modern vehicles have internal networks that provide access to nearly every major component and accessory – everything from the transmission to the cd-changer.
why hack it? because you can! maybe you want to install your own car-puter that will replace the radio and climate controls. or maybe you’d like to make your key fob roll up windows or remote-start. i’m sure you can think of something.
so that’s different
it seems people often approach this concept with an Arduino/NetDuino/PIC/etc, plus a shield or some custom circuitry, and a bit of custom code. depending on your end goal, a microcontroller could be the best approach. however, this article is about getting started quickly and cheaply by leveraging a standard ELM327-based OBD-II scan tool (~$25) and your laptop, tablet, phone, Raspberry Pi, etc.
note: we’re not talking about “pulling codes” or clearing the check engine light, that’s everyday stuff. we want to control and get info from accessories attached to the more interesting buses.
all aboard the short bus (background)
in 1996 a federal law took effect requiring most new consumer vehicles in the US to have standards-based On Board Diagnostics, called OBD-II. the OBD regulations were put in place by the EPA for monitoring emissions related components, but the systems have evolved to be much more capable.
the good thing about OBD-II was it defined a limited set of network types that a car maker could implement for the emissions related diagnostics. this meant that tools to interface with those networks could also become standardized and inexpensive. called scan-tools, they come in full-featured versions with built-in software/display/buttons, and dumb versions that must be connected to a PC/Mac/tablet/phone to be useful.
what follows is information on how to use one of these inexpensive scan-tools (the dumb USB, Bluetooth, or serial-port kind) to interface with a vehicle in ways it wasn’t exactly intended.
a couple ones that i’ve personally had success with:
- USB: ScanTool ElmScan 5 (from Amazon…)
- Bluetooth: BAFX Products ELM 327 Bluetooth OBD2 scan tool (from Amazon…)
step by step
the challenge: OBD-II standards only apply to the emissions related portions of a vehicle bus. other systems often operate on an entirely different bus which may or may not use the same protocol as the OBD-II diagnostic bus. even worse, the non-emissions-related bus data is proprietary manufacturer info that can vary for each make/model/year.
the good news is that for simplicity and cost-savings, most manufactures only implement a single network type during certain year ranges. since they have to use one of the standard OBD-II protocols for the diagnostic bus, they might as well use the same protocol (or a slight variation) on the other buses. this is why we are sometimes able to use a scan-tool to interface with a non-OBD bus.
from a high level, we need to:
- determine what protocol(s) our car uses
- make the physical connection
- test the interface
- start hacking
now onto those details…
step 1: which protocol?
vehicles usually have at least 2 buses, the main diagnostic bus and an interior or comfort bus. the diagnostic bus often has access to all the drivetrain components as well as the OBD-II emissions stuff. the simplest vehicles to hack are the ones where all the buses use the exact same protocol and all relay messages to each other. some vehicles may have the secondary buses connected to the diagnostic bus through a gateway that may only relay information when queried with the correct command. other vehicles use the same overal protocol on all buses, but different speeds.
buy a Factory Service Manual for your vehicle if at all possible. it will almost always tell you what you need to know to at least get connected and is full of great info. you can get FSM’s used on eBay if your vehicle is a few years old or get the PDF version if you can find it. online tech libraries like AllDataDIY may have complete service manual info too. public libraries sometimes have subscriptions to those services. don’t forget to just Google for your make/model and “OBDII protocol”, “OBD bus”, etc.
we are ultimately looking for the exact protocol that our target bus uses and any information about the messages that components on that bus send/receive. if we don’t have this info, we can still try connecting to the diagnostic bus and hope it relays from our target bus.
the OBD-II spec allows for the following protocols: SAE J1850 PWM, SAE J1850 VPW, ISO 9141-2, ISO 14230-4 KWP, ISO 15765-4 CAN, SAE J1939 CAN. if our target bus uses one of those, or if the target bus relays to the diagnostic bus, then we can continue with our hack of using a scan tool to interface with it.
example: i was able to find online that my 2003 Jeep Grand Cherokee (WJ) actually supported 2 different protocols for the OBD-II system (due to a factory mistake). the FSM cleared up which one was the native protocol for the “Chrysler PCI Bus” (SAE J1850 VPW). it also confirmed that the radio and steering wheel mounted remote-control buttons communicated via that PCI Bus. using those buttons to control something else was my personal end-goal.
step 2: physical connection
the OBD-II spec requires a standard diagnostic port to be located within 3 feet of the driver and be accessible without tools. usually it’s under the dash, right above your feet, and looks like this:
this is often the simplest place to access a bus. these ports will have certain standard pins populated depending on which OBD-II protocol the vehicle uses. there are also pins left undefined by the spec. car makers often bring out access to other buses on these optional pins so that their own proprietary scan tools can interface with the entire vehicle. consult that Factory Service manual you bought for your connector pinout or wiring diagram. here’s the standard vehicle-agnostic pinout info:
important note: at this point you should move on to step 3 and try the main diagnostic bus first. if that doesn’t get you the info you want, then come back here for how to tap into the correct bus directly.
if your vehicle’s diagnostic port does have pins with access to the target bus, then you can take apart your scan tool and swap wires from the standard pins to the target bus pins. otherwise you may need to actually splice into a wire harness somewhere in the vehicle. you can get an OBD-II extension cable from Amazon/eBay for cheap and hack off the vehicle end to give you raw wires to play with. tip: the radio wiring harness is often a great place to get at the interior/comfort bus.
example: my FSM told me that pin 3 of the diagnostic port went to the radio-related bus. since my Grand Cherokee uses the single wire J1850-VPW protocol, i only had to swap one wire inside my scan tool from pin 2 to pin 3 to get a direct connection to the bus i was interested in. i later found out that all the buses in my particular vehicle relay between each other and so i didn’t really even need to do that.
step 3: basic first tests
if you’re still reading then you’ve probably had all the background info you can stand and are dying to get to some actual hacking. bear with me as there’s one more bundle of knowledge required – how to actually use an ELM327-based scan-tool to read and write bus data.
these scan tools use the ELM327 IC from Elm Electronics (or more likely a clone). we can interact with the IC using AT commands similar to modems from back-in-the-day.
to get started exploring, you need a serial port terminal application (even for USB and Bluetooth devices, they create virtual serial ports). HyperTerminal for the PC has a free trial, goSerial for the Mac is free, and there’s Slick USB 2 Serial Terminal for Android 3.1+ in free and paid versions.
connect your scan tool to your vehicle and computer or Android device (iOS devices might work also, i haven’t had a chance to check into it). turn your vehicle on (the key in “run”, no need to actually start it). pull up your serial terminal program and connect to the scan-tool. check the manual for connection settings. nearly every one that i tested used the following:
- Speed/Baud: 115200
- Data Bits: 8
- Parity: none
- Stop Bits: 1
- Hardware Flow Control Input: none
- Hardware Flow Control Output: none
once connected, type the command ATI and press enter. you should get back ELM327 v1.4b (the version might be different). if nothing comes back, try ATZ instead and wait a couple seconds for the device to reset. if you don’t get anything back or you get random looking characters, you probably have the baud rate set wrong in your serial software. i did try one odd scan tool that used a rate of 9600 when not connected to the vehicle and 38400 when connected.
once you have verified that your connection to the scan tool is working, then we want to verify the scan tool’s connection to the vehicle is working. issue the command ATSP0 to tell the tool to use automatic protocol selection (you should get back OK). then issue ATMA and you’ll get back a stream of data (sets of hex numbers to be exact). just press enter again to stop the stream. if you don’t get any data back, then double check the scan-tool’s connection to the vehicle and that the vehicle is on.
if you know for sure which protocol your vehicle is using, you can try setting the tool for that instead of automatic. issue ATSP# but replace the “#” with one of the following designators:
- 0 – Automatic
- 1 – SAE J1850 PWM (41.6 kbaud)
- 2 – SAE J1850 VPW (10.4 kbaud)
- 3 – ISO 9141-2 (5 baud init, 10.4 kbaud)
- 4 – ISO 14230-4 KWP (5 baud init, 10.4 kbaud)
- 5 – ISO 14230-4 KWP (fast init, 10.4 kbaud)
- 6 – ISO 15765-4 CAN (11 bit ID, 500 kbaud)
- 7 – ISO 15765-4 CAN (29 bit ID, 500 kbaud)
- 8 – ISO 15765-4 CAN (11 bit ID, 250 kbaud)
- 9 – ISO 15765-4 CAN (29 bit ID, 250 kbaud)
- A – SAE J1939 CAN (29 bit ID, 250 kbaud)
i always issue the following commands to get the scan tool into a baseline state (enter them one at a time, you should get back OK for each one): ATL1, ATH1, ATS1, ATAL. that will ensure that you see human readable data, which will enable us to analyze what’s going on. most scan tools will remember these settings between uses.
for more information on interacting with the ELM327 IC (and to lookup what those commands did):
step 4: start hacking
that last datasheet, combined with the info in this post, should be all you need to start hacking!
my next post (part 2) will give more detail about how to get what you want out-of or in-to the bus. i’ll be covering:
- the bus message structure
- a real-world example of how to find what messages you care about
- how to send msgs into the bus to control components
Great info. I’m working in my 2002 WJs PCI bus for, among other things, aux audio in and, if possible, radio info display for audio track data.
nice! what are you planning to use for the final hardware – tablet/phone, pc, microcontroller? i know the radio does broadcast what “mode” it’s in and which track or radio-preset it’s on. no idea how the audio input for the cd-changer/sat-radio actually works.
Right now I’m looking at interface options – I have a generic ELM327 (clone, v1.5), but something isn’t the same. When I was reading the bus from the stock ODBII port, I was able to get vehicle information, but I couldn’t find anything specific from the radio (although several codes were going by when the ignition was in ACC, with the radio either on or off). I tried taking a few ODBII codes from your codebase, but I couldn’t emulate the steering wheel buttons (or sniff them from the bus). I connected the CD changer PCI bus connection in place of the ODBII Pin2 connection, and got the same data, but couldn’t find anything specific. It could also be something wrong with my ELM327 clone, but Torque works fine on my Android devices.
I think I’m going to try a logic sniffer to see if something is missing, or even put a tap between the radio and the BCM to see what data is flowing from what direction. From what I remember, the radio checks either on power on or periodically for a CD Changer (probably the same with the stock amp, which also has a PCI bus connection).
When I am done, I think I’m going to use an Android device or a Raspberry Pi as the controller, or I can work with the FreeSOC(freesoc.net). I have an old Android phone that I use for media now, which would be nice to change tracks via the steering wheel buttons as well. There is a commercial product for 2005+ Chrysler radios that seems to work, using Bluetooth to connect an Android phone to the vehicle audio and steering wheel buttons. It lacks the track display, though.
Seems like a lot of work for something so simple, but my real reason for looking at the bus is to interface with a custom lighting system (LED arrays replacing all external lights except headlights, multiple colors, customized patterns, visualizations if possible…). I think that you can read the signal information from the bus as well (mainly to communicate to the instrument panel), which could be used to get vehicle controls into a controller (Arduino or FreeSOC).
I did find an interesting wiring diagram on wjjeeps.com for the ODBII port, explaining a few additional wires. It looks like the additional wires are an RS-232-esque port used with Chrysler’s scantool, and for programming the ECM/BCM. More might be available there.
I’ll have to see if I can find information on what preset the radio is on. The only codes I saw were simple 2-3 byte status updates with the ignition on ACC. Maybe one of those was it, since it was happening around every other second.
Is your web server pretty decent? I’d like to send this link to hackaday.com for their review. It could cause a traffic spike for several hours. They’ve had a few other articles about ODBII hacking and radio control before, too.
my shared server is mediocre but i do have several caching strategies, so it might hold up – i welcome the submit.
my FSM pinout of the WJ OBDII port does not match that one on wjjeeps.com – mine basically has that several pins offer direct connection to different busses/modules (TCM, Radio, etc). i originally hooked directly to the radio one, but found i didn’t need to later. i can do a screenshot of the pinout diagram if you need it. however…
be sure you are setting your scan tool for J1850 VPW protocol. the WJ actually supports ISO9141 and J1850 for the diagnostic bus (a factory “mistake”), but i don’t think the ISO9141 relays all the other busses. all of my scan tools defaulted to the ISO9141 and so i had to issue the ATSP2 command.
good luck!
If you are still interested I found this. Talks about the radio pci bus
derp derp forgot to put the link http://www.mictronics.de/projects/cdc-protocols/#ChryslerJeep
nice find!
I’m thinking about either an Arduino, Raspberry Pi, or a FreeSoC. Changes are that I’ll use the Pi, as long as there’s a good working Android interface for it. I want to tie together a custom LED kit for all external lights (minus headlights), so I can have audio visualizations and custom light flash patterns. I’m still pretty early in that (coming up with the first parts order now).
I would think that I can read the turn signals and other light statuses from the bus, but we’ll see. I was only able to see a few codes that repeated when the vehicle was in ACC, but didn’t think to change the preset or mode to see if it changes.
Sir : [https://theksmith.com/software/hack-vehicle-bus-cheap-easy-part-1/]
on April 18th, 2013 you wrote you wanted to read the turn signals thru obd / can .
did you succeed ?
can the signals be activated on / off thru obd / can ?
if so , how ?
thank you for any help .
Al
I’m trying to design a product that can plug unto the OBD II port, I am wondering if anyone tell me if there is a Pin in the OBD II port that will tell me when the Ignition of the vehicle is ON.
Hai Bruce, Are you still on your Project, I am too Wondering on the same idea. Well u got any progress? I am wondering if anyone tell me if there is a Pin in the OBD II port that will tell me when the Ignition of the vehicle is ON. I mean any pratical example? Regards success Bruce and thanks all
piercedRichard, i also have a 2002 WJ, i am trying to link my android device to my car so i can play my mp3’s and nav audio through the stereo unit and control android with steering wheel controls, even displaying track info on the stock head unit would be nice. I have a bluetooth ELM adapter which i can read data from using laptop or the android torque app. Having read through this post and trying a few things with my OBD II connection im not getting anywhere. Could you possibly throw me some hints/tips as we have the same year/model?
yeah we’re only one year apart (mine is an 03), so we should have the same protocol…
did you try the stuff above listed under “step 3: basic first tests”? if so are you sure your laptop and adapter are talking ok? (i.e. the ATI gives you back “ELM327 v1.#”).
next, with the key on (but engine not running), if you do the automatic protocol – “ATSP0”, then do “ATMA” are you getting back tons of lines of data? if so then where are you getting hung up specifically after that?
rndm(mod) » ODB-II hacking using an Android tablet
ODB-II hacking using an Android tablet | o.NET
I am able to get data to a OBD II diagnostic program but upon typing ATMA into my terminal it says “Searching…” and brings up no data. Any ideas?
do other commands work, like ATI or ATDP? did you set the protocol manually or is it on auto? might try AT MA (note the space)… or try an ATZ (reset) first…
also which scantool? mac/pc/android? what app are you using for a serial terminal?
I have the same issue.
ELM v1.2a. PC, teraterm. 2005 Dodge Magnum
I looked through the ELM Datasheet, and it says when you select ATSP0 it chooses the automatic protocol selection, but will search when you send the next command. In this case it was the ATMA command. So its searching for the correct protocol. I tried leaving mine for 30 mins like this and it still didn’t find the protocol :(
On mine I can read ATDP (which just displays the protocol which is currently selected, not the one that works for your vehicle). I can also read Voltage, system temp, etc, but still can’t read the memory. Its really strange, because I can read trouble codes using a Engine Diagnostic software utility. :S Anyone know a software utility that has a console output/ AT command wrapper to do the heavy lifting ?
i don’t know a specific software that does what you ask, but here is a big list to look through (many free): http://scantool.imechatronics.com/downloads.htm
I am having the same problem as Nick is. I am using Android App ELM327 Terminal. (https://play.google.com/store/apps/details?id=Scantech.Terminal&hl=en)
I am able to input commands like ATI and get “ELM327 v1.5” back. I also downloaded the ELM electronics guide (http://elmelectronics.com/DSheets/ELM327DS.pdf) and found commands to read voltage (AT RV) and coolant temp (01 05) and both of those produce accurate results, so clearly the device is communicating with the car and takes the commands I give, but when I input AT MA I cannot get a stream of data. After a few seconds it says timeout. I tried to set the protocol manually and went through all 10 protocols with no change in result. When I set the protocol to automatic, I get the same result as Nick above where it says search, but shows nothing. Any thoughts? Thanks!
Nick and i emailed a bit and tried to find the problem but i don’t know if he ever got anywhere. my only two thoughts are:
– maybe the current cloned chips aren’t supporting AT MA correctly? note that there is no “real” ELM327 v1.5 (there is a 1.4b and a new 2.0: http://elmelectronics.com/obdic.html#ELM327). however i also have a cloned version which does work for me. i emailed Elm Electronics to ask who i could buy an “authentic” scan tool from and they were no help citing customer privacy concerns.
– if your vehicles are using a CAN-Bus protocol, then maybe AT MA doesn’t work with that? i know the elm datasheet lists some CAN specific commands – perhaps there is one that is similar to MA just for CAN traffic? i haven’t looked into that yet as i don’t have any CAN vehicles handy.
if anyone solves the issue, please do post here as it seems to be happening a lot, thanks!
i was looking at the STN1100 manual because several scan tools are using it instead of the ELM chip i think… you guys might try STMA:
the full STN1100 manual is here: http://www.scantool.net/scantool/downloads/98/stn1100-frpm.pdf
I also had the problem they were having on a 2012 Dodge Ram 1500 4wd. I got no activity at all at the OBD2 port. I did tie into the Canbus High and Canbus Low wires behind the ignition switch. There I got activity on 2 different protocols. There was a 500k 11bit signal and a 125k 11bit signal there. I found that with the key off, the 500k signal is dead. However, the 125k signal is alive with no activity. As soon as the lock button is pushed, I have trouble with a “buffer full” error. I get some info, but very little. I am trying to track down the door lock and unlock commands. Without knowing what to filter, I have to do a ATMA command and it bombs really fast. My USB ELM327 cable I got off of Amazon came set to 38400, but I changed it to 115200 along with the port on my computer to match. It still gives me buffer full almost immediately. I suspect if they connect to the bus at a different location than the diagnostic port, they will have activity.
Great article by the way!
Here is a quick shot of what I got from the 125k ATMA before it errored. All I did was hit the remote lock button 1 time after I issued the ATMA command.
>ATL1
OK
>ATDP
USER1 (CAN 11/125)
>ATH1
OK
>ATS1
OK
>ATAL
OK
>ATMA
0B 3C 00 00 RTR
0B 3C 00 00 RTR
0B 3C 00 00 RTR
0B 3C 00 00 RTR
0B 3C 00 00 RTR
0B 3C 00 00 RTR
CAN ERROR
0B 3C 00 00 RTR
0B 3C 00 00 RTR
0B 3C 00 00 RTR
00 3C 00 00 RTR
292 00 00 00 00 00 00 00 00
0B 3C 00 00 00 00 00 00 00 00 00 00
0B 3C 00 00 00 00 00 00 00 00 00 00
0B 3C 00 00 00 00 00 00 00 00 00 00
03 3C 00 00 00 00 00 00 00 00 00 00
77B RTR
03B RTR
03B RTR
03B RTR
03B RTR
CAN ERROR
03B RTR
03B RTR
03B RTR
03B RTR
03B RTR
00 48 99 C0 00 00 00 00
00 48 99 C0 00 00 00 00
00 48 99 C0 00 00 00 00
00 48 99 C0 00 00 00 0
BUFFER FULL
>
Can you please tell me how to change the baud rate using AT command from the serial ?
I think I understand why people are getting the searching error. There are a few things you need to make sure.
One thing I noticed is if I don’t send the command ATSP0 before starting a scan it never works. It’s included in the setup instructions but not listed in the actual tutorial in part 2.
The 2nd thing I noticed.. I am using a bench setup with a CAN-BUS gateway and a few modules. If I plug into my OBD port and there is nothing else active on the Diagnostic port there is no data to capture. I think the diagnostic BUS only reports data if there is requests on that BUS. That may explain why a few people get results from other BUS’s but not the diagnostic. Since I have another cable and program running on the diagnostic bus I can capture data when that program is active. Of course I can only capture data related to that programs activity.
This may be helpful to identify exact activities if your program can send and perform tests on certain systems. In my case it’s an Audi BUS system and I can send tests such try locks or windows so I can capture those exact items off of the BUS without to much other traffic. My bench isn’t set up for that yet but it’s an example.
Hope the insight helps some others having issues hacking their BUS. For clarification I am scanning CAN only and have no K-Line or Lin-BUS hooked up on my bench so I can confirm that an ELM clone version 1.5 (non Bluetooth) will work properly on a CAN network using the exact commands found in this tutorial. I seem to end every line in an error but I think it just may be a setup thing or the terminal software. It’s still not effecting the data capture I don’t think.
Great work and thanks for time you put into making this information available.
Also I noticed I get a buffer full error if there is more than a few seconds of no activity on the bus so this may be what others are seeing as well.
thanks for posting your experience and confirming that the basic commands do work on a CAN-BUS system as well!
i think you are correct that many people are only connecting to the diagnostic bus, and therefore never seeing any idle traffic. on most newer vehicles the buses are not interconnected like my older Grand Cherokee – or at least they don’t forward traffic between each other unless you issue a specific command asking a gateway to do so. if someone is on a newer car and just connecting directly to the OBDII port, then this would be the scenario.
i have a friend about to try some of this on a newer Jeep with CAN-BUS and we can’t find how to talk between buses, so the simplest way to work with the comfort bus looks like it will be to pull the radio and tap into its harness…
Thanks for the help. I don’t have much EE background so this is helpful. I am trying to replicate your example with this cable http://www.youtube.com/watch?v=0E7tBXDkexY but no luck so far. The Toyota diagnostic software works though with the same cable. Seems like it ought to work, but do I need a different piece of hardware? Thanks for any hints.
what year/model is your yota? do you know which OBD protocol it’s using? also what’s your goal, do you want to interact with a certain accessory?
This is awesome. Thank you!
I have started my own project after having troubles working with windows obd software and also with pyobd.
The program has barely reached Version 0.0000001 but is able to get standard OBD Information.
I have never got to read manufacture specific codes though.
My goal would be hooking up an android tablet and control the music with my steering wheel and the music title showing up in the dash-display.
The information on your page got me some steps further
Thanks
A great guide, thank you! I am able to communicate with AT commands with my elm mini, but I cant get ATMA to work. Nothing is coming back? Every other command seems to work such as ATI and so on. OK i printed for every AT command I send. What am I doing wrong?!? Please give me some clues :-)
thanks! what vehicle are you trying to work with? if it’s a CAN-BUS vehicle, then see the comments started above from David on September 10th, 2013 and my reply… (could be you need to tap into a different physical location or use the CAN specific commands)
hi,
How can I read odometer?
Look at the dash.
Maybe the dash is full of shit?
I have a 2005 Cobalt. I’m curious if anyone has enabled remote start or remote windows down using these guides?
Hey theksmith, firstly thanks for putting together this tutorial. You by far have been the best resource for this type of information. I have spent hours searching the web. So I’m trying to use your hack to get access to bus information on a 2004 Pacifica. According to the FSM it uses the same protocols as you described having. The problem I’m having is I think I have some corroded or shorted PCI bus wiring somewhere. If thats true the following question may not matter. Have you had any experience trying to access HVAC controls using the PCI bus? If so were you able to decode any messages. I think I fried the HVAC control panel in trying to jump start this vehicle (whole different issue I’m contending with.) So I want to attempt to adjust the HVAC controls and see if its actually just the panel or if something going on with the system. Thanks in advance for any thoughts.
i haven’t played with the HVAC yet from… however if you have the same “automatic zone control” system that my WJ has, it does have it’s own self-diagnostic and fault codes. check out the “AZC self-diagnostic mode” section on this page: http://wjjeeps.com/climate.htm
You rock man! I’ve been basing my work on this Pacifica all from this write up. I’ve been able to track down code to control power seats, power locks, and I want to take this even farther. I eventually want to get similar control and system access as a DRBIII without having the $3000 price tag. So if you do anymore with this please share your one of the few with some great real world work out there.
thanks man! sorry i haven’t done any more with this whole project.
i am getting ready to put a tablet (LG G Pad LTE) in my GF’s 2005 Liberty (KJ) and she doesn’t have steering wheel buttons… however, she’s keeping the factory radio, so i was considering making the radio buttons control the tablet media when in “changer” mode because physical buttons are easier to use than tapping a touchscreen (especially offroad). if i do get that working it will mean an update to my Android app to work with bluetooth instead of just USB adapters and i’ll post the bus msgs to read from the radio buttons.
How to hacker your car over OBD-II | Alan C. Assis
Still waiting | Carduino
Hey man! nice work…i was able to replicate what you did and was able to capture the CAN data. But i would like to know how to get rid of this BUFFER FULL thing. I want to capture more data in a single log file. Is there any AT command which can automatically clear buffer so that i can capture more data in a single click. Thanks :)
Also, kindly provide me your email :)
thanks! my current email is listed on the site’s “who” page.
what scan tool are you using and what baud rate is it set at? according to the ELM327 docs the BUFFER FULL msg is due to the transmit buffer filling up… i.e. the ELM chip is getting all the msgs, and deciphering them, but it can’t get them out to your computer fast enough. unfortunately i don’t know a command to clear that buffer. ATWS (warm start) is faster than ATZ though and might work. even if there is a buffer clear command, you’d be losing messages by dumping it and during the time it took to do so. a better approach would be to try and avoid the situation, some thoughts on that:
– the latest ELM327 only has a 515 byte buffer, earlier/clone ones are less. the STN1110 from scantool.net supposedly has a much larger buffer (it has 8K of RAM but they don’t state how much is allocated to the transmit buffer). their scan tools based on that chip also support a much higher baud rate. ultimately that’s going to make the most difference. this one advertises a 1M baud rate: http://www.scantool.net/obdlink-s.html
– beyond getting a better scan tool, or if you already have one with a fast transfer rate, the next step would be to limit what msgs are even being transmitted to your computer. check out the sections in the ELM327 pdf about “CAN Receive Filtering” and “Using the CAN Mask and Filter”. this could help limit the number of msgs you get and thereby not fill the buffer so fast. of course if you don’t know what you are looking for and just trying to capture all data this won’t help.
– try turning off spaces and line returns. that will make the data less human readable but you will save quite a bit of bandwidth by eliminating those characters and so again the buffer should fill slower. you can easily add the spaces back in with excel or a good text editor. the line returns might be harder to put back in without writing a little script.
good luck!
As explained by you, i tried capturing the data through ATMA.
Also, i found that my Protocol was ISO 15765-4 (CAN 11/500) means with 11 bit identifier. im using ELM327 frm Sparkfun;9800bps
First of all, i would like to know from you whether ATSH command would be able to control the Engine RPM too?
After reading from ELM327 DS, i realized i had to input “ATSH XXX” instead of “ATSH XX XX XX” format. So i tried ATSH 13F, 13F is the ID for rpm and it gave me result OK.
since the CAN message i read for RPM was “13F 00 1D A1 00 ” i then input “ATSH 00 1D A1” which again gave me output OK.
after that i noticed no change in the RPM. However, i realized that whenever i ignite my car, first of all the initial rpm value is always above 1500 for atleast 30 sec and then reduces to 800-900…. i would like to know is that because of ATSH command?
Also, since my car is of ISO 15765-4 protocol, how should i move forward to give commands to control it.
i don’t believe you have affected your vehicle…
– almost any car will idle higher upon startup and then settle to a standard RPM, the length of time for this varies with the ambient and engine temperatures.
– ATSH only configures the header bytes for following messages, my understanding is this command alone would not transmit anything. you may want to re-read the “Setting the Headers” section of the datasheet that starts on page 39.
keep in mind that many vehicles share your protocol but may use completely different bus msgs depending on the make/model/year. i’ve yet to spend any time with any CAN based vehicle so i can’t assist. the little bit of experimentation i did with controlling systems was all done on the interior/comfort bus. my guess is there may be more than one approach to setting the idle speed though… there may be an OBD mode $08 test command that could do it, or you may be able to directly instruct the ECU/PCM to change it, or it might be easiest to simulate a condition that would cause the ECU to change it based on that input.
Hey man!
I have been extracting OBD-II DATA from UART board (ELM327) on my TOYOTA INNOVA. It responded correctly few weeks before and gave all supported sensor values. But now, for every response, ECU responds “7F 01 11”. Please tell me what exactly this output means and how to get rid of this problem. Is it some kind of UART problem or what?
ODB-II hacking using an Android tablet | Hackaday
First of all, thank you! You did a great job on writing up the process you used. I am working on hacking the volt and but I cannot seem to connect to the ELM327. I have both the ScanTool ElmScan 5 and the BAFX Products ELM 327 Bluetooth OBD2 scan tool. I have tried both and cannot connect to the adapter. Hyperterminal sees COM3 and COM4 for the adapters but I cannot connect. Likewise with the slick USB serial app. I am sure I am missing something basic. Any thoughts?
so you are connected to the adapter ok, but it won’t connect to the vehicle? i.e. you can do stuff like send and ATI and get back the adapter info? are you on automatic protocol and what command are you sending that is failing (with what msg)?
thanks so much for the write-up! this is precisely what I was looking for. I am a bit surprised that there is not more information on the subject of obdII and elm327 on the internet….also surprising is that more people are not into this “new” technology (obviously not so “new,” anymore!) anyway, I was interested in this subject because I would like to make some type of “hud” (heads up display) but I want to incorporate my radar detector, scanner, cb radio, voltmeter and maybe a pc and head unit, to somehow, work off/work with my obdII (and display from the hud.) if you have any ideas you could pass my way, I would be forever grateful! thanks again for the info!
FYI the Torque app on Android has a HUD mode where it is designed to be placed on the dash facing up and the reflection in the window then is readable. a really cool approach would be to use transparent/holographic style transparent film applied in a small area to the window, then use a tiny pico style projector embedded in the dash to project onto the film – that would give you a near sci-fi level of HUD.
any OBDII adapter can pull the current voltage, as well as obviously lots of other engine stats. you’ll need some sort of MCU to talk to your other accessories and maybe communicate their status to a phone or tablet that could then handle the graphics. of course there are MCU’s with little processors on the same board running linux with video output so you could do everything in a single board (the new Intel Edison stuff and the Arduino Yun for example) – or maybe the best approach would be to do everything with a small SOC computer like the RaspberryPi or a BeagleBoard and their GPIO and I2C interfaces.
figure out what platform you are most comfortable writing code for (Android, iOS, linux, Arduino or other low level MCU) and then look into what specific hardware interfaces can be had for that platform. i personally would use an Android tablet or phone with a BT OBD2 adapter for some stats and a IOIO-OTG board to work with the custom electronics interfaces. my second choice would be a RaspberryPi or similar single board computer and some misc breakout boards that talk over I2C.
Hi. This is simply magnificent work. I have started working in this area and want to control the power windows asap to get started. Do you have any experience with power windows, door locks or any other thing in the body domain? I would love to pick up your brain on whatever you have to share.
thanks! on my particular vehicle, i did notice when doing some early testing that A0 was the receiver ID for some part of the BCM or other module that seemed to control doors and windows. i observed these transmit ID’s and data values being sent to that A0 ID:
01 00 = lock all doors
04 00 = unlock all doors
20 00 = passenger window down
10 00 = passenger window up
that’s all i still have in my notes. i did successfully re-create the commands to lock/unlock doors when playing around, but i don’t remember if i could get the windows to work or not.
what vehicle are you working with?
I have an 04 grand cherokee with a EVIC overhead console running on the PCI bus. Can you send text to that device or are stuck with the canned messages?
sorry i haven’t looked into that. i’ve seen pics of it displaying some diagnostic msgs, but those could still be just predefined.
Great work. I have been able to get some way with my BMW e46 2002, its K-line DS2 iso914/2. Using ELM327 1.3 OBD autodoctor and/or hyperterminal. But something key is missing. I have a specific goal on this. I want to access the Multiple Restraint System (MRS3) ecu to read the fault codes and reset the airbag light. The little info I have is that the Bosch MRS3 module address is “A4”. What I am having a problem with is constructing a header that is appropriate to access this module. I have tried AT SH 48 A4 F1 and permutations but I don’t get any responses. Indeed I have yet to get any response after setting up any header. I am begining to think I must be missing something. In default reset AT Z then AT H1 In response to 01 01 I get 48 6B 18 41 01 00 04 00 00 11 and 48 6B 12 41 01 80 07 6D 65. And that is all I have managed to acheive so far.
Has anyone got any suggestions please.
for god’s sake be careful, you very well might be able to trigger an airbag deployment with the wrong bus msg!
quick research says you have 2 physical k-lines, the standard diagnostic one and another one with the SRS and possibly more on it. if you are just connecting to the standard OBDII port without having made any wiring changes then you probably aren’t even talking to the second k-line (the one you want). see this post for more info: http://www.bimmerforums.co.uk/forum/f99/bmw-inpa-success-e39-e46-onwards-t74608/
if you already have all the wiring figured out, then my questions would be how did you arrive at 48 for the priority code? and what command are you sending after setting the header? setting the header alone (ATSH xx yy zz) should just say “ok”, it doesn’t actually transmit anything at that point.
good luck!
Thanks theksmith for the information. Yes a little knowledge can be dangerous. I used the same priority byte as I read on the messages I had seen. I am not aware what or where the correct setting is. Having 2 K lines is new to me so I will investigate joining them as the article suggests. Another article I read suggested that the fault code reading and resetting would be the same code structure as the ECM and I was going to proceed on that basis. So I intended to issue code 04 01 to find how many faults, 04 nn to read them, and 05 to clear them. Does that sound reasonable, or will the srs have a completly different structure.
CanBus Etc. - Chrysler 300C Forum: 300C & SRT8 Forums
Is it possible to control the cabin temperature of the car with this hack?
Hi, I read all your information as to how you came about programming your stuff. Am of the opinion if I follow your instruction closely, I will be able to install and program a pair of power folding mirrors on my 2012 grand cherokee overland. According to the information I received in order for it function properly, it must be programmed by the dealer. This looks like a big project for me. Will require as much help from your program.
Regards
OBD2 PID codes - Page 3 - Chevy SS Forum
nice article!
i need some help. I want to build an android app that would communicate with the custom ecu on my car. for now this ecu has a windows program that uses k-line adapter for communications: the program sends certain request and then receives a response. (we have these data sniffed and I guess we know the higher-level protocol – we know the meaning of each byte in the 20-bytes sequence). Tonight I’ve built a proto application that parses the string (which ends with ‘/r’ or 0xd). Pretty cool for the person who never programmed for android %-) Now I need to add some bluetooth connectivity and make it work with elm327 buetooth adapter. All I know is it uses asynchonous protocol with 8 data bits, two stop bits, no parity (8n2). As far as I got, before sending the request over bluetooth I would need to set up the adapter for such communications. Are there any chances that it would work with ELM?
the “asynchronous protocol” you mentioned could mean a lot of things, but i’m guessing from the rest of your description that it might be a classic RS-232 serial port? however you also mentioned k-line, so i’m a bit confused. are you saying your custom ECU can talk to a PC via serial port but can also talk with the car’s electronics via k-line – that would make sense. what is your end goal?
As far as I got those were the settings for the K-Line adapter on a windows machine (8n2, 9600).
This custom ECU has only K-Line external interface (just a single wire) and it talks only to the PC. We use an ft232-based k-line to serial adapter for these communications. The goal is to replace a windows box with an android device. The problem is I don’t have an adapter at hand, but for this ELM bluetooth thing. What I don’t quite understand is what are the settings in general for K-Line. Is there a baudrate? Or anything of that kind? Or in my case I can use this ELM327 bluetooth adapter and set up my application for the baudrate and settings, which are hardcoded in this adapter, and the adapter will do the rest?
ok, i get it now. your k-line adapter presents itself as a virtual serial port, so those settings are likely just how the windows app talks to that adapter via the COM port. do you know what the messages your adapter sends to the ECU look like? i’m guessing you have some sort of doc/spec on how to talk directly to the ECU via k-line msgs? note that if you can’t replicate those msgs using standard ELM327 AT commands then you won’t be able to use the ELM dongle. i’m assuming you are going to write your own Android app for this?
i’m not sure of all the variations in the K-line protocol, but there are 3 OBDII implementations of it. the physical and data layer variations of those 3 are described here at the bottom of the page: http://www.onboarddiagnostics.com/page03.htm – a standard ELM327 dongle will only work with those variations.
if one of those styles matches the spec for your ECU’s implementation of k-line, then you should be able to hook pin 7 of the ELM dongle to your ECU’s k-line (and of course you’ll need power and grounds to the dongle). then you can connect to your ELM adapter with a serial terminal from a PC or other device, and set the protocol with ATSP# where the # is replaced with 3,4 or 5:
3 – ISO 9141-2 (5 baud init, 10.4 kbaud)
4 – ISO 14230-4 KWP (5 baud init, 10.4 kbaud)
5 – ISO 14230-4 KWP (fast init, 10.4 kbaud)
then you should be able to talk to the ECU via standard ELM327 AT commands.
be aware that most of the serial terminal apps i tried on my Android devices would not reliably communicate with the ELM dongles i had… my custom app works fine, but for some reason a lot of the serial terminals just didn’t work at all or dropped connections, so i’d do your initial testing with a PC or Mac.
Thanks! These are good hints to start with. That’s a pity I have some data sniffed only at the PC side, not at the K-Line bus… So it’s difficult to say, which of these protocols is used. According to the report from the guy, who started all these hacking attempts, he doesn’t see any auxiliary packets in the beginning of conversation: he launches the software on the PC, and immediately captures the request packet, followed by the copy of the same packet and the response packet. Does this mean that the ECU uses K-Line just as physical medium, but still utilizes the simple RS232 protocol for data transmission?
I just looked at that document from your link. It looks like KWP2000, but it communicates with 2 stop bits. So, probably, elm think is not an option in my case…
i have Elm 327 (clone) mini Bluetooth device vs 2.1 . i want to capture a data related to BCM & i am sending the AT commands as per your suggestion but for ATAL command i got negatine resopnse (?) & for ATMA i got response OK only but i cant get a data. so is this version2.1 of ELM is compatible to read BCM related data.???
BCM of what vehicle? what protocol are you using and are you able to get any interactivity with the vehicle to work (like even a basic OBDII diagnostic query)? whether you can talk to the BCM completely depends on the exact vehicle.
ATAL is a valid command for v2.1 of a real ELM327, it should return “OK”. others have reported that ATMA might not return anything on some CAN-BUS systems.
nice work it helped me to start my gmlan gmrc project you can download working demo on my site
Hello there ! this is an amazing product, i am currently working on an android app as my final project in university for a mechanics shop and i am wondering if this device can be used to communicate with the android phone, is it open source ? or should i get one of those official app on the play store?
Thanks!
all the work that i’ve done related to this is open source, the latest app is here: https://github.com/theksmith/CarBusInterface
Hello there,
can I get ABS/Air bag code information using ELM327 mini bluetooth .please help me
sorry i don’t know the exact messaging you need to pull that info. i use an Innova 3160d scan tool and it works well to pull ABS/SRS codes.
Why Buy a Volkswagen to Cheat Emissions Testing When You Can Do That Yourself? | Secure Your Workplace Network
EFF Granted DMCA Exemption: Hacking Your Own Car Is Legal For Now - KnowNaija
I have a bluetooth type elm scan tool ELM327. I can scan my ecu for trouble codes but i am having a hard time calibrating my throttle body and start clutch for my cvt transmission. I dunno if this is possible with this scan tool and what other softwares are available. I am using windows platform and most of the softwares fail to connect only few work well. I just dont wanna buy a 2000 dollars worth scan tool. You have a very interesting article. Keep it up and help me out in this if u can.
Cheers!
i have this Innova scan tool which has a lot of extra features including SRS, ABS, and enhanced (manufacturer specific) diagnostic code reading abilities – it might be of use to you: http://amzn.to/1M4TtZh
do read their manuals on the innova.com site before buying, many of its features only work with certain manufacturers. however, all in all it has been a useful tool for a few hundred dollars for me and my Jeep at least.
Just bought the first year for ob2 , made in Sweden. I’m 65 yrs old but haven’t got my Chromecast working yet ! But I keep hacking away at things ,I used to hack the old C- band burning eprom chips , ram ,rom , run. But the years have flown. Got PC , and S6 Galaxy have 96 Saab 900 SE Turbo . Bone stock. 2.0 , want light upgrade and I like the way you think. Thanks ! Victor
hi from across the big pond – no one is ever too old to learn something new!
Hi,
I have a 2005 Chrysler grand voyager 2.8 CRD export version. My problem with aftermarket radio because of factory radio is turning on / of infinity factory installed amplifier. I’m using old radio under seat for amplifier turn on. The communication is PCI between radio head and amplifier. I checked with hyperterminal for wheel buttons and 6 buttons commands are %100 same as yours. When I send a command for volume up it says OK but level is not increasing (also display not showing level up).
How can I send command with hyperterminal?
How can I save command as hardware like adblue obd emulator plug & play?
Thank you for your helping
so you did the 2 commands i mentioned at the end of the second article (https://theksmith.com/software/hack-vehicle-bus-cheap-easy-part-2/) and nothing happened?
Hi,
Which 2 command you mean? I tried this ATSH 3D 11 04 and nothing happend. If you can write that two commands I can try it.
Thanks
Hi,
I tried
ATSH 3D 11 04 enter
00 enter
And it works:) I think I have to type 00 after command ID.
yup, you got it.
the first command (ATSH) configures the header that is to be included with any subsequent data transmissions. then anything you type without an “AT” prefix is sending data with that last configured header. so when you then type the 00 and press enter, that is when it actually sends the full msg of 3D 11 04 00 C3. the C3 part is the checksum of the rest of the msg and is calculated and included by the ELM chip automatically.
unfortunately there is no way i can see to construct and send an entire raw msg all at once, but keep in mind that we are using the ELM outside of its intended purpose!
Hi I have a 2002 jeep liberty 3.7L that I installed a 2004 engine in not knowing the pick up rings for the cam and crank sensors are different. Does anyone know if this hacking can be used to program the ecm to work with the engine?
Hi!
I’m playing with I-Bus in a BMW and looking for information in internet I have found this blog. I have spend a lot of hours trying to write in the cluster like your first picture, where appears the word “HAXOR”.
Can you tell me if you take this picture from any other resource, if it’s a fake picture, or something… I’m just trying to know if it is possible to write directly in the lcd like the picture shows.
Thanks in advance.
Regards.
yes, that is just Photoshop – it was only meant as an interesting lead-in for the article. my vehicle only has a number-only display in the cluster. i don’t know the BMW bus systems at all, but his guy did actually modify his newer Jeep Wrangler JK’s cluster to display whatever text he wanted: http://chadgibbons.com/2013/12/29/hacking-the-jeep-interior-can-bus/ – so it can be done with enough time spent understanding the system.
Hi.
I have a E46 M3 with a monster turbo. I drive it normally on the Nürburgring but I now have some problems when I try to pass the annual checks with the annual Carspect…The dont like when the obd says that I dont have any coils or injectors + a 100 other different things. Is there any easy way to fix this/ come around this problem so they wont see this when the check the OBD2? The way described above seems a bit hard to me….I will happily pay for someone to fix it for me…if you know anybody.
Thanks in advance!
Daniel
i think first you’d need to know exactly what diagnostic requests the inspection performs and what the valid responses should be.
OBDII simulators do exist for development reasons. here are a few (there also may be something more “black market” out there that would exactly what you need):
https://www.scantool.net/development-tools/obd-simulators/
http://freematics.com/pages/products/freematics-obd-emulator-mk2/
i wondered if your annual checks include a dyno run – because i’m not sure how you would combine the simulator in a way that it returned fake data for many params while still giving real data for RPM, speed, etc.
I have a quick question that you might be able to answer. I have a 2004 mini cooper s and what I am trying to do is be able to lock and unlock the doors via the CAN-BUS, but I recently found out that the BCM is located on the K-Bus is it still possible to send the message through the CAN-BUS to get all the way to the BCM on the K-Bus to unlock the door?
sorry, i don’t know for sure. with many newer cars, there is a gateway interconnecting each semi-independent network to the diagnostic port so that a dealer scan tool can just hook up there and talk to everything – but knowing the exact messages to tell it to relay to the BCM would be almost impossible unless that info is on the internet somewhere, in a factory service manual, or you had the dealer scan tool to use and sniff its interactions. :(
Hi
When using the CAN bus, After finding the right ID for the speed and RPM (in an Infiniti) 0x176, the RPM is straight forward. But the speed data is a multiplication of some value which changes from car to car. So how do I actually know exactly what that value is.
Testing different car speeds gives me different values for multiplying. What should I do.?
RPM should be a very standard thing using a mode 01 request, not sure what exactly you are pulling: http://www.obdsol.com/knowledgebase/obd-software-development/reading-real-time-data/
Well part 1 is concise and to the point, have you got an electronics/programming background? I wish the manufacturers would release their code (open source) and let the people play.
Second comment after reading part 2. Dur obviously you program, I’m very interested in control systems and have just bought a Saab after being faithful to Fiats for ages. There seems to be more enthusiasm for Saab development and would like to get involved. Contact me if interested.
This is realy a great guide. Thank you so much for your work. Unfortunately I realy have some problems getting this to work. I tried the ATMA command in a Ford and it worked great until a Buffer overflow (should be fixable with an Adjustment of the baudrate). In a VW after ATMA nothing happens. Nothing at all. My script just waits and doesn get any information (I tried all the CAN protocols and set all the filters to pass all). Can you get me some input? Also can you tell me if there is a way of reading GPS data out of the car?
Thanks you so much!
as far as the overflow, are you using a Bluetooth adapter by chance? i found that they often have that issue with the amount of data the ATMA command spews. a BT adapter can work for a finished project if you are able to issue a command that streams less data, but for the initial hacking i found that a USB adapter and a regular PC/Mac with a serial terminal app works best.
and sorry, i don’t know specifically about the GPS data, i’m sure it specific to VW’s and even within that a certain year range of cars.
He pingback,
thanks for the reply. I am using a USB device and could fix the buffer problem by using a higher baud rate. Still nothing comes back when I use ATMA. I tried every protocol but nothing…
if you are just plugging into the diagnostic port then you may not get anything, many newer cars have *only* the OBD standard diagnostic info on the main port and it only responds to standard OBD queries (i.e. it doesn’t just broadcast a bunch of info all the time). such a vehicle will likely have completely different busses for different functions, such as the interior components. if this is the case for your car, then you’d have to hack directly into the correct wiring to talk to whichever bus you wanted… i’d suggest doing a bunch more Googling about your specific car and trying to find a factory service manual too. this link might help you (using Google Translate): http://secuduino.blogspot.com/2011/04/grupo-volkswagen-can-confort.html – also read the comments on this post and part 2, lots of good info in there about potential problems.
How I got my Amazon Echo to start my car. – Jryanishere Blog
this is a fun read!
Thanks! I finally got part 6 up. I couldn’t have done it without the encouragement from your blog. Thanks again.
Thanks for posting this!
But PLEASE learn to use capital letters. They exist to (among other things) help the reader parse your sentences.
thanks!
having a capital letter at the beginning of a sentence is redundant since the previous one has ending punctuation. ;) but seriously, in professional situations i do know how; i simply consider it part of the style of this personal blog to avoid capitals!
Hi, thanks for your info! I wanted to know if there is anyway to write adaptation values on to the control module. These values are stored by the dme after completing drive cycles. However with some late model bmws which fails tof store adaptation when there is a cel, or malfunction.
I was able to pull view hex values, but do not have a clue on if that could be forced store by using can bus bridge or what? There must be a way to manually write the adaptations values. If it is capable of doing so it self?
sorry i don’t have any info on what would be required to do that.
Great knowledge here, I’m trying to do something with my Seat Leon 2006 (VW group).. I have a Nexus7 in place of the stock radio and I want to interact with the vehicle, first of all control the media with steering wheel buttons :)
I have a lot to read.. thanks for sharing your work and passions.
thanks! be sure to check out some of the comments in these 2 articles and my responses. a lot of newer cars won’t work with this older hack exactly the way i did it – i.e. many require you to physically splice into the interior/comfort bus wiring instead of being able to access all the systems from the OBD2 port like i did. however, once you find how to connect physically and what bus msgs you need to emulate then you should still be able to use an ELM327 based adapter and my CarBusInterface Android app on your Nexus: https://github.com/theksmith/CarBusInterface
So that cable can send OBD packet you say? I checked the answers and some of them states that they want to buıld something based on the diagnostic packets? Can I send a CAN packet via this cable? Some answer stated that the new cars may not allow a can packet to be sent by diagnostic purposed cables.
My OBDII port doesn’t have the CAN wires connected to it, I did tap into them using a PICAN2 on the Raspberry Pi 3, but it appears that CAN is not really used to actuate things (for example, there is a massage when I turn on/off the blinkers, but when I replay it, nothing happens).
So I gave the ELM327 (SparkFun board with an FTDI friend) a try on my OBDII port… I can read diagnostic info (like the PIDs), but shouldn’t I also be able to do a “ATMA” (following te steps in this article) to see flowing data (other than CAN)? Nothings seems to be happening, not even an error, it’s just stuck at “SEARCHING…”
Any advise?
Hi guys,
Very interesting post. How can I do a dump of the car system (uConnect Live) from odb2? any suggestion, please.
Best Regards,
San
ok i have an ecu management program that will let me tune my ecu or pcm can i use a scan tool to interface to a computer with this program to adjust the setting of the stock program thats in the car
I Looking keypad console device holding car key chain and released typing in password.
it is used for driving rent car.
This is a great introduction! Looking at developing something with ELM bluetooth.
CAN och ODB2 i bilen. Några hack. – dev.smedby.net
Grrrr. I am running Ubuntu 14.04 LTS on an Acer Aspire Atom. NOT Android. I did Archon, I did nodejs, I did Chromeos-apk…
Can you please not say ‘Linux’ meaning umm, I don’t know 1893 different Distros that are NOT interchangeable? Sorry, spent six hours looking and everyone ASSUMES Android functionality, which is a MASSIVE assumption.
Have anything for Ubuntu 14.04 LTS?????
Hello i have a old renault espace 3 2001 v6 24v (je0_) many garages can not read the computer, only renault dealer can with clip, i myself tried accessing it to with a simple obd to bt reader but no connection can be maked, how can i get it to work for obd 2 ?
This write up is so good, thank you!
Hi thank you for your great work
I am working on the elm327 ver 1.5 with Mac and goserial program
ATZ
ELM327 v1.5
>ATI
ELM327 v1.5
>ATSP0
OK
>ATMA
Whenever I type the ATMA, I am getting nothing do you have any idea about it?
I also facing the same problem. I send the commands, ATZ, ATSP0 and get the correct response. After it, I send 0100 but the result was SEARCHING… and it stuck to it. If you found any solution of it, please email me hj@aviacell.com
There could be big money in finding how to simulate a OBD-2 “vehicle on” to a plugged in OBD device to remain on and deliver an unlimited wifi hotspot. Port 5 may be the key. Simply powering port 16 and grounding port 4 may not do it. Ideas?
Anyone working on this?
Can someone link to a free software to sniff CAN bus from my car using OBDLink LX OBD device. Most of the softwares I found online like CANvas, CANiBUS, CANdo etc needs some specific hardware like Kvaser.
AWESOME RESOURCE THANK YOU FOR TAKING THE TIME TO SHARE! I LOOKED EVERYWHERE FOR THIS INFO AND FOUNF MAYBE A THENTH OF THIS CONTRABUTION. THANKS AGAIN!!!
This thread has been useful I am gonna try this to see if I can get the cam sensor reading for a 2000 Chevy 3500 box van so I can time it
I bought a elm327 usb tool, i connected it to my laptop and started sending AT commands using Hyper terminal, but it is not responding at all, what could be wrong
Hi,
I need to control the climate controls via sowftware on Windows on a Touareg 1 (prefacelift 2002-2007) which uses k-line kwp protocol. Do you think this possible? Would you have any helpful ressources on this? I’m using Windows and c# on a CarPC .
j2534 is it the same as agalletto 1260 and can I flash a ram pcm with a galletto 1260
I am trying to hack my car and don’t allow it to start if the scan tool is not plugged. Do you know if there is a way to do that?
Thanks
Conditions:
1) Basic head unit Peugeot 308 (2018). Air con is operated through head unit.
2) Basic unit is not capable of Mirror Link.
Problem:
1) I want to use Mirror Link and air con.
2) Is it possible without swaping head unit for Android unit?
3) If yes, can you operate air con in Android environment?
K.
Thanks a lot for this website and information! I’m just trying to get started in this area. Always thought it was a well-guarded secret on how to access these systems. My ultimate goal is to create an app and/or device for making changes to the OBD2 /CEL & other data on a 2001 Ferrari 360. Then hopefully, if successful, onto some later models. Not sure how much time I will be able to dedicate to this project, but at least you have pointed me in the right direction to experiment. You may hear a scream of excitement the first time I’m able to successfully issue an AT command to the system, lol! Again, thanks & best wishes. Greg.
by which pin the request and response are generated?
Buad set to 921600 in terminal. but still atma results in buffer full. using iCar pro adapter. ISO 15765-4 CAN 500 is the can protocol.
I have lots of modules and CPU boards as well as various CANBus shields, I also have a CAN Crocodile and a CANBus cable for serial to ODBII. If I follow this post is it possible to capture the indicators, brakes and lights from the bus using the ODBII cable?
7 Years since posted and still useful.
Found this thread searching for a way to get the raw CANbus data through my ELM327 BLE dongle and you sir are a total legend. Perfect results within 30 minutes, and even that was just down to navigating the Serial Bluetooth Terminal app more than anything else.
Yer a gent!
Can I do the same with a k+ dcan adapter for a dodge?
I have a 2003 Jeep Grand Cherokee and I was wondering how to hack the skim system to program ECU without skim or program my new key without pin I prefer the first option get back to me please
I’m also having issues with the AT MA command. I had a bluetooth adapter with the HC05 interface. The AT MA command was working OK, but I made the mistake of trying to change the baud rate. All I managed to do was change the baud rate of the ELM327 but not the BT bit, so I had effectively bricked the unit. I have bought 2 new replacement units (both v1.5) and the AT MA command just comes back with ‘?’ suggesting the command is not supported. Is there a new trend to make clones that don’t support the MA command?
I need to pull data from my 09 Yamaha R6 motorcycle, I need to make a virtual dash cause the LCD screens are ghost segmenting, the unit technically still works, all indicator and warning lights work along with the tach, but since the LCDs are screwed I have no idea if any codes have been thrown, the onboard diagnostic tool, and most importantly for daily riding engine temp. Based off how a VERY expensive aftermarket racing data logger’s installation PDF, it specifically says Yamaha uses bus communication over the KLIne but does not name the protocol. This device taps the KLIne, VBext+, and GND wires of the OEM dash harness to send data to their device via a 7pin (712 Connector I think) round connector. They offer a adapter cable to convert the 7pin to OBD2. “Assuming” that this means the protocol being used is OBD2 compliant I wired a OBD2 port to my bike tapping the KLIne, VBext+, and GND in the dash harness using the OBD2 pins 7 for Kline, 16 for VBext, and 5 for GND, putting the bikes wiring to the same pins directly, instead of going through what ultimately amounts to 2 adapter cables. So far using a Bluetooth OBD2 scanner, one that research showed many users successfully reading data from cars using the Kline, and various apps like Torque Pro, Real Dash, Dash command, and OBD2 Dr have yielded no success. The scanner connects successfully to the app, but can’t find a usable data stream. I’m wondering if I need a pull up resistor and if so where. The other wires in the Bikes dash harness are 2 VB+ lines, P1, P2, oil level, rpm, low fuel, temp alarm, right turn, left turn, high beam, and neutral. I have no real way of knowing if I’m wired up right, and am apprehensive to just start testing different combinations for fear of damaging the ECU. The other option is that the schematic shows a black with blue trace wire connecting all the sensors needed for the data I need in a loop back to the ECU. I’ve seen some people in R6 forums claiming to have tapped these sensors to pull data. To my knowledge these sensors put out an analog signal and how they’re doing this I have yet to find out. I have eliminated one of the sensors in this loop that has to do with the exhaust, sense i have an aftermarket exhaust this sensor can be removed. This left an unused 5 pin plug, could this be used as kind of diagnostic or access port? Any help or you or anyone could offer would be greatly appreciated.