• Wake the beast up

    Dmitry Ketov • 08/31/2021 at 14:08 • 0 comments

    As it turned out (thanks to the bus_monitor.py from https://gitlab.com/py_ren/pyren/ project which makes ELM327 to be the simpliest can bus hacker tool) the display wanted to be awaken by a pair of can frames being sent on the can-v (can vehicle) wires.

    To figure that out I simply recorded a pair of traces taken from both can buses on a real car and then tried playing them back frame-by-frame to my radio and display guinea pigs. The beast awoke and started roaring :)

    struct can_frame external_temp = {
  0x534, 0x5, 0x80, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00
};

struct can_frame wakeup_radio = {
  0x35C, 0x8, 0xf1, 0x06, 0x56, 0x11, 0x18, 0x3e, 0x62, 0x14
};

struct can_frame wakeup_display = {
  0x35C, 0x8, 0xf1, 0x06, 0x56, 0x11, 0x18, 0x3f, 0x62, 0x14
};

  • Display and radio to experiment with

    Dmitry Ketov • 08/17/2021 at 20:44 • 0 comments

    I firstly got myself the display 280349044R, the radio 281150030R and dug a wiring diagram 

    They say that #261 is the radio, #653 is the display, #325 is the remote. The 107W, 107X pair is the can-m I'm after and 137H, 137G pair is the can-v to get vehicle params from. #225 is obviously the OBDII port. There are also MT and NAM wires being display and radio ground shown as black lines and a bunch of +12V wires named BCP4, BT5, BPTG shown in red.

    I tried to connect everything and plug to a +12V power supply. Nothing barely happened. The display stayed black but the radio hissed a little bit. Power on button on the radio face panel didn't give anything. Eject button - nothing as well. When I then tried to load a CD it was finally swallowed. Phew! The beast was alive but was so far sleeping :)