[00:00.000 --> 00:03.540]  I'm going to talk a little bit about how you can connect to your car.
[00:03.840 --> 00:04.600]  Well, at least that's the goal.
[00:06.320 --> 00:13.460]  So, what I really do, a little bit of introduction about myself, is I read bytes from the CAN bus on your vehicle.
[00:13.560 --> 00:15.040]  How many people have CAN bus on their vehicle?
[00:15.140 --> 00:16.020]  Anybody know if they do?
[00:16.140 --> 00:16.800]  One, two...
[00:16.800 --> 00:17.740]  All right.
[00:18.180 --> 00:20.980]  So, I'm actually going to be very... it's going to be a rather technical talk.
[00:21.940 --> 00:28.240]  But if you guys have any questions, always, you know, feel free, go to my website, canbushack.com.
[00:28.740 --> 00:31.460]  The goal of my website, really, I started a couple years ago.
[00:31.560 --> 00:35.260]  The goal was to just sort of introduce people to how to get to their car.
[00:35.360 --> 00:37.560]  How to get data from their car.
[00:37.640 --> 00:38.760]  How to interact with their car.
[00:39.020 --> 00:39.880]  It's just a blog.
[00:40.140 --> 00:42.000]  It's got... it's just text.
[00:42.260 --> 00:43.180]  You know, just read it.
[00:43.980 --> 00:49.080]  It's kind of funny sometimes, so... And then my Twitter is idontweets, because I don't.
[00:51.180 --> 00:56.140]  And you can grab... I haven't posted this presentation yet, but I will probably, hopefully, by tonight.
[00:56.140 --> 00:59.560]  This will be the URL for it, canbushack.com.
[00:59.760 --> 01:00.780]  Hope it works up.
[01:02.060 --> 01:06.820]  And I'm going to talk a little bit about some... a program that... so a little bit about my background.
[01:07.400 --> 01:14.580]  I've been... I worked with a company for about five years that was called Intrepid Control Systems.
[01:15.040 --> 01:17.460]  They make tools to connect to vehicle networks.
[01:17.620 --> 01:18.960]  So that's where I got my start.
[01:19.520 --> 01:22.120]  And I'm going to talk a little bit about their software.
[01:22.280 --> 01:23.200]  I don't work with them anymore.
[01:23.340 --> 01:23.960]  I work with myself.
[01:23.960 --> 01:25.920]  But I still really believe in their software.
[01:26.240 --> 01:27.040]  I think it's excellent.
[01:28.120 --> 01:31.700]  They have free demo versions you can use to get started.
[01:32.440 --> 01:36.260]  It's really a high cost of entry to get into a lot of the stuff, I'll be honest with you.
[01:36.520 --> 01:38.760]  But I think there's ways to get around that.
[01:38.900 --> 01:42.880]  There's ways to find... you can find a way to get into it.
[01:43.800 --> 01:46.500]  Just to start hacking on your own car as well.
[01:47.680 --> 01:48.740]  So a little introduction.
[01:48.980 --> 01:50.260]  This is a little overview of what I'm going to talk about.
[01:50.380 --> 01:51.920]  I'm going to talk about how to connect to the vehicle.
[01:52.360 --> 01:53.300]  What's in the car.
[01:53.680 --> 01:55.980]  A little demo of Vehicle Spy itself.
[01:56.560 --> 01:58.840]  And looking at the communications.
[01:59.080 --> 02:01.720]  More not the software, but the communications, what they look like.
[02:02.300 --> 02:05.780]  Some of the physical layers of the vehicle, such as J1850.
[02:05.960 --> 02:06.920]  So going back a little bit.
[02:07.240 --> 02:09.380]  Some people still have J1850 on their car.
[02:09.980 --> 02:10.340]  Lynn.
[02:10.900 --> 02:12.340]  I might talk a little bit about Lynn.
[02:12.340 --> 02:13.840]  But definitely talking about CAN bus.
[02:14.260 --> 02:15.720]  The different flavors of CAN bus.
[02:15.940 --> 02:17.740]  And the devices that you use to connect to it.
[02:18.300 --> 02:19.460]  About the physical layer.
[02:20.040 --> 02:20.760]  The frame.
[02:21.860 --> 02:24.720]  I had a demo, but I didn't bring it with me.
[02:24.820 --> 02:25.340]  So I apologize.
[02:26.040 --> 02:26.880]  Understanding the data.
[02:27.940 --> 02:29.760]  The diagnostics versus normal messages.
[02:29.920 --> 02:31.600]  Which is really important once we get into it.
[02:32.380 --> 02:34.300]  A little demo, hopefully on reverse engineering.
[02:34.320 --> 02:35.020]  If we have time.
[02:35.240 --> 02:37.240]  I know I'm going to have to run through these things pretty fast.
[02:37.360 --> 02:38.360]  Because I have a whole bunch of them.
[02:39.900 --> 02:41.920]  Diagnostic protocols, if I can touch on it.
[02:41.920 --> 02:42.680]  OBD2.
[02:42.860 --> 02:46.660]  A lot of people know of vehicle networks as OBD2.
[02:46.820 --> 02:47.800]  But there's so much more.
[02:47.900 --> 02:49.240]  That's really just scratching the surface.
[02:49.880 --> 02:53.000]  A little bit about some of the other diagnostic protocols.
[02:53.600 --> 02:58.040]  Some called ISO 14229 and ISO 14230.
[02:58.340 --> 02:59.540]  A little bit about GM land.
[02:59.640 --> 03:00.860]  It was the GM land diagnostics.
[03:02.220 --> 03:04.680]  Diagnostic message commands, et cetera, et cetera.
[03:04.760 --> 03:05.860]  And then some Q&A at the end.
[03:05.960 --> 03:06.860]  So we'll have some time.
[03:07.260 --> 03:09.140]  So a little bit of history.
[03:09.340 --> 03:10.100]  How I started.
[03:10.200 --> 03:10.740]  How it all began.
[03:10.740 --> 03:16.600]  I started out by taking my compact PC and then putting it into my civic.
[03:16.800 --> 03:17.720]  Of course, this wasn't it.
[03:18.040 --> 03:19.020]  So I found this.
[03:19.920 --> 03:20.600]  I wish.
[03:22.080 --> 03:23.560]  And this is really where I started.
[03:23.700 --> 03:24.680]  So this is my high school.
[03:24.800 --> 03:28.020]  In high school, a lot of us out here have been working on it with these things for a while.
[03:28.020 --> 03:30.560]  So I put a computer in a car.
[03:30.860 --> 03:32.800]  But the computer didn't talk to the car.
[03:32.940 --> 03:34.720]  And that was really ultimately my goal.
[03:34.920 --> 03:36.020]  So I got onto a website.
[03:36.180 --> 03:37.860]  I don't know if anybody's familiar with this website.
[03:38.020 --> 03:43.040]  Excellent website for, you know, trying to figure out how to, what tools to get.
[03:43.280 --> 03:44.120]  MP3car.com.
[03:44.220 --> 03:45.140]  It started a long time ago.
[03:45.280 --> 03:47.260]  And their goal is to merge computers and cars.
[03:47.660 --> 03:48.380]  Stuff like that.
[03:48.500 --> 03:50.260]  And that's how you can really get into...
[03:50.700 --> 03:57.600]  If you haven't been to their website, their forums, they have a section just on diagnostics, engine controllers, and different controllers on how to connect.
[03:57.760 --> 03:59.060]  It's an excellent resource as well.
[04:00.440 --> 04:01.660]  A little bit about...
[04:01.660 --> 04:03.100]  This is really where it all starts.
[04:03.300 --> 04:04.460]  And a lot of you have seen this.
[04:04.580 --> 04:07.660]  Everybody who has a 1996 or newer vehicle has this in their car.
[04:07.660 --> 04:11.560]  This is the DLC or OBD2 connector or ALDL.
[04:11.680 --> 04:12.920]  There's a lot of names that it goes by.
[04:13.480 --> 04:15.460]  But every car in the...
[04:15.460 --> 04:20.880]  Sold in the United States, and a lot of European cars as well, have this connector on it.
[04:20.940 --> 04:22.480]  You can find it underneath the dash.
[04:22.620 --> 04:27.140]  Just, you know, duck your head underneath where your steering wheel is and look for this car.
[04:27.240 --> 04:28.420]  Sometimes there's a port for it.
[04:28.640 --> 04:31.900]  And this is the OBD2 connector.
[04:31.900 --> 04:35.600]  And it's designed primarily to be an interface for scan tools.
[04:35.600 --> 04:40.500]  So when you take your car and it gets serviced or whatever, the diagnostic...
[04:40.500 --> 04:45.020]  Whoever's doing the performing diagnostics nowadays, all these controllers on there, just plug this thing in.
[04:45.440 --> 04:46.840]  But it's so much more now.
[04:47.040 --> 04:47.640]  They use this.
[04:47.780 --> 04:52.100]  Also, the engineers who are developing the car use this connector as well.
[04:52.500 --> 04:55.560]  So a lot of the diagnostic data is there.
[04:55.600 --> 04:59.160]  But almost inevitably, there's a lot more information besides the diagnostic.
[04:59.700 --> 05:04.260]  So go to this connector, find it, and that's where you're going to start.
[05:04.820 --> 05:08.020]  What you will notice is that not all of the pins are populated.
[05:08.180 --> 05:09.680]  So there's 16 pins on the connector.
[05:09.980 --> 05:11.900]  It's a standard connector, but not all are populated.
[05:12.180 --> 05:16.520]  So this actually gives you a lot of information of what networks are on your car.
[05:16.720 --> 05:25.760]  So if you see that pin 2 is populated, and you'll know that you have, if you look over here, pin 2 is the J1850 pin.
[05:26.300 --> 05:29.800]  You'll know you have J1850 on there, so you know you need a tool with J1850.
[05:29.800 --> 05:35.260]  If you see pins 6 and 14 are there, you know you have high-speed CAN bus.
[05:35.540 --> 05:38.420]  So you know you can get a CAN bus tool and plug it in, and it's a high-speed CAN.
[05:38.720 --> 05:44.900]  Now, there are other pins which are called discretionary pins, like pin 1 or pin 3 and 11 or something like that.
[05:45.120 --> 05:48.440]  These are all discretionary pins, so the OEMs can put whatever they want on these pins.
[05:49.260 --> 05:53.940]  The GM puts on pin 1, they put their single-wire CAN on pin 1.
[05:53.940 --> 05:57.460]  So they can do whatever they want with these discretionary pins.
[05:57.660 --> 06:00.580]  They can put, you know, another power output.
[06:00.780 --> 06:04.360]  They can put, you know, vehicle speed sense, like a pulse or something like that.
[06:04.440 --> 06:05.280]  They can do whatever they want.
[06:05.720 --> 06:11.620]  You can also get this pin out from pinouts.ru, a very good resource for pinouts if you've ever been going around.
[06:12.440 --> 06:15.240]  So this is a really, this is the most important part.
[06:17.040 --> 06:24.420]  But given that you have, you may have more networks on your car than what's on this connector.
[06:24.520 --> 06:30.940]  This connector is for diagnostics, and some manufacturers decide that, you know, certain networks don't need to be put out here.
[06:31.320 --> 06:33.920]  And the reason is, there's a couple reasons.
[06:34.120 --> 06:37.720]  One is they don't want, you know, people like us to connect to the network.
[06:37.840 --> 06:39.460]  They want to make it difficult, a little bit more difficult.
[06:39.460 --> 06:45.320]  But mainly the reason is, they don't, there's no tool that needs to connect to it.
[06:45.400 --> 06:48.380]  So why run, route the wire, all the way to here?
[06:48.580 --> 06:49.880]  You know, there's just no reason for it.
[06:50.060 --> 06:51.620]  So they just, they don't waste the time.
[06:51.720 --> 06:53.580]  They don't spend the time, they don't move on.
[06:53.720 --> 07:02.740]  So, you may have to go to other websites to try to find, you know, body control modules, where your body control module is located on your car, and find the body networks.
[07:02.900 --> 07:05.440]  Because typically, there are two networks on your car.
[07:05.440 --> 07:07.820]  And if you have a newer car.
[07:08.080 --> 07:12.240]  And the body controller has almost all of them on there.
[07:12.400 --> 07:13.520]  So try to find the body controller.
[07:13.740 --> 07:15.880]  So a little bit about what is in the car.
[07:16.040 --> 07:21.400]  Like a little bit about how the CAN bus and why the CAN bus really exists.
[07:21.920 --> 07:29.260]  So you may find that the air conditioner module and the seat position module and the transmission engine controller are all connected via CAN bus.
[07:29.260 --> 07:33.400]  So you have all of these systems connected and they're all controllers.
[07:33.600 --> 07:34.720]  So they have a lot of I.O.
[07:34.900 --> 07:40.140]  connected and actually actuating the engine, you know, the timing on the engine, the transmission and when it shifts.
[07:40.520 --> 07:45.280]  All of these controllers are taken care of and they're all connected to a single network and it's typically the CAN bus.
[07:45.460 --> 07:52.380]  And the reason why they use the CAN bus is because it's a very, well, not very fast, but relatively fast compared to other technologies that are out there today.
[07:52.380 --> 07:59.220]  They are moving away a little bit for engine control systems from CAN bus because they are coming up with a bit faster and newer systems.
[07:59.760 --> 08:06.100]  But CAN bus is very much prevalent in cars today and I think it's going to be there for a long time just because of its nature.
[08:06.220 --> 08:08.820]  And I'll talk a little bit more about why that is a little bit later.
[08:10.660 --> 08:15.260]  So I'm going to show you a little bit of what CAN bus might look like.
[08:15.260 --> 08:18.060]  So I'll bring up VehicleSpot here.
[08:18.860 --> 08:21.320]  So this is VehicleSpot.
[08:21.420 --> 08:23.880]  This is a software that I use pretty much on a daily basis.
[08:24.360 --> 08:31.800]  And just to give you an idea, it's, you know, a lot of us probably use like Wireshark and this is sort of a similar concept.
[08:31.880 --> 08:36.140]  It shows the actual raw information on the bus.
[08:36.600 --> 08:39.420]  And I'll show you actually in more of a decimal view.
[08:41.540 --> 08:46.540]  So if we look at this, we can see like this is actually a reflash event that occurred on my vehicle.
[08:46.720 --> 08:49.060]  I reflashed the transmission controller.
[08:49.220 --> 08:50.480]  No, this is the fuel control module.
[08:50.920 --> 08:59.460]  So we can see even when we're looking at this data, we can see that, you know, we have a frame.
[08:59.580 --> 09:00.520]  This is what a frame is.
[09:00.740 --> 09:03.580]  It's an identifier and then eight bytes of data.
[09:03.740 --> 09:04.280]  That's CAN bus.
[09:04.880 --> 09:06.180]  Identifier up to eight bytes of data.
[09:06.240 --> 09:06.800]  Could be less.
[09:06.880 --> 09:07.340]  Could be more.
[09:07.340 --> 09:08.180]  But that's it.
[09:08.340 --> 09:11.220]  Really short, succinct messages that go out.
[09:11.380 --> 09:11.920]  So it's...
[09:11.920 --> 09:18.160]  I mean, if we compare this to like Ethernet or anything like that, these messages are very simple, very concise.
[09:18.480 --> 09:24.500]  And the idea is we're trying to have like very short messages that live very quickly.
[09:24.660 --> 09:34.220]  But there's a lot of data, enough data contained inside of these messages so that it can, you know, do whatever it needs to do.
[09:34.220 --> 09:36.540]  Like, okay, the temperature of the engine is this.
[09:37.000 --> 09:37.140]  Boom.
[09:37.320 --> 09:37.480]  Done.
[09:37.660 --> 09:39.360]  Just two bytes of data, one byte of data.
[09:39.500 --> 09:40.140]  That's all you need.
[09:40.600 --> 09:40.900]  There.
[09:41.140 --> 09:43.180]  Now everybody on the network has that information.
[09:43.180 --> 09:45.240]  We can move on to the next thing.
[09:45.240 --> 09:48.820]  This is, again, a reflash event, so you're going to see a lot more data here.
[09:49.360 --> 09:55.740]  But you see, very simple to use, very easy to understand, not super complicated.
[09:56.460 --> 09:59.300]  But there's a lot of different formats of these messages as well.
[09:59.300 --> 10:02.180]  So, if you look at the data, it actually can go by pretty quickly.
[10:02.520 --> 10:02.820]  Oh, of course.
[10:03.380 --> 10:03.740]  Fail.
[10:03.920 --> 10:05.020]  Yeah, you know that's going to happen.
[10:06.840 --> 10:10.600]  Well, anyway, I was going to show you going by a little bit and making it run fast.
[10:10.640 --> 10:11.940]  But, of course, it's going to fail.
[10:14.060 --> 10:14.960]  So, let's see.
[10:15.280 --> 10:21.200]  It's, again, CAN bus communications originally designed, you know, more to decrease the wiring size.
[10:21.200 --> 10:24.980]  Imagine that you wanted to share the engine speed with other controllers, you know.
[10:25.560 --> 10:28.320]  You have this radio.
[10:28.840 --> 10:31.540]  And, you know, a lot of people have this feature on their car.
[10:31.680 --> 10:32.420]  You're driving down the road.
[10:32.540 --> 10:35.280]  The radio starts to...the volume increases as you're driving.
[10:35.520 --> 10:37.480]  In fact, maybe your vehicle speed or something like that.
[10:37.880 --> 10:40.580]  And these are the types of features that they added.
[10:40.600 --> 10:53.680]  And before they had, you know, vehicle networks, it was really cumbersome because they run a vehicle speed sense to every controller, the radio, the engine, all these different things had to know what the vehicle speed was.
[10:53.900 --> 11:00.700]  Well, they took that concept, obviously, and they put it on a CAN bus and said, hey, we're going to distribute this data now across that.
[11:00.820 --> 11:02.300]  And now we can use that information.
[11:02.520 --> 11:04.800]  And we can record vehicle speed now.
[11:04.960 --> 11:06.740]  For whatever reason, we want vehicle speed.
[11:06.820 --> 11:07.480]  We can have it now.
[11:07.880 --> 11:10.540]  But, of course, there's two ways to get that data.
[11:10.600 --> 11:12.300]  And I'll talk a little bit about those later.
[11:12.480 --> 11:14.480]  So, let's talk a little bit about the physical layers themselves.
[11:14.480 --> 11:16.760]  There's the old and the new.
[11:16.980 --> 11:17.960]  So, there's J1850.
[11:18.980 --> 11:20.660]  I know this is more of a...
[11:21.120 --> 11:23.200]  I talk a little bit about CAN bus, CAN bus hack.
[11:23.400 --> 11:25.860]  But J1850 is really where it all began, at least in the U.S.
[11:27.660 --> 11:28.720]  There's two different versions.
[11:28.880 --> 11:30.820]  There's variable pulse width and pulse width modulation.
[11:33.040 --> 11:33.760]  There's LIN.
[11:34.140 --> 11:35.560]  We have this as a newer network.
[11:35.700 --> 11:36.880]  ISO 9141.
[11:36.960 --> 11:37.540]  There's CAN.
[11:37.700 --> 11:38.620]  We'll talk about different flavors.
[11:39.760 --> 11:40.120]  Newer...
[11:40.960 --> 11:45.860]  A newer type of serial data network is the most or the most media-oriented serial transfer.
[11:46.020 --> 11:48.640]  It's really used for media, as you can imagine.
[11:48.780 --> 11:51.120]  It's kind of an ironic name if it weren't used for media.
[11:52.220 --> 11:53.480]  FlexRay, which is a new...
[11:54.560 --> 11:54.960]  Very...
[11:54.960 --> 11:55.620]  Much faster.
[11:55.820 --> 12:00.000]  And when I say faster, it's really only up to, like, five meg per second.
[12:00.220 --> 12:03.840]  But, you know, it's still a lot faster for vehicle data.
[12:04.780 --> 12:08.340]  They're starting to use that in some of the more European vehicles, Audi, BMW.
[12:09.480 --> 12:11.400]  And then there's BEAN, which is...
[12:11.400 --> 12:14.540]  Toyota still uses that old archaic network.
[12:16.240 --> 12:19.020]  J250 has a two-wire differential signal.
[12:20.180 --> 12:22.120]  It's on pins 2 and 10.
[12:22.480 --> 12:23.180]  If you're...
[12:23.180 --> 12:24.580]  Take a look at your OBD2 connector.
[12:24.780 --> 12:25.580]  Just take a look at it.
[12:25.700 --> 12:27.000]  Say, oh, I got pins 2 and 10.
[12:27.220 --> 12:33.120]  You're on a Ford vehicle, of course, because the Ford is the only one that uses the PWM J250.
[12:33.620 --> 12:35.020]  It's also known as SCP.
[12:37.520 --> 12:38.500]  It's really old.
[12:38.780 --> 12:39.880]  And no longer in use.
[12:40.100 --> 12:40.960]  You won't find...
[12:41.500 --> 12:44.860]  You won't find J1850 PWM on any new vehicles today.
[12:46.300 --> 12:48.860]  There's VPW, which uses just a single wire.
[12:49.140 --> 12:52.260]  GM is really the main user of it.
[12:52.360 --> 12:53.480]  But Chrysler used it as well.
[12:53.780 --> 12:54.940]  It's just on pin 2.
[12:55.080 --> 13:01.500]  So if you take a look and you just have pin 2 there and no pin 10, you're on a GM or Chrysler vehicle that has JT50.
[13:01.500 --> 13:03.100]  So take a look and you can find it.
[13:05.400 --> 13:07.220]  Now we'll talk a little bit about CAN bus.
[13:08.440 --> 13:09.460]  Defined by Bosch.
[13:09.740 --> 13:11.580]  So a very large, privately held company.
[13:12.380 --> 13:14.360]  Had the original need...
[13:14.360 --> 13:16.220]  They make engine controllers, typically.
[13:16.680 --> 13:18.660]  So because they make these high-speed...
[13:18.660 --> 13:21.240]  They need this high-speed data that's very reliable.
[13:21.480 --> 13:25.480]  So they decided that they were going to come up with their own system.
[13:25.780 --> 13:28.300]  And fortunately they did, because it's actually very, very good.
[13:28.500 --> 13:29.560]  There are two types.
[13:29.560 --> 13:32.400]  There's two versions, I should say.
[13:32.600 --> 13:34.040]  2.0A, 2.0B.
[13:34.680 --> 13:36.280]  There are two types of monikers.
[13:36.440 --> 13:37.000]  They're usually...
[13:37.000 --> 13:39.460]  2.0A is often referred to as 11-bit.
[13:39.660 --> 13:41.000]  And then there's 29-bit.
[13:41.180 --> 13:45.940]  And this really refers to the arbitration ID, which is the identifier of every frame.
[13:46.120 --> 13:47.760]  A little bit back here.
[13:47.980 --> 13:50.580]  This is the identifier right here in the center column.
[13:50.840 --> 13:52.460]  These are 11-bit IDs.
[13:52.460 --> 13:56.500]  So if we looked at how many bits there were, we'd see that there was 11 bits.
[13:57.400 --> 13:58.820]  And some of the...
[13:58.820 --> 14:01.640]  Some vehicles very rarely have 29-bit IDs.
[14:01.860 --> 14:08.380]  Larger IDs, you can do a little bit more with IDs as far as, like, segmenting and the messages that you send out.
[14:10.400 --> 14:12.960]  It's really good for real-time systems.
[14:13.200 --> 14:14.240]  Very low latency.
[14:15.520 --> 14:17.400]  You know, you just... you send the message out.
[14:17.560 --> 14:18.700]  And if you're talking about...
[14:18.700 --> 14:22.180]  Most vehicles are, you know, running about 500 kilobits per second.
[14:22.300 --> 14:23.240]  Really super fast.
[14:23.440 --> 14:23.800]  Blazing.
[14:23.960 --> 14:25.760]  You know, 500 whole kilobits per second.
[14:26.480 --> 14:35.660]  But, you know, these messages, if you think about an 8-byte frame that goes out at 500 kilobits per second, it only takes about 280 microseconds for it to be on the bus.
[14:35.760 --> 14:36.400]  And then it's gone.
[14:36.480 --> 14:37.800]  And then there's an X one that has time.
[14:37.940 --> 14:43.000]  So if you think about all the information that you pack into 280 microseconds, it's really fast, really quick.
[14:43.100 --> 14:45.940]  And then you have this, you know, all these other controllers can share it.
[14:45.940 --> 14:47.220]  So it's really close to real-time.
[14:47.580 --> 14:48.480]  Very useful there.
[14:48.900 --> 14:50.500]  There are three different physical layers.
[14:50.540 --> 14:59.460]  And this is really, I think, probably the most important thing for somebody who's new, trying to understand or grasp the concept of CAN bus, is there are three different types.
[14:59.640 --> 15:02.500]  There's single-wire CAN, fault-tolerant CAN, and dual-wire CAN.
[15:02.940 --> 15:05.940]  Dual-wire CAN is really the one that everybody knows of.
[15:06.420 --> 15:11.140]  If you raised your hand earlier and asked if you knew what CAN bus is, you know about dual-wire CAN probably is really what it is.
[15:11.340 --> 15:19.320]  But there's actually two other flavors, and I think they're just as much fun, especially if you're getting in your car and you're trying to hack, and you want to, like, figure it out.
[15:19.480 --> 15:22.800]  But the problem is there's just no good hardware out there for the other two.
[15:22.800 --> 15:39.880]  The dual-wire CAN, 80%, 90% of all CAN tools that you use, CAN bus, CAN devices that you can buy off online or whatever, any of the Arduino shields that you may find, they're all using this dual-wire CAN, which is, I'll talk about a little bit later, a little bit more specifics.
[15:41.320 --> 15:48.420]  But there is single-wire CAN, really only a couple tools that I can think of that use that, that actually interface with it.
[15:50.520 --> 16:02.820]  And low-speed fault-tolerant CAN as well, which is this more European, you'll see Chrysler, VW, Mercedes, and some of the newer Kias are using this network.
[16:02.960 --> 16:05.560]  But this is, these two are really designed for body networks.
[16:05.560 --> 16:06.340]  They're much slower.
[16:06.560 --> 16:09.380]  But they're very, they're just as much fun, if not more fun.
[16:09.380 --> 16:12.900]  So I'll talk a little bit about single-wire CAN, just because everybody's really interested, I'm sure.
[16:13.340 --> 16:21.040]  So, developed by GM, it's found, you know, really on, you know, even on some older Hondas as well.
[16:21.300 --> 16:24.160]  So GM has it, and some of the older Hondas have single-wire CAN.
[16:24.620 --> 16:28.620]  GM, if you have a General Motors car, take a look at your OBD2 connector.
[16:29.000 --> 16:33.400]  If you have something in pin 1 on that connector, you have single-wire CAN.
[16:33.840 --> 16:40.020]  It's time to go find a tool that connects to single-wire CAN, because you can do so much, so much stuff on single-wire CAN on GM.
[16:40.580 --> 16:41.620]  Honda has it as well.
[16:43.460 --> 16:45.180]  I replaced J1850.
[16:45.540 --> 16:46.780]  It's a little bit faster.
[16:48.380 --> 16:50.780]  It's really known as the body bus, really.
[16:51.380 --> 16:53.800]  You only have body control functions on it.
[16:54.140 --> 16:55.760]  It's very low cost, et cetera.
[16:56.840 --> 16:58.480]  Much slower rate, as you can see.
[16:58.660 --> 17:02.940]  It's 33 kilobits, 33.333, actually, kilobits per second.
[17:05.640 --> 17:10.060]  J1850... or, I'm sorry, SAE spec J2411.
[17:10.840 --> 17:12.640]  It has up to 60 meters in length.
[17:12.920 --> 17:15.260]  Typically, a 0-5 volt signaling level.
[17:15.420 --> 17:21.840]  So if you are using, like, a logic analyzer to look at the data, you can use a standard logic analyzer.
[17:22.000 --> 17:24.980]  Most of them handle 0-5 volts, no problem.
[17:26.420 --> 17:29.420]  It does have a high voltage mode, pretty quick.
[17:29.600 --> 17:32.340]  So any logic analyzer wouldn't hurt it.
[17:33.960 --> 17:42.140]  And very much the most fun network that you can hack, really, because there's just so much information on there and so much control over your car on that one.
[17:42.380 --> 17:46.880]  Fault-tolerant ISO spec 11898-3.
[17:47.440 --> 17:48.580]  Body network, again.
[17:49.520 --> 17:50.660]  It's a two-wire network.
[17:51.100 --> 17:54.760]  Allows for the loss of one, at least one of the network, one of the wires.
[17:55.020 --> 17:56.600]  That's why they call it a fault-tolerant network.
[17:56.600 --> 17:58.520]  So you can cut one wire and it still works.
[17:58.900 --> 18:02.440]  This is really good if you're trying to, like, you know, figure out how to hack a car.
[18:02.520 --> 18:06.780]  You just need to find one wire instead of two if you want to hack it from the outside.
[18:08.080 --> 18:08.980]  Typical baud rates.
[18:09.460 --> 18:10.060]  There they are.
[18:10.880 --> 18:14.980]  And it's practically never, almost nearly never, found on the OBD2 port.
[18:14.980 --> 18:19.140]  So this is one of those networks that if you really wanted to connect to it, you really got to go find it.
[18:19.260 --> 18:23.900]  You got to start digging through wiring diagrams, et cetera, and you can look for it on the OBD2.
[18:23.920 --> 18:27.680]  You won't find it on the OBD2 port, except for on the Fiat 500, which I found it there.
[18:28.020 --> 18:29.280]  It's a very strange place for it.
[18:31.440 --> 18:36.800]  Dual wire CAN, ISO 11898-2, also known as J2284.
[18:37.260 --> 18:40.740]  So if you wanted to look up those specs, because I know everybody loves reading specs.
[18:40.960 --> 18:43.840]  Most prevalent version, like I mentioned before, the CAN bus.
[18:44.940 --> 18:48.780]  It technically will support up to one whole megabyte per second.
[18:49.160 --> 18:50.360]  I know, I know.
[18:51.040 --> 18:54.520]  But you'll really only find it around 500 kilobits per second.
[18:54.800 --> 18:58.540]  And the reason for that is, you know, they just don't need to set it.
[18:58.640 --> 19:02.640]  They'll actually just add another CAN network if they need more bandwidth.
[19:03.160 --> 19:04.360]  They figure it's easier.
[19:04.580 --> 19:10.280]  And then one megabit, they really have tested a little bit on some vehicles and, you know, extra capacitance.
[19:10.540 --> 19:14.720]  And then, of course, any time you're talking about speed, you have that distance tradeoff.
[19:14.840 --> 19:17.260]  So they want to make the CAN bus longer.
[19:17.580 --> 19:20.160]  Well, they can't make it as long the faster they make it.
[19:20.300 --> 19:21.240]  So you have a little bit...
[19:21.240 --> 19:22.420]  It is a differential.
[19:22.900 --> 19:27.200]  So if you're hooking up, like, an oscilloscope or something like that, you can switch it to a differential mode.
[19:27.820 --> 19:31.800]  It does shield against EMI, just like your fun Ethernet.
[19:32.680 --> 19:34.300]  Found on pins 6 and 14.
[19:35.120 --> 19:37.800]  So that's where you're going to look when you look at your OBD2 connector.
[19:37.920 --> 19:38.940]  You're going to look for 6 and 14.
[19:39.080 --> 19:40.820]  And that's going to be where your high-speed CAN network is.
[19:41.040 --> 19:43.240]  There may also be another one on 3 and 11.
[19:43.420 --> 19:44.500]  So look there as well.
[19:45.540 --> 19:47.580]  Ford has started to use that on 3 and 11.
[19:47.840 --> 19:48.820]  So you can look...
[19:48.820 --> 19:50.000]  You can take...
[19:50.000 --> 19:53.660]  And it's the same physical layer as you'll find on 6 and 14.
[19:53.660 --> 19:58.540]  So the same tool that you use to connect to 6 and 14, you can move over to 3 and 11.
[19:58.740 --> 19:59.360]  It'll work.
[19:59.480 --> 20:01.620]  They may be different baud rates, so you have to play around a little bit.
[20:01.740 --> 20:03.560]  But it will definitely work.
[20:04.200 --> 20:07.820]  Really just typically a powertrain applications typically.
[20:08.060 --> 20:10.360]  So that's what you're going to find there as well.
[20:11.720 --> 20:12.940]  So a little bit about that.
[20:13.080 --> 20:14.680]  So some of the devices that you could use...
[20:14.680 --> 20:16.960]  I have an old one.
[20:17.100 --> 20:17.740]  But here it is.
[20:17.880 --> 20:20.860]  My old Arduino Shield from SK Pang.
[20:21.300 --> 20:23.060]  The new one's a SparkFun one.
[20:23.060 --> 20:24.520]  Actually, I have a picture of it a little bit later.
[20:24.680 --> 20:25.340]  A few slides later.
[20:26.980 --> 20:27.980]  So I'll show you what it looks like.
[20:28.060 --> 20:29.740]  But they do have an Arduino Shield for it.
[20:29.800 --> 20:30.520]  It's about 50 bucks.
[20:30.700 --> 20:32.400]  It just supports, again, dual-wire can.
[20:32.840 --> 20:35.520]  So if you're working with that, you can't work on some of the cooler ones.
[20:38.000 --> 20:42.100]  The Neovye or Value Can, this is the company I used to work for in traffic control systems.
[20:42.380 --> 20:43.380]  This is very expensive.
[20:43.720 --> 20:45.980]  As you can see, about $1,200 to $2,000.
[20:46.880 --> 20:48.640]  Extremely high, you know, for this guy.
[20:48.860 --> 20:51.220]  But the Value Can is a little bit more reasonable.
[20:51.220 --> 20:53.940]  There are CAN USBs and stuff like that out there.
[20:54.080 --> 20:54.720]  A little bit cheaper.
[20:54.940 --> 20:57.040]  But you don't get the advantage of the software.
[20:57.280 --> 20:59.500]  Which you can get, like, a demo version as well.
[20:59.820 --> 21:01.200]  Or even a free version.
[21:01.300 --> 21:03.380]  They technically have a free version as well, which is really helpful.
[21:05.580 --> 21:06.420]  Engineering tool.
[21:06.720 --> 21:10.960]  Really, that's really where they sell their tools for the engineers.
[21:10.960 --> 21:16.040]  So you get the same tool as the engineers, the guys at GM, the guys at Chrysler, etc.
[21:16.440 --> 21:17.420]  A little bit more costly.
[21:17.600 --> 21:23.400]  And then, of course, there's a company called Elm that makes a tool for scan tools.
[21:24.000 --> 21:24.840]  Here's the Elm.
[21:24.900 --> 21:25.940]  Elm chipset.
[21:27.120 --> 21:29.020]  Supports all the OBD2 protocols.
[21:29.460 --> 21:31.440]  You have to sort of, you know, make your own.
[21:31.600 --> 21:32.340]  It's the chip itself.
[21:32.340 --> 21:35.120]  You have to, you know, cobble together your own devices.
[21:35.340 --> 21:36.360]  But it's AT commands.
[21:38.060 --> 21:41.740]  It's a little costly for, you know, high volume implementations.
[21:41.940 --> 21:45.620]  But the good news is there's a lot of little clones out there as well, too.
[21:46.060 --> 21:52.160]  So it's a very de facto standard for creating and talking to, you know, the CAN bus.
[21:52.340 --> 21:55.460]  So there's a lot of software out there that's based off of the Elm protocol as well.
[21:55.760 --> 22:01.340]  So you can, you know, get these free applications that can talk to your Elm-based device as well.
[22:01.340 --> 22:02.620]  In fact, I have one with me.
[22:02.780 --> 22:04.740]  I'll show it to you, anybody who wants to see it afterwards.
[22:06.440 --> 22:10.020]  So a little bit about the physical layer itself, because we're all a bunch of geeks.
[22:10.080 --> 22:11.820]  So we love physical layer.
[22:12.760 --> 22:14.420]  It's twisted pair similar to Ethernet.
[22:14.740 --> 22:15.320]  It does.
[22:15.600 --> 22:23.000]  And this is probably, if you are making, if you're going to go home and you want to make your own CAN bus network, because that's what I'm sure everybody's going to do after this, is going to make their own CAN bus network.
[22:23.380 --> 22:30.000]  You will have to make sure that the most important thing you can do is put 120 ohm resistor between CAN high and low.
[22:30.680 --> 22:32.360]  on either end of your CAN bus.
[22:32.660 --> 22:33.600]  So make a long string.
[22:33.940 --> 22:37.700]  This is the number one thing that I hear about from everybody who talks to me.
[22:37.780 --> 22:39.100]  It's like, I cooked it all up.
[22:39.120 --> 22:39.660]  It's perfect.
[22:40.260 --> 22:42.600]  I have my own CAN bus on my desk.
[22:42.920 --> 22:51.080]  And, of course, they didn't put the resistors there, and then nothing will work because, you know, you've made it two antennas.
[22:51.340 --> 22:54.440]  Now they're just two big antennas if you don't put the resistors on there.
[22:54.440 --> 22:56.240]  So you've got to put them there, and now you have a bus.
[22:57.120 --> 23:00.540]  Differential signal can have up to two to thirty nodes.
[23:01.280 --> 23:02.140]  And it's just wires.
[23:02.300 --> 23:03.140]  There's two copper wires.
[23:03.320 --> 23:05.320]  Just run, you know, twist them if you want to.
[23:05.420 --> 23:06.400]  Don't twist them if you don't want to.
[23:06.460 --> 23:06.980]  It's up to you.
[23:08.580 --> 23:12.560]  Remember, you know, the length is really the baud rate versus length problem.
[23:12.580 --> 23:14.160]  So you just have to have a little trade-off.
[23:14.540 --> 23:15.820]  So don't make it too long.
[23:15.940 --> 23:20.760]  But, you know, if it's ten meters, it's not going to be a problem for even the fastest CAN bus that you can set it to.
[23:21.260 --> 23:22.800]  So, you know, it's pretty simple.
[23:23.620 --> 23:25.360]  A little bit about the data frame itself.
[23:25.520 --> 23:28.980]  Actually, I think I have a little bit better view here.
[23:29.800 --> 23:34.120]  So the middle one is obviously an oscilloscope view of CAN frame.
[23:34.880 --> 23:38.540]  You'll notice it's not like just byte, byte, byte.
[23:38.660 --> 23:39.340]  No, here's one byte.
[23:39.400 --> 23:39.920]  Here's another byte.
[23:40.000 --> 23:40.440]  Here's another byte.
[23:40.540 --> 23:41.700]  Just all stacked next to each other.
[23:42.020 --> 23:47.280]  It's actually really well engineered to support all of the requirements for CAN bus.
[23:47.280 --> 23:53.100]  It has to be fast, reliable, and all nodes must, you know, be able to read the data as well.
[23:53.240 --> 23:56.200]  So you'll look here and, like, we have a starter frame.
[23:56.440 --> 23:57.900]  We've got an arbitration field.
[23:58.140 --> 24:02.220]  We've got a control field that tells us the data length, et cetera.
[24:03.360 --> 24:06.040]  You know, the data bytes are all sitting there.
[24:06.200 --> 24:06.980]  It's got a CRC.
[24:07.120 --> 24:09.380]  It's pretty good, robust CRC, 15 bits.
[24:09.600 --> 24:14.220]  You know, considering the size of the data, the amount of data that you can put in it, 15 bits is significant.
[24:14.760 --> 24:17.180]  An ACK field, and the end of frame.
[24:19.220 --> 24:24.120]  So it's really simple, easy to understand, not a lot, not very convoluted.
[24:24.360 --> 24:25.860]  You know, you just have a few things that you need to learn.
[24:25.980 --> 24:31.240]  Once you learn them, you know, you're in good shape as far as, you know, trying to figure out that.
[24:31.380 --> 24:34.940]  So, again, I told you I'm going to talk a little bit about that Arduino shield.
[24:35.200 --> 24:36.420]  You can get it at SparkFun.
[24:38.080 --> 24:41.220]  Again, don't forget those resistors if you're going to make your own network.
[24:42.060 --> 24:45.600]  The good news is if you connect to a vehicle, they're already there.
[24:45.720 --> 24:46.440]  You don't have to worry about it.
[24:46.460 --> 24:48.840]  It's a fully functional CAN bus.
[24:49.360 --> 24:50.340]  So it's not too bad.
[24:51.760 --> 24:53.780]  That's the Neovi that I was showing you a little bit earlier.
[24:54.000 --> 24:55.400]  It does have an OBD2 cable.
[24:55.540 --> 24:57.160]  You just connect right to the OBD2 port.
[24:59.920 --> 25:01.260]  Diagnostics versus normal messages.
[25:01.260 --> 25:10.540]  So when I talk to a lot of my customers that I work with on a daily basis, they really...
[25:10.540 --> 25:24.040]  This is the thing that I have to educate more people on than anything is the difference between the diagnostic information that you can get from the vehicle versus what's called normal messages, which is the information that just flows from controller to controller to controller.
[25:24.440 --> 25:25.580]  You don't have to do anything.
[25:25.600 --> 25:26.940]  It's just a stream of data.
[25:26.940 --> 25:30.000]  Now, with diagnostics, it's a strict protocol.
[25:31.620 --> 25:36.620]  And what's interesting about it is it's strict to the particular OEM, typically.
[25:36.900 --> 25:39.180]  So GM will have their diagnostic protocol.
[25:39.380 --> 25:40.460]  Chrysler will have theirs.
[25:40.700 --> 25:43.080]  They're all really based upon the same thing.
[25:43.240 --> 25:44.100]  It's like a...
[25:44.100 --> 25:45.380]  Think about a Latin-based.
[25:45.580 --> 25:55.240]  You know, there's this one unifying document that was created first, and then everybody just spawned their own diagnostic protocol based off of that.
[25:55.240 --> 25:56.280]  So they're all really similar.
[25:56.380 --> 25:59.340]  Once you learn one, to learn the other is very, very simple.
[25:59.920 --> 26:01.080]  But it's very strict.
[26:02.140 --> 26:04.640]  You know, the arbitration ID means this.
[26:04.980 --> 26:06.880]  The first data byte means this.
[26:07.000 --> 26:08.180]  The second data byte means this.
[26:08.280 --> 26:09.740]  So that's a very strict protocol.
[26:09.920 --> 26:16.740]  And it's, you know, if you go to a, you know, 2000 Chrysler to a 2012 Chrysler, that protocol's the same.
[26:16.900 --> 26:17.660]  It hasn't changed.
[26:17.660 --> 26:21.720]  And, you know, you can go even maybe a couple years before that.
[26:21.840 --> 26:22.600]  And it hasn't changed.
[26:22.700 --> 26:23.400]  It's always the same.
[26:24.580 --> 26:26.680]  It's used by the scan tools, right?
[26:26.840 --> 26:27.900]  So they have this.
[26:28.200 --> 26:29.800]  The OEMs make their own.
[26:29.940 --> 26:31.760]  Each OEM has their own scan tool.
[26:31.880 --> 26:33.020]  That's for that OEM.
[26:33.160 --> 26:34.880]  It's an OEM-specific scan tool.
[26:35.020 --> 26:36.260]  All the dealerships have one.
[26:36.800 --> 26:41.760]  And anybody who wants to work on a car that, you know, has the money has one as well.
[26:41.760 --> 26:45.500]  So because of that, they don't want to change the software that often.
[26:45.640 --> 26:47.820]  So they keep very strict protocols, very tight.
[26:48.080 --> 26:50.460]  And they don't change things much, unless they need to change.
[26:50.580 --> 26:57.360]  Like, obviously, there's going to be something different on a hybrid vehicle that you don't need to get on a regular, you know, non-hybrid.
[26:58.040 --> 27:00.380]  So, you know, they might add things for that.
[27:00.520 --> 27:04.020]  But other than that, everything is really backwards compatible as best as they can.
[27:04.300 --> 27:08.840]  So once you learn one thing on one vehicle, it probably is the same like on the other vehicles.
[27:09.160 --> 27:09.920]  There's not much difference.
[27:09.920 --> 27:12.420]  So there's a command and response as well.
[27:12.780 --> 27:18.260]  So what that means is the scan tool sends out a message to the car, and then the car responds back.
[27:18.380 --> 27:18.920]  It's that simple.
[27:19.180 --> 27:23.480]  And every message that has diagnostics always works in that same flow.
[27:23.700 --> 27:25.840]  The scan tool requests information, the car responds.
[27:26.140 --> 27:27.220]  Scan tool requests, response.
[27:30.200 --> 27:34.560]  So, you know, we can ask for, you know, what's this data value?
[27:34.620 --> 27:35.320]  What's this data value?
[27:35.400 --> 27:36.200]  What's this data value?
[27:36.340 --> 27:36.860]  What is it?
[27:36.900 --> 27:37.800]  And then it responds.
[27:37.800 --> 27:44.460]  And if you know the scaling, because there's a lot of, as it returns back, it's just an hexadecimal, so if you're talking engine speed or something like that, you have to rescale it.
[27:44.660 --> 27:47.740]  If you know the scaling of that, you can do it yourself from your own tools.
[27:47.960 --> 27:50.600]  You know, oh, I can mimic the scan tool and exactly what it's doing.
[27:51.800 --> 27:59.560]  Whereas if we take that in contrast with what normal messages are, normal messages really are just these messages that are just being sent.
[28:00.220 --> 28:10.800]  You know, the engine speed is going to be sent, the throttle position, the temperature, maybe torque requests, things like that, from one controller, and it's broadcasted out to the other controllers.
[28:10.940 --> 28:14.640]  But the only reason why I'd ever have to broadcast it out is because somebody else is listening.
[28:14.980 --> 28:19.120]  So if you think about it, like why would the engine...
[28:19.120 --> 28:25.380]  I mean, it's hard to, not everybody to think about it this way, but why would the engine need to share information about its mass airflow, right?
[28:25.520 --> 28:28.680]  So because it doesn't need to share that information, it's not going to send it out.
[28:28.900 --> 28:33.580]  So the only way to get it is through diagnostic requests, It's using a scan tool or something like that.
[28:34.360 --> 28:42.060]  So there's something that you wanted, like mass air flow or some sort of parameter that really only needs to be stuck inside of one controller.
[28:42.220 --> 28:43.640]  It handles it itself internally.
[28:43.820 --> 28:45.460]  Nobody needs to have that information.
[28:45.720 --> 28:50.000]  It's going to be only accessible through diagnostic messages if you're lucky.
[28:50.160 --> 28:52.880]  Most of the time it is, but it's only going to be there.
[28:53.100 --> 29:02.460]  So when you plug a tool in, like this Neovi or this, you know, either one of these devices, you plug them in, you're going to get this stream of data that's going to come across.
[29:02.600 --> 29:03.560]  These are normal messages.
[29:04.080 --> 29:10.900]  You're going to get that information, but the only thing that's in there is going to be information that needs to be shared amongst controllers.
[29:11.900 --> 29:19.440]  What that also means is as the vehicles change and as information that needs to be shared changes, that information changes.
[29:19.620 --> 29:22.000]  So it's not going to be consistent throughout the years.
[29:22.200 --> 29:25.820]  In fact, probably every two to three years, you're going to find that it's going to be completely different.
[29:26.200 --> 29:34.380]  So normal Normal messages also have things like... but this is really where the fun is, the normal messages, because that's really where the controls are.
[29:34.620 --> 29:36.780]  So that's like your unlock and your lock.
[29:37.500 --> 29:43.480]  So if you have a key fob or something like that, your lock, your unlock, that's really where you're going to find that particular information is through normal messages.
[29:43.640 --> 29:49.880]  You may be able to find it through diagnostic information, but it's really rare that some fun things like that lock and unlock are going to be there.
[29:50.440 --> 29:59.180]  So, you know, understanding the differences Messages between diagnostics and normal communications is really the key to if you're going to get out there and you're going to have, you know, fun with your own car.
[29:59.840 --> 30:01.800]  So reverse engineering with normal messages.
[30:02.220 --> 30:04.020]  Again, we just got to look for a pattern.
[30:04.400 --> 30:12.760]  You know, anybody who's worked with reverse engineering knows that once they establish a pattern, like you hit the key fob, every time I do it, hey, this message shows up.
[30:13.500 --> 30:16.140]  Chances are that's your key fob, that's your unlock message, right?
[30:16.360 --> 30:18.000]  Or you open the door on the car.
[30:18.140 --> 30:20.000]  Hey, every time I do that, this bit flips.
[30:20.320 --> 30:21.760]  It goes from zero to one to zero to one.
[30:21.980 --> 30:22.760]  Hey, that's the pattern.
[30:22.760 --> 30:27.480]  So establish a pattern, attempt to change the vehicle's input, and then use filtering.
[30:27.760 --> 30:29.100]  There's a lot of data there.
[30:29.300 --> 30:30.540]  You know it's not yours.
[30:30.720 --> 30:31.200]  Look at it.
[30:31.300 --> 30:32.280]  There's all this data changing.
[30:32.420 --> 30:33.240]  You're not opening the door.
[30:33.340 --> 30:34.280]  You're looking for the door message.
[30:34.440 --> 30:35.200]  You're not looking for the door.
[30:35.300 --> 30:36.300]  You're opening the door.
[30:36.440 --> 30:37.140]  It's not there.
[30:37.500 --> 30:38.560]  Try to filter it out.
[30:38.700 --> 30:42.100]  Use whatever methods you can to filter out all that extra data.
[30:43.520 --> 30:45.600]  A little bit about the diagnostic protocols.
[30:46.280 --> 30:52.100]  OBD2, or onboard diagnostics level 2, is really probably the most common thing.
[30:52.220 --> 30:58.640]  You go to Wikipedia, you can look up the entire spec, pretty much the entire spec, especially the messages themselves.
[30:59.060 --> 31:00.220]  So I recommend that.
[31:02.840 --> 31:06.580]  Many of the OEMs have their own flavor of diagnostics.
[31:07.020 --> 31:11.140]  There's ISO 14230, also known as UDS, or Universal Diagnostic System.
[31:11.460 --> 31:14.220]  That's used in, you know, Ford's starting to really adopt that.
[31:14.400 --> 31:17.200]  It's more of a European effort to try to unify diagnostics.
[31:18.380 --> 31:21.540]  It used to be ISO 14229.
[31:21.740 --> 31:22.760]  That's sort of the old one.
[31:23.500 --> 31:23.900]  You know what?
[31:23.900 --> 31:24.800]  I mixed those two up.
[31:25.220 --> 31:28.920]  UDS is actually ISO 14229, and the keyword is ISO 14230.
[31:29.220 --> 31:30.560]  I know it doesn't make any sense.
[31:30.900 --> 31:38.720]  The numbers are inverted, but ISO 14229 is actually the one that everybody's moving to from 14230.
[31:38.720 --> 31:40.340]  And then there's GM LAN.
[31:41.100 --> 31:48.260]  GM LAN is made by GM Motor, General Motors, and its specification you can download for free.
[31:48.400 --> 31:51.160]  I mean, not for free, but for like 50 bucks from IHS Global.
[31:51.860 --> 31:53.600]  It's GMW 3110.
[31:54.100 --> 31:59.120]  So that's a really, really useful spec if you want to learn about your, if you have a GM vehicle.
[32:01.320 --> 32:06.720]  All of these, all of these bottom ones, except for OBD2, are often referred to as enhanced diagnostics.
[32:07.920 --> 32:14.940]  So when you're, you know, whenever you're looking for, like, I want enhanced PIDs or something like that, these are in the enhanced level.
[32:15.200 --> 32:17.520]  It's really everything that's outside of OBD2.
[32:17.820 --> 32:27.980]  And just to give you an idea of why this exists, it's really, OBD2 is really only there for, you know, to understand how the emissions work on the vehicle.
[32:28.100 --> 32:29.880]  It's to do emissions tests, and that's it.
[32:30.160 --> 32:34.960]  You know, every state has their own, not every state, but a lot of states have their own emissions requirements.
[32:34.960 --> 32:42.600]  And if you want to go to like a local emissions, you know, I don't even, we don't have a Michigan, so I don't have to worry about it.
[32:43.140 --> 32:47.320]  If you want to go to get your emissions checked or whatever, they'll plug in their own little scan tool.
[32:48.100 --> 32:49.680]  And that's what OBD2 is for.
[32:49.800 --> 32:50.400]  And that's it.
[32:50.520 --> 32:54.420]  So if it's outside of the realm of emissions, it's all enhanced.
[32:54.420 --> 32:57.620]  So it's not required by any of the OEMs to do enhanced.
[32:57.860 --> 33:03.000]  So some of them will, you know, have, you know, some of their own parameters there.
[33:03.160 --> 33:06.760]  Some of them have, you know, parameter X, some of them have parameter Y and X.
[33:06.940 --> 33:09.600]  It's up to them what they're going to support with enhanced diagnostics.
[33:10.080 --> 33:14.240]  So you can't really be, you can't really understand the differences between the two.
[33:14.240 --> 33:21.160]  So enhanced diagnostics, you have to really get a scan tool that offers enhanced diagnostics.
[33:21.260 --> 33:23.780]  In fact, one of the ones that I use is called Auto Ingenuity.
[33:23.940 --> 33:31.200]  They make a very good, relatively low cost scan tool that offers you a lot of good enhanced ability as well.
[33:34.100 --> 33:41.380]  And if you're going to learn anything about diagnostic protocol, I recommend starting with ISO 15765.
[33:42.380 --> 33:50.220]  Specifically, ISO 15765-2 or just going over to canbushack.com and then reading my blog entry on ISO 15765.
[33:50.480 --> 33:54.200]  This is really the core of all diagnostic protocols.
[33:54.340 --> 33:58.980]  So if you're going to start, you know, interpreting diagnostic information yourself, that's really where it should start.
[33:58.980 --> 34:03.160]  A little bit about 14229 UDS or in 230.
[34:03.480 --> 34:05.020]  They have many overlapping functions.
[34:06.300 --> 34:10.440]  They combine to make about 80% of all of diagnostic vehicles.
[34:10.560 --> 34:14.500]  So if you learn just one or two of these, it's really very similar documents.
[34:14.980 --> 34:22.880]  If you learn just one or two of them, you'll really be ready to interpret any scan tool data that gets sent out by a scan tool.
[34:24.380 --> 34:28.200]  Each allows for OEM-specific functions and command responses.
[34:28.200 --> 34:34.080]  And they're also used for, you know, reading DTCs and controlling outputs.
[34:34.580 --> 34:36.040]  And everybody loves to control outputs.
[34:36.220 --> 34:49.260]  I mean, if you could, you know, make your car go a little bit slower because you wanted to send a command out and say, hey, turn off, you know, while you're driving around, turn off, you know, cylinder one and two.
[34:50.440 --> 34:51.780]  It's pretty fun, you know.
[34:52.360 --> 34:53.060]  I've done it.
[34:54.260 --> 34:54.620]  Hey.
[34:55.100 --> 34:55.860]  So you can do it.
[34:56.380 --> 34:58.200]  You know, just that's, those are the fun things.
[34:58.260 --> 35:07.160]  Or if you wanted to, if you're driving with your friend and you have your computer next to you and you wanted to lock the doors and honk the horn while you're driving, you can do it through diagnostics.
[35:07.420 --> 35:08.000]  It's fun.
[35:08.880 --> 35:11.180]  Honk the horn is definitely a good idea.
[35:14.640 --> 35:15.940]  Just be in the back seat.
[35:16.360 --> 35:16.840]  Hiding.
[35:18.220 --> 35:21.300]  General Motors Diagnostic Protocol, GMW 3110.
[35:21.940 --> 35:25.160]  So started with their, the old SOBs.
[35:25.340 --> 35:27.060]  SOB 93 started with GM LAN.
[35:27.440 --> 35:31.880]  So, so really from 2005 and newer GM moved to GM LAN.
[35:32.320 --> 35:35.160]  It's a, it's really, it's really a ubiquitous term.
[35:35.440 --> 35:40.300]  If you look at, if you were to search on this, a lot of people don't really have a grasp of what GM LAN really is.
[35:40.300 --> 35:42.920]  This is just the specification for GMW 3110.
[35:43.180 --> 35:47.420]  So any car that follows that specification is a GM LAN vehicle.
[35:49.240 --> 35:54.040]  A lot of people refer to GM LAN as the single wire can on the, on the vehicle.
[35:54.260 --> 35:54.940]  That's not GM LAN.
[35:55.060 --> 35:56.700]  It's a little bit more encompassing than that.
[35:57.360 --> 36:01.400]  Allows you for reading and writing data just like any of the other diagnostics specs.
[36:01.700 --> 36:03.100]  And it's only on GM, obviously.
[36:03.260 --> 36:06.100]  But it's really similar to all the other diagnostic protocols.
[36:06.300 --> 36:07.460]  There's a lot of overlap.
[36:07.700 --> 36:09.140]  There's really, they haven't changed too much.
[36:10.320 --> 36:14.880]  OBD II, 1996 or newer.
[36:15.080 --> 36:17.100]  Also known as SAE J1979.
[36:17.500 --> 36:20.320]  So if you're looking up specifications, J1979.
[36:21.100 --> 36:24.020]  They've replaced J1979 with 15765.
[36:24.380 --> 36:28.180]  But you'll see that still J1979 is a good spec to read if you're going to go there.
[36:28.440 --> 36:32.380]  There's 10 different modes that are defined.
[36:33.880 --> 36:36.120]  Again, emissions related only.
[36:36.560 --> 36:39.720]  So if it's not emissions related, it's really not going to be there.
[36:40.340 --> 36:41.720]  There's just no reason for it.
[36:42.700 --> 36:43.560]  Mode one.
[36:43.760 --> 36:46.920]  They often refer to their services or functions as modes.
[36:48.060 --> 36:52.700]  So mode one is how you can read data by parameter ID or a PID.
[36:52.700 --> 36:57.120]  And this is probably the term that a lot of people are looking for, these PIDs, these parameter IDs.
[36:57.220 --> 37:05.740]  It's just a single ID that defines engine speed, vehicle speed, maybe engine coolant temperature, etc.
[37:06.240 --> 37:15.760]  Again, you can go to Wikipedia and you can look up every single one of the PIDs and what they do and a little bit of how they're interpreted as the response comes back.
[37:17.060 --> 37:22.180]  And really represents really a very small fraction of all the diagnostics that exist on the vehicle network.
[37:22.380 --> 37:23.560]  But it's a good place to start.
[37:23.720 --> 37:24.140]  It really is.
[37:24.260 --> 37:28.020]  Just once you get your feet wet with OBD2 because there's so many tools.
[37:28.440 --> 37:34.540]  You know, for like $100 you can go, even cheaper than that, you can go to like AutoZone or something like it, and buy a scan tool.
[37:34.840 --> 37:38.400]  You know, and really simple, just plug it in and it'll just send diagnostic information.
[37:38.600 --> 37:39.720]  Now, you don't have to plug it into your car.
[37:39.860 --> 37:43.940]  You can plug it into your, you know, your Arduino and see what it's doing.
[37:45.740 --> 37:46.760]  It'll send out a message.
[37:46.880 --> 37:55.980]  And as long as you know how to respond to that message, Wikipedia, my blog, etc., you can start to learn how to formulate those responses.
[37:57.220 --> 37:59.140]  And then you don't even need a car anymore.
[37:59.540 --> 38:02.280]  You know, if you live in New York City, you probably don't have a car.
[38:03.040 --> 38:04.180]  So, you don't need a car.
[38:04.340 --> 38:06.240]  You can just, you know, just do it on a bench.
[38:06.500 --> 38:07.380]  And it's a lot of fun.
[38:10.700 --> 38:11.340]  Diagnostic commands.
[38:13.600 --> 38:13.920]  CAN bus.
[38:14.320 --> 38:16.160]  So, what was I trying to say here?
[38:18.080 --> 38:21.220]  With diagnostics, you know, we are at the mercy of the control software.
[38:21.560 --> 38:23.100]  This is one thing that a lot of people understand.
[38:23.100 --> 38:28.580]  They say, well, I just want to, you know, I just want to make the trunk open and closed, too.
[38:28.580 --> 38:33.420]  You know, you don't have an auto-closed trunk, but you want to make it closed by sending data.
[38:33.660 --> 38:35.160]  You are at the mercy of the software.
[38:35.400 --> 38:41.600]  So, if your software can't do it, if it says, no, I can't do it, well, then you're going to have to change the software.
[38:41.820 --> 38:41.980]  Right?
[38:42.120 --> 38:42.420]  Easy.
[38:42.660 --> 38:43.840]  You know, just modify it.
[38:44.080 --> 38:45.320]  Now, that's a whole different class.
[38:46.920 --> 38:52.300]  But, you know, just, if you wanted to, if you want to send data to the car, you absolutely can.
[38:52.460 --> 38:55.140]  You can send it and it will say, thank you for the data, no.
[38:55.680 --> 38:56.540]  I will not do that.
[38:57.660 --> 38:58.300]  And it will.
[38:58.440 --> 38:59.420]  It does it all the time.
[38:59.540 --> 39:00.620]  I try and try and try.
[39:00.820 --> 39:04.900]  But that's kind of the fun, you know, having it say no and then making it say yes, eventually.
[39:05.900 --> 39:07.480]  You know, just tricking it.
[39:08.240 --> 39:16.780]  And once you start learning and you're combining those normal messages with the diagnostic information, if you can combine those two, like, I'll give you a great example.
[39:16.780 --> 39:21.020]  I have a problem where I'm trying to make the fuel control module turn on.
[39:21.320 --> 39:22.340]  That's this, right?
[39:22.500 --> 39:23.160]  Fuel control module.
[39:24.120 --> 39:28.160]  I'm trying to make the fuel control module turn on and it says no after 30 seconds.
[39:28.280 --> 39:29.300]  No, I won't turn on.
[39:29.940 --> 39:37.240]  Well, I figured out a way using a combination of normal messages and diagnostic messages to make it say yes, eventually.
[39:37.400 --> 39:40.300]  I don't have to change the software, although I was looking into it if I needed to.
[39:41.580 --> 39:46.120]  But, you know, there's a way to bypass some of the software restrictions.
[39:46.500 --> 39:52.460]  Another good example, I actually had two problems, two different OEMs trying to turn the fuel control module on.
[39:53.040 --> 39:57.360]  Another one, it said, okay, no, I won't turn the fuel control module on.
[39:57.380 --> 39:58.820]  I said, well, then reset software.
[39:59.020 --> 40:00.320]  Okay, now turn it on.
[40:00.420 --> 40:01.460]  Okay, no problem.
[40:01.580 --> 40:04.520]  So, you know, using diagnostic messages to tell it to reset.
[40:04.520 --> 40:06.980]  Maybe you have to take a different way around it.
[40:07.580 --> 40:09.360]  So, you know, so there's a lot of different services.
[40:09.600 --> 40:12.240]  And maybe you're not using them for what they're intended for.
[40:12.480 --> 40:13.880]  That's the other thing that's really important.
[40:14.240 --> 40:21.360]  Don't necessarily have to use them for what they're intended for, you know, but for your own will, which is kind of the fun part as well.
[40:24.580 --> 40:29.620]  So, the commands that we use, so you can do things like, you know, locking, unlocking the doors.
[40:29.620 --> 40:32.000]  Engine idle speed is a really common one.
[40:32.460 --> 40:34.460]  Remember, all of these are diagnostics.
[40:34.760 --> 40:43.880]  So, really, we have to think about, okay, what would the diagnostic technician need to do to solve a problem on this vehicle?
[40:44.020 --> 40:46.280]  Well, then we can probably do it ourselves.
[40:46.600 --> 40:47.980]  So, we can send our own commands.
[40:49.420 --> 40:52.480]  There's always a sequence in order to them.
[40:52.660 --> 40:53.440]  Again, command response.
[40:53.660 --> 40:55.000]  Sometimes it's a sequence of them.
[40:55.000 --> 40:56.160]  You know, you have to set it up.
[40:56.260 --> 40:58.160]  Say, okay, I want to start diagnostics now.
[40:58.360 --> 41:00.900]  And now that I've started diagnostics, now I want to do this.
[41:01.060 --> 41:01.560]  I want to do that.
[41:04.880 --> 41:06.100]  And that's probably all over here.
[41:06.320 --> 41:06.480]  Okay.
[41:06.620 --> 41:07.520]  And then normal messages.
[41:07.860 --> 41:10.460]  These are, again, we're going back to...
[41:10.460 --> 41:14.440]  These are the messages between them, between two controllers.
[41:17.160 --> 41:20.360]  So, they're typically a little bit harder to find these commands, as you can imagine.
[41:20.660 --> 41:22.000]  There's no format.
[41:22.000 --> 41:25.180]  You can't just tell a scan tool that, hey, send this command.
[41:25.440 --> 41:26.400]  You have to look for it.
[41:26.480 --> 41:34.640]  You have to actually, you know, press the key fob, open the door, open the trunk, you know, drive the car down the road if you need to find vehicle speed or something like that.
[41:34.780 --> 41:37.720]  So, these things are... this is data that's just normally going out there.
[41:38.560 --> 41:49.280]  And the problem with CAN bus is, you know, if you have a controller that's sending that message, but you want to send it instead, well, that controller is not going to stop sending that message just because you want to send it.
[41:49.280 --> 42:01.720]  So, you have to find a way, really creative, intuitive ways, like to make that message disappear as best as possible or to send your message immediately after it so that you can send your own version of it.
[42:01.880 --> 42:02.480]  So, these are things.
[42:02.660 --> 42:06.420]  But then, of course, there's always consequences to you sending your own version of it, obviously.
[42:07.260 --> 42:18.260]  So, you have to be aware that if you're driving down the road and you turn off, you know, like, the traction control or something like that, you know, it's gone.
[42:18.400 --> 42:19.240]  It's gone for a while.
[42:19.400 --> 42:25.020]  And you have to learn how to then send diagnostic commands to clear any information that you may have caused.
[42:25.220 --> 42:27.160]  Like, I still have that airbag light on my car.
[42:27.240 --> 42:28.040]  I've got to get rid of that.
[42:29.560 --> 42:30.860]  So, you know, it happens.
[42:31.160 --> 42:32.400]  I don't know if my airbags work.
[42:32.500 --> 42:33.000]  We'll find out.
[42:35.360 --> 42:44.300]  So, you know, so you have to be, you know, be aware that with, you know, when you're working with these messages, you still have all these physical layer constraints that you have to deal with.
[42:44.660 --> 42:47.580]  You know, the CAN bus message is going out from the other controller.
[42:47.720 --> 42:50.800]  So, if you need to send your version of it, you have to find a way to shut it up.
[42:50.800 --> 42:53.620]  Now, you could physically pull the module.
[42:53.780 --> 42:54.860]  Obviously, that's not a good idea.
[42:54.860 --> 42:57.580]  In a lot of cases, especially the engine controller, it just won't drive.
[42:57.960 --> 43:02.640]  But you could pull, like, fuses or there are other diagnostic commands to make it work.
[43:02.720 --> 43:09.840]  But, you know, you really have to get in there and, you know, pull up your sleeves a little bit to figure out how to disable some of these other normal communications.
[43:10.080 --> 43:13.480]  But in the case of some communications, they only happen one time.
[43:13.580 --> 43:14.080]  They're events.
[43:15.080 --> 43:17.480]  You know, the unlock commands or something like that.
[43:18.360 --> 43:22.180]  You can send your version of unlock and then the car unlocks.
[43:22.500 --> 43:22.700]  It's great.
[43:23.200 --> 43:24.540]  Or send the lock and the car locks.
[43:24.700 --> 43:25.380]  So, it's pretty fun.
[43:29.940 --> 43:30.600]  Let's see.
[43:31.320 --> 43:32.180]  Security systems.
[43:32.900 --> 43:38.260]  So, a lot of people are, if they're going to get into the car, they're going to want to know a little bit more about the security in them.
[43:38.660 --> 43:46.260]  So, the OEMs were smart and they said, hey, listen, what if somebody else wanted to, like, change the firmware on this?
[43:46.260 --> 43:47.700]  Would that be a bad thing or a good thing?
[43:47.780 --> 43:48.620]  That's a bad thing.
[43:48.780 --> 43:50.240]  So, let's secure it.
[43:50.660 --> 43:53.960]  Or what if somebody else wanted to change this parameter here or that parameter there?
[43:54.320 --> 44:00.660]  Or put a new key, you know, like, hey, I've got this key, but I need to learn a new key to my car so I can start it.
[44:01.060 --> 44:05.000]  Like, we should probably protect that information a little bit and make it a little bit harder for them.
[44:05.140 --> 44:08.600]  So, what they do, what almost every, actually, every OEM does this.
[44:08.600 --> 44:12.440]  They secure it using something called Mode 27 or Service 27.
[44:13.700 --> 44:17.480]  And how it works is you request a seed from the car.
[44:17.660 --> 44:18.940]  Say, hey, give me a seed.
[44:19.220 --> 44:20.860]  Actually, I probably even have one here.
[44:21.360 --> 44:23.420]  I could even look for it if I was so inclined.
[44:25.000 --> 44:25.660]  There it is.
[44:26.480 --> 44:28.540]  So, you know, hey, give me a seed.
[44:28.740 --> 44:29.600]  02-2701.
[44:30.580 --> 44:31.700]  That says, give me a seed.
[44:31.700 --> 44:33.080]  And then it says, okay, here's your seed.
[44:34.440 --> 44:36.660]  67-01-19-83.
[44:37.040 --> 44:37.400]  That's it.
[44:37.500 --> 44:38.060]  19-83.
[44:38.240 --> 44:39.440]  So, we take this 19-83.
[44:39.700 --> 44:42.000]  We apply it to some algorithm that I know of.
[44:42.100 --> 44:44.760]  You know, it's just a standard hash algorithm of some sort.
[44:45.000 --> 44:50.440]  And then, later down, actually, that's the one.
[44:50.660 --> 44:51.720]  I've got to find the other 27.
[44:56.870 --> 44:57.970]  Okay, there's the response.
[44:58.370 --> 45:00.350]  So, it says, okay, here's your key.
[45:00.550 --> 45:02.970]  So, it's 88-5-CF or whatever.
[45:02.970 --> 45:08.850]  So, you know, standard, you know, hey, here's the hash response to that seed.
[45:10.090 --> 45:11.770]  Now, it says, okay, I agree.
[45:11.770 --> 45:13.910]  We both calculated the same value.
[45:13.910 --> 45:15.270]  So, it is now unlocked.
[45:15.650 --> 45:17.150]  Good news is, it's unlocked.
[45:17.490 --> 45:19.350]  Now, I don't have to know the algorithm.
[45:19.670 --> 45:21.270]  Some other tool knew the algorithm.
[45:21.650 --> 45:22.730]  Now, it's open.
[45:22.930 --> 45:24.290]  I can do whatever I want now.
[45:24.610 --> 45:24.970]  Right?
[45:25.110 --> 45:25.650]  It's open.
[45:25.930 --> 45:29.070]  I can change those parameters that it didn't let me change before.
[45:29.070 --> 45:30.650]  I can reflash the module.
[45:30.770 --> 45:32.150]  Heck, that's what I'm doing right now, right?
[45:32.150 --> 45:33.010]  This is the whole reflash.
[45:33.110 --> 45:37.730]  I'm letting another tool to do it, but it actually unlocked the controller for me.
[45:38.450 --> 45:44.070]  What's really interesting is GM, they don't have a very dynamic seed key.
[45:44.310 --> 45:47.050]  So, that only ever sends the single seed.
[45:47.270 --> 45:49.150]  So, I know now how to unlock this car.
[45:49.430 --> 45:50.150]  85-CF.
[45:50.950 --> 45:53.030]  I'm not going to tell you which car is mine out there.
[45:53.170 --> 45:54.350]  But, it's there.
[45:54.510 --> 45:56.670]  And you can now unlock this controller.
[45:57.050 --> 45:58.750]  And now, what can I really do?
[45:58.910 --> 46:00.990]  I mean, I can reflash it.
[46:01.050 --> 46:02.170]  I can delete the firmware.
[46:02.490 --> 46:02.970]  For sure.
[46:03.150 --> 46:03.630]  Real easy.
[46:03.890 --> 46:04.290]  You know?
[46:04.710 --> 46:05.450]  It will...
[46:05.910 --> 46:07.210]  It doesn't brick the module.
[46:07.470 --> 46:09.130]  It's usually the boot loaders are really good.
[46:09.230 --> 46:10.510]  You can still communicate with it.
[46:10.510 --> 46:15.750]  But, you know, it's really sucked to wake up and your engine controller doesn't have software in it.
[46:15.770 --> 46:17.350]  So, it's possible.
[46:17.570 --> 46:18.410]  It's possible.
[46:18.450 --> 46:18.830]  You know?
[46:18.990 --> 46:19.510]  You never know.
[46:19.730 --> 46:21.410]  So, you can unlock these controllers.
[46:21.550 --> 46:24.210]  Either another controller can do that or you can.
[46:25.030 --> 46:26.690]  So, you know, you can crack...
[46:26.690 --> 46:28.770]  You know, if you crack it, it could be profitable.
[46:28.970 --> 46:31.270]  I've heard of people paying good money for that.
[46:31.270 --> 46:34.390]  So, you know, the security systems are pretty basic.
[46:34.570 --> 46:35.270]  You know, you unlock it.
[46:35.390 --> 46:37.310]  And sometimes, there's a dual security system.
[46:37.430 --> 46:38.410]  I've definitely seen that before.
[46:38.590 --> 46:40.550]  You know, you want to write your own odometer to the car.
[46:40.770 --> 46:42.030]  I don't know why anybody would want to do that.
[46:42.110 --> 46:43.090]  Just to increase your miles.
[46:43.230 --> 46:44.750]  Make it look like you're getting good gas mileage.
[46:44.750 --> 46:45.030]  I know.
[46:47.790 --> 46:49.550]  So, let's say you wanted to change your odometer.
[46:49.670 --> 46:52.270]  A lot of them will have this standard security.
[46:53.150 --> 46:53.750]  Really simple.
[46:53.890 --> 46:57.410]  And then they'll have a second layer of security in order to rewrite their odometer on it.
[46:57.450 --> 47:00.250]  Because that's a very valid application, rewriting an odometer.
[47:00.250 --> 47:05.630]  Because if your odometer is replaced, you know, you're going to need to write the new value to it.
[47:05.790 --> 47:08.410]  So, it could be, you know, could be very useful.
[47:11.950 --> 47:14.190]  So, and that actually, that brings us to Q&A.
[47:14.310 --> 47:15.530]  So, we have about 10 minutes.
[47:15.690 --> 47:16.630]  So, I have time for Q&A.
[47:16.750 --> 47:18.330]  They said there's mics up there.
[47:18.350 --> 47:21.410]  So, if anybody has any questions, you can turn the lights up a little bit.
[47:21.490 --> 47:23.470]  I think it'd be time to do it.
[47:23.550 --> 47:24.230]  And we have some questions.
[47:24.350 --> 47:24.530]  Go ahead.
[47:25.650 --> 47:25.990]  Thanks.
[47:30.930 --> 47:31.410]  Go ahead.
[47:32.370 --> 47:34.370]  So, there's a company called Ross Tech.
[47:34.570 --> 47:38.630]  And they make a Vagcom is the software and like a USB dongle and all that.
[47:38.930 --> 47:42.030]  And it was like about $100 to get into that.
[47:42.310 --> 47:42.350]  Yeah.
[47:42.350 --> 47:43.610]  Are they like an anomaly?
[47:43.890 --> 47:47.830]  Or do other people have that kind of fanaticism support for different makes and models?
[47:49.490 --> 47:51.390]  I've actually never used the Vagcom thing.
[47:51.690 --> 47:55.450]  But I think, like I said, Auto Ingenuity has a tool, but it's not as cheap.
[47:56.710 --> 47:58.770]  I don't know who has some...
[47:58.770 --> 48:01.970]  There's like Elm tools you can buy, things like that.
[48:02.430 --> 48:03.490]  I don't really know.
[48:03.690 --> 48:04.590]  To be honest, I think they're it.
[48:05.030 --> 48:06.670]  I've heard of it, but I don't know.
[48:06.810 --> 48:07.950]  But it's just for Volkswagen.
[48:08.250 --> 48:08.670]  Just VW and Audi.
[48:08.670 --> 48:09.110]  Yeah, yeah.
[48:09.150 --> 48:09.470]  VW.
[48:09.650 --> 48:10.250]  Yeah, it's Vag.
[48:11.230 --> 48:11.590]  Vags.
[48:13.690 --> 48:14.050]  Vags.
[48:14.310 --> 48:14.850]  That's true.
[48:14.850 --> 48:18.030]  I just wanted to ask you, what does the arbitration on the bus...
[48:18.030 --> 48:19.610]  How does each phone know...
[48:19.610 --> 48:20.350]  Oh, arbitration.
[48:20.650 --> 48:21.610]  Hey, I'm ready to talk.
[48:21.890 --> 48:22.370]  Yeah, yeah, yeah.
[48:22.370 --> 48:22.750]  Okay.
[48:23.270 --> 48:25.270]  So, let's use my hands.
[48:25.950 --> 48:26.130]  Okay.
[48:26.430 --> 48:28.110]  We have two controllers.
[48:28.310 --> 48:29.450]  This is a typical...
[48:29.450 --> 48:32.410]  Everybody who works with serial data networks understands a little bit about this.
[48:32.530 --> 48:33.550]  But you have two controllers.
[48:33.710 --> 48:34.070]  They both...
[48:34.070 --> 48:34.810]  The bus is free.
[48:34.950 --> 48:36.690]  Both controllers can talk at the same time.
[48:36.990 --> 48:38.210]  They both start talking.
[48:38.770 --> 48:40.130]  Clearly a collision is going to happen.
[48:40.370 --> 48:43.650]  In the case of Ethernet, it detects the collision, starts, resets, right?
[48:43.650 --> 48:44.310]  Everybody knows that.
[48:44.450 --> 48:48.970]  But with Ethernet, with CAN bus, only one of them or...
[48:48.970 --> 48:49.750]  One of them will stop.
[48:50.310 --> 48:51.210]  So, we'll both...
[48:51.210 --> 48:54.950]  Both nodes will start sending a starter frame.
[48:55.530 --> 48:56.170]  They'll go.
[48:56.490 --> 48:58.190]  And then we'll start with our arbitration ID.
[48:58.530 --> 48:58.690]  All right?
[48:59.070 --> 48:59.490]  Da, da, da.
[48:59.730 --> 49:00.130]  And then...
[49:00.130 --> 49:01.250]  But one of them will say...
[49:01.250 --> 49:03.470]  Will go high with an arbitration ID.
[49:03.630 --> 49:04.350]  And one of them will go low.
[49:04.810 --> 49:06.170]  Well, low wins, right?
[49:06.310 --> 49:06.910]  Because it's a...
[49:06.910 --> 49:07.810]  It's a lower number.
[49:08.010 --> 49:09.090]  Essentially, that's how it works.
[49:09.250 --> 49:10.490]  So, low wins.
[49:12.670 --> 49:16.130]  And as you're transmitting, you're also listening at the same time.
[49:16.330 --> 49:19.750]  So, you realize, hey, the bus went low, but I didn't want it to go low.
[49:20.750 --> 49:21.470]  That's not good.
[49:21.630 --> 49:23.170]  That means I'm being arbitrated out.
[49:23.250 --> 49:27.610]  That means somebody else is sending an arbitration frame at the same time I was.
[49:27.770 --> 49:30.510]  The whole time, we've been in sync with each other, but now we're out of sync.
[49:31.070 --> 49:31.670]  I'm listening.
[49:31.770 --> 49:32.870]  Now I go to a receiver.
[49:33.490 --> 49:39.930]  I back off, and then the transmitter who was transmitting has no idea that I was ever even talking on the bus.
[49:40.050 --> 49:43.770]  Because as far as it's concerned, the wave, if you look at the wave on the bus, you would never know.
[49:44.050 --> 49:45.210]  So, that's it.
[49:45.330 --> 49:47.290]  It says, okay, I'm arbitrated out.
[49:47.970 --> 49:48.850]  Move on to the next one.
[49:49.150 --> 49:51.390]  And the ID is the ID of the module, or...?
[49:51.390 --> 49:53.590]  The ID is really just a concept, right?
[49:53.650 --> 49:57.610]  The ID really means, all right, this is the data that's stored here.
[49:57.610 --> 49:58.270]  You know what I mean?
[49:58.490 --> 49:59.170]  This is...
[49:59.170 --> 50:05.470]  ID 111 means every time 111 comes out, I have this data in this frame, in this format.
[50:05.850 --> 50:06.870]  That's really all it's for.
[50:06.970 --> 50:07.650]  It doesn't really necessarily...
[50:08.190 --> 50:16.030]  It means something in the case of diagnostics, 70, 0, et cetera, but it doesn't really mean anything in the case of normal messages themselves.
[50:16.330 --> 50:16.570]  Thanks.
[50:16.810 --> 50:17.170]  Yeah, no problem.
[50:18.450 --> 50:23.950]  I've been messing around with a little bit of some of the Ford software, the Ford IDS.
[50:24.030 --> 50:24.630]  IDS, yes.
[50:24.870 --> 50:26.070]  Do you have a knockoff can?
[50:26.510 --> 50:27.230]  Yes, I do.
[50:27.230 --> 50:28.070]  Yeah, the Chinese one?
[50:28.670 --> 50:29.170]  It's cheaper.
[50:29.190 --> 50:29.970]  It's a bit of a monster.
[50:30.110 --> 50:31.710]  I had to open it up and fix a few things.
[50:31.970 --> 50:34.210]  But, you know, you get what you pay for, and that's fine.
[50:34.250 --> 50:34.990]  I don't want to fix it.
[50:36.390 --> 50:39.210]  Now, the software, though, that comes with it seems to be...
[50:39.210 --> 50:40.050]  It's a...
[50:40.050 --> 50:40.810]  So bad.
[50:41.310 --> 50:43.350]  I don't mind, like, if there's any...
[50:43.350 --> 50:45.430]  Is there anything else to go on with that?
[50:45.510 --> 50:47.350]  Because there's some features I like, but I don't even want to put it in my car.
[50:47.350 --> 50:51.270]  I don't represent the company at all, but I recommend the auto-ingenuity tool.
[50:51.390 --> 50:52.550]  It's really good for enhanced stuff.
[50:52.790 --> 50:56.110]  Like, just enhance PIDs, just enhance control, they're very good.
[50:56.110 --> 51:02.150]  But if you want to do something that's not, like, only four technicians should be able to do, the IDS tool is really the only way to go, unfortunately.
[51:02.850 --> 51:03.110]  From...
[51:03.110 --> 51:04.750]  What happens, like, the next layer underneath it?
[51:04.850 --> 51:07.170]  Like, I haven't been willing to plug it in my car because it scares me.
[51:07.270 --> 51:07.870]  Just trying to...
[51:07.870 --> 51:08.510]  Like, it crashes.
[51:08.670 --> 51:09.390]  It does lots of other things.
[51:09.430 --> 51:10.630]  I'm just looking at this and it's like, okay...
[51:10.630 --> 51:11.150]  It'll be fine.
[51:11.250 --> 51:11.730]  It'll be fine.
[51:11.850 --> 51:12.170]  It'll really...
[51:12.170 --> 51:12.670]  Plug it in.
[51:12.830 --> 51:14.030]  It won't hurt any...
[51:14.390 --> 51:15.610]  Chances are it won't hurt anything.
[51:15.610 --> 51:16.470]  It won't hurt.
[51:17.250 --> 51:17.770]  It'll be fine.
[51:17.910 --> 51:18.090]  It'll be fine.
[51:18.290 --> 51:22.670]  I got the bumper-to-bumper electronic warranty and, you know, I'm not here talking about this...
[51:22.670 --> 51:23.230]  I would never...
[51:23.230 --> 51:24.290]  Yeah, I don't know what you're talking about.
[51:24.570 --> 51:25.750]  I didn't plug in the...
[51:25.750 --> 51:26.930]  Was that a knock-off?
[51:27.110 --> 51:27.430]  I don't know.
[51:28.610 --> 51:29.810]  A real technician did it.
[51:29.810 --> 51:30.090]  Yeah, yeah.
[51:30.090 --> 51:30.790]  But in my house.
[51:30.830 --> 51:31.470]  Oh, my goodness.
[51:31.990 --> 51:36.410]  But, you know, there's a lot of neat systems in this thing with, like, you know, collision avoidance and lots of other stuff.
[51:36.410 --> 51:36.630]  Okay.
[51:36.650 --> 51:38.590]  I'm thinking, you know, where...
[51:38.590 --> 51:40.570]  Like, is this stuff documented anywhere?
[51:40.770 --> 51:43.230]  Like, I noticed you mentioned some protocols, but which protocol are they using?
[51:43.250 --> 51:45.730]  And can I communicate closer to the IDS?
[51:46.750 --> 51:50.410]  If you want to, like, simulate a car, you're going to need to learn 14229.
[51:51.330 --> 51:51.590]  Okay.
[51:51.590 --> 51:56.650]  I mean, or 14230, depending on which car you have, because Ford did transition away from 14230.
[51:57.750 --> 52:01.930]  But if I look at the IDS software, they won't be speaking this internally, correct?
[52:03.470 --> 52:07.050]  It'll talk to it, to the controller, to the...
[52:07.050 --> 52:10.710]  I don't know how much is handled on the hardware itself and versus the software.
[52:11.010 --> 52:11.230]  Okay.
[52:11.330 --> 52:12.930]  To be honest, I don't know what the interaction is.
[52:13.050 --> 52:16.830]  But I just know what's output from the controller, and it's, you know...
[52:16.830 --> 52:17.170]  Okay.
[52:17.290 --> 52:18.690]  So it's an unknown thing.
[52:18.830 --> 52:21.730]  So essentially, it's like three points got a point, but no one knows yet.
[52:22.110 --> 52:22.770]  Yeah, I don't know.
[52:22.890 --> 52:23.690]  Unfortunately, I don't know.
[52:23.970 --> 52:24.310]  Well, that's...
[52:24.310 --> 52:26.110]  I mean, if no one knows, then I'll take a look.
[52:26.310 --> 52:26.450]  Yeah.
[52:26.650 --> 52:27.290]  Good luck.
[52:27.530 --> 52:27.630]  Yeah.
[52:27.630 --> 52:27.990]  Okay, thanks.
[52:28.210 --> 52:28.650]  Yep, no problem.
[52:31.570 --> 52:33.550]  Have you messed around with motorcycles at all?
[52:33.830 --> 52:39.550]  I used to work with Harley a little bit, but they just were starting to get into CAN bus at the time, so...
[52:39.550 --> 52:44.270]  Yeah, so both Ducati and BMW use similar stuff.
[52:44.430 --> 52:44.490]  Yep.
[52:44.670 --> 52:51.810]  And actually, some guy did a thesis on... his thesis for school on reverse engineering the whole Ducati thing, so...
[52:51.810 --> 52:56.290]  You know, I saw a Ducati board where they were talking about that, but I never really read the whole thing.
[52:56.290 --> 52:57.290]  It's called Ducati Diag.
[52:57.750 --> 52:58.490]  It's really interesting.
[52:58.670 --> 52:58.730]  Yep.
[52:58.730 --> 53:02.470]  And you can do all kinds of stuff, like redo the fuel maps and...
[53:02.470 --> 53:02.990]  Yes.
[53:03.330 --> 53:06.170]  So that's a huge business, you know, redoing fuel maps.
[53:06.250 --> 53:09.550]  Clearly, anybody who's a tuner knows about redoing it, but that's really not...
[53:10.110 --> 53:12.350]  That's a really high-level application of it.
[53:12.610 --> 53:12.810]  Yeah.
[53:12.830 --> 53:13.410]  I have two minutes.
[53:13.570 --> 53:13.630]  Okay.
[53:14.470 --> 53:14.870]  Thanks.
[53:14.870 --> 53:15.570]  Yeah, no problem.
[53:16.050 --> 53:16.390]  Ducati.
[53:17.250 --> 53:18.070]  You got a Ducati?
[53:18.830 --> 53:18.970]  Yeah.
[53:19.310 --> 53:19.530]  I'm sure.
[53:20.150 --> 53:28.150]  Oh, with the transition towards EPS or electronic power steering, is that going to be put on these buses as well?
[53:28.190 --> 53:28.310]  No.
[53:28.630 --> 53:30.150]  No, no, no, no, no, no, no, no, no, no, no, no.
[53:30.150 --> 53:31.310]  So you won't be able to...
[53:31.310 --> 53:33.390]  But you'll be able to hack them nonetheless, obviously.
[53:33.610 --> 53:36.410]  But no, they won't put them on the buses, but the controllers are there.
[53:36.610 --> 53:37.670]  So the software's there.
[53:37.850 --> 53:37.990]  Yep.
[53:37.990 --> 53:38.430]  Right?
[53:38.730 --> 53:38.930]  Okay.
[53:39.730 --> 53:48.310]  There are private CAN buses as well between two controllers, like a lot of ABS controllers, engine controllers, will have their own private CAN network.
[53:48.490 --> 53:53.890]  You'll have to tap into those so they have some physical security that you have to augment, which is good, actually.
[53:54.010 --> 53:55.670]  That sort of, like, gap is good.
[53:55.830 --> 53:59.730]  However, the controllers, there's still controllers that are on the CAN bus.
[53:59.950 --> 54:11.530]  So if we find a way to modify software, clearly, and we can reflash it over the CAN bus, I mean, we have a potential for, you know, steering into, you know, school children, which is good.
[54:11.730 --> 54:12.730]  I mean, it's bad.
[54:12.990 --> 54:13.390]  Don't do that.
[54:13.390 --> 54:15.950]  I have kids, so don't know.
[54:16.210 --> 54:16.330]  Yeah.
[54:16.910 --> 54:21.610]  But fortunately, they're a little bit smart, and they think, well, we'll set it aside, and they won't do it.
[54:21.670 --> 54:22.190]  And that's good.
[54:22.650 --> 54:26.310]  But the software, although they're getting better with securing software, to be honest with you.
[54:26.530 --> 54:27.050]  So that's good.
[54:27.330 --> 54:27.670]  Thanks.
[54:27.830 --> 54:27.930]  Yep.
[54:30.290 --> 54:32.830]  Do you recommend any particular CAN stack?
[54:35.210 --> 54:46.930]  Like, as far as CAN stacks for diagnostics, or CAN stacks for just general, like, I'm going to make my own controller, I want to throw a CAN stack, like, I've got a MotorTron, and I want to throw my own CAN stack.
[54:46.990 --> 54:52.150]  Yeah, I did some work many years ago with CAN bus and a CAN stack and embedded applications.
[54:52.190 --> 54:57.570]  Well, I mean, I've used a handful of them only by proxy, really, through some of the other control guys.
[54:57.570 --> 55:00.070]  And so I can't really recommend anybody good.
[55:00.230 --> 55:01.070]  They're just really expensive.
[55:01.210 --> 55:01.730]  That's all I know.
[55:02.090 --> 55:02.830]  Yeah, they are.
[55:03.030 --> 55:03.090]  Yeah.
[55:03.470 --> 55:04.130]  A hundred grand.
[55:04.450 --> 55:04.770]  Here.
[55:05.270 --> 55:05.970]  A hundred grand.
[55:06.050 --> 55:06.930]  Anybody want me to CAN stack?
[55:07.130 --> 55:08.090]  I don't know how much time I have left.
[55:08.170 --> 55:08.510]  Am I good?
[55:08.670 --> 55:09.010]  Am I done?
[55:09.110 --> 55:10.130]  I can't see the sign.
[55:10.830 --> 55:11.470]  So I'm not...
[55:11.470 --> 55:11.630]  Okay.
[55:11.870 --> 55:12.290]  I believe you.
[55:12.370 --> 55:12.530]  Okay.
[55:12.630 --> 55:12.990]  Thanks, guys.