with supporting software
Supported by LS Droid & PCM Hammer
Supports 4x high-speed programming
Read & clear ‘Check Engine’ light using free applications
Supports ELM327 OBD2 Applications(Windows PC, Android & IOS)
Supports J2534 programming
Free firmware updates

Yeah, that should work, Tazzi here is the developer of that device.. I haven't bought one yet, mainly only because I have too many mdi's to need one, lol.. You could try Powerpcm and see if it sees it, I do believe you'd need to point powerpcm to the j2534 dll that the OBDX pro VX uses though, it's not so user friendly but there is a drop down for the J2534 driver location.. viewtopic.php?f=3&t=6666&hilit=e38+powerpcm