rusefi_documentation/B6-temp-TCU-main-in-the-middle-new-approach-now-with-replacement.txt

AIRBAG = 0x050

onEcuTimer = Timer.new()
onEcuTimer : reset ()

TCU_1088_440 = 0x440
TCU_1344_540 = 0x540


BRAKE_1_416 = 0x1A0
BRAKE_8_428 = 0x1AC

Komf_1_912 = 0x390

BRAKE_3_1184 = 0x4a0
BRAKE_5_1192 = 0x4a8
BRAKE_2_1440 = 0x5A0


-- 640
MOTOR_1 = 0x280
-- 644
MOTOR_BRE = 0x284
-- 648
MOTOR_2 = 0x288
-- 896
MOTOR_3 = 0x380
-- 1152
MOTOR_5 = 0x480
-- 1160
MOTOR_6 = 0x488
-- 1386
ACC_GRA = 0x56A
-- 1408 the one with variable payload
MOTOR_INFO = 0x580
-- 1416
MOTOR_7 = 0x588

motor1Data = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
motorBreData = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
motor2Data = { 0x8A, 0x8D, 0x10, 0x04, 0x00, 0x4C, 0xDC, 0x87 }
motor2mux = { 0x8A, 0xE8, 0x2C, 0x64 }
canMotor3 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD }
motor6Data = { 0x00, 0x00, 0x00, 0x7E, 0xFE, 0xFF, 0xFF, 0x00 }
accGraData = { 0x00, 0x00, 0x08, 0x00, 0x1A, 0x00, 0x02, 0x01 }
canMotorInfo02 = { 0x00, 0x00, 0x00, 0x14, 0x1C, 0x93, 0x48, 0x14 }
canMotorInfo1 = { 0x99, 0x14, 0x00, 0x7F, 0x00, 0xF0, 0x47, 0x01 }
canMotorInfo3 = { 0x9B, 0x14, 0x00, 0x11, 0x1F, 0xE0, 0x0C, 0x46 }
motor7Data = { 0x1A, 0x66, 0x7E, 0x00, 0x00, 0x00, 0x00, 0x00 }

payload416 = {0x00, 0x43, 0x00, 0x00, 0x00, 0xfe, 0x00, 0x5d}
payload428 = {0xff, 0x0e, 0x00, 0x00, 0x69, 0x01, 0x0b, 0x92}
payload912 = {0x6a, 0x40, 0x50, 0x00, 0x00, 0x00, 0x20, 0x00}
payload1440 = {0x7e, 0x00, 0x00, 0x83, 0x33, 0x00, 0x10, 0xab}

canMotorInfoTotalCounter = 0

VWTP_OUT = 0x200
cuType = 0x02 -- TCU
VWTP_IN = 0x200 + cuType
VWTP_TESTER = 0x300

-- sometimes we want to cut a CAN bus and install rusEFI into that cut
-- https://en.wikipedia.org/wiki/Man-in-the-middle_attack

-- this controls onCanRx rate as well!
setTickRate(100)

ECU_BUS = 1
TCU_BUS = 2

fakeTorque = 0
rpm = 0
tps = 0

function xorChecksum(data, targetIndex)
	local index = 1
	local result = 0
	while data[index] ~= nil do
		if index ~= targetIndex then
			result = result ~ data[index]
		end
		index = index + 1
	end
	data[targetIndex] = result
	return result
end

function setBitRange(data, totalBitIndex, bitWidth, value)
	local byteIndex = totalBitIndex >> 3
	local bitInByteIndex = totalBitIndex - byteIndex * 8
	if (bitInByteIndex + bitWidth > 8) then
		bitsToHandleNow = 8 - bitInByteIndex
		setBitRange(data, totalBitIndex + bitsToHandleNow, bitWidth - bitsToHandleNow, value >> bitsToHandleNow)
		bitWidth = bitsToHandleNow
	end
	mask = (1 << bitWidth) - 1
	data[1 + byteIndex] = data[1 + byteIndex] & (~(mask << bitInByteIndex))
	maskedValue = value & mask
	shiftedValue = maskedValue << bitInByteIndex
	data[1 + byteIndex] = data[1 + byteIndex] | shiftedValue
end

function relayFromECU(bus, id, dlc, data)
    onEcuTimer : reset ()
	totalEcuMessages = totalEcuMessages + 1
	-- 	print("Relaying to TCU " .. id)
	txCan(TCU_BUS, id, 0, data)
end

function setTwoBytes(data, offset, value)
	data[offset + 1] = value % 255
	data[offset + 2] = (value >> 8) % 255
end

function sendMotor1()
	engineTorque = fakeTorque * 0.9
	innerTorqWithoutExt = fakeTorque
	torqueLoss = 20
	requestedTorque = fakeTorque

	motor1Data[2] = engineTorque / 0.39
	setTwoBytes(motor1Data, 2, rpm / 0.25)
	motor1Data[5] = innerTorqWithoutExt / 0.4
	motor1Data[6] = tps / 0.4
	motor1Data[7] = torqueLoss / 0.39
	motor1Data[8] = requestedTorque / 0.39

	txCan(TCU_BUS, MOTOR_1, 0, motor1Data)
end

function getBitRange(data, bitIndex, bitWidth)
	byteIndex = bitIndex >> 3
	shift = bitIndex - byteIndex * 8
	value = data[1 + byteIndex]
	if (shift + bitWidth > 8) then
		value = value + data[2 + byteIndex] * 256
	end
	mask = (1 << bitWidth) - 1
	return (value >> shift) & mask
end

motor2counter = 0
function sendMotor2()
 motor2counter = (motor2counter + 1) % 16

    minTorque = fakeTorque / 2
    -- todo: add CLT
    motor2Data[7] = math.floor(minTorque / 0.39)

--print ( "brake " .. getBitRange(data, 16, 2) .. " " .. rpm)

    brakeBit = rpm < 2000 and 1 or 0
    setBitRange(motor2Data, 16, 1, brakeBit)

    index = math.floor(motor2counter / 4)
    motor2Data[1] = motor2mux[1 + index]

 txCan(TCU_BUS, MOTOR_2, 0, motor2Data)
end

function sendMotor3()
	desired_wheel_torque = fakeTorque
	iat = iat or 30
	canMotor3[2] = (iat + 48) / 0.75
	canMotor3[3] = tps / 0.4
	canMotor3[5] = 0x20
	setBitRange(canMotor3, 24, 12, math.floor(desired_wheel_torque / 0.39))
	canMotor3[8] = tps / 0.4
	txCan(TCU_BUS, MOTOR_3, 0, canMotor3)
end

motor3counter = 0
function onMotor3(bus, id, dlc, data)
 motor3counter = (motor3counter + 1) % 16
	totalEcuMessages = totalEcuMessages + 1
	iat = 30 -- getBitRange(data, 8, 8) * 0.75 - 48
	pps = 7 -- getBitRange(data, 16, 8) * 0.40
	tps = 7 -- getBitRange(data, 56, 8) * 0.40
    if motor3counter % 70 == 0 then
    	print ('MOTOR_3 pps ' ..pps ..' tps ' ..tps ..' iat ' ..iat)
    end
end

function onMotor1(bus, id, dlc, data)
	totalEcuMessages = totalEcuMessages + 1
	rpm = 0 -- getBitRange(data, 16, 16) * 0.25
	if rpm == 0 then
		canMotorInfoTotalCounter = 0
	end

	tps = 0 -- getBitRange(data, 40, 8) * 0.4

	fakeTorque = interpolate(0, 6, 100, 60, tps)

	sendMotor1()
end

function relayFromECUAndEcho(bus, id, dlc, data)
	totalEcuMessages = totalEcuMessages + 1
	print("Relaying to TCU " ..id)
	txCan(TCU_BUS, id, 0, data) -- relay non-TCU message to TCU
end

totalTcuMessages = 0
counter440 = 0
function onTcu440(bus, id, dlc, data)
	totalTcuMessages = totalTcuMessages + 1
	-- 	print("Relaying onTcu440 to ECU " .. id)

	    isShiftActive = getBitRange(data, 0, 1)
        tcuStatus = getBitRange(data, 1, 1)
        EGSRequirement = getBitRange(data, 7, 1)
    counter440 = counter440 + 1
    if counter440 % 70 == 0 then
        print("TCU " .. isShiftActive .. " " .. tcuStatus .. " " .. EGSRequirement)
    end
	txCan(ECU_BUS, id, 0, data)
end

function relayFromTCU(bus, id, dlc, data)
	totalTcuMessages = totalTcuMessages + 1
	-- 	print("Relaying to ECU " .. id)
	txCan(ECU_BUS, id, 0, data)
end

function relayTcuDiagHelloFromTCU(bus, id, dlc, data)
	totalTcuMessages = totalTcuMessages + 1
	print("Relaying TcuDiagHello to ECU " ..id ..arrayToString(data))
	txCan(ECU_BUS, id, 0, data)
end

local payLoadIndex = 0

function relayTpPayloadFromTCU(bus, id, dlc, data)
	totalTcuMessages = totalTcuMessages + 1
	-- print("Relaying TP ECU " ..id ..arrayToString(data))
	txCan(ECU_BUS, id, 0, data) -- relay non-ECU message to ECU


	if data[1] == 0xA3 then
		-- 		print ("Keep-alive")
		return
	end

	if data[1] == 0xA1 then
		print ("I sniff Happy 300 packet")
		return
	end

	if data[1] == 0xA8 then
		print ("I sniff They said Bye-Bye")
		return
	end

	if data[1] == 0x10 and dlc == 5 then
		return
	end

	top4 = math.floor(data[1] / 16)
	if top4 == 0xB then
		-- ACK
		return
	end

	if top4 == 2 or top4 == 1 then
		print ("Looks like payload index " ..payLoadIndex ..": " ..arrayToString(data))

		if payLoadIndex == 1 then
			H4 = data[4]
			H7 = data[7] or -1

			-- 			print("h5/h7 " ..H4 .." " ..H7)

			if H7 == 0 then
--				print("I sniff diag: TCU is happy!")
			else
--				print("I sniff diag: TCU has ERROR ERROR ERROR")
			end

		end

		payLoadIndex = payLoadIndex + 1

		if top4 == 1 or top4 == 2 then
			payLoadIndex = 0
			len = data[3]

			if data[2] == 0 and data[4] == 0x58 then
				if len == 2 then
					print("I sniff TCU NO CODES")
				else
					print("****************                     I sniff ERROR ERROR                " .. data[5])
				end
			end

		end
		return
	end

	print('Got unexpected ' ..arrayToString(data))
end

function drop(bus, id, dlc, data)
end

motorBreCounter = 0
function sendMotorBre()
	motorBreCounter = (motorBreCounter + 1) % 16

	setBitRange(motorBreData, 8, 4, motorBreCounter)
	xorChecksum(motorBreData, 1)

	txCan(TCU_BUS, MOTOR_BRE, 0, motorBreData)
end

motor5counter = 0
motor5FuelCounter = 0
function sendMotor5()
--    motor5counter = (motor5counter + 1) % 16
-- todo	index = math.floor(motor5counter / 4)

	setBitRange(motor5Data, 5, 9, motor5FuelCounter)
	xorChecksum(motor5Data, 8)
	txCan(TCU_BUS, MOTOR_5, 0, motor5Data)
end

motor6Counter = 0
function sendMotor6()
	motor6Counter = (motor6Counter + 1) % 16

	engineTorque = fakeTorque * 0.9
	actualTorque = fakeTorque
	feedbackGearbox = 255

	motor6Data[2] = math.floor(engineTorque / 0.39)
	motor6Data[3] = math.floor(actualTorque / 0.39)
	motor6Data[6] = math.floor(feedbackGearbox / 0.39)
	setBitRange(motor6Data, 60, 4, motor6Counter)

	xorChecksum(motor6Data, 1)
	txCan(TCU_BUS, MOTOR_6, 0, motor6Data)
end

function sendMotor7()
	txCan(TCU_BUS, MOTOR_7, 0, motor7Data)
end

accGraCounter = 0
function sendAccGra()
 accGraCounter = (accGraCounter + 1) % 16
 setBitRange(accGraData, 60, 4, accGraCounter)
    xorChecksum(accGraData, 1)

 txCan(TCU_BUS, ACC_GRA, 0, accGraData)
end

canMotorInfoCounter = 0
function sendMotorInfo()
	canMotorInfoTotalCounter = canMotorInfoTotalCounter + 1
	canMotorInfoCounter = (canMotorInfoCounter + 1) % 16

	baseByte = canMotorInfoTotalCounter < 6 and 0x80 or 0x90
	canMotorInfo02[1] = baseByte + (canMotorInfoCounter)
	canMotorInfo1[1] = baseByte + (canMotorInfoCounter)
	canMotorInfo3[1] = baseByte + (canMotorInfoCounter)
	mod4 = canMotorInfoCounter % 4

	if (mod4 == 0 or mod4 == 2) then
		txCan(TCU_BUS, MOTOR_INFO, 0, canMotorInfo02)
	elseif (mod4 == 1) then
		txCan(TCU_BUS, MOTOR_INFO, 0, canMotorInfo1)
	else
		txCan(TCU_BUS, MOTOR_INFO, 0, canMotorInfo3)
	end
end

hexstr = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, "A", "B", "C", "D", "E", "F" }

function toHexString(num)
	if num == 0 then
		return '0'
	end

	local result = ""
	while num > 0 do
		local n = num % 16
		result = hexstr[n + 1] ..result
		num = math.floor(num / 16)
	end
	return result
end

function arrayToString(arr)
	local str = ""
	local index = 1
	while arr[index] ~= nil do
		str = str.." "..toHexString(arr[index])
		index = index + 1
	end
	return str
end

totalEcuMessages = 0

-- REQUIRED kombi 3
canRxAdd(ECU_BUS, 1312, relayFromECU)
-- REQUIRED Soll_Verbauliste_neu
canRxAdd(ECU_BUS, 1500, relayFromECU)
-- REQUIRED GRA_Neu
canRxAdd(ECU_BUS, 906, relayFromECU)

canRxAdd(ECU_BUS, BRAKE_1_416, relayFromECU)
--canRxAdd(ECU_BUS, BRAKE_2_1440, relayFromECU)
canRxAdd(ECU_BUS, BRAKE_8_428, relayFromECU)

canRxAdd(ECU_BUS, BRAKE_3_1184, relayFromECU)

canRxAdd(ECU_BUS, BRAKE_5_1192, relayFromECU)


--canRxAdd(ECU_BUS, Komf_1_912, relayFromECU)
-- Systeminfo_1
canRxAdd(ECU_BUS, 1488, relayFromECU)
-- REQUIRED? Diagnose_1
canRxAdd(ECU_BUS, 2000, relayFromECU)

canRxAdd(ECU_BUS, MOTOR_1, onMotor1)
-- canRxAdd(ECU_BUS, MOTOR_BRE, relayFromECU)
-- canRxAdd(ECU_BUS, MOTOR_2, relayFromECU)

canRxAdd(ECU_BUS, MOTOR_3, onMotor3)
-- canRxAdd(ECU_BUS, MOTOR_3, relayFromECU)

-- canRxAdd(ECU_BUS, MOTOR_5, onMotor5)
-- canRxAdd(ECU_BUS, MOTOR_5, relayFromECU)

--canRxAdd(ECU_BUS, MOTOR_6, sendMotor6)
-- canRxAdd(ECU_BUS, MOTOR_6, relayFromECU)

--canRxAdd(ECU_BUS, ACC_GRA, relayFromECU)
-- canRxAdd(ECU_BUS, MOTOR_INFO, relayFromECU)

canRxAdd(ECU_BUS, VWTP_OUT, relayFromECU)
canRxAdd(ECU_BUS, 0x760, relayFromECU)

canRxAddMask(ECU_BUS, 0, 0, drop)
-- canRxAddMask(ECU_BUS, 0, 0, relayFromECU)

canRxAdd(TCU_BUS, VWTP_IN, relayTcuDiagHelloFromTCU)
canRxAdd(TCU_BUS, VWTP_TESTER, relayTpPayloadFromTCU)
canRxAdd(TCU_1088_440, onTcu440)
canRxAddMask(TCU_BUS, 0, 0, relayFromTCU)

everySecondTimer = Timer.new()

function onTick()
    if onEcuTimer : getElapsedSeconds() > 1 then
        -- do not spam if ECU is silent
        return
    end

	sendMotor2()
	sendMotor3()
	sendMotor5()
	sendMotor6()
	sendMotor7()
	sendMotorBre()
	sendAccGra()

--    txCan(TCU_BUS, BRAKE_1_416, 0, payload416)
--    txCan(TCU_BUS, BRAKE_8_428, 0, payload428)
    txCan(TCU_BUS, BRAKE_2_1440, 0, payload1440)

    txCan(TCU_BUS, Komf_1_912, 0, payload912)

	if everySecondTimer : getElapsedSeconds() > 1 then
		everySecondTimer : reset()
		print("Total from ECU " ..totalEcuMessages)
		motor5FuelCounter = motor5FuelCounter + 20

		sendMotorInfo()
	end


end