Raspberry Pi CANBUS Adventure

[Meistro]

I figured I would start a new thread more specific to what I'm doing with my RasPi and bench powered E67 ECU.

I swapped my tired LQ9 6.0 in my gen 3 truck for a more rubust https://blueprintengines.com/products/4 ... psls4271ct 7 liter. This is a gen 4 with different configuration for the crank reluctor and cam signals, a configuration that will not work with the P59 in my truck. Unless I can convert the signals, Lingenfelter TRG-002 58X to 24X Trigger Conversion Module was the answer. Then it wasn't. I'm just not happy with it. It isn't working out for me. Then there's another adapter for the throttle body, still works. The obvious thing to fix this is upgrade to gen 4? Seems that way since I am definitly not tearing into the engine to replace the reluctor wheel with a dumber one. Especially since there's only a few thousand miles on it. So... I found what I thought was an E38 at the junkyard. It came from an 07 Acadia 1/2 ton etc, etc.. Turns out it's an E67! OK that'll do I guess as long as I can force a VIN change to an unsupported P59 VIN.

I bought the OBDXPRO VX. It works great on the P59 but the support is lacking and it doesn't play nice with the E67. Maybe I should have purchased the GT.

So how do I force a VIN on it that isn't supposed to be there? I have no idea lol. But I'm going to try to figure it out since it's winter sports season, that means lots of time in my lab.

I had this idea at first to use Arduino to sniff the canbus and log to SD or serially capture the bus stream. I want to do this so I can see what's going on in there and attempt to figure out how to change the VIN on the E67 to the VIN on my 04 Silverado SS. It worked, however it took too long to make code changes, upload, make code changes, upload, again, again, etc.. I will go back to the Arduino later on when I have a better grasp on all this.

Lets try my Raspberry Pi 4!! I ordered a RS485 CAN HAT, https://www.amazon.com/dp/B07VMB1ZKH?ps ... ct_details

I installed the Linux can-utils, SocketCan, and a bunch of other stuff. Can-utils works great. I can connect to can0 and log directly to the screen or log to a file, amongst other things I don't quite understand yet. It was pretty cool seeing the bus idle messages. Next order of business, log the bus during a HP Tuners read of the ECU to hopefully see what that's all about.

Attached are two logs. The first one is 14mb and was logged during a "read entire" Hp Tuners event that took about 2 1/2 minutes. The second smaller size log was recorded while I connected the VCM scanner. I read the DTC, cleared the DTC, started logging, stopped logging, and all kinds of clicking in the special controls section.

This below is a tiny sample:

Code: Select all

(1701219273.152535) can0 0C9#00000007004100
(1701219273.152726) can0 191#1625162516250000
(1701219273.164998) can0 0C9#0000000A004100
(1701219273.165246) can0 191#1625162516250000
(1701219273.165419) can0 1A1#001042
(1701219273.165591) can0 1C1#122A122A
(1701219273.177500) can0 0C9#0000000D004100
(1701219273.177744) can0 191#1625162516250000
(1701219273.189998) can0 0C9#00000000004100
(1701219273.190245) can0 191#1625162516250000
(1701219273.190445) can0 1A1#001042
(1701219273.190619) can0 1C1#122A122A
(1701219273.190795) can0 2C5#122A03201FFF
(1701219273.202493) can0 0C9#00000007004100
(1701219273.202742) can0 191#1625162516250000
(1701219273.214995) can0 0C9#0000000A004100
(1701219273.215245) can0 191#1625162516250000
(1701219273.215418) can0 1A1#001042
(1701219273.215591) can0 1C1#122A122A
(1701219273.227494) can0 0C9#0000000D004100
(1701219273.227741) can0 191#1625162516250000
(1701219273.239995) can0 0C9#00000000004100
(1701219273.240251) can0 191#1625162516250000
(1701219273.240424) can0 1A1#001042
(1701219273.240599) can0 1C1#122A122A
(1701219273.240825) can0 2C5#122A03201FFF
(1701219273.241086) can0 3C1#0765040000000000
(1701219273.241369) can0 3D1#704E800000000000
(1701219273.241619) can0 3E9#8000400000008000
(1701219273.252485) can0 0C9#00000007004100
(1701219273.252731) can0 191#1625162516250000
(1701219273.264981) can0 0C9#0000000A004100
(1701219273.265232) can0 191#1625162516250000
(1701219273.265395) can0 1A1#001042
(1701219273.265557) can0 1C1#122A122A
(1701219273.277479) can0 0C9#0000000D004100
(1701219273.277730) can0 191#1625162516250000
(1701219273.289983) can0 0C9#00000000004100
(1701219273.290233) can0 191#1625162516250000
(1701219273.290417) can0 1A1#001042
(1701219273.290580) can0 1C1#122A122A
(1701219273.290802) can0 2C5#122A03201FFF
(1701219273.302480) can0 0C9#00000007004100
(1701219273.302730) can0 191#1625162516250000
(1701219273.314980) can0 0C9#0000000A004100
(1701219273.315232) can0 191#1625162516250000
(1701219273.315395) can0 1A1#001042
(1701219273.315557) can0 1C1#122A122A
(1701219273.327479) can0 0C9#0000000D004100
(1701219273.327729) can0 191#1625162516250000
(1701219273.339981) can0 0C9#00000000004100
(1701219273.340238) can0 191#1625162516250000
(1701219273.340401) can0 1A1#001042
(1701219273.340563) can0 1C1#122A122A
(1701219273.340808) can0 2C5#122A03201FFF
(1701219273.341071) can0 3C1#0765040000000000
(1701219273.341337) can0 3D1#704E800000000000
(1701219273.341607) can0 3E9#8000400000008000
(1701219273.352492) can0 0C9#00000007004100
(1701219273.352738) can0 191#1625162516250000
(1701219273.364989) can0 0C9#0000000A004100
(1701219273.365238) can0 191#1625162516250000
(1701219273.365412) can0 1A1#001042
(1701219273.365584) can0 1C1#122A122A
(1701219273.377486) can0 0C9#0000000D004100
(1701219273.377737) can0 191#1625162516250000
(1701219273.389989) can0 0C9#00000000004100
(1701219273.390239) can0 191#1625162516250000
(1701219273.390438) can0 1A1#001042
(1701219273.390612) can0 1C1#122A122A
(1701219273.390784) can0 2C5#122A03201FFF
(1701219273.391078) can0 3F9#0600000057000000
(1701219273.402486) can0 0C9#00000007004100
(1701219273.402736) can0 191#1625162516250000
(1701219273.414990) can0 0C9#0000000A004100
(1701219273.415238) can0 191#1625162516250000
(1701219273.415410) can0 1A1#001042
(1701219273.415583) can0 1C1#122A122A
(1701219273.427485) can0 0C9#0000000D004100
(1701219273.427735) can0 191#1625162516250000
(1701219273.439989) can0 0C9#00000000004100
(1701219273.440245) can0 191#1625162516250000
(1701219273.440418) can0 1A1#001042
(1701219273.440591) can0 1C1#122A122A
(1701219273.440821) can0 2C5#122A03201FFF
(1701219273.441080) can0 3C1#0765040000000000
(1701219273.441347) can0 3D1#704E800000000000
(1701219273.441616) can0 3E9#8000400000008000
(1701219273.452484) can0 0C9#00000007004100
(1701219273.452733) can0 191#1625162516250000
(1701219273.464986) can0 0C9#0000000A004100
(1701219273.465236) can0 191#1625162516250000
(1701219273.465409) can0 1A1#001042
(1701219273.465582) can0 1C1#122A122A
(1701219273.477486) can0 0C9#0000000D004100
(1701219273.477735) can0 191#1625162516250000
(1701219273.489991) can0 0C9#00000000004100
(1701219273.490240) can0 191#1625162516250000
(1701219273.490433) can0 1A1#001042
(1701219273.490606) can0 1C1#122A122A
(1701219273.490778) can0 2C5#122A03201FFF
(1701219273.502484) can0 0C9#00000007004100
(1701219273.502734) can0 191#1625162516250000
(1701219273.514984) can0 0C9#0000000A004100
(1701219273.515234) can0 191#1625162516250000
(1701219273.515407) can0 1A1#001042
(1701219273.515580) can0 1C1#122A122A
(1701219273.527483) can0 0C9#0000000D004100
(1701219273.527732) can0 191#1625162516250000
(1701219273.539984) can0 0C9#00000000004100
(1701219273.540245) can0 191#1625162516250000
(1701219273.540418) can0 1A1#001042
(1701219273.540590) can0 1C1#122A122A
(1701219273.540817) can0 2C5#122A03201FFF
(1701219273.541077) can0 3C1#0765040000000000
(1701219273.541352) can0 3D1#704E800000000000
(1701219273.541613) can0 3E9#8000400000008000
(1701219273.552483) can0 0C9#00000007004100
(1701219273.552733) can0 191#1625162516250000
(1701219273.564988) can0 0C9#0000000A004100
(1701219273.565238) can0 191#1625162516250000
(1701219273.565411) can0 1A1#001042
(1701219273.565584) can0 1C1#122A122A
(1701219273.577483) can0 0C9#0000000D004100
(1701219273.577730) can0 191#1625162516250000
(1701219273.589986) can0 0C9#00000000004100
(1701219273.590233) can0 191#1625162516250000
(1701219273.590436) can0 1A1#001042
(1701219273.590587) can0 1C1#122A122A
(1701219273.590803) can0 2C5#122A03201FFF
(1701219273.602491) can0 0C9#00000007004100
(1701219273.602732) can0 191#1625162516250000
(1701219273.614982) can0 0C9#0000000A004100
(1701219273.615231) can0 191#1625162516250000
(1701219273.615405) can0 1A1#001042
(1701219273.615577) can0 1C1#122A122A
(1701219273.627484) can0 0C9#0000000D004100
(1701219273.627731) can0 191#1625162516250000
(1701219273.639985) can0 0C9#00000000004100
(1701219273.640234) can0 191#1625162516250000
(1701219273.640407) can0 1A1#001042
(1701219273.640579) can0 1C1#122A122A
(1701219273.640801) can0 2C5#122A03201FFF
(1701219273.641069) can0 3C1#0765040000000000
(1701219273.641335) can0 3D1#704E800000000000
(1701219273.641606) can0 3E9#8000400000008000
(1701219273.641871) can0 3F9#0600000057000000
(1701219273.642128) can0 4C1#82B43C3C50000000
(1701219273.642379) can0 4D1#88000092942600DA
(1701219273.652481) can0 0C9#00000007004100
(1701219273.652728) can0 191#1625162516250000
(1701219273.664977) can0 0C9#0000000A004100
(1701219273.665222) can0 191#1625162516250000
(1701219273.665390) can0 1A1#001042
(1701219273.665558) can0 1C1#122A122A
(1701219273.677483) can0 0C9#0000000D004100
(1701219273.677734) can0 191#1625162516250000
(1701219273.689984) can0 0C9#00000000004100
(1701219273.690231) can0 191#1625162516250000
(1701219273.690434) can0 1A1#001042
(1701219273.690585) can0 1C1#122A122A
(1701219273.690801) can0 2C5#122A03201FFF
(1701219273.702481) can0 0C9#00000007004100
(1701219273.702726) can0 191#1625162516250000
(1701219273.714979) can0 0C9#0000000A004100
(1701219273.715228) can0 191#1625162516250000
(1701219273.715402) can0 1A1#001042
(1701219273.715575) can0 1C1#122A122A
(1701219273.727477) can0 0C9#0000000D004100
(1701219273.727730) can0 191#1625162516250000
(1701219273.739979) can0 0C9#00000000004100
(1701219273.740237) can0 191#1625162516250000
(1701219273.740411) can0 1A1#001042
(1701219273.740584) can0 1C1#122A122A
(1701219273.740811) can0 2C5#122A03201FFF
(1701219273.741073) can0 3C1#0765040000000000
(1701219273.741338) can0 3D1#704E800000000000
(1701219273.741604) can0 3E9#8000400000008000
(1701219273.752468) can0 0C9#00000007004100
(1701219273.752716) can0 191#1625162516250000
(1701219273.764964) can0 0C9#0000000A004100
(1701219273.765216) can0 191#1625162516250000
(1701219273.765379) can0 1A1#001042
(1701219273.765541) can0 1C1#122A122A
(1701219273.777466) can0 0C9#0000000D004100
(1701219273.777715) can0 191#1625162516250000
(1701219273.789967) can0 0C9#00000000004100
(1701219273.790217) can0 191#1625162516250000
(1701219273.790382) can0 1A1#001042
(1701219273.790545) can0 1C1#122A122A
(1701219273.790786) can0 2C5#122A03201FFF
(1701219273.802466) can0 0C9#00000007004100
(1701219273.802715) can0 191#1625162516250000
(1701219273.814966) can0 0C9#0000000A004100
(1701219273.815216) can0 191#1625162516250000
(1701219273.815378) can0 1A1#001042
(1701219273.815540) can0 1C1#122A122A
(1701219273.827463) can0 0C9#0000000D004100
(1701219273.827712) can0 191#1625162516250000
(1701219273.839968) can0 0C9#00000000004100
(1701219273.840223) can0 191#1625162516250000
(1701219273.840388) can0 1A1#001042
(1701219273.840550) can0 1C1#122A122A
(1701219273.840791) can0 2C5#122A03201FFF
(1701219273.841055) can0 3C1#0765040000000000
(1701219273.841322) can0 3D1#704E800000000000
(1701219273.841594) can0 3E9#8000400000008000
(1701219273.852475) can0 0C9#00000007004100
(1701219273.852722) can0 191#1625162516250000
(1701219273.864979) can0 0C9#0000000A004100
(1701219273.865224) can0 191#1625162516250000
(1701219273.865397) can0 1A1#001042
(1701219273.865570) can0 1C1#122A122A
(1701219273.877473) can0 0C9#0000000D004100
(1701219273.877725) can0 191#1625162516250000
(1701219273.889976) can0 0C9#00000000004100
(1701219273.890224) can0 191#1625162516250000
(1701219273.890398) can0 1A1#001042
(1701219273.890571) can0 1C1#122A122A
(1701219273.890797) can0 2C5#122A03201FFF
(1701219273.891062) can0 3F9#0600000057000000
(1701219273.902471) can0 0C9#00000007004100
(1701219273.902722) can0 191#1625162516250000
(1701219273.914975) can0 0C9#0000000A004100
(1701219273.915222) can0 191#1625162516250000
(1701219273.915394) can0 1A1#001042
(1701219273.915566) can0 1C1#122A122A
(1701219273.927474) can0 0C9#0000000D004100
(1701219273.927720) can0 191#1625162516250000
(1701219273.939974) can0 0C9#00000000004100
(1701219273.940230) can0 191#1625162516250000
(1701219273.940403) can0 1A1#001042
(1701219273.940575) can0 1C1#122A122A
(1701219273.940797) can0 2C5#122A03201FFF
(1701219273.941063) can0 3C1#0765040000000000
(1701219273.941329) can0 3D1#704E800000000000
(1701219273.941598) can0 3E9#8000400000008000
(1701219273.952460) can0 0C9#00000007004100
(1701219273.952705) can0 191#1625162516250000
(1701219273.964969) can0 0C9#0000000A004100
(1701219273.965211) can0 191#1625162516250000
(1701219273.965373) can0 1A1#001042
(1701219273.965535) can0 1C1#122A122A
(1701219273.977457) can0 0C9#0000000D004100
(1701219273.977707) can0 191#1625162516250000
(1701219273.989959) can0 0C9#00000000004100
(1701219273.990210) can0 191#1625162516250000
(1701219273.990373) can0 1A1#001042
(1701219273.990534) can0 1C1#122A122A
(1701219273.990778) can0 2C5#122A03201FFF
(1701219274.002456) can0 0C9#00000007004100
(1701219274.002706) can0 191#1625162516250000
(1701219274.014965) can0 0C9#0000000A004100
(1701219274.015212) can0 191#1625162516250000
(1701219274.015375) can0 1A1#001042
(1701219274.015537) can0 1C1#122A122A
(1701219274.027461) can0 0C9#0000000D004100
(1701219274.027709) can0 191#1625162516250000
(1701219274.039965) can0 0C9#00000000004100
(1701219274.040217) can0 191#1625162516250000
(1701219274.040379) can0 1A1#001042
(1701219274.040541) can0 1C1#122A122A
(1701219274.040785) can0 2C5#122A03201FFF
(1701219274.041050) can0 3C1#0765040000000000
(1701219274.041315) can0 3D1#704E800000000000
(1701219274.041592) can0 3E9#8000400000008000
(1701219274.052471) can0 0C9#00000007004100
(1701219274.052716) can0 191#1625162516250000
(1701219274.064976) can0 0C9#0000000A004100
(1701219274.065211) can0 191#1625162516250000
(1701219274.065380) can0 1A1#001042
(1701219274.065548) can0 1C1#122A122A
(1701219274.077469) can0 0C9#0000000D004100
(1701219274.077717) can0 191#1625162516250000
(1701219274.089968) can0 0C9#00000000004100
(1701219274.090217) can0 191#1625162516250000
(1701219274.090394) can0 1A1#001042
(1701219274.090568) can0 1C1#122A122A
(1701219274.090795) can0 2C5#122A03201FFF

So there it is! I have no idea what I'm doing but I'll keep trying to figure it out until I get bored or whatever.

two files attached hopefully.

[ironduke]

Thanks for the logs, it's a little weird how it was already unlocked? Had you tried something prior and possibly semi brick it?

As far as writing the vin it's done with a 3b write command to 0x90 after it's been unlocked.. everything after // is just commenting

Code: Select all

//Needs to be unlocked already with 2701 getting the seed and 2702 sending the key back to unlock it.

7E010133B9030313233 // 0x10 means multiline write command,0x13 means sending0x13 bytes(17 digit vin plus 2 byte write command), 3B write command to location 0x90. then ascii digits in hex, writing 0123 for the start of the vin
7E830000A // This is the ecm ack back and signaling that it's ready for the rest of the message.
7E02134353637383941 // 2nd line of data. 21 is the number of the line.. writing some more of the vin.456789A
7E02231313537363300 // 3nd line of data. 22 is the number of the line.. Writing the rest of the vin. BCDEF0
7E8027B90AAAAAAAAAA // This is the correct response from writing the vin.

Not sure what's going to happen after you write the vin. Scan tools may not connect to it correctly? not sure what hpt will do either. hpt looks at the operating system of the ECM to determine what it is but if the vin doesn't match it I have no idea if it'll error out like a scan tool might?

[Meistro]

Does it need to be unlocked to do the "read entire"? Thats all I can do with HPT currently since I didn't burn any credits on this ECU yet. How can I tell what command is coming from HPT and what the ECU is saying? I can post the .hpt file it made if anyone wants it but it would be in about 8 hours since it's at home. Is there a way to convert the hpt file into a bin?

Another thing I want to try is connecting more modules to the bus and do some more logging. I need to hit up the junk yard again Saturday for a throttle control module and pedal assy. I'm pretty sure my gen 3 throttle crap won't work with E67. The throttle body itself is gen 4 already, using xlink adapter. I need to find a T42 to operate my 4L80e. I have a transfer case control module. Not sure I'm even going to need that one since, AWD without any electronic interference . I have a body control module to mess with. I should find an instrument cluster.

This project might turn out to be an almost complete rewire of my truck. I'd still like to keep things like power windows, heated seats, power mirrors, climate control is a plus too.

Does anyone have a wiring schematic of a 2007 GMC Acadia? I'd like to figure out what the power, gnd, and can lines are on the BCM and see what that has to add to the bus traffic.

[Meistro]

Here's the details of the E67 that HPtuners read..

[ironduke]

Right here you can see it sending back a seed of 0000.. that means it's already unlocked, which it shouldn't be.. I do see this after I've semi bricked an ecu and programming isn't complete.. If it's unlocked you can do most of the normal routines like send a kernel to it for execution like reading or writing.. Do not think you can perform a vin write but I've never tried in this situation.

(1701219294.830578) can0 7E0#0227010000000000
(1701219294.833213) can0 7E8#0467010000AAAAAA

Below is a normal unlock log.. See how the ecm sends a 2 byte seed and then the programmer sends a 2 byte key back and then gets a 6702 response for successful unlock.


7E00227010000000000
7E80467018EE40000000
101FE013E0000000000
7E00427029BB2000000
7E8026702AAAAAAAAAA

[Meistro]

Thanks for the logs, it's a little weird how it was already unlocked? Had you tried something prior and possibly semi brick it?

As far as writing the vin it's done with a 3b write command to 0x90 after it's been unlocked.. everything after // is just commenting

Code: Select all

//Needs to be unlocked already with 2701 getting the seed and 2702 sending the key back to unlock it.

7E010133B9030313233 // 0x10 means multiline write command,0x13 means sending0x13 bytes(17 digit vin plus 2 byte write command), 3B write command to location 0x90. then ascii digits in hex, writing 0123 for the start of the vin
7E830000A // This is the ecm ack back and signaling that it's ready for the rest of the message.
7E02134353637383941 // 2nd line of data. 21 is the number of the line.. writing some more of the vin.456789A
7E02231313537363300 // 3nd line of data. 22 is the number of the line.. Writing the rest of the vin. BCDEF0
7E8027B90AAAAAAAAAA // This is the correct response from writing the vin.

Not sure what's going to happen after you write the vin. Scan tools may not connect to it correctly? not sure what hpt will do either. hpt looks at the operating system of the ECM to determine what it is but if the vin doesn't match it I have no idea if it'll error out like a scan tool might?

Is it possible that HPT leaves it unlocked after a read?

07acadia.jpg (45.14 KiB) Viewed 6622 times

Btw when I brick it, because realistically I probably will, then I'll have better reason to extract it from the housing to see whats on the other side. Looks like I'd have to suck the solder out of each pin. Not too friendly but not impossible.

[Tazzi]

Is it possible that HPT leaves it unlocked after a read?

This is where a bit of confusion happens when people talk about 'locks'.

So, all engine computers have a factory seed/key. The procedure of requesting security access to allow doing more advanced abilities is called "security unlock" which requests calculating the correct key from the ecus supplied seed.
The seed value varies between each ECU hence why a calculation is needed to get the key.

When an ecu has a factory seed/key combination, this is known as being stock or "unlocked" as factory tools or commercial tuning tools can happily read and write a tune to the car.

Whereas, when an ecu is "tuner locked", this is where someone has placed a custom key in place of the stock one, which results in tools from being unable to complete the security unlock as the wrong key is entered.

[Meistro]

Is it possible that HPT leaves it unlocked after a read?

This is where a bit of confusion happens when people talk about 'locks'.

So, all engine computers have a factory seed/key. The procedure of requesting security access to allow doing more advanced abilities is called "security unlock" which requests calculating the correct key from the ecus supplied seed.
The seed value varies between each ECU hence why a calculation is needed to get the key.

When an ecu has a factory seed/key combination, this is known as being stock or "unlocked" as factory tools or commercial tuning tools can happily read and write a tune to the car.

Whereas, when an ecu is "tuner locked", this is where someone has placed a custom key in place of the stock one, which results in tools from being unable to complete the security unlock as the wrong key is entered.

Ahhh, I understand now. Thats why all my "licensed" HPT tunes have a feature not shown on this unlicensed one that I can click to lock it.

[ironduke]

I'm confused because the log I read was from a read, wasn't it?? afaik all gm ecu's will revert back to a locked status after about 3 seconds of inactivity on the bus.. I do not know why it showed 0000 as the seed when your controller information shows a seed of 8B4E.. Key should be BDC8 I believe..
Wonder if you had read it and just read it a second time real quick? lol, no idea..

[kur4o]

That box looks like custom key for unlocking, and it is unchecked so it must be not used during the read process.