Dodge Challenger Forum banner

21 - 40 of 105 Posts

·
Registered
2015 RT 5.7 M6
Joined
·
7,584 Posts
Dam you...now you got me looking how to CAN bus sniff...hopefully I won't need a rolled up hundred dollar bill.



I know it's just 0s and 1s but usually I only understand the zero part.
 

·
Premium Member
The Bacon Hauler (‘12 Cop Charger)
Joined
·
6,180 Posts
Odometer shenanigans are actually out there.

And I thought I was crafty when I stumbled on how to stop my Challenger’s odometer from moving forward with the tuner I had at the time...looks like I was barely scratching the surface of possible ways to manipulate the mileage on a vehicle.
 

·
Premium Member
The Bacon Hauler (‘12 Cop Charger)
Joined
·
6,180 Posts
Dam you...now you got me looking how to CAN bus sniff...hopefully I won't need a rolled up hundred dollar bill.



I know it's just 0s and 1s but usually I only understand the zero part.
move always heard there are 10 kinds of people in the world - those that can understand binary and those that can’t.
 

·
Registered
2016 Jazz Blue A8 Scat
Joined
·
694 Posts
Is there a way (software) to use the OBDlink MX+ as a CAN bus sniffer?
I think I saw something about using the MX+ but not the Alpha software.

I'll google a few minutes and see if I can run across it again.
It was an older thread on one of the Ram forums and the guy that was trying to share info was immediately tarred and feathered. Witchcraft I say!
 

·
Registered
2015 RT 5.7 M6
Joined
·
7,584 Posts
I think I saw something about using the MX+ but not the Alpha software.

I'll google a few minutes and see if I can run across it again.
It was an older thread on one of the Ram forums and the guy that was trying to share info was immediately tarred and feathered. Witchcraft I say!
CANiBUS supposedly works with ELM chipset.

Although not the best route to go I guess.
994028


I wonder if this can be used for finally getting performance pages to work on the uconnect radio that has had a trial/subscription...basically figure out a way for it to ignore the uconnect deactivation signal? (if that is what is truly happening)

Looks like someone was able to get info on the older headunits. Looks like I may need to enlist help from my little brother...he can't turn a wrench but he understands code.
 

·
Registered
2015 RT 5.7 M6
Joined
·
7,584 Posts
Yeah but those are in the cluster and are usually the ones that don't disappear. It's the PP on the head unit that goes bye-bye.
994039
 

·
Registered
Joined
·
40 Posts
Discussion Starter #30
That depends on how its generated. If the ECU needs to upload information its not a matter of manipulating the unit but manipulating the ECU. If the ECU always stores it but the unit just doesnt display it, thats an easy one. You just need to have a device to tell it its okay to display it. And if it disappears after restarting the car it just means you need a middle man to reproduce the signal every time the car starts.
 

·
Registered
2015 RT 5.7 M6
Joined
·
7,584 Posts
The PP are stored on the head unit (radio). If I reset the radio to factory settings PP shows up but as soon as a 3G connection is made it disappears. Hence, why I think there is a signal being sent over 3G to disable PP...at least on the radio and not the cluster.
 

·
Registered
Joined
·
40 Posts
Discussion Starter #32
Think of the head unit like an internet browser. Like for this forum! It may have a webpage stored, but it doesnt have the latest data. ECU will need to pass it something later on. And just how some forums need a login and password, the ECU might as well. Or it just needs a browser to view the data (A properly working head unit). If it needs login information that means youll need to manipulate the ecu. If the data is always being broadcasted for anyone who wants to see, and you just need a headunit that can see the info on the ecu thats easy. Also if the only thing that is causing you issues i the 3g, why not just remove the sim card? It sounds like its doing some sort of account check.
 

·
Registered
Joined
·
2,272 Posts
Hi there! I've been working at reverse engineering the 2015 dodge challenger instrument cluster to allow it to be implanted into any vehicle. Theres one last thing that is critical to completing the project and its figuring out how mileage is updated. I was wondering if there was anyone here that knew the message requirements for it? Or was tech savy enough to capture some of the c canbus data for me? Please and thank you!
Ideally would need to see a wiring diagram to possible "guess" how this is handled.

There can be a signal from the transmission with each pulse representing the speed of the driveshaft and the distance this represents.

The engine controller uses this pulse to increment the distance traveled.

This same pulse can be routed to the instrument cluster controller which keeps an independent tally of the distance traveled.

This is used to (possibly ) detect odometer tampering.

The instrument cluster controller can then periodically update the odometer.

In the absence of any input from the transmission to the instrument cluster controller another way -- possibly -- is the engine controller sends a CAN bus message to the instrument cluster controller and the instrutment cluster controller then updates its storage of this value and keeps the odometer display currrent.
 

·
Registered
2015 RT 5.7 M6
Joined
·
7,584 Posts
No pulses coming from a manual trans...everything is off the wheels sensors (ABS module). From my experience in getting launch control to work on an non-STP car there most likely communication between the ABS-BCM-IP (instrument panel).

How is this for a wiring diagram?
994046


 

·
Registered
Joined
·
40 Posts
Discussion Starter #36
In terms of a wiring diagram, I know roughly how the challenger handles its speed logic. ABS sensors at the wheel look at how fast the wheels are going and report it to the ECU. (Clever if you ask me And just saw Chally independently confirm this)

No signal from transmission required related to speed anyway.

You're correct in your statement that it can be coming from 2 separate things. ECU when ABS isn't functioning correctly. Or maybe always ABS. Who knows.

Chally is evidence of the two not matching up and working just fine. So we can confirm that "Tampering" isnt as tough we might fear.

The mismatch suggests the ECU and or ABS dont actually request or need any info from the cluster to work correctly. This isnt 100% but its a high chance. Its possible the ECU requests from the cluster its current reading, updates it internal to the ECU then pushes an update to the Cluster.

Right now I'm working off the assumption that top priorty is that under no circumstances ever, no matter what can the cluster miss an update to mileage (Since this can add up a lot over 400,000!)

Simplest way would be to "push" an incremental update to cluster or throw a large error code if not possible or even shut the engine off.

I'm confident its the last suggestion in your post Rockster again using Chally's cluster swap as evidence (Lower mileage cluster never updating to new value but increasing correctly). And as other people have shown its possible to manipulate the stored data, but problem is we need a reliable way to increment it.


I dont particularly care about setting it to any value. I want to keep track of mileage on the car for Oil changes, mpg, ect.
 

·
Registered
2015 RT 5.7 M6
Joined
·
7,584 Posts
One thing I have wondered is how are guys that are doing the resto mods getting the PCM and IP the vehicle speed? It's been asked on HP tuners site a couple of times but I have never seen a response on how it's done. I am pretty sure they are not installing the ABS module and wheel sensors.
 

·
Registered
Joined
·
40 Posts
Discussion Starter #38
Speedo data is very easy. When i get home ill double check the frame, but you just send it on bit 4 i think. Arduino can count square wave pulses from tranny, have a moving average and send the number on bit 4
 

·
Registered
‘15 R/T 6M STP
Joined
·
393 Posts
You can disable 3G by pulling the antenna but that knocks out GPS as well.
My Nav works and I don’t have 3G. It thinks it has 3G, but it is just a defeater I built.
 

·
Registered
Joined
·
5,706 Posts
CANiBUS supposedly works with ELM chipset.

Although not the best route to go I guess.
View attachment 994028

I wonder if this can be used for finally getting performance pages to work on the uconnect radio that has had a trial/subscription...basically figure out a way for it to ignore the uconnect deactivation signal? (if that is what is truly happening)

Looks like someone was able to get info on the older headunits. Looks like I may need to enlist help from my little brother...he can't turn a wrench but he understands code.
I hope there is a way.
 
21 - 40 of 105 Posts
Top