VAG CAN Hacking

AhA! that is the trick.
Thanks man!
There are no way to measure the CAN network in the car through the OBDII and a scope?
Is it maybe possible to get a CAN signal on the OBDII connector with an OBD brakeout box?
Hmmm or we can put an ELMA scanner on the OBDII and whit the Hyperterminal send and request the CAN commands
and monitoring the signals whit a DSO to check if there are any disturbing in the CAN network?
I mean is a shorten or not or broken CAN wire...

With a ELM327 you can make polling CAN devices, if you know ID.
See AT command in ELM327 manual, how to work with CAN BUS. I dont remember all commands, but I polled the CAN devices according to OBD.

@jodank - see my post above about connecting to the OBD connector vs tapping a 'real' CAN line elsewhere in the car.

If you're just listening on the OBD2 CAN pins using your scope you won't see very much - that CAN line does not actively send any data unless it has been specifically requested by a device connected to those pins.

If you connect a diagnostic tool to those pins and actively request CAN data from the car then you should be able to watch the traffic go past using your scope.

Note that the VW CAN Gateways are very particular in their data format and packet timing and if you don't send commands exactly per the specification the Gateway will close the 'session' and stop sending data, so sending individual CAN commands by hand doesn't usually work when connected to the diagnostic CAN line via the OBD2 port.

If you tap an actual vehicle CAN line then those are chatty, and you'll pick up traffic on those lines just by listening.

Thank you guys, you helped me a lot.
Problem solved.

@avis, you has a great idea at #Comment_507. I'll try to use that in my experimentations with comfort bus.
@Derek‌, whats the status of the DB you talked about in #Comment_42?

Thanks for all the info so far. I own a VW CrossFox year 2008 and I'm getting things ready to play with its CAN bus. I'll post my results when I get anything.

Some additional info I ran across: <a href="https://jazdw.net/tp20">https://jazdw.net/tp20</a>
Has some good info on how to setup measurements.
I haven't tried anything yet but my CAN board is in transit.
Hoping to be able to poll engine oil temp, boost, coolant, and what not and be able to provide indicators such as LEDs and beepers to warn me when things get dicey or that I need to let the oil cool before shutting off the engine after a long turbo pull.
I'm working with an Arduino but have a Raspberry Pi 2 as well if I need more horsepower.
My car is a 2008 Audi A4.

Has anyone played around with comfort-bus data in A4 (b7 -07) ?
Im able to command passenger side window as well mirror but on driver side theres no specific can-id's to manipulate. Reoccurring id on Dside is 381 but that seems to be some general trigger for locking, alarm as well warningsidelights(?)
Ive tested to dump all data while commanding driverside window buttons and mirror joystick and replayed that back to the bus but nothing happens. Also tested to command D and P side windows together for replaying dumped data, P side works flawlessly but nothing happens on D side...

really frustrating :/

@Ded you're able to influence the door control module to manipulate the mirrors? How so, move the mirror? Fold the mirror?

Thanks,
Pete

The best way to take control of things is to purchase a Tech II scan tool and an OBD-II Y-splitter so you can have both the Tech II and your CBT on the bus. Simply execute controls using the Tech II tool while your CBT is logging the traffic.

But How??

Every ECU has its own Diagnostic ID for requests and another ID that it will reply to when a request is made.

Find the ID that the scan tool opens a diagnostic session with then find the ID where the ECU sends responses to.

In my opinion, this method is the best for controlling on-board systems because the diagnostic protocol is there for that exact reason

Also, having your CBT rigged up to all available busses increases the probability of controlling all available systems on the vehicle.

It should be noted that on some vehicles / manufactures implement certain limits on diagnostic functions to prevent (some, not all) unsafe conditions.

@slypete nope not folding since I have 2007 y car. I'm only able to reposition mirrors and control windows on passenger side but not on driver side.

I've moved all my development away from CBT since software is too unreliable (works only 40% of all attempts) to Linux based environment as well custom hardware / software using mcp25xx chips.

Looks like your connection to CANBus Triple was lost, please wait while we try to reconnect.