Anyone With CAN Bus Sniffing Experience? - Pontiac Solstice Forum
 8Likes
Reply
 
LinkBack Thread Tools Display Modes
post #1 of 27 (permalink) Old 02-24-2019, 11:46 AM Thread Starter
Member
 
Join Date: Sep 2006
Location: Lexington, KY
Posts: 5,108
Anyone With CAN Bus Sniffing Experience?

I am working on a project that needs information from the low-speed data bus and it will simplify things considerably if someone has experience sniffing it and has isolated some of the signals.

Anyone?

John
Lexington, KY
Sky NA 2007 Midnight Blue
Sky RL 2008 Carbon Flash - Naked
JohnWR is online now  
Sponsored Links
Advertisement
 
post #2 of 27 (permalink) Old 02-24-2019, 07:22 PM
Member
 
raygun's Avatar
 
Join Date: Nov 2014
Location: Dallas, TX
Posts: 1,400
Garage
Send a message via Skype™ to raygun
There's quite a bit of info out there already.

I found this one helpful (though incomplete):

https://docs.google.com/spreadsheets...kn0/edit#gid=1

... but you need to know a bit about the protocol first. What interface are you using? What exactly are you trying to build?

I'm using one of these for track days:

https://www.autosportlabs.com/produc...turetrack-mk2/

which supports Lua scripting - it can do things like, say, randomly change your radio volume on a set interval, or clear DTCs every 10 seconds, or maybe even something that's actually useful - that will let you write to the bus if you need to poke things. Also happily does CAN logging. You can get something cheaper, like:

https://www.8devices.com/products/usb2can

which might be a little more reasonable for a side project, but you'd have to make a cable to connect it to the OBD port, or to splice it into the harness. (Or this cable might work.)

Blue-ish 2006 2.4, Werks stage 1 turbo, Borla cat-back, DDM braces, Spec aluminum flywheel, Spec stage 2 clutch, Werks aluminum radiator, some gauges, RKSport hood, Morimoto FX-Rs, GReddy Profec, Norm's fenders

'07 GXP, RPM Stage 2, Solocatless downpipe, TCE Wilwood 6 piston front brakes, 4-piston rears , Stainless brake lines, slotted/drilled rotors, BC Racing BR coilovers, Performance Autowerks intercooler, DDMWorks CAI, charge pipes and braces

Last edited by raygun; 02-24-2019 at 07:29 PM.
raygun is online now  
post #3 of 27 (permalink) Old 02-24-2019, 09:03 PM Thread Starter
Member
 
Join Date: Sep 2006
Location: Lexington, KY
Posts: 5,108
Yes, there is a lot of information out there, and there are a number of interfaces available.

How to do it isn't the problem, decoding the messages is the challenge.

I am replacing the radio and need the messages for various warning sounds, power on/off, and instrument light dimming.

John
Lexington, KY
Sky NA 2007 Midnight Blue
Sky RL 2008 Carbon Flash - Naked
JohnWR is online now  
post #4 of 27 (permalink) Old 02-24-2019, 09:49 PM
Member
 
raygun's Avatar
 
Join Date: Nov 2014
Location: Dallas, TX
Posts: 1,400
Garage
Send a message via Skype™ to raygun
Anyone With CAN Bus Sniffing Experience?

The spreadsheet I referenced has message ids, etc. for most of the audio functions. The rest is protocol.


The other way to do it is hook up a sniffer and start triggering the behavior that youíre trying to replicate. CAN isnít very complex.

Sent from my iPhone using Tapatalk

Blue-ish 2006 2.4, Werks stage 1 turbo, Borla cat-back, DDM braces, Spec aluminum flywheel, Spec stage 2 clutch, Werks aluminum radiator, some gauges, RKSport hood, Morimoto FX-Rs, GReddy Profec, Norm's fenders

'07 GXP, RPM Stage 2, Solocatless downpipe, TCE Wilwood 6 piston front brakes, 4-piston rears , Stainless brake lines, slotted/drilled rotors, BC Racing BR coilovers, Performance Autowerks intercooler, DDMWorks CAI, charge pipes and braces
raygun is online now  
post #5 of 27 (permalink) Old 02-25-2019, 06:25 AM Thread Starter
Member
 
Join Date: Sep 2006
Location: Lexington, KY
Posts: 5,108
The spreadsheet doesn't seem to do anything, and the links I tried couldn't access anything. I'll try it again from a different computer.

Yes, I understand how to do it, but it takes time I don't rally have right now. I was hoping that someone already had, so I wouldn't have to.

John
Lexington, KY
Sky NA 2007 Midnight Blue
Sky RL 2008 Carbon Flash - Naked
JohnWR is online now  
post #6 of 27 (permalink) Old 02-25-2019, 06:59 AM
Member
 
Sly Bob's Avatar
 
Join Date: Aug 2006
Location: Welland, ON, Canada
Posts: 3,175
Okay, time for a really stupid question...
John, if you are just replacing the radio why not use one of the radio interfaces Crutchfield and others sell for that purpose?

WooHoo!!! Ordered a loaded Deep GXP on March 19th, 2008. Order number 0814D93708
Event code 3400 on April 12, 2008
Born April 30, 2008
Delivered to dealer May 23th, 2008
Delivered on May 27, 2008

Mods: lose the chicklets, VentureShield, Dual horns, AfterShock spoiler, Weathershield cover, Lil Chromies, Red calipers with black Solstice stickers, Opel GT antenna and
Solo GXP-RCD exhaust with Solo hi-flow cat!
Sly Bob is offline  
post #7 of 27 (permalink) Old 02-25-2019, 07:23 AM
Member
 
raygun's Avatar
 
Join Date: Nov 2014
Location: Dallas, TX
Posts: 1,400
Garage
Send a message via Skype™ to raygun
Quote:
Originally Posted by JohnWR View Post
The spreadsheet doesn't seem to do anything, and the links I tried couldn't access anything. I'll try it again from a different computer.

Yes, I understand how to do it, but it takes time I don't rally have right now. I was hoping that someone already had, so I wouldn't have to.
There are different pages (tabs) in the spreadsheet, breaking down messages by category.

For audio, for instance, for the steering wheel controls: (Direct link to tab)



The steering wheel controls (these are from an '08 G8, but should be the same as our cars) have a header of 0x100D0060, followed by our bytes indicating function (which button was pressed) and a count. To increase the volume, you'd send

0x10 0D 00 60 00 00 00 xx

where 'xx' is the number of "volume up" presses that you want to send.

Forgive me if I'm telling you things you already know. The spreadsheet also contains some sniffing logs. In the linked-to tab, the C through P columns contain such a log. Many of the tabs for the various CAN functions have these logs.

I saw another collection of
Attached Thumbnails
Click image for larger version

Name:	gmlanbible_steeringwheelcontrols.PNG
Views:	158
Size:	113.0 KB
ID:	93891  

Blue-ish 2006 2.4, Werks stage 1 turbo, Borla cat-back, DDM braces, Spec aluminum flywheel, Spec stage 2 clutch, Werks aluminum radiator, some gauges, RKSport hood, Morimoto FX-Rs, GReddy Profec, Norm's fenders

'07 GXP, RPM Stage 2, Solocatless downpipe, TCE Wilwood 6 piston front brakes, 4-piston rears , Stainless brake lines, slotted/drilled rotors, BC Racing BR coilovers, Performance Autowerks intercooler, DDMWorks CAI, charge pipes and braces

Last edited by raygun; 02-25-2019 at 07:35 AM.
raygun is online now  
post #8 of 27 (permalink) Old 02-25-2019, 08:03 AM Thread Starter
Member
 
Join Date: Sep 2006
Location: Lexington, KY
Posts: 5,108
While I cannot say that I have done an exhaustive search I have looked at a lot of different adapters, and have read all of the radio replacement threads that I could find here. So far all of the adapters that I have looked at either leave out some function, use an internal speaker (instead of the radio speaker) to reproduce the chimes, or have had problems with installation or operation. For some the descriptions are too vague for me to understand exactly what they do and how, and I don't want to buy one and be disappointed.

Connecting to the bus isn't difficult, and neither is converting the CAN messages to the outputs that the radio needs, so I decided it would ultimately be more satisfying to simply assemble and program my own interface, especially since that would also give me the option to do some customizing of the sounds and functions. If Raygun's spreadsheet can lead me to the proper messages that option gets a lot less time consuming.

I have sent emails to some of the interface manufacturers asking for some additional detail, but haven't gotten any responses yet. Depending on what I get back from them, or anyone here for that matter, I may still go the conventional route.

John
Lexington, KY
Sky NA 2007 Midnight Blue
Sky RL 2008 Carbon Flash - Naked
JohnWR is online now  
post #9 of 27 (permalink) Old 02-25-2019, 08:08 AM Thread Starter
Member
 
Join Date: Sep 2006
Location: Lexington, KY
Posts: 5,108
Quote:
Originally Posted by raygun View Post
There are different pages (tabs) in the spreadsheet, breaking down messages by category........
Thanks.

I'll do some more looking through your information now that I have a working computer again.

One concern is that the messages are sometimes not standard, even when you think they would be. I'll give the listed ones a try to see if they are actually the same.

I do know that our steering wheel controls are analog and not digital, so that is an obvious difference.

John
Lexington, KY
Sky NA 2007 Midnight Blue
Sky RL 2008 Carbon Flash - Naked
JohnWR is online now  
post #10 of 27 (permalink) Old 02-25-2019, 09:14 AM Thread Starter
Member
 
Join Date: Sep 2006
Location: Lexington, KY
Posts: 5,108
@raygun: Thank you again for the data. Now that I can actually open the spreadsheet it does appear to have exactly what i was looking for. Testing should be pretty easy and, assuming that GM actually stayed consistent with themselves, you have saved me a lot of time.
raygun likes this.

John
Lexington, KY
Sky NA 2007 Midnight Blue
Sky RL 2008 Carbon Flash - Naked
JohnWR is online now  
post #11 of 27 (permalink) Old 02-25-2019, 09:29 AM
Member
 
raygun's Avatar
 
Join Date: Nov 2014
Location: Dallas, TX
Posts: 1,400
Garage
Send a message via Skype™ to raygun
@JohnWR

This might make things a little more economical:

Arduino CAN-BUS Shield

If you have an Arduino lying around, this should make things a little easier. There's also decent support / forum activity for Arduino + CAN out there. You'd still need to buy or build a D-SUB to OBD-2 cable. The one on Amazon I linked to earlier *should* work.

Blue-ish 2006 2.4, Werks stage 1 turbo, Borla cat-back, DDM braces, Spec aluminum flywheel, Spec stage 2 clutch, Werks aluminum radiator, some gauges, RKSport hood, Morimoto FX-Rs, GReddy Profec, Norm's fenders

'07 GXP, RPM Stage 2, Solocatless downpipe, TCE Wilwood 6 piston front brakes, 4-piston rears , Stainless brake lines, slotted/drilled rotors, BC Racing BR coilovers, Performance Autowerks intercooler, DDMWorks CAI, charge pipes and braces
raygun is online now  
post #12 of 27 (permalink) Old 02-25-2019, 09:33 AM
Member
 
TomatoSoup's Avatar
 
Join Date: Aug 2009
Location: Gaithersburg, MD
Posts: 6,447
Quote:
Originally Posted by JohnWR View Post
I do know that our steering wheel controls are analog and not digital
No, they are digital. You press a button using your digit == Digital!


raygun likes this.

Owner of "Campbelle", a Brazen 2008 GXP ... with mods piling up...
TomatoSoup is offline  
post #13 of 27 (permalink) Old 02-25-2019, 11:50 AM Thread Starter
Member
 
Join Date: Sep 2006
Location: Lexington, KY
Posts: 5,108
Quote:
Originally Posted by TomatoSoup View Post
No, they are digital. You press a button using your digit == Digital!


That is just ... just .... bad. Funny, though.

Quote:
Originally Posted by raygun View Post
@JohnWR

This might make things a little more economical:

Arduino CAN-BUS Shield

If you have an Arduino lying around, this should make things a little easier. There's also decent support / forum activity for Arduino + CAN out there. You'd still need to buy or build a D-SUB to OBD-2 cable. The one on Amazon I linked to earlier *should* work.
I have been looking at two options, although neither has some of the functionality of that one. One is really low cost, the other is a bit more expensive, but more convenient.

https://www.amazon.com/XCSOURCE-Rece...WV1F3A4JVVSS5M
https://www.sparkfun.com/products/14483

In either case, I will have the low-speed LAN wire (and ground) at the radio connector for a direct connection. For testing I will just rig a connection from the DLC.

John
Lexington, KY
Sky NA 2007 Midnight Blue
Sky RL 2008 Carbon Flash - Naked
JohnWR is online now  
post #14 of 27 (permalink) Old 02-25-2019, 12:11 PM
Member
 
raygun's Avatar
 
Join Date: Nov 2014
Location: Dallas, TX
Posts: 1,400
Garage
Send a message via Skype™ to raygun
@JohnWR Well, for those prices, why not?

My soldering skills aren't as great as they used to be, so if I can find something that snaps together, I'll tend towards paying the extra $30 or whatever.

For my data acquisition widget, I'm considering splicing into the CAN hi/lo wires behind the OBD port - though it'd have to be turned off for any diagnostic tool to connect - or just wiring it up as another node on the network, which is a tiny bit more effort. I haven't looked at the physical bus layout so I'm not sure exactly how that works.

This was helpful:

https://www.instructables.com/id/How...Using-CAN-Bus/

Does anyone know where the terminator is on the car?

Blue-ish 2006 2.4, Werks stage 1 turbo, Borla cat-back, DDM braces, Spec aluminum flywheel, Spec stage 2 clutch, Werks aluminum radiator, some gauges, RKSport hood, Morimoto FX-Rs, GReddy Profec, Norm's fenders

'07 GXP, RPM Stage 2, Solocatless downpipe, TCE Wilwood 6 piston front brakes, 4-piston rears , Stainless brake lines, slotted/drilled rotors, BC Racing BR coilovers, Performance Autowerks intercooler, DDMWorks CAI, charge pipes and braces

Last edited by raygun; 02-25-2019 at 12:19 PM.
raygun is online now  
post #15 of 27 (permalink) Old 02-25-2019, 12:43 PM Thread Starter
Member
 
Join Date: Sep 2006
Location: Lexington, KY
Posts: 5,108
There are other components that I will be soldering, so a couple more connections are no thing.

I believe that the terminators are in the ECM and BCM, but will check the manual tonight to confirm or correct, unless someone beats me to it.

There is also a pretty good network diagram in the manual. I will post it tonight also, unless ......

John
Lexington, KY
Sky NA 2007 Midnight Blue
Sky RL 2008 Carbon Flash - Naked

Last edited by JohnWR; 02-25-2019 at 12:47 PM.
JohnWR is online now  
Sponsored Links
Advertisement
 
Reply

Quick Reply
Message:
Options

Register Now



In order to be able to post messages on the Pontiac Solstice Forum forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.

User Name:
Password
Please enter a password for your user account. Note that passwords are case-sensitive.

Password:


Confirm Password:
Email Address
Please enter a valid email address for yourself.

Email Address:
OR

Log-in










Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page
Display Modes
Linear Mode Linear Mode



Similar Threads
Thread Thread Starter Forum Replies Last Post
OBD-II / GMLAN traffic sniffing? (Diagnosing startup issues) raygun Mods - Engine 2.4 l Ecotec 5 06-18-2015 02:57 PM
A special day, in a short bus way. Xanath General Off Topic 5 08-01-2006 06:20 AM
GM LAN Bus (Radio Wiring Harness) tatooedsn Mods - Audio & Etc. 9 06-11-2006 08:57 PM
OBD II CAN bus recommendation JimmyMood General Tech, Platform Common Issues & Solutions 7 05-28-2006 08:33 PM

Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

 
For the best viewing experience please update your browser to Google Chrome