Diagnostic Interface via OBD

Reverse Engineering
#1

I have been in discussion with a fellow hacker via email and wanted to post some of the findings here to see if anyone else has had any experience (or luck) with using diagnostic tools on the OBD connector to interface with the car.

(If any interface gets full support for the ZS EV then it may mean that a Leaf Spy Pro type app will be possible with a cheap dongle)

List of interfaces tried by users (no functionality guaranteed, these are just reports from other users like you):

Launch ThinkDiag/EasyDiag
High level of control and data polling for the ZS EV. Has eZS and other foreign market vehicles that are similar to the ZS EV UK Model.
Can poll data for most ECUs present on UK vehicle. Has decode built in and can be easily reverse engineered. Has shown us a few of the key bits of data through the OBD port.
Most mature software for MG EV currently. Using “SAIC MG” module version 12.80 or later.
Available to purchase on eBay and other sites. The bluetooth dongle version comes with 1 manufacturer included for free.
Cost is circa ÂŁ82
User: @mikeRES , Hardware: THINKDIAG (sold by uk-thinkdiag ) , Software Version: 12.80 or later

Autel MP808 (and other devices from Autel Line)
Interfaces via OBD and can talk to some areas of the car, company appears to be actively developing/reverse engineering from manufacturer tools. Has many features for ICE MGs and older EVs like the LEAF, but mainly focused on garage functions (brake bleeding etc.)
Use does seem to flag up some warnings on the dashboard when talking to the ABS module
User: @mikeRES
Hardware: MaxiPro MP808 (note: there is a Bluetooth dongle which might be a cheaper option)
Software Version: Latest as of 22 July 2020

MG Official Diagnostic Tool - This is the dealer diagnostic tool, if anyone can share details of what the tool(s) is/are I would be very interested.

#2

Any news Mike ?
I see we haven’t had much info lately
has anyone had the comfort update yet?

#3

Comfort update changes the car experience and makes it a much more pleasant experience with out the bongs imho. Nice to have range on display and great to have a outside temp. Does reset the gom and infotainment settings though.

#4

Just had the update done. Cost was ÂŁ80.

It was worth doing as the car is much more pleasant to drive the Bongs are nearly all gone and if it does need to bong it is a quieter and a more pleasant tone. Lane keep Assist does not bong when changing lanes. Conditional speed limits don’t bong so you can leave the speed limit indicator on without worry.

When I got home I found that the garage had left a usb stick in the car, so being nosey i had a look at it and it was obiviously used for the updates. The files though were encrypted using RSA keys. Some files though had references to the infotainment systems and it suggests that the update possibly not only involves the OBDII connector but also the USB connectors.

The garage rang me the next day and came and collected the usb stick so it must be important.

The service manager told me that it can take upto 3 hrs to get the new software installed and that it depended a lot on the speed of the servers from China. Whether that is a load of boloney or not i don’t know.

#5

Great information there, I would guess the infotainment part of the update was performed via USB…which would be a lot faster than CAN. It wouldn’t surprise me if the encryption is what is slowing down the dealers so much in getting this update…as they have to download unique files for each car from the Chinese servers. I ensured the Comfort 2 update was applied before I would accept the car and it is so much better :grinning:.

#6

Did you happen to copy the files… ? :wink: i’d love to have a look…

#7

I didnt copy them as I could not see much value as none had much readable text content except some of the log files which seemed to just confirm various update completions. The only file that looked potentialy interesting was called checklist but this file was RSA encrypted. Also I noted that the dates on alot of the files suggested they were old (2008 on some). Most files were.bin or .log extensions.

#8

Hi @mikeRES.
I’ve noticed in the google spreadsheet that you have found some useful OBD requests.
That’s great news !
I’ll like to help.
How did you discover thoses requests ?
Did you sent random requests until you had some answers from the car ?

arturyux from openvehicles.com forum has shown some results using the eMG6 config (device may be “Launch x431 v+”, see photo)

MG BMU Scan LOW
MG BMU Scan LOW800Ă—600 56.4 KB

#9

@acid256 Yes indeed I have been working with arturyux to get the first round of data.

Since then I have been able to get my hands on equivalent hardware (ThinkDiag) and done some digging myself. I am very optimistic for some native OVMS support (and have tried to myself but it is slow going as I am not exactly an experienced programmer)

The hardware is available easily on eBay and works very well, there is lots of data to be uncovered.

1 Like
#10

What dealer charged on £80 the two I’ve had quotes from have said £120 and £140