OBD-II and ELM327 (8), MITM Failure Analysis 2

Introduction

In school, the textbook illustrates theorems in sequence. It seems there's some path that we can get the answer. In reality, I can write some failure analysis with confident, but I would say it's wrong in this article. I think that's engineer's daily life, struggling in debugging, until reaching the answer

New Weapon

I bought STM32 Nucleo F767ZI in Mouser, which is high-end MCU fabricated in 90nm
  • Cortex-M7 @ 216Mhz，512KB SRAM，2MB Flash
    • Extremely fast processor, very large PM/DM
    • Stupid code still runs quite fast
  • 3x CAN，USB 2.0HS，Ethernet
    • With 3x CAN, I can do packet forwarding within MCU
    • I can play USB/Ethernet if desired


FedEx is quite efficient. Ordering on Friday and the EVB dispatched from USA and arrived to Taiwan on the next Tuesday. With some efforts, I completed CAN forwarding within MCU. In the scope picture below, the latency reduces from 400us to 20us (finally...)




HUD was NOT killed by latency

In the picture below, with extremely fast packet forwarding, the left red-rectangular is speed query from HUD. The right rectangular is Pi-CAR responses to the speed query. The latency between two rectangular is 4ms = 4000us, and HUD is still alive !!


I tried to enlarge the latency, Pi-CAR waits 0.1sec=100ms=10000us then responses to HUD. The HUD is still alive !!


Opps

So I bought new boards from USA, did some coding with STM32, and I was totally in wrong direction. Anyway, I still like the new EVB. Linux is hard to manipulate, while MCU is easier to use. I can use familiar tool (J-Link debugger) to analyze. It's extremely fast to forward packets, I would keep using it


Eventually, I put the equipment to the car, and the HUD is not working yet

Comments

Post a Comment

Popular posts from this blog

OBD-II and ELM327 (1)

Image
I bought a Volvo XC60 2017, and the car had an OBD-II port. I always feel the port is inviting me to do some hacking. I had power supply, oscilloscope, soldering equipment, multi-meter. I can read English, and had some embedded system development experience, but no hacking car ever. Maybe with some study, I can learn to do that My adventure starts with ELM327, the equipment is quite cheap. I want to talk pro/con of the cheap China ELM327 unit, and when you will feel disappointed to it ELM327 is basically a Microchip PIC18F2480 with customized FW, which supports various OBD protocol. Picture below is from its datasheet Left-upper corner, MCP2551 is the CAN transceiver It communicates to car by CANL/CANH signals It outputs CAN signal to PIC18F2480 (ELM327) (PIN1/4) PIC18F2480 (ELM327) It accepts the output signal from CAN transceiver The internal CAN controller send/receive from CAN bus It had UART interface in PIN17/18 Option1: FTDI UART to USB interface Conne
Read more

OBD-II and ELM327 (3), try to decode CAN package recorded by ELM327

Image
Volvo XC60 2017 doesn't offer the capability of closing tailgate by remote control. I have to press the button in the tailgate (see below) to hand. That's probably because of security reason, but I feel so stupid. M assumption is, the button sends some message to CAN bus. If I can sniffer the signal, I can close the tailgate remotely Challenge Accept !! I connect the ELM327 with my XC60, and successfully read VIN code . Then I tried ATMA (Monitor All) command to sniffer CAN bus... Then... nothing happened !! What the fuck ?! So now I can tell you when the cheap ELM327 makes you disappointed In complete AT command Because Torque App doesn't use ATMA command, so the cloned ELM327 don't offer such capability Poor bluetooth connectivity As sending ATRV command, sometimes I got incomplete response. I guess that's because bluetooth module doesn't work well Even the cheap ELM327 dongle offers ATMA capability, the data rate is far exceeding the blue
Read more

OBD-II and ELM327 (2), the underlying interface of ELM327

Image
Go to Google play and search keyword of "ELM327 Terminal", all of them were similar, you can just pick arbitrary of one. If you really had some difficult of selection, this one  looks beautiful and just updated recently After connecting the tool with ELM327 and car, type "0902" in the tool to read the VIN code . These PIDs (0902) were industrial standard , and all cars shall implement it. Here's some useful PIDs. That's why HUD (head up display) can connect to all brands of cars with OBD2 connector 01 0D: car speed 01 0C: engine RPM Here's the 0902 query response of my car in the APP. If interested, decode it :-) 7E8 08 01 14 49 02 01 59 56 41 7E8 08 21 44 5A 41 38 42 44 48 7E8 08 22 32 30 37 36 36 38 32 A lot of people read CAN bus by Torque, but only few people read the ELM327's capability document. Check out ELM327 website and download their AT command list , that's all the capability it had. It had different capability
Read more