rnd-ash / mercedes-hacking-docs Goto Github PK

Documents on hacking and reverse engineering Mercedes vehicles

mercedes-hacking-docs's Introduction

A Guide to Hacking and Exploring Your Mercedes-Benz

This repository is a journey on how one would go about hacking and reverse engineering Mercedes vehicles. When we use the term hacking, we pay homage to the original hackers of the day, the MIT’s Tech Model Railroad Club who way back in 1961 hacked their high-tech train sets in order to modify their functions. It is not criminal in any way but is about exploring our cars and understanding how they work and more importantly, how we can modify functions to our liking.

It will be a living document that is continually edited and updated. This is a new area of car research that takes into account both the mechanical and engineering from yesteryear but also embedded electronics, networking and protocols.

Chapter 1: Vehicle Bus Protocols and Diagnostics

Chapter 2: Tools and Equipment

Chapter 3: Connecting to the Vehicle

Chapter 4: Understanding Controller Area Networks (CAN) Messages

Chapter 5: Understanding Mercedes-Benz Signal Acquisition Modules (SAM)

Chapter 6: Exploring the Engine Control Unit (ECU)

Chapter 7: In Car Entertainment

Chapter 8: Performance Tuning

Chapter 9: Debugging and Fault Finding

mercedes-hacking-docs's People

Contributors

Stargazers

Watchers

mercedes-hacking-docs's Issues

CAN bus connection to OBD2 Port

I tried to listen to my CAN bus on my W169 over the OBD2 port. I use an USB2CAN device and linux SocketCAN. I could successfully listen to my interior bus (CAN-B, speed 83'000) but somehow it is not possible to listen to CAN-C engine bus directly over the OBD2 port. For the interior bus, I connected my CAN device to the CAN connector near the SAM on the passenger seat side.

This is how I bring up the can device:

sudo ip link set can0 up type can bitrate 500000
sudo candump can0

Unfortunately I can nothing see on the command line. Candump does not display any data.

I use an OBD2 to D-SUB 9 cable. I also sent the wakeup command before:

sudo cansend can0 01C#0210920000000000

Nothing changed after trying again with candump.

Does anybody know what might be the problem?

reverse engineering formulas from xsmonitor_frame

If signal has UNIT, sometimes there is also calculation required. for example temperatures. Would love to see calculation formula in parse_dat_v4.py

Created some formulas based on guesswork (which work). Identified 15 unknown padding bytes in frame, unfortunately I don't know how reverse engineer formulas from that.

The (working) formulas are:
angelovAlex/can-bus-w211#3 (comment)

The full frame example is:

Click to expand

05 80 02 00 08 53 41 4d  5f 56 5f 41 32 00 17 00  |.....SAM_V_A2...|
00 00 00 00 04 00 07 80  00 01 00 0a 54 5f 41 55  |............T_AU|
53 53 45 4e 5f 42 00 08  02 01 00 00 00 00 00 00  |SSEN_B..........|
00 3f 00 00 20 c2 02 b0  43 13 41 75 df 65 6e 6c  |.?.. ...C.Au.enl|
75 66 74 74 65 6d 70 65  72 61 74 75 72 07 80 00  |ufttemperatur...|
02 00 08 50 5f 4b 41 45  4c 54 45 08 10 02 01 00  |...P_KAELTE.....|
00 00 00 cd cc cc 3d 00  00 00 00 03 62 61 72 17  |......=.....bar.|
44 72 75 63 6b 20 4b e4  6c 74 65 6d 69 74 74 65  |Druck K.ltemitte|
6c 20 52 31 33 34 61 07  80 00 03 00 08 54 5f 4b  |l R134a......T_K|
41 45 4c 54 45 18 10 02  01 00 00 00 00 cd cc cc  |AELTE...........|
3d 00 00 20 c1 02 b0 43  1c 54 65 6d 70 65 72 61  |=.. ...C.Tempera|
74 75 72 20 4b e4 6c 74  65 6d 69 74 74 65 6c 20  |tur K.ltemittel |
52 31 33 34 61 07 80 00  04 00 06 49 5f 4b 4f 4d  |R134a......I_KOM|
50 28 08 02 01 00 00 00  00 00 00 20 41 00 00 00  |P(......... A...|
00 02 6d 41 21 53 74 72  6f 6d 20 4b 6f 6d 70 72  |..mA!Strom Kompr|
65 73 73 6f 72 2d 48 61  75 70 74 72 65 67 65 6c  |essor-Hauptregel|
76 65 6e 74 69 6c                                 |ventil|

rnd-ash / mercedes-hacking-docs Goto Github PK

mercedes-hacking-docs's Introduction

A Guide to Hacking and Exploring Your Mercedes-Benz

mercedes-hacking-docs's People

Contributors

Stargazers

Watchers

Forkers

mercedes-hacking-docs's Issues

CAN bus connection to OBD2 Port

reverse engineering formulas from xsmonitor_frame

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent