I've always wanted to know how can bus communication works. My car radio have no bluetooth support so I thought it would be nice to add it myself :)
My intention is to use an audio bluetooth module such as BK8000L, XS3868 or CSR8645 controllable by AT commands and the original segmented display connected to the car radio for the UI. It's known that they use a can-m (multimedia) bus and the simplest way to connect to them is OBDII port. At the same time, the main can-v (vehicle) bus is also reachable by the port means so it will be definitely great to read and expose some engine or transmission parameters such as coolant or transmission fluid temperatures, etc on the same display.
More than that, OBDII is going to provide +12V power and is extremely close to the audio aux RCA sockets so the final device might be placed in OBDII adapter casing and be completely pluggable with no irreversible modifications to the car wirings
As it turned out (thanks to the bus_monitor.py from https://gitlab.com/py_ren/pyren/ project which makes ELM327 to be the simpliest can bus hacker tool) the display wanted to be awaken by a pair of can frames being sent on the can-v (can vehicle) wires.
To figure that out I simply recorded a pair of traces taken from both can buses on a real car and then tried playing them back frame-by-frame to my radio and display guinea pigs. The beast awoke and started roaring :)
I firstly got myself the display 280349044R, the radio 281150030R and dug a wiring diagram
They say that #261 is the radio, #653 is the display, #325 is the remote. The 107W, 107X pair is the can-m I'm after and 137H, 137G pair is the can-v to get vehicle params from. #225 is obviously the OBDII port. There are also MT and NAM wires being display and radio ground shown as black lines and a bunch of +12V wires named BCP4, BT5, BPTG shown in red.
I tried to connect everything and plug to a +12V power supply. Nothing barely happened. The display stayed black but the radio hissed a little bit. Power on button on the radio face panel didn't give anything. Eject button - nothing as well. When I then tried to load a CD it was finally swallowed. Phew! The beast was alive but was so far sleeping :)