OBDII Scanner Sketch

Developer Projects
#8

I just did a scan of a 2014 Toyota Rav 4 using this branch of the code:

https://github.com/sergiomiracco/OBD2Scan/tree/dev

Here is what I get in the serial terminal (VIN obfuscated), pretty cool :grinning: I had to plug M2 in the car, press RESET button and then open the terminal right away to catch everything.

MS: SD card detected!
Capacity: 0
MS: Bus clock: 128
MS: Bus width: 1
MS: Card type: SDHC
FS: File created.
FS: File closed.
OBDII Scanner for M2

CAN0:

Trying CAN rate: 250000 FAILURE!

Trying CAN rate: 500000 SUCCESS!

Autobaud detected speed is 500000
CAN1:

Trying CAN rate: 250000 FAILURE!

Trying CAN rate: 500000 FAILURE!

Trying CAN rate: 1000000 FAILURE!

Trying CAN rate: 125000 FAILURE!

Trying CAN rate: 33333 FAILURE!

Trying CAN rate: 50000 FAILURE!

Trying CAN rate: 800000 FAILURE!

No speeds worked! Are you sure you're connected to a CAN bus?!
Auto speed detect failed. Using 250000
----==== CAN0 ECUS ====----
Querying ECU at 0x7E0
Reported VIN#: JTMRFREVXED0xxxxx
Reported ECU Name: ECM-EngineControl
Supported PIDs 1-32: 10111110 00011111 10101000 00010011 
2: Monitor status since DTCs cleared. (Includes malfunction indicator lamp (MIL) status and number of DTCs.)
FS: File opened.
FS: File closed.
3: Freeze DTC
FS: File opened.
FS: File closed.
4: Fuel system status
FS: File opened.
FS: File closed.
5: Calculated engine load
FS: File opened.
FS: File closed.
6: Engine coolant temperature
FS: File opened.
FS: File closed.
8: Long term fuel trim—Bank 1
FS: File opened.
FS: File closed.
9: Short term fuel trim—Bank 2
FS: File opened.
FS: File closed.
10: Long term fuel trim—Bank 2
FS: File opened.
FS: File closed.
11: Fuel pressure (gauge pressure)
FS: File opened.
FS: File closed.
12: Intake manifold absolute pressure
FS: File opened.
FS: File closed.
13: Engine RPM
FS: File opened.
FS: File closed.
20: Oxygen sensors present (in 2 banks)
FS: File opened.
FS: File closed.
22: Oxygen Sensor 2
FS: File opened.
FS: File closed.
24: Oxygen Sensor 4
FS: File opened.
FS: File closed.
25: Oxygen Sensor 5
FS: File opened.
FS: File closed.
26: Oxygen Sensor 6
FS: File opened.
FS: File closed.
29: OBD standards this vehicle conforms to
FS: File opened.
FS: File closed.

Supported PIDs 33-64: 10010000 00000101 10110000 00010101 
37: Oxygen Sensor 1
FS: File opened.
FS: File closed.
40: Oxygen Sensor 4
FS: File opened.
FS: File closed.
41: Oxygen Sensor 5
FS: File opened.
FS: File closed.
43: Oxygen Sensor 7
FS: File opened.
FS: File closed.
53: Oxygen Sensor 1
FS: File opened.
FS: File closed.
54: Oxygen Sensor 2
FS: File opened.
FS: File closed.
56: Oxygen Sensor 4
FS: File opened.
FS: File closed.
57: Oxygen Sensor 5
FS: File opened.
FS: File closed.
59: Oxygen Sensor 7
FS: File opened.
FS: File closed.
61: Catalyst Temperature: Bank 1, Sensor 1
FS: File opened.
FS: File closed.

Supported PIDs 65-96: 11111010 11011100 10100000 00000001 
66: Monitor status this drive cycle
FS: File opened.
FS: File closed.
68: Absolute load value
FS: File opened.
FS: File closed.
69: Fuel–Air commanded equivalence ratio
FS: File opened.
FS: File closed.
70: Relative throttle position
FS: File opened.
FS: File closed.
71: Ambient air temperature
FS: File opened.
FS: File closed.
72: Absolute throttle position B
FS: File opened.
FS: File closed.
75: Accelerator pedal position E
FS: File opened.
FS: File closed.
76: Accelerator pedal position F
FS: File opened.
FS: File closed.
77: Commanded throttle actuator
FS: File opened.
FS: File closed.
79: Time since trouble codes cleared
FS: File opened.
FS: File closed.
80: Maximum value for Fuel–Air equivalence ratio, oxygen sensor voltage, oxygen sensor current, and intake manifold absolute pressure
FS: File opened.
FS: File closed.
86: Short term secondary oxygen sensor trim, A: bank 1, B : bank 3
FS: File opened.
FS: File closed.
88: Short term secondary oxygen sensor trim, A: bank 2, B : bank 4
FS: File opened.
FS: File closed.
89: Long term secondary oxygen sensor trim, A: bank 2, B : bank 4
FS: File opened.
FS: File closed.

Supported PIDs 97-128: 00001000 00000000 00000000 00000000 
100: Engine reference torque
FS: File opened.
FS: File closed.

Supported PIDs 129-160: ERR!

Querying ECU at 0x7E1
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E2
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E3
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E4
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E5
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E6
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E7
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

----==== CAN1 ECUS ====----
Querying ECU at 0x7E0
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E1
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E2
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E3
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E4
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E5
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E6
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

Querying ECU at 0x7E7
Reported VIN#: ERR!
Reported ECU Name: ERR!
Supported PIDs 1-32: ERR!
Supported PIDs 33-64: ERR!
Supported PIDs 65-96: ERR!
Supported PIDs 97-128: ERR!
Supported PIDs 129-160: ERR!

And here is what the file on the SD card looks like.

Note: I renamed the file “log.txt”

OBDII Scanner for M2
1: Monitor status since DTCs cleared. (Includes malfunction indicator lamp (MIL) status and number of DTCs.)
2: Freeze DTC
3: Fuel system status
4: Calculated engine load
5: Engine coolant temperature
7: Long term fuel trim—Bank 1
8: Short term fuel trim—Bank 2
9: Long term fuel trim—Bank 2
10: Fuel pressure (gauge pressure)
11: Intake manifold absolute pressure
12: Engine RPM
19: Oxygen sensors present (in 2 banks)
21: Oxygen Sensor 2
23: Oxygen Sensor 4
24: Oxygen Sensor 5
25: Oxygen Sensor 6
28: OBD standards this vehicle conforms to
36: Oxygen Sensor 1
39: Oxygen Sensor 4
40: Oxygen Sensor 5
42: Oxygen Sensor 7
52: Oxygen Sensor 1
53: Oxygen Sensor 2
55: Oxygen Sensor 4
56: Oxygen Sensor 5
58: Oxygen Sensor 7
60: Catalyst Temperature: Bank 1, Sensor 1
65: Monitor status this drive cycle
67: Absolute load value
68: Fuel–Air commanded equivalence ratio
69: Relative throttle position
70: Ambient air temperature
71: Absolute throttle position B
74: Accelerator pedal position E
75: Accelerator pedal position F
76: Commanded throttle actuator
78: Time since trouble codes cleared
79: Maximum value for Fuel–Air equivalence ratio, oxygen sensor voltage, oxygen sensor current, and intake manifold absolute pressure
85: Short term secondary oxygen sensor trim, A: bank 1, B : bank 3
87: Short term secondary oxygen sensor trim, A: bank 2, B : bank 4
88: Long term secondary oxygen sensor trim, A: bank 2, B : bank 4
99: Engine reference torque

Nice work guys! A couple ideas that come to mind:

  • Some sort of visual feedback indicating we are scanning and writing to SD card. Maybe blinking Red when “recording” and Green when done? or something like that

  • Increment file name so it doesn’t overwrite. It would be cool to be able to plug this into several cars, download the info to M2 and have 1 file for each car.

Keep it up guys, this is great stuff!

M2 cannot use SD card
#9

Maybe a log file by vin number would be a good way so you can keep different car files in there and be able to track them too.

#10

The log file is now put into a folder which increments with every new scan. I chose to organize in folders so you can split up the files by VIN numbers if you like without loosing scope of the whole scan.

#11

Savvycan was able to detect the baud rate with no problem and I was able to see traffic. This sketch can’t seem to detect it I still have yet to try to manually set the rate.

#12

What is the reason for only using 7 of the 8 available mailboxes?

  for (int filter = 0; filter < 3; filter++) {
      Can0.setRXFilter(filter, 0, 0, true);
      Can1.setRXFilter(filter, 0, 0, true);
  }  
  //standard
  for (int filter = 3; filter < 7; filter++) {
      Can0.setRXFilter(filter, 0, 0, false);
      Can1.setRXFilter(filter, 0, 0, false);
   }

I use this and it doesn’t seem to cause me any problems:

  // Declare 4 standard and 4 extended mailboxes for each controller
  for (i = 0 ;  i < 4;  i++) {         // standard (0..3)
    Can0.setRXFilter(i, 0, 0, false);  // Mailbox#, MID, MAM, extended
    Can1.setRXFilter(i, 0, 0, false);
  }
  for ( ;  i < CANMB_NUMBER;  i++) {   // extended (4..7)
    Can0.setRXFilter(i, 0, 0, true);
    Can1.setRXFilter(i, 0, 0, true);
  }
#13

The reason is: whoops.

2 Likes
#14

Hi Collin

Can you help me out here…?
I have tried to use Macchina M2 and your interface Savycan. It worked on our 2012 Ampera the first time, bot not on my 2001 Peugeot 406 coupe 3.0 that i want to convert to Leaf motor. First i would like to have a solid CAN database so that i can simulate motor running to use all the gizmos in the car.

So when i connect M2 to 406c OBDII socket nothing happens. No LED nothing. Whilst on Ampera everything starts flashing and i can observe a lot of traffic even when the car is off. Is it possible that on Peugeot OBD port has different speed than usual?

Also i noticed something odd with M2. Usually when i connect M2 to USB and laptop i get “Arduino due hardware on com15” or similar. However sometimes i connect the same, but hardware says something like “bossac port on com16”. When i connect Savycan i cant start communication. I have to unplug M2 and play with drivers to get Arduino Due back.

What is your experience with CAN/OBDII, could the pins be switched on OBDII connector? Why would they do such a thing?

A

#15

Verify that your Peugeot actually uses CANBUS. It is very likely that it does not. CANBUS was not required in the US until 2008. Some GM vehicles included CANBUS earlier but not as early as 2001. I wouldn’t be surprised if your 2001 uses a different protocol.

#16

Well shoot! It does use a similar protocol, but it is not CAN, it is ISO 14230-4. However ELM bluetooth reader instantly starts to work, when i connect it.
So is there hope for me or not?
How should i try to hack the Pug then?

EDIT: I saw something… KWP2000 is also compatible on ISO 11898 (Controller Area Network) supporting higher data rates of up to 1 Mbit/s.

and

Very common protocol for 2003+ vehicles using ISO9141 K-Line. Uses pin 7.
Two variants of ISO14230-4 exist. They differ only in method of communication initialization. All use 10400 bits per second.
ISO 14230-4 KWP (5 baud init,10.4 Kbaud)
ISO 14230-4 KWP (fast init,10.4 Kbaud)

So maybe it will work if i change speed to 1Mbps and/or 10,4Kbaud rate.
Collin does Savycan work with pin 7 of the OBD and K/Lin bus?
A

#17

Please be aware that there are very few utilities at this time that can deal with anything other than canbus for reverse engineering. The M2RET sofrtware does not currently support anything other than CANBUS or SWCAN and SavvyCAN currently only works with CANBUS and SWCAN…

There is a LIN library if you go to the macchina documentation and look up the “spotlight” projects. At this time you have to roll your own tools to capture and process.

I hope to change this though my summer project but I can not promise anything at this time. I hope to add full Lawicel 2.0 support and allow modular development for M2 so things just work but at this time this is not the case. (With full Lawicel 2.0 support Craig Smith has promised to add support into Metasploit which should be beneficial. If I learn how to do Wireshark protocols I MAY add the protocols to Wireshark as well…)

Lawicel Basically is the basis for CAN driver support in Linux. With proposed Lawicel 2.0, driver level support can be added into Linux to be used as simply as SocketCAN.

I will be announcing my summer project in 2 weeks after I finish this semester. I am still looking at my resources at this time and need to focus my time on my finals between now and the 24th.

#18

Rod’s basically right here, I never supported anything other than CAN (and swCAN) in SavvyCAN. In theory support could be added for some of the other protocols and bus types but those things don’t interest me so I haven’t done it.

Though, LAWICEL 2.0 is already in M2RET. In fact, I helped define how it would work. So, in actuality the reference code for LAWICEL 2.0 is M2RET as I believe it’s the only thing that actually supports it currently. The problem is that there’s nothing to talk to it. I think that’ll change this year. Yes, the goal is to standardize how all the various bus types are presented so that a single code base could feasibly read/write to many bus types without needing to know which it is talking to. Work on all that is quite preliminary at this point. And, like I said, I couldn’t care less about k-line and all the other old crap so that sort of makes it fall into someone else’s lap. :wink:

Macchina m2 Blynk
#19

Yeah, i figured i have chosen a beautiful but unsupported car. I will just go and reverse engineer analog signals from sensors end and try to simulate motor at 800rpm.

A

#20

I’m just beginning in this and I don’t have a programmer’s background (pardon my stupid questions).

I’m trying the OBDII Scanner sketch on my M2 on 4 different cars (Subaru BRZ 2013, Mazda 3 2013, Dodge Grand Caravan 2005, Kia Sportage 2013) and it always fails with similar results (only difference is Mazda 3 CAN1 baud is 125000 instead of 250000).

I must be missing something obvious but I don’t get it. Can anybody help ? Thx.

Here are the results as read from the SD card (same thing in serial console, just more verbose…)

OBDII Scanner for M2
CAN0 baud: 500000 B/s
CAN1 baud: 250000 B/s
---- CAN0 ECUs ----
Querying ECU at 0x7e0
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e1
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e2
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e3
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e4
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e5
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e6
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e7
Reported VIN#: ERR!
ECU name: ERR!
---- CAN1 ECUs ----
Querying ECU at 0x7e0
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e1
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e2
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e3
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e4
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e5
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e6
Reported VIN#: ERR!
ECU name: ERR!
Querying ECU at 0x7e7
Reported VIN#: ERR!
ECU name: ERR!

#21

The 2005 Grand Caravan probably won’t work as vehicles that old don’t tend to use CAN on the OBDII port. The three 2013 vehicles should have worked. I find it interesting that one of the cars went to 125000 for the speed. That’s pretty low but makes sense, it’s probably a low speed body control system. Anyway, it it successfully negotiated auto baud then that’s a good sign. You might try some of the other sketches like M2RET to see if those vehicles are indeed sending traffic. It’s possible that they’re not responding for some unknown reason but it’d be nice to know if things are actually working on the bus or not.

#22

Good news, I’m able to capture frames and save log with M2RET & SavvyCan on the three 2013 cars. And as you predicted, the Grand Caravan 2005 doesn’t work at all.

I tried again the OBD Scanner sketch without success.

May be this can help (although I feel it’s limited to how the serial port behave, and shouldn’t interfere with SD card), I notice after uploading sketch the M2 is recognized as Arduino DUE (COM28) on my laptop, but as soon as I plug the M2 in a car it dissappears and reappears as Bossa Program Port (COM29), and never comes back as Arduino Due and stays stuck as Bossa. (I’m not sure if it adds any useful info).

OBD Scanner sketch should still work but doesn’t.
Thx

#23

Following the limited success I had with SavvyCAN, I tried its UDS scanner (to my understanding it does approximately the same thing as the OBD Scanner sketch) but it failed by falling in a endless loop finding nothing (I had to kill the SavvyCAN program to get out).

That just adds to my misunderstanding and confusion.

#24

Actually I made dozens of CAN Frame captures and playback of discrete events (door lock, window up/down…) using SavvyCAN as describes on Chapter 5 in the Car Hacker’s Handbook.

None of the playback works (it does nothing except flashing various lights in the dash).

So I wonder if all frames captured would be corrupted in some way ? (something wrong with my M2 ?) That would be a common cause to all: OBD Scanner sketch fail, SavvyCAN UDS Scan fail, and playback fail.

Can someone bring some light on this ?

#25

The UDS scanner shouldn’t go into an endless loop and crash the program. That seems a bit odd. Perhaps I’ll have to go test that again. I’ve used it lots of times myself and haven’t had it freeze.

You are getting weird results. But, if various lights on the dash flash then something must be happening. So I have to assume it is sending something. Perhaps you’re right and it might not be sending the proper things. Unfortunately the only way to verify what is being sent is to have a second device also hooked up and monitoring to see what that second device says.

#26

I watched again your YouTube UDS scanner demo to realize I was doing it wrong.
Now SavvyCAN goes thru but it doesn’t find anything (on the Subaru BRZ, didn’t test the other).
See UDS export file content below;

UDS Scan Log:

0x07E0
TESTER_PRESENT
0x00
No Reply

0x07E1
TESTER_PRESENT
0x00
No Reply

… All the same up to 0x07EF.

(I know the OBD2 port on the car is good as it works fine with ELM327 Reader (Bluetooth, cheap chinese clone) with various app such as; Torque Lite…)

I don’t have a second Macchina M2, but I have a Can Bus Shield for Arduino Uno that I can use to monitor what the Macchina is doing.
Is there a sketch for the Uno that can help me troubleshoot the M2 ?
(I tried some stuff but everything failed…)

#28

I am hoping thay someone can help me with this. I ran the scanner on my car and returned ERR! For pid 1-128, i did recoece the vin and 129-160, however i got an extremely long string of an unknown character for ID 137, I am attempting to get it to send me RPM info for a shift light