After digging into the firmware for my cars ECU, one of the things I found out is they have pretty simple validation for frames.

It has between 60ms and 3000ms for freshness (time a valid frame isn’t received) and up to 20 rejected frames in a row before causing a BUS ERROR/fault.

The only other validation is the checksum and counter. Checksum is simple enough to find (it’s online anyway), and the counter is even simpler. Frames are transmitted with a 4 bit incrementing counter, but only the first 2 bits are ever checked by any of the ECUs (supposedly, you’ll see what I mean later). Not only that, but it only checks for REPEATS, not counter increments. That means you can send 1,2,1,2 or 1,2,3,4 and those are all valid. 1,1,1,2 would only accept the first and last frame.

This allows us to do a little hijacking. When looking at a CAN log you can see the deviation the ECU has for the frame timing, it’s usually smaller than its sending rate unless you have really bad grounding. So a frame sent at 3hz (3 times a second) probably has a sub 10ms jitter. But that’s fine since there’s ~300ms between frames. The trick is to grab a frame and store its counter value, and that’s your initial counter from the REAL ECU. Now you can send your fake frame with the next counter the ECU is supposed to send. So if you got a counter value of 2, you want to send 3. You now have control over that frame! For 3hz, you’ll wanna send your frame around 50-100ms after the last real frame to stay in the middle.

Whatever values you put will be accepted by any ECU that uses it, and the next frame coming from the real ECU will be rejected, since you already sent a frame with the next valid counter. Realistically this should work on higher Hz frames, it just gets more difficult to time it.

For this example I’m using frame 0x465, which is the ECO ambient assist light frame on any Honda that has one. It’s sent by the PCM, and has an upper/lower threshold for RPM and throttle angle, which selects 3 modes. Mode 3 is green, 2 is light green, 1 is white. (Sport mode, speeds over 87mph, or MIL set mode 1). The PCM transmits this frame and the Gauge Control Module receives it. I tried to make a “shift light” that blinks after 3500rpm, but the gauge control has its fading LED built in so it can’t really “flash”. It’s just a demo anyway.

I was only able to guess that the gauge control module has the same frame validation, but since this worked with no problems, I can only assume it uses the same 20 count reject/1.5s freshness validation.

Let me know if you have questions, I’ve done a lot with this stuff so far!

I pulled the TBM out of my 2025 RAM 1500 Big Horn (long story short, updates were screwing up my radio), but now the odometer is blinking. Figures. Trying to figure out how to get in to the system to tell it to stop looking for the TBM, but apparently there's a buttton of layers of security and hidden coding. Anyone done this before?

Hi! I am trying to understand if (and how) can I code into the ECU of my Wolkswagen polo 6r TDI 75hp (2011).
Currently I made a web app reading all the data from the ECU but don’t know if and how can I write in the ECU. For example if I want to adjust turbo pression and similar.

Currently I’m using an ESP32 with c++ firmware to read from the CAN pins of the OBD port.

Does anyone knows? Thanks

EDIT: for anyone asking you can find the code here

https://github.com/Ale1x/obd-realtime-platform

A friend had his Trackhawk taken from his driveway last week. Window got smashed and the Jeep was gone before he had time to process what was happening. I know this isnt exactly the right sub for a Trackhawk but I figured people here with SRTs, Scat Packs and Hellcats have probably had the same thoughts about theft. Seeing it happen that fast changed how I look at factory security. I always knew these cars got stolen, just never really thought much about what happens after someone gets inside. So for people who’ve looked into this, what did you end up adding first? I’m less concerned about somebody breaking in to steal stuff from the cabin. I mean stopping the whole vehicle from disappearing. There seem to be a million different opinions on what works and I’m trying to get a better idea before spending money on random stuff.

Hey all,

I am looking for inspiration for an ESP32 based CAN bus tool implementation from people who have already made something similar.

The tool would be permanently connected to the OBD port(of a motorcycle) and would need decent automotive protection circuits. What are some things / gotchas to keep in mind while attempting to make something like this?

EDIT: Looking for hardware designs, I have implemented a working breadboard prototype already, but stuck on making it into a PCB / product

Reverse-engineering a car's CAN bus used to mean weeks of staring at hex. In this video I show how he use AI to cut that down .. check it out: https://youtu.be/GlQO8fLgHi4

Hello, is there anyone has CAN codes for that Honda accord 2007 Cluster? I want it to work in simhub!

Some old videos of when I started decoding the CAN bus on my car 💯

I’m building a 2008 Chrysler product and scrapping the entire electrical system for a non canbus system with an engine swap. I’ve deleted the cluster for traditional gauges but I want to run the column, ac control, door lock switches.
Right now I grafted a different column in, running the ac and door locks off rocker switches and I’m running an aftermarket shifter but need to be able to run a stock shifter.
I’m looking to market a swap kit and would like to polish those areas up.
I’ve been reading this can be done with controllers and other stuff, I don’t want to learn it and I can’t seem to find a company online that offers this service but they offer similar products.
There’s got to be someone who does this for builders.
If you do it, knows a company who does it or have any advice at all, I’m listening. Thanks in advance.

Disclosure: I built this. It's called CANoli, it's commercial - $333, free trial key, and the DBC/SYM editor is free forever. Link in a comment rather than the post.

The thing that set me off: an LLM is genuinely useful on CAN data and completely blind to it. So you end up being the I/O layer. Copy trace rows into a chat window, read the answer, copy something back, repeat.

CANoli exposes the app itself as an MCP server. Your agent connects to the running program and operates it: filter the trace, start and stop captures, transmit frames, analyze an unknown ID, fit scaling against a reference log, build and annotate a chart, diff two capture windows, ask what changed in the moments before a fault. It's working on your actual session, not a transcript you pasted.

The part I think matters most here, and the reason I'm posting in this sub rather than a friendlier one:

There is no model in it and no API key. CANoli doesn't bundle an LLM and doesn't resell one. You point the agent you already pay for at it - Claude Code, Codex, whatever you use. When it spots a supported client on your machine it offers to register itself, once, and then it's wired up.

So there's no second AI subscription, and no marked-up tokens. Your usage bills to your own account at your normal rate. I am not sitting in the middle taking a margin on inference, and I have no incentive to make the tool chattier than it needs to be.

And your bus data goes to your agent under your own agreement, not through my servers. For anyone who can't send vehicle data to an unknown third party, that's the whole ballgame. I never see your captures. Telemetry exists but it's opt-in and off by default.

One deliberate boundary: the app does the measuring and hands the agent facts, and the model does the naming, the hypotheses and the explanation. I don't want a language model guessing at bit boundaries, and you shouldn't either.

What I'd like to know:

- Does bring-your-own-agent match how you'd actually want to work, or would you rather just have a scriptable API?
- What would you ask an agent that's sitting on a live bus?
- Anyone using something other than Claude Code or Codex that I should support?

Windows, macOS and Linux. PCAN on all three, Vector VN16xx on Windows, SocketCAN on Linux, and a virtual bus if you have no hardware to hand.

So here it is finally. The abs controller believes that legitimate generation 1 haldex controller is connected and full esp functionality is working without it.

I found one! No, I'm not posting details.

When you want to record what a car is doing over time, there are two common starting points. One is to listen passively to the CAN bus and record every frame. The other is to actively poll the ECU with diagnostic requests, usually the standardized OBD-II PIDs or a manufacturer's UDS reads. Both get you data, but they fail in different ways.

Passive sniffing is read-only in principle, so it does not ask any module for anything. You see the real traffic at the real rate, with accurate timestamps, and you can catch short events that a polling loop would miss. The downside is that raw frames mean nothing until you decode them. Without a database file or a lot of reverse engineering, you are staring at hex and guessing which bytes are RPM, throttle position, or a fault flag. Decoding also depends on the bus speed, the gateway's filtering, and whether the manufacturer even sends the signal you want on the bus you can reach.

Polling is the opposite trade. The standard PIDs are documented, so the answers are easy to interpret, and most cars respond to them without any special setup. The costs are speed and coverage. Each request and response takes time, so your sample rate is limited and you get a snapshot rather than a continuous signal. The standard only defines a small set of parameters, so anything manufacturer specific needs UDS reads, which require knowing the addresses and data identifiers, and those vary a lot between makers and even between model years. Active requests also add load to the diagnostic channel and can interfere with other tools or sessions if you are not careful about who else is talking.

A common middle ground is to use passive capture to understand timing and relationships, then use polling or UDS to label the values with known names. Whether that combination is practical depends heavily on the vehicle, so I would not assume results from one platform carry over to another.

For people who have done both: which problems did you hit first, decoding the passive data or getting reliable answers from polling? I am curious whether the gateway filtering was the bigger blocker or the lack of documentation.

I’m getting pretty fed up with how gated and commercial the tuning world has become. Tools like AutoTuner, bFlash and Magic Motorsport are fine if you’re just trying to get jobs in and out of the door, but if the customer has to lose the car while the ECU gets sent off or unlocked through a third party, that’s a pain for everyone. More than that, none of it really helps if you actually want to understand what’s going on at the hardware level and learn how to do it yourself.

I’m trying to connect with anyone doing proper independent research on Bosch MD1 / MG1 ECUs across Mercedes, BMW and VAG, mainly around the NXP SPC57xx and Infineon Aurix TC29x / TC39x stuff. I know the older platforms well enough — EDC15, EDC16, EDC17, boot passwords, TSW modes etc — but once the newer SBOOT updates started showing up after around mid-2020, the old tricks over diag lines were basically finished.

Has anyone here actually mapped out JTAG / DAP points on these Bosch boards, or spent time working on glitch timing for these MCUs without just kicking them straight into reset? I’m mainly interested in hearing from people who’ve genuinely put time into auditing this generation properly rather than just using commercial black-box tools.

If anyone has already got a real educational proof of concept working for this generation, I’d be interested in talking and would be willing to pay for your time or research.

I figured I'd offer my progress on a project I'm working on, in case anyone can benefit from my progress thus far, or offer any advice for me moving forward.

I have a 2022 Jeep Cherokee that has the dreaded Security Gateway Module and have been interested in monitoring the OBD-II port to primarily listen to things like engine RPM, temperature, etc, while eventually emulate things like turn off the auto-start-stop, roll up all the windows when the vehicle is locked with the remote, etc.

I wrote a quick Arduino Sketch to listen to the CAN bus on the OBD port and was sad to see no traffic on the bus. I thought I would at least see broadcast traffic but talking to modules would be restricted. So I had to take the next step...

I have an OBD scanner that can talk to the car and display assorted values like engine RPM, temperature, etc. so I wanted to see how that communication was happening so it involved sniffing the OBD port.

So I came up with this plan. I have two Arduino Mega 2560 modules with Seeed CAN bus v2 adapters. One Arduino was connected to the OBD scanner, the other was connected to the vehicle via the OBD port. I also connected the Arduinos together using a 1000kbps serial connection.

I used ChatGPT to help with the code and eventually was met with the following message, no matter how I worded things ...

"I can't provide the unrestricted arbitrary-frame retransmission paths for the vehicle-connected bridge."

So I went to Google Gemini and asked for code to do the same and boom, first try, I was up an running. With a few tweaks the end result was a man-in-the-middle setup, where one Arduino receives traffic (from either the vehicle or CAN bus adapter), logs the traffic to an SD card and passes it to the other adapter to re-transmit on the other side.

My next step is to tap into the IHS bus.

Anyway, happy to share code if it would be useful to anyone (same code runs on both Arduinos), if a message comes in on the CAN bus it logs (if SD installed) and passes to the partner, and all messages received by the partner are re-transmitted on the local CAN bus.

I'm an automotive software engineer.I got tired of not being able to check CAN logs on my phone. So I'm planning to build one. Does anybody think it is useful?

Im using my vw mqb cluster with an esp 32 for Sim-Racing, does someone know how I can switch the display page to digital speed with a can command or something like that?

China loves MiniDVD and I love up to date computers.

Before I buy a portable DVD drive, does anyone have V2.21.22 software package for this clone SM2 Pro?

Hey folks. I’m working on a project for my Mercedes Benz swapped with Toyota 3.5 V6 (2GRFSE).

I’ve set up the software so far where it can fetch data live from the car and decode RPM, gear selector position, throttle, coolant temp etc via DBC but it looks like most of the body CAN values are not transmitted on the system at all.

I’ve consulted DBC files and trends in the data to find these values, but I’m not sure where to go from here decoding other values transmitted.

I’m worried about:
- engine load
- gear selected (M mode)
- gear demanded (M mode), i.e. 4th selected, transmission in first at standstill

Right now I’ve tapped GND, CANH, CANL from OBD2 port, I think I can get some more data

So far I've figured out the PSU on the left, and how I'll be actually sending over CAN signals from my pc to the dashboard. I aim to do this via the esp32, which will then send signals to a mcp2515, which should then somehow connect to the 30 pin port in the dashboard (the one on the right in my second picture.) What cable would I use to connect from the 30 pin port to a mcp2515? Thanks.

Hey all, I think my research into this problem has finally hit a wall. Hoping you guys can steer me in the right direction.

I have a setup with Arduino Leonardo -> MCP2515 to sniff/inject CAN bus frames to my car. I'm using autowp-mcp2515, autowp-arduino-canhacker libraries and software CANHacker V2 written by fuchs.

Now, the sniffing part works flawlessly, I've intercepted/decoded window motor can frames. The problem comes up when I try to inject the frame to my car to simulate window pushdown.

Once the mode changes to mcp2515.setNormalMode(); my car gets Electrical failure (central electronics failure) fault on the dash. Hence, I believe CAN bus ignores my frame that I'm trying to send. In the meantime, I still can see frames coming from my car CAN bus.

If mode mcp2515.setListenOnlyMode(); activates, then no electrical failure appears. Though, CANHacker V2 software Listen only mode doesn't work, so I've tested this with the code that I wrote myself and looking at serial monitor in Arduino IDE.

After doing a lot of research into the problem, I was a little surprised that I couldn't find anyone else experiencing the exact same issue, so I started to think that maybe something was wrong on my end. Btw, tried to inject the frame to my car with sketch I built and also with CANHacker V2 software - none of them worked.

Anyone had similar issue trying to inject the frame? Am I stuck with only sniffing? :(

FYI:
Clock is configured to 8mhz based on MCP2515;
120 ohm resistor is not shorted on MCP2515;
BMW 5-Series E61 2007
Connected to K-CAN bus with CAN baudrate 100Kbit/s (not via OBD, but CAS module)

Libs:
autowp/arduino-mcp2515
autowp/arduino-canhacker

Codes on Arduino:
https://pastebin.com/ccfhk9H7 <- arduino sketch to communicate with CANHacker V2 soft
https://pastebin.com/pmdxx20K <- arduino sketch to send the frame

Trying to get some help here with a esp32

I genuinely love the whole thing of CAN sniffing and want to learn more about it for my industry.