diff --git a/B6-temp.md b/B6-temp.md index d31fade9..f2b11af9 100644 --- a/B6-temp.md +++ b/B6-temp.md @@ -1,14 +1,18 @@ ``` +-- 640 MOTOR_1 = 0x280 MOTOR_3 = 0x380 MOTOR_INFO = 0x580 MOTOR_5 = 0x480 +-- 1160 MOTOR_6 = 0x488 +-- 1416 MOTOR_7 = 0x588 -fuelCounter = 0; +fuelCounter = 0 +fakeTorque = 0 function xorChecksum(data, targetIndex) local index = 1 @@ -95,10 +99,9 @@ totalEcuMessages = 0 totalTcuMessages = 0 motor1Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } -canMotorInfo = { 0x00, 0x00, 0x00, 0x14, 0x1C, 0x93, 0x48, 0x14 } canMotor3 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } -motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD} -motor6Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } +motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD } +motor6Data = { 0x00, 0x00, 0x00, 0x7E, 0xFE, 0xFF, 0xFF, 0x00 } motor7Data = { 0x1A, 0x66, 0x7E, 0x00, 0x00, 0x00, 0x00, 0x00 } function onMotor1(bus, id, dlc, data) @@ -112,9 +115,9 @@ function onMotor1(bus, id, dlc, data) -- torqueLoss = getBitRange(data, 48, 8) * 0.39 -- requestedTorque = getBitRange(data, 56, 8) * 0.39 - engineTorque = fakeTorque + engineTorque = fakeTorque * 0.9 innerTorqWithoutExt = fakeTorque - torqueLoss = 10 + torqueLoss = 20 requestedTorque = fakeTorque motor1Data[2] = engineTorque / 0.39 @@ -155,18 +158,38 @@ function onMotor5(bus, id, dlc, data) txCan(TCU_BUS, id, 0, motor5Data) end +function onMotor6(bus, id, dlc, data) + engineTorque = getBitRange(data, 8, 8) * 0.39 + actualTorque = getBitRange(data, 16, 8) * 0.39 + feedbackGearbox = getBitRange(data, 40, 8) * 0.39 + +-- engineTorque = fakeTorque * 0.9 +-- actualTorque = fakeTorque +-- feedbackGearbox = 255 + + motor6Data[2] = math.floor(engineTorque / 0.39) + motor6Data[3] = math.floor(actualTorque / 0.39) + motor6Data[6] = math.floor(feedbackGearbox / 0.39) + + xorChecksum(motor6Data, 1) + txCan(TCU_BUS, id, 0, motor6Data) +end + +function silentDrop(bus, id, dlc, data) +end + function printAndDrop(bus, id, dlc, data) print('Dropping ' ..arrayToString(data)) end function onAnythingFromECU(bus, id, dlc, data) totalEcuMessages = totalEcuMessages + 1 - txCan(TCU_BUS, id, 0, data) -- relay non-TCU message to TCU +-- txCan(TCU_BUS, id, 0, data) -- relay non-TCU message to TCU end function onAnythingFromTCU(bus, id, dlc, data) totalTcuMessages = totalTcuMessages + 1 - txCan(ECU_BUS, id, 0, data) -- relay non-ECU message to ECU +-- txCan(ECU_BUS, id, 0, data) -- relay non-ECU message to ECU end -- VAG Motor_1 just as example @@ -175,7 +198,7 @@ canRxAdd(ECU_BUS, MOTOR_1, onMotor1) canRxAdd(ECU_BUS, MOTOR_3, onMotor3) canRxAdd(ECU_BUS, MOTOR_5, onMotor5) canRxAdd(ECU_BUS, MOTOR_INFO, printAndDrop) -canRxAdd(ECU_BUS, MOTOR_6, printAndDrop) +canRxAdd(ECU_BUS, MOTOR_6, onMotor6) canRxAdd(ECU_BUS, MOTOR_7, printAndDrop) -- last option: unconditional forward of all remaining messages @@ -185,11 +208,21 @@ canRxAddMask(TCU_BUS, 0, 0, onAnythingFromTCU) everySecondTimer = Timer.new() canMotorInfoCounter = 0 +mafSensor = Sensor.new("maf") +mafCalibrationIndex = findCurveIndex("mafcurve") + function onTick() + freqValue = getSensor("AuxSpeed1") or 0 + mafValue = curve(mafCalibrationIndex, 5) +-- print(freqValue .. " mafValue=" .. mafValue) + mafSensor : set(mafValue) + + + if everySecondTimer : getElapsedSeconds() > 1 then everySecondTimer : reset() print("Total from ECU " ..totalEcuMessages .." from TCU " ..totalTcuMessages) - + fuelCounter = fuelCounter + 20 diff --git a/CAN-decoding-hints.md b/CAN-decoding-hints.md new file mode 100644 index 00000000..5aea9ea9 --- /dev/null +++ b/CAN-decoding-hints.md @@ -0,0 +1,9 @@ +Text format CAN traces preferred. + +# TPS/PPS sweep + +Ignition key ON, engine OFF. Press pedal all the way down fast, complexly release fast, press all way down slowly, complexly release slowly, repeat from start two more times. + +# PPS sweep with TPS disengages + +Open hood, unhook TPS sensor plug. Repeat "TPS/PPS sweep" \ No newline at end of file diff --git a/CAN.md b/CAN.md index 84902fc0..0f24bb82 100644 --- a/CAN.md +++ b/CAN.md @@ -5,10 +5,13 @@ Overview of CAN usage and IDs used by rusEFI * rusEFI WBO bootloader * rusEFI gauge broadcast 0x200 default base see [DBC](https://github.com/rusefi/rusefi/blob/master/firmware/controllers/can/rusEFI_CAN_verbose.dbc) * rusEFI vehicle specific communication -* rusEFI ECU bootloader OpenBLT TX 667h, RX 7E1h +* rusEFI ECU bootloader OpenBLT TX 667h, RX 7E1h * rusEFI CAN GPIO * rusEFI [TS over CAN](TS-over-CAN) 0x100 0x102 +# Software + +[Man-in-the-middle](Man-in-the-middle) # Hardware options diff --git a/Man-in-the-middle.md b/Man-in-the-middle.md new file mode 100644 index 00000000..b56c579e --- /dev/null +++ b/Man-in-the-middle.md @@ -0,0 +1,6 @@ +See [CAN-decoding-hints](CAN-decoding-hints) + + +https://github.com/rusefi/rusefi/blob/master/firmware/controllers/lua/examples/man-in-the-middle.txt + +See also https://en.wikipedia.org/wiki/Man-in-the-middle_attack \ No newline at end of file diff --git a/VolkswagenPassatB6.md b/VolkswagenPassatB6.md index eff3d3a1..7c38348c 100644 --- a/VolkswagenPassatB6.md +++ b/VolkswagenPassatB6.md @@ -202,11 +202,12 @@ Solenoid Valve 1 N88 and Solenoid Valve 2 N89 are on/off. | 30 | ??? | Solenoid #3 K3 ? | YEL/VIO | | 31 | | Solenoid #6 Main Pressure Positive | | | 32 | | Solenoid #9 K2 ? | VIO/BLU | +| 34 | CAN | CAN | ORG/BRN | | 39 | | | BRN | | 42 | | | | | 42 | | | | | 43 | | Solenoid #4 TC Negative | | -| | | | | +| 46 | CAN | CAN | ORG/BRN | | 48 | | Shift lock solenoid ? | VIO | | 50 | | | GRN | | | | | |