327 lines
7.7 KiB
Markdown
327 lines
7.7 KiB
Markdown
# jackm/carhack Nissan Sentra 2010 CAN bus data
|
|
|
|
This is a copy-paste of [https://github.com/jackm/carhack/blob/master/nissan.md](https://github.com/jackm/carhack/blob/master/nissan.md)
|
|
|
|
## CAN bus frame
|
|
|
|
CAN message bytes are referenced by letters A-H:
|
|
|
|
`(A, B, C, D, E, F, G, H)`
|
|
|
|
Individual bits within a byte are represented by the byte letter followed by a period followed by a number (1-8).
|
|
For example, `B.1` would mean the first bit within the second byte, and `C.6` would mean the sixth bit within the third byte.
|
|
Hyphens denote a range.
|
|
For instances where the data length code (DLC) is not 8 bytes, the DLC is specified.
|
|
|
|
Many similarities in CAN IDs found in the [Knio/carhack repo](https://github.com/Knio/carhack/blob/master/Cars/Nissan.markdown).
|
|
Planning on cross-referencing this soon. It is quite likely that all Nissan vehicles share CAN IDs for common fucntions.
|
|
|
|
Also planning on cross-referencing from the [commaai/opendbc PR #72](https://github.com/commaai/opendbc/pull/72) which has further categorized Nissan CAN IDs.
|
|
|
|
## Controls to reverse engineer
|
|
|
|
A preliminary list of human vehicle controls to sniff the CAN bus for
|
|
|
|
* Accelerator pedal
|
|
* Brake pedal
|
|
* Steering wheel angle
|
|
* Vehicle headlights
|
|
* Windshield wiper controls
|
|
* Turn signals
|
|
* Hazard lights
|
|
* Cruise control
|
|
* Horn
|
|
* Climate control
|
|
* Rear window defrost
|
|
* Doors open
|
|
* Seat belts
|
|
* Parking brake
|
|
* Radio buttons
|
|
* Power windows
|
|
* Power door locks
|
|
* Power side mirrors
|
|
* Cabin lights
|
|
* Gas cap release
|
|
* Trunk release
|
|
|
|
## Setup
|
|
|
|
Physically connected to vehicle's OBD-II port using a [Kvaser Leaf Light HS v2](https://www.kvaser.com/product/kvaser-leaf-light-hs-v2/) CAN interface.
|
|
This CAN interface is connected via USB to a laptop running Linux.
|
|
Using the [SocketCAN](https://en.wikipedia.org/wiki/SocketCAN) driver to create a network interface (arbitrarily named "can0").
|
|
|
|
Discovered via trial and error that the CAN bus bit rate on the Nissan Sentra is 500kbit/s.
|
|
The the majority of passenger vehicles will use a CAN bus bit rate of either 250kbit/s or 500kbit/s.
|
|
|
|
Configuring the CAN network interface
|
|
|
|
1. `sudo ip link set can0 type can bitrate 500000`
|
|
1. `sudo ip link set can0 up`
|
|
|
|
Using the [can-utils](https://github.com/linux-can/can-utils) package; specifically `cansniffer` to see changes and `canbusload` to monitor bus load.
|
|
|
|
Arguments used
|
|
|
|
* `cansniffer -c can0`
|
|
* `canbusload -tcbr can0@500000`
|
|
|
|
All recorded CAN message IDs are in hexadecimal.
|
|
|
|
## Active CAN IDs
|
|
|
|
### Key inserted, ACC off, engine off
|
|
|
|
CAN bus load 7%
|
|
|
|
When key inserted or removed, messages from the following IDs only last a few seconds then stop sending
|
|
|
|
* 358
|
|
* 35D
|
|
* 625
|
|
|
|
When key moved to first position (before ACC), messages from the following IDs are seen periodically and constantly
|
|
|
|
* 35D
|
|
* **60D**
|
|
* 625
|
|
|
|
When vehicle is off (no key inserted at all) and a control is activated (one that is allowed to be used when the vehicle is off; eg. door open, hazard & head lights) messages with the following IDs are seen in addition to the usual ones associated with said control
|
|
|
|
* 35D
|
|
* `B.1-B.2` => 0b00=doors closed, 0b11=driver door opened
|
|
* 625
|
|
* DLC=6
|
|
* `D.1-D.2` => 0b10=doors closed, 0b01=any door opened
|
|
|
|
### ACC on, engine off
|
|
|
|
CAN bus load 30%
|
|
|
|
Messages from the following IDs always actively changing
|
|
|
|
* 174
|
|
* `E` => cycles through values 0x01 0x04 0x05 0x09 0x0C 0x0D
|
|
* 176
|
|
* DLC=7
|
|
* `G` => cycles through values 0x01 0x05 0x06 0x09 0x0D
|
|
* 180
|
|
* 182
|
|
* 280
|
|
* 284
|
|
* 285
|
|
* 551
|
|
* `A.1-A.2` => cycles through values 0b01 0b10
|
|
* 560
|
|
* DLC=3
|
|
* 6E2
|
|
* DLC=3
|
|
* `C` => cycles through values 0x78 0x7A and 0x7B 0x79
|
|
|
|
### Engine running
|
|
|
|
CAN bus load 30%
|
|
|
|
Messages from the following IDs always actively changing.
|
|
Bolded IDs are newly seen relative to when ACC on.
|
|
|
|
* **160**
|
|
* 174
|
|
* 176
|
|
* 180
|
|
* 182
|
|
* **1F9**
|
|
* 280
|
|
* 284
|
|
* 285
|
|
* 551
|
|
* 560
|
|
* 6E2
|
|
|
|
### Vehicle controls
|
|
|
|
#### Accelorator pedal
|
|
|
|
* 160
|
|
* `E-H` => seem to correspond to pedal position
|
|
* `A-B` => 0x3D64 when pedal not pressed, increases to 0x41D4 when fully pressed
|
|
* `C` => always 0xA1
|
|
|
|
#### Brake pedal
|
|
|
|
* 354
|
|
* `G.5` => 0=not pressed, 1=pressed
|
|
* 35D
|
|
* `E.5` => 0=not pressed, 1=pressed
|
|
|
|
#### Steering wheel angle
|
|
|
|
No change in messages
|
|
|
|
Only tried with ACC on, engine off
|
|
|
|
#### Vehicle lights
|
|
|
|
Forward facing lights
|
|
|
|
Possible states are: off, headlights on, fog lights on, high beams on
|
|
|
|
* 358
|
|
* `B.8` => 0=off, 1=any light on
|
|
* 60D
|
|
* `A.2-A.3` => 0b00=off, 0b10=headlights on, 0b11=fog lights on
|
|
* 60D
|
|
* `B.4` => 0=high beams off, 1=high beams on
|
|
* 625
|
|
* DLC=6
|
|
* `B.5-B.7` => 0b000=off, 0b100=headlights on, 0b110=fog lights on, 0b001=high beams on
|
|
|
|
When car is off (no key inserted)
|
|
|
|
* 5C5
|
|
* `A.7-A.8` => 0b10=off, 0b01=any light on
|
|
|
|
#### Windshield wipers
|
|
|
|
Wiper control stick
|
|
|
|
Possible states are: off, oneshot ("MIST"), intermittent ("INT"), slow ("LO"), fast ("HI")
|
|
|
|
* 35D
|
|
* `C.6-C.8` => 0b000=off, 0b110=oneshot, 0b010=intermittent, 0b110=slow, 0b111=fast
|
|
* Bits for oneshot and slow settings are the same
|
|
* 354
|
|
* appears during intermittent wiper setting
|
|
* `E.2` => 0=off, 1=intermittent, ...
|
|
* 625
|
|
* `A.2-A.3` => 0b01=off, 0b10=intermittent, ...
|
|
|
|
#### Turn signals
|
|
|
|
Turn signal control stick
|
|
|
|
Data bytes change each time turn signal ticks/lights up
|
|
|
|
* 60D
|
|
* `B.6-B.7` => 0b00=off tick, 0b01=left turn tick, 0b10=right turn tick
|
|
|
|
#### Hazard lights
|
|
|
|
Data bytes change each time lights are flashed on and off
|
|
|
|
* 60D
|
|
* `B.6-B.7` => 0b00=off, 0b11=blink on
|
|
|
|
This is really just a combination of both the left and right turn signal lights.
|
|
Same bits seen when using turn signal control stick.
|
|
|
|
#### Cruise control
|
|
|
|
Cruise control on/off button on steering wheel
|
|
|
|
* 551
|
|
* `F.5-F.7` => 0b000=off, 0b101=on
|
|
|
|
Did not test setting cruise control speed or increasing/reducing speed setting, this would require the vehicle to be moving (minimum 40 km/h before cruise control can be active)
|
|
|
|
#### Horn
|
|
|
|
No change in messages
|
|
|
|
#### Climate control fan
|
|
|
|
* 358
|
|
* `B.7` => 0=off, 1=fan on (any speed)
|
|
* 35D
|
|
* `A.1` => 0=off, 1=fan on (any speed)
|
|
|
|
No other climate control setting showed any change in messages
|
|
|
|
#### Rear defrost
|
|
|
|
Rear window defrost on/off button
|
|
|
|
* 35D
|
|
* `A.2-A.3` => 0b00=off, 0b11=on
|
|
|
|
#### Door ajar
|
|
|
|
* 60D
|
|
* `A.4` driver side front door => 0=closed, 1=open
|
|
* `A.5` passenger side front door => 0=closed, 1=open
|
|
* `A.6` driver side rear door => 0=closed, 1=open
|
|
* `A.7` passenger side rear door => 0=closed, 1=open
|
|
|
|
#### Seat belt
|
|
|
|
When seat belt is clicked in for the driver
|
|
|
|
* 280
|
|
* `A.2` => 0=clicked in, 1=not clicked in
|
|
|
|
Most likely for enabling the seat belt indicator light on the dash
|
|
|
|
Also tried passenger seat belt but saw no change in messages
|
|
|
|
#### Parking brake
|
|
|
|
* 5C5
|
|
* `A.3` => 0=off, 1=parking brake engaged
|
|
|
|
#### Radio buttons
|
|
|
|
No change in messages
|
|
|
|
Unlikely to be on the same bus as the rest of the vehicle controls
|
|
|
|
#### Power windows
|
|
|
|
No change in messages
|
|
|
|
Tried lowering and raising all four windows
|
|
|
|
#### Power door locks
|
|
|
|
No change in messages
|
|
|
|
Tried locking and unlocking all four doors
|
|
|
|
#### Power side mirrors
|
|
|
|
No change in messages
|
|
|
|
Tried adjusting both left and right side mirrors
|
|
|
|
#### Cabin lights
|
|
|
|
No change in messages
|
|
|
|
Tried turning on front cabin light and back seat cabin light
|
|
|
|
#### Gas cap release
|
|
|
|
No change in messages
|
|
|
|
Likely just a mechanical release
|
|
|
|
#### Trunk release
|
|
|
|
No change in messages
|
|
|
|
Likely just a mechanical release
|
|
|
|
## CAN ID summary
|
|
|
|
CAN message IDs to control relations identified but not limited to
|
|
|
|
| ID | Control |
|
|
| -- | ------- |
|
|
| 160 | Accelorator pedal |
|
|
| 280 | Seat belt |
|
|
| 354 | Brake, wipers |
|
|
| 358 | Headlights, climate control |
|
|
| 35D | Brake, wipers, climate control, rear defrost |
|
|
| 551 | Cruise control |
|
|
| 5C5 | Headlights (car off), parking brake |
|
|
| 60D | Headlights, turn signals, doors |
|
|
| 625 | Headlights, wipers |
|