Looking for some help/info on CAN sniffing/hacking

[AB4S]

Anyone on here good with canbus?

I want to learn how more things work within the airbag ECU, i.e send a can message to the ECU to see what fault codes are present?

I'm a complete newbie when it comes to this but so far i've managed to find the CAN ID of an ECU and also the message it sends when the diagnostics machine requests to read information/read dtc and erase dtc.

If anyone has done something like this with success, please get in touch, i can re-pay the favour with airbag ECU help and files :)

[slick_dick]

Good topic this bro

my understanding of sniffing is just that, see what data packets are being sent between modules and what passwords seed keys etc can be detected.
With this info you could reverse engineer an ecu and talk to its binary and have all necessary data to read the ecu alone on bench.

So maybe you would really need a car a new one at that too, hold car for a little while to sniff data between modules?

If i remember right "repairmymodule" might be able to point you in the right direction. check out skype group for his comments on this subject you might be pleasantly surprised

good luck boss!

br

slick

[AB4S]

Update:

Managed to get some more understanding on how this works.

So basically you just have to write a simple script on what the ECU responds too within the CAN ID.

Example commands are read DTC information (03 19), read vin number (F1 90) and (F1 87) get part number. List of commands (identifiers) can be found here https://www.csselectronics.com/pages/uds-protocol-tutorial-unified-diagnostic-services. Many more to go through like get serial number etc...

Pictures below on some script and the program in action :)

link to the software if anyone is interested - https://cantracer.ru/en/

100092010009201000921

[fuzz1]

Hi
What is the advantage of this tool as is as compared to others?

Has anyone used it?

[AB4S]

Hi
What is the advantage of this tool as is as compared to others?

Has anyone used it?

Hi

Software is basically a CAN sniffer, which can be used with J2534 interface. However inside software has "paid" scripts, or you can also make your own scripts. You can make scripts for whatever you want, to do whatever you want on any ECU. (Just need to do research on how its done)

[fuzz1]

Hi
In what language are the scripts pascal or c or something else? Are there examples of the scripts to follow and make our own?

[AB4S]

Hi

Yes there are a couple free scripts inside, see example for VW airbag ECU 5Q0959655 -

[readdtc/send]
messages=715;8;02 10 03 00 00 00 00 00


[readdtc/trigger1]
wait=77F;3;06 50 03
infostart=1
messages=715;8;03 19 02 2C 00 00 00 00


[readdtc/trigger2]
wait=77F;1;1*
messages=715;8;30 00 00 FF FF FF FF FF


[readdtc/trigger3]
wait=77F;4;03 7F 19 78
type=1
infostart=1

So that code there is to read stored trouble codes, 77F and 715 is the CAN ID for this ECU (i think it will be the same ID for all VW airbag ECU's around that year range)

Then it sends CAN messages to the ECU to receive a response (trouble codes)