General Motors CAN Sniffing

General Discussion
#1

I am using the M2RETFlash Bin file to use the M2 with SavvyCan…
I am using a 2017 Chevy camaro and I use the overrite mode to only see changing frames.

However no matter how much I study the info, I dont see anything that coorisponds with my blinker usage, or even steering wheel button presses. My goal was to log and dump into excel to remove the duplicates, but SavvyCan crashes when i start to log.

One final question, I am being told exterior light manipulation is not possible WITH ENGINE RUNNING due to GM safety features coded in. Are there any other buses not accessible via engine run?

Thanks

#2

Are you searching the CANBUS or the SWCAN? Most non critical stuff should be on the SWCAN bus…
You may also find that you don’t have anything at the diagnostic port without asking for it and may need to tie into the SWCAN bus directly somewhere within your car.

#3

I was plugged into the OBD2 Port. SavvyCan showed 3 buses detected. Are all 3 buses shown at once?

#4

And all 3 where enabled

#5

Yes, if all three are enabled then you will see all three shown at once. The bus number corresponds to which one produced the CAN frame. 0 = The standard OBDII CAN bus, 1 = secondary CAN bus, 2 = Single Wire CAN.

Obviously it isn’t ideal that you are getting crashes in SavvyCAN. What do you mean by it crashes when you start to log? If you are connected and receiving traffic then it is logging but I wonder if you mean you are doing continuous logging? Which operating system are you using? Apparently there’s a bug somewhere.

Steering wheel button presses are almost certainly going to be single wire CAN or LIN. Currently you aren’t going to get LIN but you could potentially receive SWCAN messages. But, as redheadedrod said, it isn’t guaranteed that they allow all traffic through to the OBDII port. Some newer vehicles segment the buses and don’t allow a whole lot through to the OBDII port. They might have a more thorough diagnostics port somewhere else or they might require that you send a specific set of secret messages that unlocks the true traffic.

#6

Good morning Collin, you are correct. I was clicking Continuous logging. I wasnt aware that SavvyCAN was continuously logging, and that I could just click save log ect…

I am using Windows 10 home Edition Build # 17134.829

As for the traffic being broadcast on the OBDII port, I have to assume its happening. There are a few products on the market for the same year GM vehicle, albeit for a Silverado truck that have features activated when you turn on your blinker ect
Thanks

#7

Steeringwheel buttons are connected thu linbus as far I know, atleast with many of the other Global A vehicles this is the case

#8

Thanks, I’ll check out the library.

#9

It’s linbus is connected to IPC I think (is atleast on some other global a cars from that year)
In any case not connected to the OBD connector

#10

Im not sure about that, as I came accross a product that turned your backup camera on when you turned your blinker on. The device only plugged into an OBDII port.

The mystery thickens.

#11

Well that should be possible, you’ll need to instruct the BCM and HMI to turn on the camera if you watch the lowspeed canbus (id 1020C040, byte 4, bit 2 and bit 6) for the blinker

#12

It should be possible to control these items from the OBDII port. It is used as a diagnostic port and your newer Tech2Win devices can test these items. The problem is going to be how to actually get to the codes. You may find that just watching on the OBDII bus will be frustrating because the codes may not be there without prompting. You need to find what code is used to request the bus. I am sure the information is out there but I am not aware of it myself. If it is communicating on a LIN line, the M2 can be tapped into that line to look but unless you want to leave the M2 connected to that line that won’t help you out either.
The BCM likely takes the input from the OBD port and translates it for the LIN. If that is the case then what you will have to do is get access to a diagnostic tool and sniff what it is using to test the devices you are trying to get to. Then you can duplicate those codes and be good to go. Those diagnostic commands then would be telling the BCM to tell the device over LIN to do whatever you want.

When developing something like this you really need to try and get the full OEM wiring diagram and troubleshooting information. It is very beneficial to get the whole OEM shop manual for your vehicle for doing this and other things. Such as fixing your car. They are expensive but, just like a divorce… Worth it.

The manual can tell you what is connected to what bus and how it gets there. Also using the diagnostic tool you will be able to find out what code can open up the bus and such as well. You can get the Tech2win and supporting hardware relatively cheap if you look in the right places. Possibly cheaper than the $300 -$400 tech2 clones. (Which only work up through 2013).

Rodney

#13

The steeringwheel controls are connected to LIN or analog to the IPC and then transferred over MOST (radio controls), LIN can indeed be sniffed. Done that, got the tshirt
The rear camera turn on command can be sent over OBD2 with GDS and an MDI to the HMI and bcm, that is something I’m still looking for but I think in a few days I’ve found that can message too.
The blinker should be in the message specified earlier

#14

Steering wheel controls is not on the lin bus it is on the swcan bus and the controls are physically connected to the BCM. The BCM is sending the messages for the steering wheel. You can trigger the camera on the swcan bus communicating to the radio. Blinker is on the swcan bus also coming from the BCM to the IPC and then to the radio. You can trigger lights or any functions with the engine on or the car turned off. I have figured all of that out years ago on my Volt. Check out my IG for examples.

#15

I don’t believe the LIN stuff is on the OBD port? Or atleast I had not seen in in any GM vehicle I was looking at. One thing about GM is they don’t change much around very often so if you find the same codes for another vehicle you can likely use them on yours or something similar.

Rodney

#16

It depends on model, I think the Camaro from 2017 mentioned above uses the HMI 2.5, in the Buick regal, Opel Insignia and some others where I could confirm it it used a LIN to the IPC. I could confirm if I could access the SPS files but only got GME.
Same with the reverse camera, the bcm sends this to the HMI through highspeed can.