This commit is contained in:
mi-hol 2022-12-27 15:19:50 +01:00
commit 5e95ff4801
5 changed files with 64 additions and 12 deletions

View File

@ -1,14 +1,18 @@
``` ```
-- 640
MOTOR_1 = 0x280 MOTOR_1 = 0x280
MOTOR_3 = 0x380 MOTOR_3 = 0x380
MOTOR_INFO = 0x580 MOTOR_INFO = 0x580
MOTOR_5 = 0x480 MOTOR_5 = 0x480
-- 1160
MOTOR_6 = 0x488 MOTOR_6 = 0x488
-- 1416
MOTOR_7 = 0x588 MOTOR_7 = 0x588
fuelCounter = 0; fuelCounter = 0
fakeTorque = 0
function xorChecksum(data, targetIndex) function xorChecksum(data, targetIndex)
local index = 1 local index = 1
@ -95,10 +99,9 @@ totalEcuMessages = 0
totalTcuMessages = 0 totalTcuMessages = 0
motor1Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } motor1Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
canMotorInfo = { 0x00, 0x00, 0x00, 0x14, 0x1C, 0x93, 0x48, 0x14 }
canMotor3 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } canMotor3 = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD } motor5Data = { 0x1C, 0x08, 0xF3, 0x55, 0x19, 0x00, 0x00, 0xAD }
motor6Data = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } motor6Data = { 0x00, 0x00, 0x00, 0x7E, 0xFE, 0xFF, 0xFF, 0x00 }
motor7Data = { 0x1A, 0x66, 0x7E, 0x00, 0x00, 0x00, 0x00, 0x00 } motor7Data = { 0x1A, 0x66, 0x7E, 0x00, 0x00, 0x00, 0x00, 0x00 }
function onMotor1(bus, id, dlc, data) function onMotor1(bus, id, dlc, data)
@ -112,9 +115,9 @@ function onMotor1(bus, id, dlc, data)
-- torqueLoss = getBitRange(data, 48, 8) * 0.39 -- torqueLoss = getBitRange(data, 48, 8) * 0.39
-- requestedTorque = getBitRange(data, 56, 8) * 0.39 -- requestedTorque = getBitRange(data, 56, 8) * 0.39
engineTorque = fakeTorque engineTorque = fakeTorque * 0.9
innerTorqWithoutExt = fakeTorque innerTorqWithoutExt = fakeTorque
torqueLoss = 10 torqueLoss = 20
requestedTorque = fakeTorque requestedTorque = fakeTorque
motor1Data[2] = engineTorque / 0.39 motor1Data[2] = engineTorque / 0.39
@ -155,18 +158,38 @@ function onMotor5(bus, id, dlc, data)
txCan(TCU_BUS, id, 0, motor5Data) txCan(TCU_BUS, id, 0, motor5Data)
end end
function onMotor6(bus, id, dlc, data)
engineTorque = getBitRange(data, 8, 8) * 0.39
actualTorque = getBitRange(data, 16, 8) * 0.39
feedbackGearbox = getBitRange(data, 40, 8) * 0.39
-- engineTorque = fakeTorque * 0.9
-- actualTorque = fakeTorque
-- feedbackGearbox = 255
motor6Data[2] = math.floor(engineTorque / 0.39)
motor6Data[3] = math.floor(actualTorque / 0.39)
motor6Data[6] = math.floor(feedbackGearbox / 0.39)
xorChecksum(motor6Data, 1)
txCan(TCU_BUS, id, 0, motor6Data)
end
function silentDrop(bus, id, dlc, data)
end
function printAndDrop(bus, id, dlc, data) function printAndDrop(bus, id, dlc, data)
print('Dropping ' ..arrayToString(data)) print('Dropping ' ..arrayToString(data))
end end
function onAnythingFromECU(bus, id, dlc, data) function onAnythingFromECU(bus, id, dlc, data)
totalEcuMessages = totalEcuMessages + 1 totalEcuMessages = totalEcuMessages + 1
txCan(TCU_BUS, id, 0, data) -- relay non-TCU message to TCU -- txCan(TCU_BUS, id, 0, data) -- relay non-TCU message to TCU
end end
function onAnythingFromTCU(bus, id, dlc, data) function onAnythingFromTCU(bus, id, dlc, data)
totalTcuMessages = totalTcuMessages + 1 totalTcuMessages = totalTcuMessages + 1
txCan(ECU_BUS, id, 0, data) -- relay non-ECU message to ECU -- txCan(ECU_BUS, id, 0, data) -- relay non-ECU message to ECU
end end
-- VAG Motor_1 just as example -- VAG Motor_1 just as example
@ -175,7 +198,7 @@ canRxAdd(ECU_BUS, MOTOR_1, onMotor1)
canRxAdd(ECU_BUS, MOTOR_3, onMotor3) canRxAdd(ECU_BUS, MOTOR_3, onMotor3)
canRxAdd(ECU_BUS, MOTOR_5, onMotor5) canRxAdd(ECU_BUS, MOTOR_5, onMotor5)
canRxAdd(ECU_BUS, MOTOR_INFO, printAndDrop) canRxAdd(ECU_BUS, MOTOR_INFO, printAndDrop)
canRxAdd(ECU_BUS, MOTOR_6, printAndDrop) canRxAdd(ECU_BUS, MOTOR_6, onMotor6)
canRxAdd(ECU_BUS, MOTOR_7, printAndDrop) canRxAdd(ECU_BUS, MOTOR_7, printAndDrop)
-- last option: unconditional forward of all remaining messages -- last option: unconditional forward of all remaining messages
@ -185,7 +208,17 @@ canRxAddMask(TCU_BUS, 0, 0, onAnythingFromTCU)
everySecondTimer = Timer.new() everySecondTimer = Timer.new()
canMotorInfoCounter = 0 canMotorInfoCounter = 0
mafSensor = Sensor.new("maf")
mafCalibrationIndex = findCurveIndex("mafcurve")
function onTick() function onTick()
freqValue = getSensor("AuxSpeed1") or 0
mafValue = curve(mafCalibrationIndex, 5)
-- print(freqValue .. " mafValue=" .. mafValue)
mafSensor : set(mafValue)
if everySecondTimer : getElapsedSeconds() > 1 then if everySecondTimer : getElapsedSeconds() > 1 then
everySecondTimer : reset() everySecondTimer : reset()
print("Total from ECU " ..totalEcuMessages .." from TCU " ..totalTcuMessages) print("Total from ECU " ..totalEcuMessages .." from TCU " ..totalTcuMessages)

9
CAN-decoding-hints.md Normal file
View File

@ -0,0 +1,9 @@
Text format CAN traces preferred.
# TPS/PPS sweep
Ignition key ON, engine OFF. Press pedal all the way down fast, complexly release fast, press all way down slowly, complexly release slowly, repeat from start two more times.
# PPS sweep with TPS disengages
Open hood, unhook TPS sensor plug. Repeat "TPS/PPS sweep"

3
CAN.md
View File

@ -9,6 +9,9 @@ Overview of CAN usage and IDs used by rusEFI
* rusEFI CAN GPIO * rusEFI CAN GPIO
* rusEFI [TS over CAN](TS-over-CAN) 0x100 0x102 * rusEFI [TS over CAN](TS-over-CAN) 0x100 0x102
# Software
[Man-in-the-middle](Man-in-the-middle)
# Hardware options # Hardware options

6
Man-in-the-middle.md Normal file
View File

@ -0,0 +1,6 @@
See [CAN-decoding-hints](CAN-decoding-hints)
https://github.com/rusefi/rusefi/blob/master/firmware/controllers/lua/examples/man-in-the-middle.txt
See also https://en.wikipedia.org/wiki/Man-in-the-middle_attack

View File

@ -202,11 +202,12 @@ Solenoid Valve 1 N88 and Solenoid Valve 2 N89 are on/off.
| 30 | ??? | Solenoid #3 K3 ? | YEL/VIO | | 30 | ??? | Solenoid #3 K3 ? | YEL/VIO |
| 31 | | Solenoid #6 Main Pressure Positive | | | 31 | | Solenoid #6 Main Pressure Positive | |
| 32 | | Solenoid #9 K2 ? | VIO/BLU | | 32 | | Solenoid #9 K2 ? | VIO/BLU |
| 34 | CAN | CAN | ORG/BRN |
| 39 | | | BRN | | 39 | | | BRN |
| 42 | | | | | 42 | | | |
| 42 | | | | | 42 | | | |
| 43 | | Solenoid #4 TC Negative | | | 43 | | Solenoid #4 TC Negative | |
| | | | | | 46 | CAN | CAN | ORG/BRN |
| 48 | | Shift lock solenoid ? | VIO | | 48 | | Shift lock solenoid ? | VIO |
| 50 | | | GRN | | 50 | | | GRN |
| | | | | | | | | |