• Sign Up! To view all forums and unlock additional cool features

    Welcome to the #1 Dodge, Jeep and RAM Forum dedicated to FCA owners and enthusiasts. Register for an account, it's free and it's easy, so don't hesitate to join the SRT Forum today!


Building a bench harness for GPEC based controllers.

Mean Cat

4000 Posts Club
Founding Member
Donating Member
9 Second Best E/T
HFCOTM
Member ID
#997
Messages
4,981
Reactions
9,435
Likes
302
City
Houston
State
TX
Country
United States
Vehicle
2017 Challenger Hellcat
#21
Most of this is over my head, but very cool thread & learning a little. :whistle:
 


OP
fumanchu182

fumanchu182

3000 Posts Club
Vendor
Premium Account
U.S. Navy Veteran
Donating Member
9 Second Best E/T
HFCOTM
Member ID
#2366
Messages
3,488
Reactions
8,484
Likes
302
City
Pasadena
State
MD
Country
United States
Vehicle
2015 Challenger SRT Hellcat
Thread Starter #22
Most of this is over my head, but very cool thread & learning a little. :whistle:
that's why I created this thread, to help get information out. Today I'm learning how to sniff the traffic the controller is throwing around:

1628887557555.png

The 2C3CDZC is the beginning of the vin, and the id of the controller throwining it around is 0x3e0, a few milliseconds later it will broadcast the rest of the vin. Right now I'm going to be setting up some brute forcing to see how you can get data with Caring Caribou (can utility). I'd like to see how to receive a PCM read and ultimately a write. I don't think any of these utilities exist right now on linux.
 


Speedy!

Infomercial Producer
Staff Team
Founding Member
U.S. Marine Veteran
9 Second Best E/T
HFCOTM & HFCOTY
Member ID
#1070
Messages
6,069
Reactions
15,536
Likes
402
City
Murfreesboro
State
TN
Country
United States
Vehicle
2016 Hellcat Go Man Go
#23
HEX, yuck brings back nightmares from college LOL
 


drag racer

1000 Posts Club
Founding Member
Premium Account
Member ID
#1047
Messages
1,229
Reactions
3,157
Likes
162
City
PEORIA
State
AZ
Country
United States
Vehicle
'16 Challenger HC, '19 Durango SRT, '22 Charger SP
#24
sub'd
 


Member ID
#9157
Messages
3
Reactions
5
Likes
2
City
Mansfield
State
TX
Country
United States
Vehicle
1979 Plymouth Trailduster
#25
Nifty.
 


OP
fumanchu182

fumanchu182

3000 Posts Club
Vendor
Premium Account
U.S. Navy Veteran
Donating Member
9 Second Best E/T
HFCOTM
Member ID
#2366
Messages
3,488
Reactions
8,484
Likes
302
City
Pasadena
State
MD
Country
United States
Vehicle
2015 Challenger SRT Hellcat
Thread Starter #26
Hey, didn't think you'd come from the HP Tuners forums to here! Welcome to the dark side of the Mopar community. :D
 


Jack_Toepfer

3000 Posts Club
Founding Member
Premium Account
Donating Member
Member ID
#966
Messages
3,296
Reactions
6,590
Likes
252
City
Buffalo
State
NY
Country
United States
Vehicle
2016 Dodge Charger Triple Black
#27
HEX, yuck brings back nightmares from college LOL
Just CTRL+H to turn it into English… right? Lol.
 


Member ID
#9157
Messages
3
Reactions
5
Likes
2
City
Mansfield
State
TX
Country
United States
Vehicle
1979 Plymouth Trailduster
#28
Hey, didn't think you'd come from the HP Tuners forums to here! Welcome to the dark side of the Mopar community. :D
I don't have to own a Hellcat to play do I?
 


OP
fumanchu182

fumanchu182

3000 Posts Club
Vendor
Premium Account
U.S. Navy Veteran
Donating Member
9 Second Best E/T
HFCOTM
Member ID
#2366
Messages
3,488
Reactions
8,484
Likes
302
City
Pasadena
State
MD
Country
United States
Vehicle
2015 Challenger SRT Hellcat
Thread Starter #29
Nope, just enjoy the banter and stay way from @Hickster he might give you some shine and you'll be addicted.
 


OP
fumanchu182

fumanchu182

3000 Posts Club
Vendor
Premium Account
U.S. Navy Veteran
Donating Member
9 Second Best E/T
HFCOTM
Member ID
#2366
Messages
3,488
Reactions
8,484
Likes
302
City
Pasadena
State
MD
Country
United States
Vehicle
2015 Challenger SRT Hellcat
Thread Starter #30
Small update, have been working on figuring out how to speak the correct language on the canbus, been doing a lot of research and found that the system uses ISO-TP. This means that if I send data to one arbitration ID (unique id) it will appear on another. This means I have to setup a sender and a listener. There are some good open source tools to do so namely isotpsend, isotpsniffer and isotprecv. All of them have quirks and nuances but make gathering intelligence easy. On top of the ISO-TP layers sits Unifited Diagnostic Services (UDS). UDS is to guarantee that any mechanic in the world can diagnose a car without paying stupid money to a higher conglomerate for proprietary data. These services are pretty well defined here: https://en.wikipedia.org/wiki/OBD-II_PIDs, andything above 0x10 is propriety but I have also enumerated those.

So when doing some enumeration I used the tools like follows (have to put it in a monofont):

to enumerate: echo "01 00" | isotpsend -p00 -s 7df -d 7e8 slcan0
response: slcan0 7E8 [8] [SF] ln: 6 data: 41 00 BF FE A8 93 30 - 'A.....0' - [???] Unknown

The bytes returned are hex encoded so that 1 means supported, 0 means not supported

1 0 1 1 1 1 1 1 1 1 1 1 1 1 1 0 1 0 1 0 1 0 0 0 1 0 0 1 0 0 1 1
Y N Y Y Y Y Y Y Y Y Y Y Y Y Y N Y N Y N Y N N N Y N N Y N N Y Y
1 2 3 4 5 6 7 8 9 A B C D E F 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20


So of note you can request 01 20, 01 40, 01 60, 01 80, 01 A0 to find all the pids supported
all the way through 00 - C4, I would rather do this programatically.


to enumerate: echo "09 00" | isotpsend -p00 -s 7df -d 7e8 slcan0
response: slcan0 7E8 [8] [SF] ln: 6 data: 49 00 55 40 00 00 0C - 'I.U@...' - [???] Unknown

The bytes returned are hex encoded so that 1 means supported, 0 means not supported

0 1 0 1 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
N Y N Y N Y N Y N Y N N N N N N N N N N N N N N N N N N N N N N
1 2 3 4 5 6 7 8 9 A B C D E F 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20


0x2 is the vin
0x4 is the calibration id
0x6 is the cvn (cali smog check bullshit)
0x8 is race stuff?
0xa is text name of ecm

Now for the proprietary stuff, anything above 0x10 is manufacturer defined and there are a few tools that can help with that Caring Caribou is a brute/sniffer of softs and it found the following:

└─$ ./cc.py uds discovery -ab 10

-------------------
CARING CARIBOU v0.3
-------------------

Loaded module 'uds'

Scanning for arbitration IDs to blacklist
0.0 seconds left, 1 found
Detected IDs: 0x122
Sending Diagnostic Session Control to 0x07df
Verifying potential response from 0x07df
Resending 0x7df... Success
Found diagnostics server listening at 0x07df, response at 0x07e8
Sending Diagnostic Session Control to 0x07e0
Verifying potential response from 0x07e0
Resending 0x7e0... Success
Found diagnostics server listening at 0x07e0, response at 0x07e8
Sending Diagnostic Session Control to 0x07ff

Identified diagnostics:

+------------+------------+
| CLIENT ID | SERVER ID |
+------------+------------+
| 0x000007df | 0x000007e8 |
| 0x000007e0 | 0x000007e8 |
+------------+------------+


then from there I did a follow on test

└─$ ./cc.py uds services -t 0.5 0x7df 0x7e8

-------------------
CARING CARIBOU v0.3
-------------------

Loaded module 'uds'

Probing service 0xff (255/255): found 7
Done!

Supported service 0x-2a: Unknown service
Supported service 0x00: Unknown service
Supported service 0x-2e: Unknown service
Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL
Supported service 0x28: COMMUNICATION_CONTROL
Supported service 0x29: Unknown service
Supported service 0x3e: TESTER_PRESENT

┌──(weeeeeeeeee㉿kali-vm)-[~/canbus/caringcaribou/tool]
└─$ ./cc.py uds services 0x7e0 0x7e8

-------------------
CARING CARIBOU v0.3
-------------------

Loaded module 'uds'

Probing service 0xff (255/255): found 29
Done!

Supported service 0x-2a: Unknown service
Supported service 0x00: Unknown service
Supported service 0x-2e: Unknown service
Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL
Supported service 0x11: ECU_RESET
Supported service 0x14: CLEAR_DIAGNOSTIC_INFORMATION
Supported service 0x17: Unknown service
Supported service 0x18: Unknown service
Supported service 0x1a: Unknown service
Supported service 0x21: Unknown service
Supported service 0x22: READ_DATA_BY_IDENTIFIER
Supported service 0x23: READ_MEMORY_BY_ADDRESS
Supported service 0x27: SECURITY_ACCESS
Supported service 0x28: COMMUNICATION_CONTROL
Supported service 0x29: Unknown service
Supported service 0x2c: DYNAMICALLY_DEFINE_DATA_IDENTIFIER
Supported service 0x2e: WRITE_DATA_BY_IDENTIFIER
Supported service 0x30: Unknown service
Supported service 0x31: ROUTINE_CONTROL
Supported service 0x32: Unknown service
Supported service 0x33: Unknown service
Supported service 0x34: REQUEST_DOWNLOAD
Supported service 0x35: REQUEST_UPLOAD
Supported service 0x36: TRANSFER_DATA
Supported service 0x37: REQUEST_TRANSFER_EXIT
Supported service 0x3b: Unknown service
Supported service 0x3d: WRITE_MEMORY_BY_ADDRESS
Supported service 0x3e: TESTER_PRESENT
Supported service 0x85: CONTROL_DTC_SETTING


Of course thought I am not expert and when in doubt I have to correlate my findings to what I can see with the MPVI2 which is kinda of cheating but hey, it's been fun over the last 48 hours and I learned how to speak ISOTP. There is more to come, I have to decide if I want to try and break the MPVI2 for use with Linux as it just uses a standard FTDI driver or continue using a generic connector like my Lawicel CANUSB and going from there.
 


Member ID
#9157
Messages
3
Reactions
5
Likes
2
City
Mansfield
State
TX
Country
United States
Vehicle
1979 Plymouth Trailduster
#31
Small update, have been working on figuring out how to speak the correct language on the canbus, been doing a lot of research and found that the system uses ISO-TP. This means that if I send data to one arbitration ID (unique id) it will appear on another. This means I have to setup a sender and a listener. There are some good open source tools to do so namely isotpsend, isotpsniffer and isotprecv. All of them have quirks and nuances but make gathering intelligence easy. On top of the ISO-TP layers sits Unifited Diagnostic Services (UDS). UDS is to guarantee that any mechanic in the world can diagnose a car without paying stupid money to a higher conglomerate for proprietary data. These services are pretty well defined here: https://en.wikipedia.org/wiki/OBD-II_PIDs, andything above 0x10 is propriety but I have also enumerated those.

So when doing some enumeration I used the tools like follows (have to put it in a monofont):

to enumerate: echo "01 00" | isotpsend -p00 -s 7df -d 7e8 slcan0
response: slcan0 7E8 [8] [SF] ln: 6 data: 41 00 BF FE A8 93 30 - 'A.....0' - [???] Unknown


The bytes returned are hex encoded so that 1 means supported, 0 means not supported

1 0 1 1 1 1 1 1 1 1 1 1 1 1 1 0 1 0 1 0 1 0 0 0 1 0 0 1 0 0 1 1
Y N Y Y Y Y Y Y Y Y Y Y Y Y Y N Y N Y N Y N N N Y N N Y N N Y Y
1 2 3 4 5 6 7 8 9 A B C D E F 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20


So of note you can request 01 20, 01 40, 01 60, 01 80, 01 A0 to find all the pids supported
all the way through 00 - C4, I would rather do this programatically.


to enumerate: echo "09 00" | isotpsend -p00 -s 7df -d 7e8 slcan0
response: slcan0 7E8 [8] [SF] ln: 6 data: 49 00 55 40 00 00 0C - 'I.U@...' - [???] Unknown

The bytes returned are hex encoded so that 1 means supported, 0 means not supported

0 1 0 1 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
N Y N Y N Y N Y N Y N N N N N N N N N N N N N N N N N N N N N N
1 2 3 4 5 6 7 8 9 A B C D E F 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20


0x2 is the vin
0x4 is the calibration id
0x6 is the cvn (cali smog check bullshit)
0x8 is race stuff?
0xa is text name of ecm

Now for the proprietary stuff, anything above 0x10 is manufacturer defined and there are a few tools that can help with that Caring Caribou is a brute/sniffer of softs and it found the following:

└─$ ./cc.py uds discovery -ab 10

-------------------
CARING CARIBOU v0.3
-------------------


Loaded module 'uds'

Scanning for arbitration IDs to blacklist
0.0 seconds left, 1 found
Detected IDs: 0x122
Sending Diagnostic Session Control to 0x07df
Verifying potential response from 0x07df
Resending 0x7df... Success
Found diagnostics server listening at 0x07df, response at 0x07e8
Sending Diagnostic Session Control to 0x07e0
Verifying potential response from 0x07e0
Resending 0x7e0... Success
Found diagnostics server listening at 0x07e0, response at 0x07e8
Sending Diagnostic Session Control to 0x07ff


Identified diagnostics:

+------------+------------+
| CLIENT ID | SERVER ID |
+------------+------------+
| 0x000007df | 0x000007e8 |
| 0x000007e0 | 0x000007e8 |
+------------+------------+


then from there I did a follow on test

└─$ ./cc.py uds services -t 0.5 0x7df 0x7e8

-------------------
CARING CARIBOU v0.3
-------------------


Loaded module 'uds'

Probing service 0xff (255/255): found 7
Done!


Supported service 0x-2a: Unknown service
Supported service 0x00: Unknown service
Supported service 0x-2e: Unknown service
Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL
Supported service 0x28: COMMUNICATION_CONTROL
Supported service 0x29: Unknown service
Supported service 0x3e: TESTER_PRESENT


┌──(weeeeeeeeee㉿kali-vm)-[~/canbus/caringcaribou/tool]
└─$ ./cc.py uds services 0x7e0 0x7e8


-------------------
CARING CARIBOU v0.3
-------------------


Loaded module 'uds'

Probing service 0xff (255/255): found 29
Done!


Supported service 0x-2a: Unknown service
Supported service 0x00: Unknown service
Supported service 0x-2e: Unknown service
Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL
Supported service 0x11: ECU_RESET
Supported service 0x14: CLEAR_DIAGNOSTIC_INFORMATION
Supported service 0x17: Unknown service
Supported service 0x18: Unknown service
Supported service 0x1a: Unknown service
Supported service 0x21: Unknown service
Supported service 0x22: READ_DATA_BY_IDENTIFIER
Supported service 0x23: READ_MEMORY_BY_ADDRESS
Supported service 0x27: SECURITY_ACCESS
Supported service 0x28: COMMUNICATION_CONTROL
Supported service 0x29: Unknown service
Supported service 0x2c: DYNAMICALLY_DEFINE_DATA_IDENTIFIER
Supported service 0x2e: WRITE_DATA_BY_IDENTIFIER
Supported service 0x30: Unknown service
Supported service 0x31: ROUTINE_CONTROL
Supported service 0x32: Unknown service
Supported service 0x33: Unknown service
Supported service 0x34: REQUEST_DOWNLOAD
Supported service 0x35: REQUEST_UPLOAD
Supported service 0x36: TRANSFER_DATA
Supported service 0x37: REQUEST_TRANSFER_EXIT
Supported service 0x3b: Unknown service
Supported service 0x3d: WRITE_MEMORY_BY_ADDRESS
Supported service 0x3e: TESTER_PRESENT
Supported service 0x85: CONTROL_DTC_SETTING


Of course thought I am not expert and when in doubt I have to correlate my findings to what I can see with the MPVI2 which is kinda of cheating but hey, it's been fun over the last 48 hours and I learned how to speak ISOTP. There is more to come, I have to decide if I want to try and break the MPVI2 for use with Linux as it just uses a standard FTDI driver or continue using a generic connector like my Lawicel CANUSB and going from there.
Have you tried talking using an ELM327 device like the OBDlink MX+?

You might look up a thing called PCM Hammer as well. I believe that this software allows J2534 flashing with ELM327 devices. It's centered around GM protocols.
 


Hpindy

4000 Posts Club
Founding Member
9 Second Best E/T
HFCOTM
Member ID
#974
Messages
4,869
Reactions
11,001
Likes
302
City
Jackson's Point
State
Non-US
Country
Canada
Vehicle
2018 challenger hellcat
#32
Holy Crap !
I`m in for this. I do a lot of the same stuff for my snowmobile tuning.
 


jonx96

4000 Posts Club
8 Second Best E/T
HFCOTM
Member ID
#4957
Messages
4,246
Reactions
10,573
Likes
302
City
Small town
State
MI
Country
United States
Vehicle
2019 Challenger Redeye
#33
This looks like fun. When I was 17 I started on something like this. But I wasn't going this deep into it. I just wanted to get it to say something funny instead of read outside temperature or something like that. I can't remember the name of the device that was around at that time. I think I have an ELM device as mentioned ahead laying around somewhere. I haven't used it in awhile. You may have inspired me just to play around a little with something like this again. Sounds like a fun winter project. I have been looking for a cheap winter project.
Holy Crap !
I`m in for this. I do a lot of the same stuff for my snowmobile tuning.
I should have kept my turbo Z1 to play around with for tuning. I sold all my sleds. I sold 4 snowmobiles and 2 trailers over winter and have 0 left. Maybe I'll get another. I want a sidewinder. Tons of tuning potential there. I just don't know if sleds and a bigger trailer (why I sold the 2 smaller ones) are in the cars for this year. I need two sleds because the wife will want another if I get one. We just don't have the snow like you do. We get a snow storm and then a week later it'll get warm and then another snowstorm and repeat.
 


OP
fumanchu182

fumanchu182

3000 Posts Club
Vendor
Premium Account
U.S. Navy Veteran
Donating Member
9 Second Best E/T
HFCOTM
Member ID
#2366
Messages
3,488
Reactions
8,484
Likes
302
City
Pasadena
State
MD
Country
United States
Vehicle
2015 Challenger SRT Hellcat
Thread Starter #34
Have you tried talking using an ELM327 device like the OBDlink MX+?

You might look up a thing called PCM Hammer as well. I believe that this software allows J2534 flashing with ELM327 devices. It's centered around GM protocols.
The issue with ELM327 and ELM327L are the knock off chips. That combined with the covid-19 has meant that ELM is shutting down. i.e. the chips are a dead market now.

Elm Electronics has had a presence on the internet since 1998, providing unique integrated circuits to the electronics community. What began as an idea to provide ‘glue’ circuits for experimenters soon developed into providing more complicated devices such as our LANC and OBDII interfaces. Certainly the most popular of these has been our ELM327 OBD to RS232 Interpreter product.

Having to live with, and make adjustments for Covid-19 has reminded us of a great many things, however. Foremost is that life is very precious and our time here is very limited. For this reason, we have decided to wind down our business, and close it effective June 2022.
I am building the software on top of SocketCAN which has built in drivers with the Linux Kernel, anyone that has this will be able to use the software. For greater adoption I'd love to use Windows but I dont' know much about it. Last time I did Windows development was 2002 and with the Win32 API.
 


OP
fumanchu182

fumanchu182

3000 Posts Club
Vendor
Premium Account
U.S. Navy Veteran
Donating Member
9 Second Best E/T
HFCOTM
Member ID
#2366
Messages
3,488
Reactions
8,484
Likes
302
City
Pasadena
State
MD
Country
United States
Vehicle
2015 Challenger SRT Hellcat
Thread Starter #35
Status update, wrote two utilities. One to query what pids are available on the system and anothe to read all DTC codes. These were exercises to get used to how the GPEC2A controller talks ISO-TP over can. Since it uses traditional sockets it was quite easy. Now these are using traditional OBD2 "words", should Stellantis have put in special codes/mmenoics/hidden fuckery I'll have to do the research to uncover them but so far comparing my work with HP Tuners I'm on par. Here is output from HP Tuners:

0x7E8: P007D - Charge Air Cooler Temperature Sensor Circuit High (Bank 1) (Pending)
0x7E8: P0098 - Intake Air Temperature Sensor 2 Circuit High (Pending)
0x7E8: P00A3 - Charge Air Cooler Temperature Sensor Circuit High (Bank 2) (Pending)
0x7E8: P00E1 - Charge Air Cooler Coolant Temperature Sensor Circuit High (Pending)
0x7E8: P00EB - Intake Air Temperature Sensor 3 Circuit High Bank 1 (Pending)
0x7E8: P00FB (SES, Pending, Current)
0x7E8: P0103 - Mass or Volume Air Flow A Circuit High (SES, Pending, Current, Permanent)
0x7E8: P0108 - Manifold Absolute Pressure/BARO Sensor High (SES, Pending, Current)
0x7E8: P0113 - Intake Air Temperature Sensor 1 Circuit High (Pending)
0x7E8: P0118 - Engine Coolant Temperature Sensor 1 Circuit High (SES, Pending, Current, Permanent)
0x7E8: P0123 - Throttle/Pedal Position Sensor A Circuit High (SES, Pending, Current, Permanent)
0x7E8: P012D - Turbocharger/Supercharger Inlet Pressure Sensor Circuit High (SES, Pending, Current)
0x7E8: P018D - Fuel Pressure Sensor B Circuit High (Pending)
0x7E8: P0198 - Engine Oil Temperature Sensor Circuit High (SES, Pending, Current)
0x7E8: P0222 - Throttle/Pedal Position Sensor/Switch B Circuit Low (SES, Pending, Current, Permanent)
0x7E8: P0480 - Fan 1 Control Circuit (SES, Pending, Current, Permanent)
0x7E8: P051D - Crankcase Pressure Sensor Circuit High (Current)
0x7E8: P0523 - Engine Oil Pressure Sensor/Switch Circuit High (SES, Pending, Current)
0x7E8: P0627 - Fuel Pump A Control Circuit / Open (Current)
0x7E8: P0685 - ECM/PCM Power Relay Control Circuit/Open (Current)
0x7E8: P0688 - ECM/PCM Power Relay Sense Circuit (Current)
0x7E8: P1457 (SES, Pending, Current)
0x7E8: P1610 (SES, Pending, Current, Permanent)
0x7E8: P1617 (SES, Pending, Current, Permanent)
0x7E8: P2122 - Throttle/Pedal Pos Sens/Switch D Circ Low Input (SES, Pending, Current, Permanent)
0x7E8: P2127 - Pedal Pos Validation Switch 2 Low (SES, Pending, Current)
0x7E8: P2A0D (SES, Pending, Current)
0x7E8: U0101 - Lost Communication with TCM (Pending)
0x7E8: U0140 - Lost Communication With Body Control Module (SES, Pending, Current)
0x7E8: U0155 - Lost Communication With Instrument Panel Cluster (IPC) Control Module (Pending)
0x7E8: U110C (Pending)
0x7E8: U110E (Pending)
0x7E8: U110F (Pending)
0x7E8: U1110 (Pending)
0x7E8: U1120 (Pending)
0x7E8: U113E (Pending)
0x7E8: U1141 (Current)
0x7E8: U11BC (SES, Pending, Current)
0x7E8: U11C2 (Current)
0x7E8: U1403 (Pending)
0x7E8: U1411 (Pending)


Here is output from my program:
Created can socket with descriptor: 3
Applied filter to receive responses from 0x7e8
Bound can socket to interface: can0 (index = 6)
Checking for stored DTC codes.
Encountered a First Frame, buffering data.
Sending Flow Control Frame
Found 18 DTCs
P0480
P0523
P0198
P0118
P0108
P2122
P2127
P0123
P0222
P1457
U0140
U11BC
P0103
P00FB
P012D
P2A0D
P1610
P1617
Checking for pending DTC codes.
Encountered a First Frame, buffering data.
Sending Flow Control Frame
Found 33 DTCs
U0101
U110C
P0480
U1110
U1120
P0523
U1403
U1411
U110E
U110F
P0198
P0118
P0108
P2122
P2127
P0123
P0222
P1457
U0140
U11BC
P018D
P0103
P00EB
P007D
P00A3
P0113
P0098
P00E1
P00FB
P012D
P2A0D
P1610
P1617
Checking for permanent DTC codes.
Encountered a First Frame, buffering data.
Sending Flow Control Frame
Found 8 DTCs
P0103
P0480
P0118
P1610
P1617
P0123
P0222
P2122


I plan on writing some more utilities and then moving into the UDS services that were discovered and potentially figuring out the seed key algorithm. I will make most of the code potentially open source however I probably won't make the seed key algorithm or how to read/write to the PCM public, maybe a snippe or a demo but not a full program. Don't want to seem selfish but those could be additional revenue streams for me.
 


covidcommander

500 Posts Club
Member ID
#7706
Messages
645
Reactions
1,047
Likes
82
City
Clementon
State
NJ
Country
United States
Vehicle
2018 Charger
#36
Nice work
 


OP
fumanchu182

fumanchu182

3000 Posts Club
Vendor
Premium Account
U.S. Navy Veteran
Donating Member
9 Second Best E/T
HFCOTM
Member ID
#2366
Messages
3,488
Reactions
8,484
Likes
302
City
Pasadena
State
MD
Country
United States
Vehicle
2015 Challenger SRT Hellcat
Thread Starter #37
Almost ready for a first release of the binaries, decided against open sourcing any of the work I've done. :(

dpkg-deb: building package 'mopar-canbus-utils' in './mopar_canbus_utils.deb'.
new Debian package, version 2.0.
size 7752 bytes: control archive=380 bytes.
224 bytes, 9 lines control
Package: mopar-canbus-utils
Version: 1.0
Section: custom
Priority: optional
Architecture: all
Essential: no
Installed-Size: 1024
Maintainer: Anthony W.
Description: Canbus utilities to use with Mopar GPEC based controllers.
(Reading database ... 550519 files and directories currently installed.)
Preparing to unpack ./mopar_canbus_utils.deb ...
Unpacking mopar-canbus-utils (1.0) over (1.0) ...
Setting up mopar-canbus-utils (1.0) ...
┌──[~/mopar_canbus_utilities]
└─$ ls -al /opt/mopar_canbus_utils/
total 88
drwxr-xr-x 2 root root 4096 Sep 1 15:40 .
drwxr-xr-x 11 root root 4096 Sep 1 15:23 ..
-rwxr-xr-x 1 17880 Sep 1 15:40 clear_trouble_codes
-rwxr-xr-x 1 18008 Sep 1 15:40 query_pids
-rwxr-xr-x 1 18144 Sep 1 15:40 query_stored_dtc
-rwxr-xr-x 1 18272 Sep 1 15:40 query_vehicle_information


Some basic utilities will always be free to use, some utilities like reading/writing tunes will be licensed for a small fee (beer cost money, so do car parts...).
 


Diboblo

4000 Posts Club
Founding Member
Wiki Contributor
Member ID
#1044
Messages
4,703
Reactions
26,108
Likes
252
City
Riverside
State
CA
Country
United States
Vehicle
2015 Dodge Charger Hellcat!
#38
Kicking ass, on this project!

Nice!!!

Bob
 


Hellcat Cuda

Active Member
Founding Member
Member ID
#1131
Messages
465
Reactions
811
Likes
117
City
S.F. East Bay
State
CA
Country
United States
Vehicle
2019 Challenger HC Red Eye 1969 Hellcat Cuda
#39
Well now that the gloves are off and I’m not bound to the agency or the Navy I’m reverse engineering everything from our cars. A lot of information should be pushed out. The only things I wont publish are sercurity systems/immobilizers. I want to learn how to unlock PCMs and ultimately generate passive income streams.
Yes, but what are you going to do with it. (Sorry, have had very little electronics training)
 


Diboblo

4000 Posts Club
Founding Member
Wiki Contributor
Member ID
#1044
Messages
4,703
Reactions
26,108
Likes
252
City
Riverside
State
CA
Country
United States
Vehicle
2015 Dodge Charger Hellcat!
#40
Yes, but what are you going to do with it. (Sorry, have had very little electronics training)
"Ultimately generate passive income streams".

Sent from my SM-G955U using Tapatalk
 




Top