EOS CAN-BUS Hacking | Volkswagen Eos Forum

Menu Log in Sign up

• Home
• Forums
• Volkswagen Eos Forum
• D.I.Y. (Do It Yourself)

vascojdb Hi all, Few months ago I have been playing with the CAN-BUS of my EOS. First I gathered some information online about VW CAN signals, grabbed my oscilloscope and started analyzing the signals going on my EOS Then I went back to my desk and made a sniffer/injector using a Microchip PIC and few other components, written in C. I also made a python console GUI to show the results Finally I went back to the car and made simple test: Pressed the drive and passenger window controls, managed to get the address and data for those actions, and then injected packets into the CAN-BUS with the same data, surprise surprise, I was controlling the windows with my Laptop Later I developed a PCB with a bluetooth interface (I've got everything except the time to solder the parts on the PCB) and I plan to control few things on my car using my phone The final idea is to hide an android phone inside my car, and use Android speech recognition and speech generation (as well as internet, and other sensors that I can add via serial/bluetooth like RFID card readers, etc) to make an interactive smart EOS lady Example: "Hello! Who are you?" (I scan my RFID card) "Welcome back Vasco, today is a sunny Saturday and we will have 32 degrees. I will now adjust myself to your personal settings. Have a nice trip!" (I forgot to fasten the seat belt) "Vasco, please fasten your seat belt" Me: "<insert girl name here>, please open the roof" "I will now open the roof" (roof opens) How cool would be that? Imagine the possibilities The fact is that I actually tested some CAN commands, and I tested the voice recognition, speech generation and bluetooth communication, Google also gave me the city and street address, which then I can make the phone speak. --- Anyway, If anyone is interested, we can share ideas and code. Here is my source of information from where I started: VW CAN-BUS: http://www.volkspage.net/technik/ssp/ssp/SSP_238.pdf Some CAN codes: https://docs.google.com/spreadsheets/d/1eirT8LbSRl4j06BpwgsiE4PM_2BGH9UStdWLXwKvHJw/edit#gid=0 Schematics and code: I havent had time to prepare them but soon they will be available #1 · Oct 28, 2015 Hi all, Few months ago I have been playing with the CAN-BUS of my EOS. First I gathered some information online about VW CAN signals, grabbed my oscilloscope and started analyzing the signals going on my EOS Then I went back to my desk and made a sniffer/injector using a Microchip PIC and few other components, written in C. I also made a python console GUI to show the results Finally I went back to the car and made simple test: Pressed the drive and passenger window controls, managed to get the address and data for those actions, and then injected packets into the CAN-BUS with the same data, surprise surprise, I was controlling the windows with my Laptop Later I developed a PCB with a bluetooth interface (I've got everything except the time to solder the parts on the PCB) and I plan to control few things on my car using my phone The final idea is to hide an android phone inside my car, and use Android speech recognition and speech generation (as well as internet, and other sensors that I can add via serial/bluetooth like RFID card readers, etc) to make an interactive smart EOS lady Example: "Hello! Who are you?" (I scan my RFID card) "Welcome back Vasco, today is a sunny Saturday and we will have 32 degrees. I will now adjust myself to your personal settings. Have a nice trip!" (I forgot to fasten the seat belt) "Vasco, please fasten your seat belt" Me: "<insert girl name here>, please open the roof" "I will now open the roof" (roof opens) How cool would be that? Imagine the possibilities The fact is that I actually tested some CAN commands, and I tested the voice recognition, speech generation and bluetooth communication, Google also gave me the city and street address, which then I can make the phone speak. --- Anyway, If anyone is interested, we can share ideas and code. Here is my source of information from where I started: VW CAN-BUS: http://www.volkspage.net/technik/ssp/ssp/SSP_238.pdf Some CAN codes: https://docs.google.com/spreadsheets/d/1eirT8LbSRl4j06BpwgsiE4PM_2BGH9UStdWLXwKvHJw/edit#gid=0 Schematics and code: I havent had time to prepare them but soon they will be available See less See more Sort by Oldest first Oldest first Newest first Most reactions #2 · Oct 28, 2015 All I can say is: "That's Cool!" #3 · Oct 28, 2015 I'm interested but I'm not a code writer. I have the Microchip Canbus module, although I've found a Chinese multi channel usb scope more useful because it captures and has inbuilt interpreters for various bus standards. You can also 'replay' sequences. I guess at the moment you are on the OBD II port which collects and 'translates' bus signals from other controllers through the convenience module. The door and roof controllers use single wire Linbus V1.0. If you scope on those buses you will need a Linbus interpreter V1.0, yes V1.0 not later! The problem I have is identifying the packet ID's and what they are for, getting my head around the CRC and which bits are MSB and LSB! I've got vagcom/vcds but it is lacking for roof area diagnostics and external control at the pump and valves level. It appears to me the OBD II port is filtered and can be pretty dumb with limits on what you can control. I'd like to see some labels identifying packet ID's, have you got some info on those? You probably know already that the OBD port controls are what VW are obliged to release but there are a lot more packet IDs you will need to discover. If you have an EOS 2008 or older, you can read the ECU through the OBD II port and easily re-map.. Now I understanding how easily perps can steal your car by hacking into the OBD port to bypass/recode the immobilizer. I am going to rewire my OBD port non standard and make up a short male-female OBD pin translation cable. Regards - Vox #4 · Oct 28, 2015 (Edited) O.K the spreadsheet link is most helpful, but won't cover the EOS roof since it is for a Golf V - but it is more than I have seen and will help me interpret the CAN data I can capture. Do you know how the author might have identified the data and assigned labels? I think you can set your bus analyzer to capture, then go back and find the packet ID and data sequence. Where I get lost is I think the OBD port CAN lines are not the same as the CAN lines used outside the convenience module translator because you only see CAN data when there's an event like a switch press. Whereas if you are sitting across the other buses there is active data flow all the time. In fact when I was scoping my rear window controller module fault I could see the CRCs were bad, but correct after I replaced the faulty modules ($s!). The other problem I had was differentiating the transmitted data from received data and where it was coming from. All the OBD port told me via diagnostics was there was a serious module failure. I liked the Radio info because I have a clone radio that switches on via its Canbus but throws up diagnostics errors. I'm pretty sure that is because it has a simple CAN emulator and isn't looking like the genuine VW radio module. Now I can do some experiments and find out if I can get the radio operating when the ignition is switched off. Incidentally, on that spreadsheet link, click the top left icon and you can download as .ods or xls and import into Open Office. By the way, what you are doing on the OBD port is legitimate because you are using the interface and commands which VW have to provide for 3rd party applications to develop fault finding equipment. It is an EU requirement that manufacturers provide protocol information to allow their cars to be repaired and not necessarily by VW shops. Most of the 'convenience' customization settings are there for that reason to. Where it gets difficult is going beyond that. If VW had been more open with their 'secrets' the ECU bypass code might have been discovered by the flashing and tuning community sooner, saving them a lot of money and loss of reputation. #5 · Oct 29, 2015 I decided to build my own as VW uses pure CAN protocol on their convenience and infotainment buses, only the voltages are different that the normal CAN. So at the moment I removed the level translator and I am using it connected directly to the PIC. Im also using just 1 or the 2 CAN lines, but I will change that later. CAN still works if you send data only on one line. No, I am not on the ODB II port because I know this port connects to the CAN gateway and that ass can filter some messages. Im connected straight to the CAN BUS under the passenger seat, I have there connection to my (not working) bluetooth module. I havent managed to find the Linbus anywere, but I guess I will find it anyway, The protocol is not a probably, someone somewhere already wrote it probably. My python application can show a table of addresses and values in real time, it can also look for values that changed/increased/decreased on specific times, I can also take logs and then look for some message later. How do I identify the IDs? Using the excel table or simply changing parameters, pressing keys, etc... Its slow and a pain in the ass, i know... CRC, MSB/LSB are usually done in the PIC CAN interface, not by me. My car is a 2006 EOS, but i decided to skip ODB port and go straight to the hardcore bus sniffing/injection. The EOS roof is not on the table, I know, but I believe if I can sniff the CAN buses near the roof module, I would see the info from the buttons there for sure. On the CAN bus, not the one in the ODB port but the one with the colorful cables, you see messages all the time even with the key off. I dont remember the number per second but it was A LOT I just wonder what will be on the drivetrain CAN BUS, I know the speed is 1Mb and not 500Kb as in the other 2 buses. And yes i know its dangerous but I wonder if I can control the horn and for example the steering wheel motor... #15 · Oct 31, 2015 (Edited)

vascojdb said: No, I am not on the ODB II port because I know this port connects to the CAN gateway and that ass can filter some messages. Im connected straight to the CAN BUS under the passenger seat, Click to expand...

Where exactly under the passenger seat? Which wires/color for CAN high/low? What is the CAN speed setting to connect, 125kbs? Do you have any picture of that CAN bus connection? Isn't it risky/unsafe to connect to the CAN bus with your own hardware while driving? Show more replies 0 Reply #6 · Oct 29, 2015 (Edited) OK I understand. As I discovered, you have to be on the CANbus not on the OBD port CAN wires. That's why we have both seen lots of bus activity. VW use LIN protocol for the simpler control like doors & windows. It's slow speed single wire 12 volts like K-line. Messages from their LINbus linked modules get translated through to the OBD II, but as you say only what VW wants you to play with. However, there are now some ECU flash tools working through the newer vehicle OBD II. So there must be some access that others have discovered.

you see messages all the time even with the key off. Click to expand...

CAN should go to sleep after about 10 minutes. Some don't and cause battery drain problems. You could be playing with fire, especially steering and brake modules. ECU would also come high up the list. I'm doing some research into the roof control system at the moment to be able to get some manual control without the controller as a fault finding and testing aid. But be warned, if you command the roof pump to activate in the wrong sequence position, you might get expensive self inflicted damage, mitigated only by the built in hydraulic over pressure protection. It would be like opening the door of your washing machine part way through a cycle when it is full of water! #7 · Oct 30, 2015 I was not sitting in the car for longer than 10 minutes to see the BUS going to sleep. What I would do in the roof control, is just to sniff what the buttons near the handbrake send to the roof controller and mimic the same exact thing, I believe the buttons just send a message like 'PRESSED X'-'RELEASED X' or even 'PRESSING X'. Thats why when you release them, the operation stops. So technically you would need to send the 'PRESSED'/'PRESSING' message and stop if you would detect some error or when the task is done. I guess the control unit of the roof is the responsible for collecting data like the trunk cover sensor, the parking sensors, etc... This should be transparent for the buttons inside the car #8 · Oct 30, 2015 I'm a bit further ahead on the roof but not with CAN control and I don't think that will give me what I want. The roof operation switch as you say is just sending Up/Down to the roof controller. The problem with roof fault finding is to prove both the roof controller, any relevant inputs on CAN from other controllers (windows) and the pump. I now understand what's going on and to get total roof control you need to disconnect the roof controller completely and operate the pump and valves manually with their correct sequence settings. Of course that brings potential hazards to know what you are doing, because you have no sequence control from the roof controller or limit stops from sensors to move through the sequence. As I understand more I think it would not be hard for a good PIC programmer to replace the roof controller with a custom design. I am guessing that once a problem has been confirmed with the roof controller it is likely to be with wiring or failed output (mos?) drivers which should be easy to fix at micro board level. The pump can be broken down into the pump motor, 3 solenoid valves, over temperature thermistor and internal shuttle valves. Pump repair could be more difficult because of the way they build them, but there are some simple tests that can be done to prove most of these things. #9 · Oct 30, 2015 Ok, I now understand what you are doing. But are you doing this because your roof does not work? Or you actually want to dig in what is after the roof controller (between the controller and the sensors/actuators) rather than what is in the overall car BUS? I understand that you are accessing this date via ODB II right? #10 · Oct 30, 2015 I am digging whilst my roof is working. From some past issues I know just how hard it can be when a roof problem occurs. VCDS via OBD II is very limited to telling you the sensor positions and putting out 'module fault-replace', but goes no deeper. Either it is limited to what comes out of OBD II or I suspect that Ross-Tech mindset was for non-cab cars. There is an opportunity there for somebody to develop a bespoke software fault finding and analysis tool for the EOS roof system! Dealers don't seem to have an easy time at your expense either. There are roof faults that can lock you out of the trunk space, and a rear window fault which forces you to smash the window glasses, because the roof controller will not let you raise the roof to remove them! There is a good reason because the side flaps have to come out, but you can disconnect those, allowing the roof to be opened partially using manual control. Then there are those 'My roof is stuck halfway' problems that most would need the tow car for. But now I understand how the hydraulic locking is done! I hate to see messages on the MFD like 'Take car to garage'! I am taking a simple 2 step approach which requires no CAN interface, assumes the roof controller is dead or faulty and inhibits normal roof operation via the roof switch. First is to build a small read only box I can leave connected inside the car accessible from the ski panel that tells me what the pump and valves are doing and their status at the fault point. CAN might be able to do that, but a few leds and some multi-core is a lot simpler, telling the truth without time delay. The second step I won't be posting details for is write level direct manual control of the pump and valves for each stage in the sequence, which carries a big risk. #11 · Oct 30, 2015 I guess I'm curious as you, but if the roof module stops working, isn't it easier to replace with a new/used one? I guess its quite useful to have the sequence of sensors/actuators while the roof is working. I believe there is some PDF from VW with the whole operation of the roof step-by-step, but I don't know their level of abstraction. In this way, if something breaks u can easily tell if some sensor is not working or some actuator is being powered but nothing happens. #12 · Oct 30, 2015 (Edited) How would you tell if it is the roof controller, the pump and its solenoid valves or both? If both you could be paying out £3K to 4K. A pump exchange is some days off the road and still a lot of money. If you have deep pockets though, you just take your EOS to the dealer and let them replace what they think and tell you is wrong. VCDS only gives you the sensor sequence, it doesn't tell you if the pump is running, which direction the pump is running or the status of valves whether open or closed. If a pump solenoid valve is faulty the roof sensors only tell you where it stopped or didn't get to before sequence time out. Not whether the roof controller outputted the correct valve commands but one failed to operate. However, I'm not 100% sure about that because the roof motor solenoids have some resistance in their grounds and that usually means their current is being monitored to indicate when they are active. There may be a lot more information on the roof controller bus than what is accessible through OBD II. #13 · Oct 30, 2015 (Edited) I would advise you to use some micro controller as a kind of a logic analyser with as many inputs as the number of sensors/actuators, and I would store a snapshot of a working unit. For that you would have to sniff the data beween the roof controller and the actual sensors/actuators/pumps/solenoids. In this way you have time, voltage, phase, direction of motors, etc. Something like: http://www.sunrom.com/media/images/3770/3770a.jpg Later with the help on the roof PDF from VW you could reach the final pattern to work with the roof. Having this you could easily troubleshoot when the module would stop working. Obviously the easiest thing would be do to it via ODB II, if that does not work you can try the CAN bus, but to get to the exact source of the thing, you need to suck the pattern from the very ending #14 · Oct 30, 2015 Thanks - I'm already working with the VW Pdf. Once I get the key connections out on a multi core I can put all the trim back and play with my multi channel USB scope as you suggest. I think that is how the author derived the Golf V table. Without a PIC or CAN sniff I can already wire up a 4 wafer rotary switch to set the pump and valve parameters for each of 6 stages, low tech but simple! There are some things to watch out for. I've discovered the sunroof extends back on the sunroof switch, but goes back and lifts off the roof seal when the roof operates. I need to get that extended sunroof control. I see there's one wire leaving the roof controller so I'm hoping that is just a 1 or 0 to extend the sunroof back. #16 · Oct 31, 2015 (Edited) It's risky if you don't know what you are doing. Reading CAN communication and identifying chat to modules and what it does should be safe if all you want to do is enhanced fault diagnostics when not driving. But something worries me about newer cars after about 2012. Their Bosch ECU's are 'protected' to the extent that if you happened to send a wrong code which gets picked up by the ECU you could find it bricked. Our friend experimenting with his EOS may be lucky and has avoided that so far. But you have to admire somebody who is prepared to 'discover' and share. Just don't try anything on your car without a full understanding of the outcomes and potential risks involved. I don't mind experimenting and learning the EOS roof system, because one day I might need the outcomes of my work, but then I'm not permanently installing something and driving with it. Now I know some more I could easily make my own version of the SmartTop. It wouldn't use the VW key fob, but a cheap $8 Fleabay wireless garage door remote. Insert Quotes Post Reply

1. ?
2. ?
3. ?
4. ?
5. ?
6. ?
7. ?
8. ?
9. ?
10. ?
11. ?
12. ?
13. ?
14. ?
15. ?
16. ?
17. ?
18. ?
19. ?
20. ?

posts 98K members 29K Since 2006 A forum community dedicated to Volkswagen Eos owners and enthusiasts. Come join the discussion about performance, classifieds, modifications, troubleshooting, maintenance, and more! Show Less Full Forum Listing Explore Our Forums VW Eos Q&A VW Eos Tech Q&A New Member Introductions Engine & Drivetrain D.I.Y. (Do It Yourself)

Our Vendors

View All

• C CARiD Forum

Top Contributors this Month

View All V voxmagna 60 Replies 2phast 8 Replies F Fourbears 8 Replies

Recommended Communities

VWVortex Volkswagen Forum 1.6M members Mercedes-Benz Forum 795K members Can-Am electric vehicles 40 members

• Home
• Forums
• Volkswagen Eos Forum
• D.I.Y. (Do It Yourself)