Waking up the bus so I can send OBD2 queries on GM

General Discussion
#1

I am trying to send OBD2 queries to a Chevy Volt while the car is off. I can still get responses when the car is “awake” (for example, if I press the lock or unlock buttons on the key), but after about 30 seconds, it goes back to sleep, and nothing I send will wake it back up.

I can wake up the SWCAN bus by sending almost any frame, which is a start, and when I do that, I see one frame being repeated on CAN0 (ID 0x3ED, 6 bytes, 00 00 00 00 00 FF), which I don’t see when the car wakes up normally.

I have tried sniffing the bus while it is waking up, but I don’t see any special frames being sent, other than the 0x100 frame over SWCAN, which just seems to wake that bus up.

Is there an extra out-of-band signal I need to tap into somehow?

#2

You need to change the mode of the SWCAN to HV wake up then send a frame ID of 100 00 00 00 00 00 00 00 00 then send a few frames with the ID’s of 62x 00 FF FF FF FF FF 00 00 or 62x 01 FF FF FF FF FF 00 00 then change the SWCAN mode back to normal then the bus on the car should be fully awake to query. The bus will go back to sleep after a min or so since the car is not powered on. I use this method to wake up the bus for my MyVoltStar app https://play.google.com/store/apps/details?id=com.thunkable.android.myvoltapp.MyVoltStar1

1 Like
SWCAN Wakeup Issue
#3

Thanks, brianbri6, that worked great! My problem was that I was taking it out of high voltage wakeup mode as soon as I sent the 0x100 frame.

I was able to figure out how to lock and unlock the doors using frame 0x1024E097, but I was unable to figure out how to start preconditioning - there’s just too much data on the bus, and I don’t have the resources to isolate the Onstar module to figure out which frames are coming from it.

Would you be willing to share some of the code used in your app for sending commands to the Volt?

#4

Hi, jspenguin did you find a way how to start remote preheat?

#5

I assume you’re talking about the preconditioning that can be done from the key and the OnStar app? Yes, it is possible to control that.

I had a bit of trouble with the command, so I tried to mimic exactly what the OnStar module sends. The frames I send are:

  1. Send wakeup frames to all the addresses I’ve ever observed over the wire: 0x620, 0x621, 0x622, 0x627, 0x62C, 0x62D. This is probably overkill.
  2. Wait until I start seeing activity on the high-speed bus.
  3. Send the following frame via SWCAN: 1024E097 00 01 FF (extended frame, 3 bytes). This is actually the door lock code, but OnStar sends it, so I do too.
  4. After 500ms, send 1024E097 80 01 FF. This is the actual command to start preconditioning.
  5. Wait 1000ms, then send 1024E097 00 00 FF. I’m not sure what this does, but OnStar sends it.

To cancel preconditioning, repeat the same steps, but send 40 01 FF instead of 80 01 FF in step 4.

Here’s a list of commands that can be sent:
00 01 FF - Lock all doors
00 02 FF - Unlock driver door
00 03 FF - Unlock all doors
02 00 FF - Open rear hatch
40 01 FF - Stop preconditioning
80 01 FF - Start preconditioning

1 Like
#6

Thanks for sharing,

but by some reasons it’s doesn’t work for me…

here is my code, maybe you find what i do wrong ?

#include <mcp_can.h>
#include <SPI.h>

MCP_CAN CAN0(10);

byte wakeUp[8] = {0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00};
byte battery[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
byte closeDoors[3] = {0x00, 0x01, 0xFF};
byte preheat[3] = {0x80, 0x01, 0xFF};
byte onstar[3] = {0x00, 0x00, 0xFF};

void setup()
{
Serial.begin(115200);
if(CAN0.begin(MCP_ANY, CAN_500KBPS, MCP_16MHZ) == CAN_OK) Serial.println(“MCP2515 Initialized Successfully!”);
else Serial.println(“Error Initializing MCP2515…”);
CAN0.setMode(MCP_NORMAL);
}

void loop()
{
delay(10000);
CAN0.sendMsgBuf(0x62, 0, 8, wakeUp);
CAN0.sendMsgBuf(0x620, 0, 8, wakeUp);
CAN0.sendMsgBuf(0x621, 0, 8, wakeUp);
CAN0.sendMsgBuf(0x622, 0, 8, wakeUp);
CAN0.sendMsgBuf(0x627, 0, 8, wakeUp);
CAN0.sendMsgBuf(0x62C, 0, 8, wakeUp);
CAN0.sendMsgBuf(0x62D, 0, 8, wakeUp);
CAN0.sendMsgBuf(0x100, 0, 8, battery);

delay(5000);

CAN0.sendMsgBuf(0x1024E097, 3, closeDoors);
delay(500);

CAN0.sendMsgBuf(0x1024E097, 3, preheat);
delay(1000);

CAN0.sendMsgBuf(0x1024E097, 3, onstar);

}

#7

You need to use SWCAN, not CAN0. You also need to send the wakeup frames using mode 1. I don’t know what CAN library you’re using, so I don’t know how to do that. I’ll try to help later, I don’t have a lot of time right now.

1 Like
#8

i use this lib. https://github.com/coryjfowler/MCP_CAN_lib
thanks in advance

#10

Question:
Do the messages to 0x1024e097 need to be sent in high voltage wakeup mode, or only the earlier wakeup messages?

I’m successfully waking up the bus, but not seeing the vehicle actually start preconditioning on a 2020 Chevrolet Bolt.

I’m running on a Macchina P1, I’ll try and attach my current script later tonight. I need to copy it over from the P1 after dinner.

Edit: At this point, I’m fairly certain the serial data gateway seen on newer GM vehicles is firewalling OnStar commands that come from the OBD port.

#11

@Entropy512 Did you ever have any luck with this? I’m trying to see if I can start a precondition on a 2016 Volt from the OBD2 port. MyVoltStar hasn’t worked for me.

#12

I am trying to do the same and have had no luck. I seem to be able to wake up the bus but my 2016 Chevy Volt doesn’t seem respond to any OnStar messages I send from my M2. I could be doing it wrong, but I have been trying quite a few approaches. I can see the traffic fine. I wonder if they started firewalling the OBD port with the Gen2 volt

#13

One way to know for sure is to connect to the bus on the other side of your BCM and see if you can communicate there. It is possible that the BCM is filtering out any traffic that isn’t legit. Which then would disable a bunch of automotive security Dongles that depend on communicating through the OBDII port to do a bunch of functions that are not diagnostic. There is likely a way to do it because the dealer tools will still do this but would require getting a dealer tool and reverse engineering the codes it puts out.

Otherwise the dealers may have a special programming port that allows them to access each module directly.

1 Like
#14

I’m 99% certain the SDGM on a 2020 Bolt is firewalling any messages that SHOULD be coming from telematics if they originate from the OBD port.

I finally found a 2020 SM, and the SDGM is fancier than in 2017-2019 - the OBD port is on the main buses in 2017-2019 and the SDGM is just isolating the telematics buses, on a 2020, the OBD port goes through the SDGM for EVERYTHING.

It really looks like on a Bolt, the only way to do wakeups is if you splice into the radio harness. I have yet to find connectors that would allow me to build a passthrough that aren’t unobtainium.