OVMS for Reverse Engineering OBD PIDs

OVMS
#1

OVMS can be used for Reverse Engineering, particularly useful for anyone with an MG5! Sorry my video isn’t the smoothest, I had some strange issues copy/pasting commands into the shell interface :persevere:

OVMS CAN Logging Documentation:

Commands Used:

Start CAN bus 1 in active mode
can can1 start active 500000

Start Logging to SD card
can log start vfs crtd /sd/can.crtd

Transmit Tester present to the car
can can1 tx standard 0x7df 02 3e 00 00 00 00 00 00

Stop Logging to SD card
can log stop

PID Sweep on 0x710
re obdii scan start 1 710 0001 fffe

A big thanks to @chris for his hard work to create the OBD PID sweep

1 Like
#2

Morning,

I just ran the Transmit tester on my MG5, and got the following.

    TESTER	Response											
1611042967	CXX	OVMS	CRTD									
1611042967	1CXX	Info	Type:vfs	Format:crtd(discard)	Filter:off	Vehicle:NONE	Path:/sd/logs/canRE.crtd					
1611042971	1R11	718	02	7e	00	aa	aa	aa	aa	aa		GWM
1611042971	1R11	719	02	7e	00	aa	aa	aa	aa	aa		TBOX
1611042971	1R11	728	02	7e	00	aa	aa	aa	aa	aa		ABS
1611042971	1R11	729	02	7e	00	aa	aa	aa	aa	aa		EPS
1611042971	1R11	72B	02	7e	00	aa	aa	aa	aa	aa		EPB
1611042971	1R11	72C	02	7e	00	aa	aa	aa	aa	aa		TPMS
1611042971	1R11	72E	02	7e	00	aa	aa	aa	aa	aa		???
1611042971	1R11	738	02	7e	00	aa	aa	aa	aa	aa		SRM
1611042971	1R11	748	02	7e	00	aa	aa	aa	aa	aa		BCM
1611042971	1R11	74A	02	7e	00	aa	aa	aa	aa	aa		ESCL
1611042971	1R11	74D	02	7e	00	aa	aa	aa	aa	aa		PEPS
1611042971	1R11	758	02	7e	00	aa	aa	aa	aa	aa		ATC
1611042971	1R11	768	02	7e	00	aa	aa	aa	aa	aa		IPK
1611042971	1R11	769	02	7e	00	aa	aa	aa	aa	aa		ICE
1611042971	1R11	76B	02	7e	00	aa	aa	aa	aa	aa		?
1611042971	1R11	779	02	7e	00	aa	aa	aa	aa	aa		SCU
1611042971	1R11	77D	02	7e	00	aa	aa	aa	aa	aa		???
1611042971	1R11	77E	02	7e	00	aa	aa	aa	aa	aa		PLC
1611042971	1R11	78C	02	7e	00	aa	aa	aa	aa	aa		EVCC
1611042971	1T11	7DF	02	3e	00	00	00	00	00	00		???
1611042971	1R11	7EB	02	7e	00	00	00	00	00	00		VCU
1611042971	1R11	7ED	02	7e	00	aa	aa	aa	aa	aa		???
1611042971	1R11	7EE	02	7e	00	aa	aa	aa	aa	aa		???

Last column is a cross reference to the ZS ECU addresses.
Not had a chance to do any PID Sweeps yet… :frowning:

Hope this helps.

Tim

#3

Thanks @Tim for you work today on the MG5, we have some early support.

OBD PID Reverse Engineering Spreadsheet: https://docs.google.com/spreadsheets/d/1u3ygHEyHGONkziikCflygmeqJYUH4V4LOoZy0ZOjjCc/edit?usp=sharing

#4

@mikeRES thanks for the video on the poll mechanism. Do you know which commands to use to log the stream of CAN messages that modules in the car send to each other, if possible at all?

#5

Yes the same command would work but you need to be connected on the internal networks (the other side of the gateway). See my earlier work on the breakout leads. If all you want are log files whilst actions are happening I can get those for you.