From 2a3cee64f3f3a8340895848eb9d37a8e2a1f1a6a Mon Sep 17 00:00:00 2001 From: rusefillc <48498823+rusefillc@users.noreply.github.com> Date: Sun, 25 Dec 2022 14:00:12 -0500 Subject: [PATCH 1/9] Updated B6 temp (markdown) --- B6-temp.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/B6-temp.md b/B6-temp.md index d31fade9..243c272e 100644 --- a/B6-temp.md +++ b/B6-temp.md @@ -185,7 +185,17 @@ canRxAddMask(TCU_BUS, 0, 0, onAnythingFromTCU) everySecondTimer = Timer.new() canMotorInfoCounter = 0 +mafSensor = Sensor.new("maf") +mafCalibrationIndex = findCurveIndex("mafcurve") + function onTick() + freqValue = getSensor("AuxSpeed1") * 16 or 0 + mafValue = curve(mafCalibrationIndex, 5) +-- print(freqValue .. " mafValue=" .. mafValue) + mafSensor : set(mafValue) + + + if everySecondTimer : getElapsedSeconds() > 1 then everySecondTimer : reset() print("Total from ECU " ..totalEcuMessages .." from TCU " ..totalTcuMessages) From d330dadec5efc27c2c3e80d0377af9d4917c279d Mon Sep 17 00:00:00 2001 From: rusefillc Date: Sun, 25 Dec 2022 14:48:39 -0500 Subject: [PATCH 2/9] B6 --- B6-temp.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/B6-temp.md b/B6-temp.md index 243c272e..cdb1d3bb 100644 --- a/B6-temp.md +++ b/B6-temp.md @@ -8,7 +8,7 @@ MOTOR_6 = 0x488 MOTOR_7 = 0x588 -fuelCounter = 0; +fuelCounter = 0 function xorChecksum(data, targetIndex) local index = 1 @@ -97,7 +97,7 @@ totalTcuMessages = 0 motor1Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } canMotorInfo = { 0x00, 0x00, 0x00, 0x14, 0x1C, 0x93, 0x48, 0x14 } canMotor3 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } -motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD} +motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD } motor6Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } motor7Data = { 0x1A, 0x66, 0x7E, 0x00, 0x00, 0x00, 0x00, 0x00 } @@ -189,7 +189,7 @@ mafSensor = Sensor.new("maf") mafCalibrationIndex = findCurveIndex("mafcurve") function onTick() - freqValue = getSensor("AuxSpeed1") * 16 or 0 + freqValue = getSensor("AuxSpeed1") or 0 mafValue = curve(mafCalibrationIndex, 5) -- print(freqValue .. " mafValue=" .. mafValue) mafSensor : set(mafValue) @@ -199,7 +199,7 @@ function onTick() if everySecondTimer : getElapsedSeconds() > 1 then everySecondTimer : reset() print("Total from ECU " ..totalEcuMessages .." from TCU " ..totalTcuMessages) - + fuelCounter = fuelCounter + 20 From 05e77d88946b4ac50cebf46d6417eb85c56468e3 Mon Sep 17 00:00:00 2001 From: rusefillc Date: Mon, 26 Dec 2022 00:14:59 -0500 Subject: [PATCH 3/9] B6 --- B6-temp.md | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/B6-temp.md b/B6-temp.md index cdb1d3bb..2b9b35bf 100644 --- a/B6-temp.md +++ b/B6-temp.md @@ -1,14 +1,18 @@ ``` +-- 640 MOTOR_1 = 0x280 MOTOR_3 = 0x380 MOTOR_INFO = 0x580 MOTOR_5 = 0x480 +-- 1160 MOTOR_6 = 0x488 +-- 1416 MOTOR_7 = 0x588 fuelCounter = 0 +fakeTorque = 0 function xorChecksum(data, targetIndex) local index = 1 @@ -98,7 +102,7 @@ motor1Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } canMotorInfo = { 0x00, 0x00, 0x00, 0x14, 0x1C, 0x93, 0x48, 0x14 } canMotor3 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD } -motor6Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } +motor6Data = { 0x00, 0x00, 0x00, 0x7E, 0xFE, 0xFF, 0xFF, 0x00 } motor7Data = { 0x1A, 0x66, 0x7E, 0x00, 0x00, 0x00, 0x00, 0x00 } function onMotor1(bus, id, dlc, data) @@ -112,9 +116,9 @@ function onMotor1(bus, id, dlc, data) -- torqueLoss = getBitRange(data, 48, 8) * 0.39 -- requestedTorque = getBitRange(data, 56, 8) * 0.39 - engineTorque = fakeTorque + engineTorque = fakeTorque * 0.9 innerTorqWithoutExt = fakeTorque - torqueLoss = 10 + torqueLoss = 20 requestedTorque = fakeTorque motor1Data[2] = engineTorque / 0.39 @@ -155,6 +159,26 @@ function onMotor5(bus, id, dlc, data) txCan(TCU_BUS, id, 0, motor5Data) end +function onMotor6(bus, id, dlc, data) + engineTorque = getBitRange(data, 8, 8) * 0.39 + actualTorque = getBitRange(data, 16, 8) * 0.39 + feedbackGearbox = getBitRange(data, 40, 8) * 0.39 + +-- engineTorque = fakeTorque * 0.9 +-- actualTorque = fakeTorque +-- feedbackGearbox = 255 + + motor6Data[2] = math.floor(targetTorque / 0.39) + motor6Data[3] = math.floor(actualTorque / 0.39) + motor6Data[6] = math.floor(feedbackGearbox / 0.39) + + xorChecksum(motor6Data, 1) + txCan(TCU_BUS, id, 0, motor6Data) +end + +function silentDrop(bus, id, dlc, data) +end + function printAndDrop(bus, id, dlc, data) print('Dropping ' ..arrayToString(data)) end @@ -175,7 +199,7 @@ canRxAdd(ECU_BUS, MOTOR_1, onMotor1) canRxAdd(ECU_BUS, MOTOR_3, onMotor3) canRxAdd(ECU_BUS, MOTOR_5, onMotor5) canRxAdd(ECU_BUS, MOTOR_INFO, printAndDrop) -canRxAdd(ECU_BUS, MOTOR_6, printAndDrop) +canRxAdd(ECU_BUS, MOTOR_6, onMotor6) canRxAdd(ECU_BUS, MOTOR_7, printAndDrop) -- last option: unconditional forward of all remaining messages From a8c8f4321762f26be26f817eb96a8bf1339712ec Mon Sep 17 00:00:00 2001 From: rusefillc Date: Mon, 26 Dec 2022 12:18:53 -0500 Subject: [PATCH 4/9] B6 --- B6-temp.md | 2 +- VolkswagenPassatB6.md | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/B6-temp.md b/B6-temp.md index 2b9b35bf..0b335b3e 100644 --- a/B6-temp.md +++ b/B6-temp.md @@ -168,7 +168,7 @@ function onMotor6(bus, id, dlc, data) -- actualTorque = fakeTorque -- feedbackGearbox = 255 - motor6Data[2] = math.floor(targetTorque / 0.39) + motor6Data[2] = math.floor(engineTorque / 0.39) motor6Data[3] = math.floor(actualTorque / 0.39) motor6Data[6] = math.floor(feedbackGearbox / 0.39) diff --git a/VolkswagenPassatB6.md b/VolkswagenPassatB6.md index eff3d3a1..7c38348c 100644 --- a/VolkswagenPassatB6.md +++ b/VolkswagenPassatB6.md @@ -202,11 +202,12 @@ Solenoid Valve 1 N88 and Solenoid Valve 2 N89 are on/off. | 30 | ??? | Solenoid #3 K3 ? | YEL/VIO | | 31 | | Solenoid #6 Main Pressure Positive | | | 32 | | Solenoid #9 K2 ? | VIO/BLU | +| 34 | CAN | CAN | ORG/BRN | | 39 | | | BRN | | 42 | | | | | 42 | | | | | 43 | | Solenoid #4 TC Negative | | -| | | | | +| 46 | CAN | CAN | ORG/BRN | | 48 | | Shift lock solenoid ? | VIO | | 50 | | | GRN | | | | | | From 52c4046aeedcc23d238e101df709c8aaabae7ecc Mon Sep 17 00:00:00 2001 From: rusefillc <48498823+rusefillc@users.noreply.github.com> Date: Mon, 26 Dec 2022 13:16:52 -0500 Subject: [PATCH 5/9] Created Man in the middle (markdown) --- Man-in-the-middle.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 Man-in-the-middle.md diff --git a/Man-in-the-middle.md b/Man-in-the-middle.md new file mode 100644 index 00000000..5d5ef314 --- /dev/null +++ b/Man-in-the-middle.md @@ -0,0 +1,4 @@ + +https://github.com/rusefi/rusefi/blob/master/firmware/controllers/lua/examples/man-in-the-middle.txt + +See also https://en.wikipedia.org/wiki/Man-in-the-middle_attack \ No newline at end of file From 64f82f3ec42c05fba2903e7386f4b2b0466272de Mon Sep 17 00:00:00 2001 From: rusefillc <48498823+rusefillc@users.noreply.github.com> Date: Mon, 26 Dec 2022 14:43:48 -0500 Subject: [PATCH 6/9] Created CAN decoding hints (markdown) --- CAN-decoding-hints.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 CAN-decoding-hints.md diff --git a/CAN-decoding-hints.md b/CAN-decoding-hints.md new file mode 100644 index 00000000..5aea9ea9 --- /dev/null +++ b/CAN-decoding-hints.md @@ -0,0 +1,9 @@ +Text format CAN traces preferred. + +# TPS/PPS sweep + +Ignition key ON, engine OFF. Press pedal all the way down fast, complexly release fast, press all way down slowly, complexly release slowly, repeat from start two more times. + +# PPS sweep with TPS disengages + +Open hood, unhook TPS sensor plug. Repeat "TPS/PPS sweep" \ No newline at end of file From 2247a256990a4457dc281c7a7cb6dff92c5ee8f6 Mon Sep 17 00:00:00 2001 From: rusefillc <48498823+rusefillc@users.noreply.github.com> Date: Mon, 26 Dec 2022 21:48:50 -0500 Subject: [PATCH 7/9] Updated Man in the middle (markdown) --- Man-in-the-middle.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Man-in-the-middle.md b/Man-in-the-middle.md index 5d5ef314..b56c579e 100644 --- a/Man-in-the-middle.md +++ b/Man-in-the-middle.md @@ -1,3 +1,5 @@ +See [CAN-decoding-hints](CAN-decoding-hints) + https://github.com/rusefi/rusefi/blob/master/firmware/controllers/lua/examples/man-in-the-middle.txt From 83ac574239d507c23a5edc012ecbbca4e3353151 Mon Sep 17 00:00:00 2001 From: rusefillc <48498823+rusefillc@users.noreply.github.com> Date: Mon, 26 Dec 2022 21:49:27 -0500 Subject: [PATCH 8/9] Updated CAN (markdown) --- CAN.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/CAN.md b/CAN.md index 84902fc0..0f24bb82 100644 --- a/CAN.md +++ b/CAN.md @@ -5,10 +5,13 @@ Overview of CAN usage and IDs used by rusEFI * rusEFI WBO bootloader * rusEFI gauge broadcast 0x200 default base see [DBC](https://github.com/rusefi/rusefi/blob/master/firmware/controllers/can/rusEFI_CAN_verbose.dbc) * rusEFI vehicle specific communication -* rusEFI ECU bootloader OpenBLT TX 667h, RX 7E1h +* rusEFI ECU bootloader OpenBLT TX 667h, RX 7E1h * rusEFI CAN GPIO * rusEFI [TS over CAN](TS-over-CAN) 0x100 0x102 +# Software + +[Man-in-the-middle](Man-in-the-middle) # Hardware options From 346ec88eb0a4657c192f43e9a8d2722f609b1ca7 Mon Sep 17 00:00:00 2001 From: rusefillc Date: Tue, 27 Dec 2022 08:31:24 -0500 Subject: [PATCH 9/9] B6 --- B6-temp.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/B6-temp.md b/B6-temp.md index 0b335b3e..f2b11af9 100644 --- a/B6-temp.md +++ b/B6-temp.md @@ -99,7 +99,6 @@ totalEcuMessages = 0 totalTcuMessages = 0 motor1Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } -canMotorInfo = { 0x00, 0x00, 0x00, 0x14, 0x1C, 0x93, 0x48, 0x14 } canMotor3 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD } motor6Data = { 0x00, 0x00, 0x00, 0x7E, 0xFE, 0xFF, 0xFF, 0x00 } @@ -185,12 +184,12 @@ end function onAnythingFromECU(bus, id, dlc, data) totalEcuMessages = totalEcuMessages + 1 - txCan(TCU_BUS, id, 0, data) -- relay non-TCU message to TCU +-- txCan(TCU_BUS, id, 0, data) -- relay non-TCU message to TCU end function onAnythingFromTCU(bus, id, dlc, data) totalTcuMessages = totalTcuMessages + 1 - txCan(ECU_BUS, id, 0, data) -- relay non-ECU message to ECU +-- txCan(ECU_BUS, id, 0, data) -- relay non-ECU message to ECU end -- VAG Motor_1 just as example