OBD-II and ELM327 (10), superb driving skill demo

Finally, I can demo my superb driving skill in basement, the HUD showed that I'm @ 116km/hr !!




HUD kept queried the speed from the car. Here's the code snippet to hack the speed response in STM32

STM32, the man-in-the-middle hacked the speed (+100). Here's the code snippet to hack



Video demo


Thanks for your reading. Two years after buying the car, learned a bit of CAN development

Comments

Post a Comment

Popular posts from this blog

OBD-II and ELM327 (2), the underlying interface of ELM327

Image
Go to Google play and search keyword of "ELM327 Terminal", all of them were similar, you can just pick arbitrary of one. If you really had some difficult of selection, this one  looks beautiful and just updated recently After connecting the tool with ELM327 and car, type "0902" in the tool to read the VIN code . These PIDs (0902) were industrial standard , and all cars shall implement it. Here's some useful PIDs. That's why HUD (head up display) can connect to all brands of cars with OBD2 connector 01 0D: car speed 01 0C: engine RPM Here's the 0902 query response of my car in the APP. If interested, decode it :-) 7E8 08 01 14 49 02 01 59 56 41 7E8 08 21 44 5A 41 38 42 44 48 7E8 08 22 32 30 37 36 36 38 32 A lot of people read CAN bus by Torque, but only few people read the ELM327's capability document. Check out ELM327 website and download their AT command list , that's all the capability it had. It had different capability...
Read more

OBD-II and ELM327 (3), try to decode CAN package recorded by ELM327

Image
Volvo XC60 2017 doesn't offer the capability of closing tailgate by remote control. I have to press the button in the tailgate (see below) to hand. That's probably because of security reason, but I feel so stupid. M assumption is, the button sends some message to CAN bus. If I can sniffer the signal, I can close the tailgate remotely Challenge Accept !! I connect the ELM327 with my XC60, and successfully read VIN code . Then I tried ATMA (Monitor All) command to sniffer CAN bus... Then... nothing happened !! What the fuck ?! So now I can tell you when the cheap ELM327 makes you disappointed In complete AT command Because Torque App doesn't use ATMA command, so the cloned ELM327 don't offer such capability Poor bluetooth connectivity As sending ATRV command, sometimes I got incomplete response. I guess that's because bluetooth module doesn't work well Even the cheap ELM327 dongle offers ATMA capability, the data rate is far exceeding the blue...
Read more

VOLVO+ Development Story (11), A-SS function release

Image
New feature A-SS OFF release and camping mode FW fix XC60 ASS-OFF feature VOLVO+ Development Story (8), A-SS function definition VOLVO+ Development Story (9), A-SS development Demo Video Camping mode VOLVO+ Development Story (10), camping mode Thanks Mr. Chen in Hsinchu city, help me hardware knowledge, review schematics Thanks to everyone who bought VOLVO+. If no body likes it, the project is meanless Thanks to everyone who helped me verifying A-SS OFF Special Thanks to Mr. Hsu, the project can't be success without your help Special thanks to Mr. Hsu, the project successes with your help
Read more