This commit is contained in:
mi-hol 2022-12-27 15:19:50 +01:00
commit 5e95ff4801
5 changed files with 64 additions and 12 deletions

View File

@ -1,14 +1,18 @@
```
-- 640
MOTOR_1 = 0x280
MOTOR_3 = 0x380
MOTOR_INFO = 0x580
MOTOR_5 = 0x480
-- 1160
MOTOR_6 = 0x488
-- 1416
MOTOR_7 = 0x588
fuelCounter = 0;
fuelCounter = 0
fakeTorque = 0
function xorChecksum(data, targetIndex)
local index = 1
@ -95,10 +99,9 @@ totalEcuMessages = 0
totalTcuMessages = 0
motor1Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
canMotorInfo = { 0x00, 0x00, 0x00, 0x14, 0x1C, 0x93, 0x48, 0x14 }
canMotor3 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD}
motor6Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD }
motor6Data = { 0x00, 0x00, 0x00, 0x7E, 0xFE, 0xFF, 0xFF, 0x00 }
motor7Data = { 0x1A, 0x66, 0x7E, 0x00, 0x00, 0x00, 0x00, 0x00 }
function onMotor1(bus, id, dlc, data)
@ -112,9 +115,9 @@ function onMotor1(bus, id, dlc, data)
-- torqueLoss = getBitRange(data, 48, 8) * 0.39
-- requestedTorque = getBitRange(data, 56, 8) * 0.39
engineTorque = fakeTorque
engineTorque = fakeTorque * 0.9
innerTorqWithoutExt = fakeTorque
torqueLoss = 10
torqueLoss = 20
requestedTorque = fakeTorque
motor1Data[2] = engineTorque / 0.39
@ -155,18 +158,38 @@ function onMotor5(bus, id, dlc, data)
txCan(TCU_BUS, id, 0, motor5Data)
end
function onMotor6(bus, id, dlc, data)
engineTorque = getBitRange(data, 8, 8) * 0.39
actualTorque = getBitRange(data, 16, 8) * 0.39
feedbackGearbox = getBitRange(data, 40, 8) * 0.39
-- engineTorque = fakeTorque * 0.9
-- actualTorque = fakeTorque
-- feedbackGearbox = 255
motor6Data[2] = math.floor(engineTorque / 0.39)
motor6Data[3] = math.floor(actualTorque / 0.39)
motor6Data[6] = math.floor(feedbackGearbox / 0.39)
xorChecksum(motor6Data, 1)
txCan(TCU_BUS, id, 0, motor6Data)
end
function silentDrop(bus, id, dlc, data)
end
function printAndDrop(bus, id, dlc, data)
print('Dropping ' ..arrayToString(data))
end
function onAnythingFromECU(bus, id, dlc, data)
totalEcuMessages = totalEcuMessages + 1
txCan(TCU_BUS, id, 0, data) -- relay non-TCU message to TCU
-- txCan(TCU_BUS, id, 0, data) -- relay non-TCU message to TCU
end
function onAnythingFromTCU(bus, id, dlc, data)
totalTcuMessages = totalTcuMessages + 1
txCan(ECU_BUS, id, 0, data) -- relay non-ECU message to ECU
-- txCan(ECU_BUS, id, 0, data) -- relay non-ECU message to ECU
end
-- VAG Motor_1 just as example
@ -175,7 +198,7 @@ canRxAdd(ECU_BUS, MOTOR_1, onMotor1)
canRxAdd(ECU_BUS, MOTOR_3, onMotor3)
canRxAdd(ECU_BUS, MOTOR_5, onMotor5)
canRxAdd(ECU_BUS, MOTOR_INFO, printAndDrop)
canRxAdd(ECU_BUS, MOTOR_6, printAndDrop)
canRxAdd(ECU_BUS, MOTOR_6, onMotor6)
canRxAdd(ECU_BUS, MOTOR_7, printAndDrop)
-- last option: unconditional forward of all remaining messages
@ -185,11 +208,21 @@ canRxAddMask(TCU_BUS, 0, 0, onAnythingFromTCU)
everySecondTimer = Timer.new()
canMotorInfoCounter = 0
mafSensor = Sensor.new("maf")
mafCalibrationIndex = findCurveIndex("mafcurve")
function onTick()
freqValue = getSensor("AuxSpeed1") or 0
mafValue = curve(mafCalibrationIndex, 5)
-- print(freqValue .. " mafValue=" .. mafValue)
mafSensor : set(mafValue)
if everySecondTimer : getElapsedSeconds() > 1 then
everySecondTimer : reset()
print("Total from ECU " ..totalEcuMessages .." from TCU " ..totalTcuMessages)
fuelCounter = fuelCounter + 20

9
CAN-decoding-hints.md Normal file
View File

@ -0,0 +1,9 @@
Text format CAN traces preferred.
# TPS/PPS sweep
Ignition key ON, engine OFF. Press pedal all the way down fast, complexly release fast, press all way down slowly, complexly release slowly, repeat from start two more times.
# PPS sweep with TPS disengages
Open hood, unhook TPS sensor plug. Repeat "TPS/PPS sweep"

5
CAN.md
View File

@ -5,10 +5,13 @@ Overview of CAN usage and IDs used by rusEFI
* rusEFI WBO bootloader
* rusEFI gauge broadcast 0x200 default base see [DBC](https://github.com/rusefi/rusefi/blob/master/firmware/controllers/can/rusEFI_CAN_verbose.dbc)
* rusEFI vehicle specific communication
* rusEFI ECU bootloader OpenBLT TX 667h, RX 7E1h
* rusEFI ECU bootloader OpenBLT TX 667h, RX 7E1h
* rusEFI CAN GPIO
* rusEFI [TS over CAN](TS-over-CAN) 0x100 0x102
# Software
[Man-in-the-middle](Man-in-the-middle)
# Hardware options

6
Man-in-the-middle.md Normal file
View File

@ -0,0 +1,6 @@
See [CAN-decoding-hints](CAN-decoding-hints)
https://github.com/rusefi/rusefi/blob/master/firmware/controllers/lua/examples/man-in-the-middle.txt
See also https://en.wikipedia.org/wiki/Man-in-the-middle_attack

View File

@ -202,11 +202,12 @@ Solenoid Valve 1 N88 and Solenoid Valve 2 N89 are on/off.
| 30 | ??? | Solenoid #3 K3 ? | YEL/VIO |
| 31 | | Solenoid #6 Main Pressure Positive | |
| 32 | | Solenoid #9 K2 ? | VIO/BLU |
| 34 | CAN | CAN | ORG/BRN |
| 39 | | | BRN |
| 42 | | | |
| 42 | | | |
| 43 | | Solenoid #4 TC Negative | |
| | | | |
| 46 | CAN | CAN | ORG/BRN |
| 48 | | Shift lock solenoid ? | VIO |
| 50 | | | GRN |
| | | | |