UDS - OBD Addressing

[DieselBob]

Been a while.
Found a new rabbit hole to run around in..

Multiple manufacturer comms....
Sniffing standard ISO CANBUS (11 bit header/addressing for Isuzu) for ECM addresses/connections.

Haven't tried looping through addresses as don't have a bench rig to leave overnight..

Wondering if anyone has a generic GATEWAY address or range to use as a starting point?
0x241 gets a reply from 0x261 as an example
Found some ECM addressing on the net.
But other than the standard 0x7xx diagnostic, appears to be manufacturer assigned...

[antus]

Have you tried any J1939? Also look for K-Line (some isuzu have old hardware still talking K-Line).

[DieselBob]

Thanks Antus.

The info was good.
Got the Arduino running, both as a CAN sniffer and ECU sim.
ISUZU are like most Japanese manufacturers, they have minimal OBD2.
Their main diagnostic is KWP2000 on CAN.
The Engine ECU has a seperate KWP K line - thinking for flashing.
Currently writing the app to auto connect and download the ECU ID's.

[DieselBob]

Been a while. So here's where it's at.
If you run the standard OBD on ELM327.
ATZ - OK
ATSP0 - OK
0100 - SEARCHING... 41 00 XX XX XX XX
Now there's a connection try
3E - NO DATA.
ATSH 7E0 - OK
3E - either 7E or 7F 3E 12

If you get the 7F reject.
Try adding sub - functions
3E 00 or 3E 81.
Use the ISO^s and roll through until you get a 7E response.

And this is where it gets fun.
Isuzu have used KWP - GMLAN - and now UDS.

If the ECU answers the TESTER PRESENT - 3E depending on the flavour - you have a PROTOCOLonCAN

You need to probe to find the right flavour.

The higher protocols will only answer from the physical addressing.

Tried a 2701 probe. Got a seed.
No idea how to get the key.

[antus]

What vehicle? Year and model?

[jakka]

good work!