CANBOX , CAN decoder reverse engineering

darkspr1te · Feb 25, 2020

Hi All,
I have a PX5 radio that was supplied with fittings for 2006 Toyota RAV4 , sadly it didnt come with a CANBOX and supplier was not able to provide one that matched, I managed to get my hands on a Canbox for VW unit and decided to reverse engineer the unit.
Here are my findings.

Code:

Pinouts
1--2--3--4--5--6--7--8
9--10-11-12-13-14-15-16
1	GND			9	B+
2	CANH			10	CANL
3	EMPTY			11	ACC
4	EMPTY			12	EMPTY
5	EMPTY			13	EMPTY
6	EMPTY			14	EMPTY
7	MCU_RXD_CAN	  15	EMPTY
8	EMPTY	                 16	MCU_TXD_CAN

On power up the device sends a hex packet to TX Uart of the board (RX of the head unit) at 38400 baud,

the packet is as follows

Code:

0x0,
0x2E,0x21,0x5,0x0,0x10,0x0,0x0,0x0,0xC9
0x2E,0x21,0x5,0x0,0x10,0x0,0x0,0x0,0xC9,
0x2E0x21,0x5,0x0,0x10,0x0,0x0,0x0,0xC9,
0x2E,0x21,0x5,0x0,0x10,0x0,0x0,0x0,0xC9,
0x2E,0x22,0x4,0x1,0x1,0x1,0x1,0xD5,
0x2E,0x22,0x4,0x1,0x10x1,0x1,0xD5,
0x2E,0x22,0x4,0x1,0x1,0x1,0x1,0xD5,
0x2E,0x22,0x4,0xFE,0x2,0x1,0x1,0xD5,
0x2E,0x23,0x4,0x1,0x1,0x1,0x1,0xD4,
0x2E,0x23,0x4,0x1,0x1,0x1,0x1,0xD4,
0x2E,0x23,0x4,0x1,0x1,0x1,0x1,0xD4,
0x2E,0x23,0x4,0x1,0x1,0x1,0x1,0xFF,0xFF

Raw Packet

Code:

02E215010000C92E215010000C92E215010000C92E215010000C92E2241111D52E2241111D52E2241111D52E2241111D52E2341111D42E2341111D42E2341111D42E2341111D4FF

packet burst start with 0x0 then each packet start with 0x2e
My Assumption is the box acts as a translator converting each car specific CANBUS/KKL/KLINE/IR-bus protocol into a
pre-defined packet of information that it transmits to the headunit.
if this is confirmed then creating a open source version of the box should be easy within the ease of the cars can system ,
it may also open cars that dont have can bus to still use the canbus system of headunit, eg reading speed to adjust volume , monitor door open to display on screen using arduino.

If anyone has seen a lookup chart or information on the CANBOX/Decoders protocol to/from the headunit I would love the link.

next i will hookup to the headunit itself and send the same codes to see what effect they have.

darkspr1te
p.s if anyone knows of a firmware bin for canbus box then please let me know.

darkspr1te · Feb 25, 2020

Some reference information
Kia CANBOX pinouts
canbox scematic and versions XDA-post

canbus protocol headunit

darkspr1te

darkspr1te · Feb 25, 2020

Found on another page, posted here for info ,

Code:

Action			DEC				HEX
Vol+			46 32 2 1 1 219			2E 20 02 01 01 DB
Vol-			46 32 2 2 1 218			2E 20 02 02 01 DA
Next			46 32 2 3 1 217			2E 20 02 03 01 D9
Back			46 32 2 4 1 216			2E 20 02 04 01 D8
BT connect		46 32 2 5 1 215			2E 20 02 05 01 D7
Mute			46 32 2 6 1 214			2E 20 02 06 01 D6
Home			46 32 2 7 1 213			2E 20 02 07 01 D5
		

Front left door		46 65 2 1 1 186			2E 41 02 01 01 BA
Front right door	46 65 2 1 2 185			2E 41 02 01 02 B9
Rear left door		46 65 2 1 4 183			2E 41 02 01 04 B7
Rear right door		46 65 2 1 8 179			2E 41 02 01 08 B3
Trunk			46 65 2 1 16 171		2E 41 02 01 10 AB
Parking brake		46 65 2 1 32 155		2E 41 02 01 20 9B
Wiper fluid level	46 65 2 1 64 123		2E 41 02 01 40 7B
Seat belt		46 65 2 1 128 59		2E 41 02 01 80 3B	
Closes decoder ?	46 34 1 0 0 220			2E 22 01 00 00 DC

Code:

1rst byte: 2E ->start
2nd byte: XX -> request ID
3 byte: NN -> number of data bytes length
4 to NN+3 bytes: DD ... DD -> data of request
NN+4 byte: cheksum from second byte to NN+3 byte complement 2

royalhawk2002 · Feb 25, 2020 at 8:06 PM

Thanks. That is very interesting. I subscribed the topic. In my case I have a problem with my can decoder regarding the panel lights. It is correctly switch on if I manually switch on the headlights, but it doesn't come on if the headlights are in "Automatic" mode. Probably the CAN message in this case is different and is not correctly decoded by the box.

Inviato dal mio SM-N960F utilizzando Tapatalk

royalhawk2002 · Feb 26, 2020 at 9:15 AM

darkspr1te said:

Found on another page, posted here for info ,

Code:

Action			DEC				HEX
Vol+			46 32 2 1 1 219			2E 20 02 01 01 DB
Vol-			46 32 2 2 1 218			2E 20 02 02 01 DA
Next			46 32 2 3 1 217			2E 20 02 03 01 D9
Back			46 32 2 4 1 216			2E 20 02 04 01 D8
BT connect		46 32 2 5 1 215			2E 20 02 05 01 D7
Mute			46 32 2 6 1 214			2E 20 02 06 01 D6
Home			46 32 2 7 1 213			2E 20 02 07 01 D5
		

Front left door		46 65 2 1 1 186			2E 41 02 01 01 BA
Front right door	46 65 2 1 2 185			2E 41 02 01 02 B9
Rear left door		46 65 2 1 4 183			2E 41 02 01 04 B7
Rear right door		46 65 2 1 8 179			2E 41 02 01 08 B3
Trunk			46 65 2 1 16 171		2E 41 02 01 10 AB
Parking brake		46 65 2 1 32 155		2E 41 02 01 20 9B
Wiper fluid level	46 65 2 1 64 123		2E 41 02 01 40 7B
Seat belt		46 65 2 1 128 59		2E 41 02 01 80 3B	
Closes decoder ?	46 34 1 0 0 220			2E 22 01 00 00 DC

Code:

1rst byte: 2E ->start
2nd byte: XX -> request ID
3 byte: NN -> number of data bytes length
4 to NN+3 bytes: DD ... DD -> data of request
NN+4 byte: cheksum from second byte to NN+3 byte complement 2

probably this post could help you... it gives some usefull codes, including a sort of CAN Bus monitoring:
https://forum.xda-developers.com/showpost.php?p=71455277&postcount=11

darkspr1te · Feb 27, 2020 at 7:58 AM

royalhawk2002 said:
Thanks. That is very interesting. I subscribed the topic. In my case I have a problem with my can decoder regarding the panel lights. It is correctly switch on if I manually switch on the headlights, but it doesn't come on if the headlights are in "Automatic" mode. Probably the CAN message in this case is different and is not correctly decoded by the box.

Inviato dal mio SM-N960F utilizzando Tapatalk

Yes, the can ID or $ID in short hand is different for light, auto lights on and dial light turned on. i have fallen pray to this with my RAV4 auto lights, like why my display is dim "oh i put a book on top of the sensor on the dash" , but I chased other bugs before that one became more obvious.

darkspr1te · Feb 27, 2020

royalhawk2002 said:
probably this post could help you... it gives some usefull codes, including a sort of CAN Bus monitoring:
https://forum.xda-developers.com/showpost.php?p=71455277&postcount=11

Thanks, I had come across that one and apart from the logcan function most of the other stuff is not valid in this application.
I intend to aim primarily at the protocol between Head unit and CANBOX, not CANBOX to car (as i'am sort of covering that elsewhere) , the CANBOX to car part is one hell of a rabbit hole to go down , not only are varied high level terms thrown around incorrectly or misunderstood in a lot of articles but as soon as the document gets to a level of understanding the information drains off as the commercial applications come forward, imagine cartoon authors eye's turn to ($) ($).
Thats why you dont see much in the way of good open source OBD stuff thats not tied into a specific hardware circle or device type.
J2435 is sort of opening that up but in a poor way, they hiding the CAR part behind a device again so again we dont know what the device is saying to the car.
This is why i wont be really covering much on the car side but more in how we can replicate the canbox functions first of all.
I already have a POC that talks to a ELM327 device via wifi or BT, only the programming the esp2866 lacks full understanding of the car as i have JDM cars, not only is JDM protocols different from euro/US counterparts but the also have sub -divided protocols where a euro/us function will work on 2006-2007 model but not 2008-current, who knows why but that is the way of it.

I also do have some additional information on the protocol that i've have to digest, ~~the last bytes are CRC8~~ EDIT:twos compliment crc see below, i've confirmed that, so we can calc on fly or use look up table for speed, I also have seen this protocol in my research before into another subject but i cannot place it yet, the $2e start byte is the giveaway and followed by function High byte and low bytes and then data and finally crc, Maybe i'll remember it before someone else does, but we have the base part of the protocol and i already have a POC code that is usable on many devices due to being arduino in nature(just not arduino ide but thats a coders choice),

Now as we already have a schematic floating around with full BOM we could in theory make our own canbox but when checking I found it's based on STM8 which is a older chip and I'am personally more familiar with STM32F series and atmega, sam4c etc so i may re-produce the board using that. Also all of my current in stock hardware that has canbus is all stm32f.

Now some of you might have spotted my glaring mistake, I want the code the to work on anything but i'am building it using stm, well thats only due to the fact i have a quite a few stm's to sacrifice , once i know the code works (HU to canbox & canbox to car) then i can introduce other brands of MCU once i have a validated test bench. What will vary device to device is how you Initiate the CAN, with stm32 chips they have bXcan drivers in f103 chips, for atmega we can use spi based canbus driver chips. Supporting those two functions will be enough to pull in esp/atmega/LT and many other chip makers should someone want to port to their fav brand of chip.

I would also like to support non-obd cars , sensing door open is not that hard and a simple arduino+level converter you can sense doors, speed and more. there's also a few after market steering wheels that have vol dials as wheel as custom car builder wanting to use a wheel from brand A on brand B , who am i to judge where you got your real Lotus F1 wheel from.

Now we do have to cover one subject thats often missed in these discussions, OBD and all it's cousins was ment as Diagnostic first, which means not all cars are happy having a dongle full time on the OBD port, I've seen cummings based vehicles refuse to start unless the OBD is unplugged first, that means the dongle is introducing noise on to the bus, be it in the form of legit data request, eronus data or real electrical noise from not having the BUS resistor .
edit: while trying to solve this "ive seen this before" problem I did find this, very similar,
https://www.peak-system.com/produktcd/Pdf/English/PCAN-LIN_ProtDef_eng.pdf

darkspr1te

vegfokic · Feb 25, 2020 26 1 0

My head unit isudar h53 also has can box. The car can H and can L connect directly to the box. Between the box and radio there are can rx and can tx. If I go to car choise menu to select car type, after that the unit update the mcu firmware. When this update is done whether the can box is also updated via can rx and can tx lines?
Normally the can rx and can tx signal translated via can chip eg.: tja1050 to can H and can L. If nothing else is in the can box it is not need to update. But the box include ignition ac signal and fix voltage. Because this reason maybe there are much more component in the box than a single can chip.
So my question is if I want to modify one of the can message, enough the head unit update or need to the can box also?

darkspr1te · Feb 27, 2020

CRC sorted

Ok, so i've sorted the crc out, I can now calc the crc correctly based on this :-

Code:

uint8_t data_packet[] ={0x41,0x2,0x01,0x80};

uint8_t crc_mod(uint8_t car_array[],int datasize)
{
  int checksum=0;
  for (int i = 0; i < datasize; i++)
    {
      checksum = (checksum + car_array[i]) & 0xFF;
    }
    return (256 - checksum & 0xFF)-1;
}

void main()
{
uint8_t data_crc=crc_mod(data_packet,sizeof(data_packet));
Serial.print(data_crc,HEX);
}

and of course the final packet array will be :-
0x2E,0x41,0x02,0x01,0x80,0x3B
or
START_BYTE,PKT_BODY,sizeof(MIN_DATA_SIZE),FILLER_BYTE,SEAT_BELT,crc_mod(PKT_BODY,sizeof(MIN_DATA_SIZE),FILLER_BYTE,SEAT_BELT)
would make up a full packet,

As for the actual data packet i've broken it down to :-

Code:

#define START_BYTE 0x2e
#define MIN_DATA_SIZE 0x2
#define FILLER_BYTE
//buttons
#define PKT_BUTTON 0x20
#define HU_VOLUME_UP    0x1
#define HU_VOLUME_DOWN  0x2
#define HU_NEXT         0x3
#define HU_BACK         0x4
#define HU_BT_ON        0x5
#define HU_MUTE         0x6
#define HU_HOME         0x7

//body functions -
#define PKT_BODY    0x41
#define FL_DOOR         0x1
#define FR_DOOR         0x2
#define RL_DOOR         0x4
#define RR_DOOR         0x8
#define BOOT_DOOR       0x10
#define PARK_BRAKE      0x20
#define WIPER_FLUID     0x40
#define SEAT_BELT       0x80

~~I'am going to assume there are different packet ID's other than 0x20 and 0x41 out there eg AC, windows , lights~~ see next post, Also i've not optimized the packet structure or definitions and i've not pasted all the body definitions i've found, some are unconfirmed or contradicting.

I'am going to tidy up the code so i can share it and hope it will make more sense once i've removed all my test rubbish but I initially have the arduino acting on packets from the device (CANBOX) and I can now build a packet with crc being calculated runtime, have not tested what happens when i send to the box yet as my setup is very , ahem, primitive due to desk space limitations and my current setup includes :-
1x canbox
3xstm32 blackpills (one is acting as HU, one is acting as CAR CAN and one ties uarts together)
1x rigol ds1054z scope

anyway, more to come.

darkspr1te

darkspr1te · Feb 27, 2020 at 9:36 PM

Ok,so in the prior post we spoke about the basic packet so far,
but in my first post I pasted some data from my box

Code:

0x2E,0x21,0x5,0x0,0x10,0x0,0x0,0x0,0xC9
0x2E,0x21,0x5,0x0,0x10,0x0,0x0,0x0,0xC9,
0x2E,0x22,0x4,0x1,0x1,0x1,0x1,0xD5,
0x2E,0x22,0x4,0xFE,0x2,0x1,0x1,0xD5,
0x2E,0x23,0x4,0x1,0x1,0x1,0x1,0xD4,
0x2E,0x23,0x4,0x1,0x1,0x1,0x1,0xFF,0xFF

So we also know that packet size can change , maybe this is the difference between brands (RAISE is a common one i see and mine has that written on PCB) , I dont have the box for my unit but I have seen a image of it around, i'll try to post it on the CANBOX Types post and then refer here.
I also see a lot of duplicate transmissions too so next step is to listen to the device while connected to a real HU to sniff for packet OK response, again that is a assumption on my side.

darkspr1te

darkspr1te · Mar 1, 2020 at 6:55 PM

MCTCoreServices

So I've found the sources that document the protocol between CANBOX and HeadUnit for some CANBOX models,

Code:

public class CanBoxProtocol
{
	private final static String TAG 		= "CanBoxProtocol";
	private boolean mIsValidProtocol = false;
	private int mLengthFlag 				= 0x1;//0 = 长度在前，1 = 长度在后
	private int mHeadLength 				= 0x00;//Head长度
	private int[] mHeadTag 				= new int[]{0xFF,0xFF,0xFF};//协议头，不够补0xFF
	private int[] mBaudRate 				= new int[]{0x00,0x00,0x00,0x00};//波特率
	private int mChecksumAddLength 	= 0x1;//0 checksum计算不需要包含length;1 需要包含length
	private int mChecksumAddCmd 	= 0x1;//0 checksum计算不需要包含cmd;1 需要包含cmd
	private int mChecksumMode 		= 0x1;//0 &0xFF; 1 ^0xFF
	private int mChecksumExtern 		= 0x0;//0 checksum不需要-1;1 不需要
	private int mNeedAck 					= 0x1;//是否需要ACK
	private int mOkAck 						= 0xFF;//成功ACK
	private int mFailedAck 				= 0xF0;//失败ACK
	private int mCheckSumLength		= 0x01;//CheckSum长度
	private int mDataLengthMode		= 0x00;//0 Data部分的长度;1 除协议头以外所有的数据长度
	
	
	public CanBoxProtocol(int canBoxType,int carModel)
	{
		updateCanBoxType(canBoxType,carModel);
	}
	
	public void updateCanBoxType(int canBoxType,int carModel)
	{
		Log.i(TAG, "updateCanBoxType:"+canBoxType+",carModel:"+carModel);
		switch(canBoxType)
		{
			case CarModelDefine.CAN_BOX_RZC:
			{
				//睿智诚标志雪铁龙车系协议格式要单独处理
				if(carModel >= 250 && carModel <= 299)
				{
					mLengthFlag = 0x00;
					mHeadTag[0] = 0xFD;
					mHeadTag[1] = 0xFF;
					mHeadTag[2] = 0xFF;
					mHeadLength = 0x01;
					mBaudRate[0] = 0x00;
					mBaudRate[1] = 0x00;
					mBaudRate[2] = 0x4B;
					mBaudRate[3] = 0x00;
					mChecksumAddLength = 0x01;
					mChecksumAddCmd = 0x01;
					mChecksumMode = 0x00;
					mChecksumExtern = 0x00;
					mNeedAck = 0x00;
					mOkAck = 0xFF;
					mFailedAck = 0xFF;
					mIsValidProtocol = true;
					mCheckSumLength = 0x01;
					mDataLengthMode = 0x01;
				}
				else if(carModel >= 300 && carModel <= 349)
				{
					mLengthFlag = 0x00;
					mHeadTag[0] = 0xFD;
					mHeadTag[1] = 0xFF;
					mHeadTag[2] = 0xFF;
					mHeadLength = 0x01;
					mBaudRate[0] = 0x00;
					mBaudRate[1] = 0x00;
					mBaudRate[2] = 0x4B;
					mBaudRate[3] = 0x00;
					mChecksumAddLength = 0x01;
					mChecksumAddCmd = 0x01;
					mChecksumMode = 0x00;
					mChecksumExtern = 0x00;
					mNeedAck = 0x00;
					mOkAck = 0xFF;
					mFailedAck = 0xFF;
					mIsValidProtocol = true;
					mCheckSumLength = 0x02;
					mDataLengthMode = 0x01;
				}
				else 
				{
					mLengthFlag = 0x01;
					mHeadTag[0] = 0x2E;
					mHeadTag[1] = 0xFF;
					mHeadTag[2] = 0xFF;
					mHeadLength = 0x01;
					mBaudRate[0] = 0x00;
					mBaudRate[1] = 0x00;
					mBaudRate[2] = 0x96;
					mBaudRate[3] = 0x00;
					mChecksumAddLength = 0x01;
					mChecksumAddCmd = 0x01;
					mChecksumMode = 0x01;
					mChecksumExtern = 0x00;
					mNeedAck = 0x01;
					mOkAck = 0xFF;
					mFailedAck = 0xF0;
					mIsValidProtocol = true;
					mCheckSumLength = 0x01;
					mDataLengthMode = 0x00;
				}
			}
				break;
			case CarModelDefine.CAN_BOX_SS:
				mLengthFlag = 0x00;
				mHeadTag[0] = 0xAA;
				mHeadTag[1] = 0x55;
				mHeadTag[2] = 0xFF;
				mHeadLength = 0x02;
				mBaudRate[0] = 0x00;
				mBaudRate[1] = 0x00;
				mBaudRate[2] = 0x96;
				mBaudRate[3] = 0x00;
				mChecksumAddLength = 0x01;
				mChecksumAddCmd = 0x01;
				mChecksumMode = 0x00;
				mChecksumExtern = 0x01;
				mNeedAck = 0x00;
				mOkAck = 0xFF;
				mFailedAck = 0xFF;
				mIsValidProtocol = true;
				mCheckSumLength = 0x01;
				mDataLengthMode = 0x00;
				break;
			case CarModelDefine.CAN_BOX_XP:
				mLengthFlag = 0x01;
				mHeadTag[0] = 0x2E;
				mHeadTag[1] = 0xFF;
				mHeadTag[2] = 0xFF;
				mHeadLength = 0x01;
				mBaudRate[0] = 0x00;
				mBaudRate[1] = 0x00;
				mBaudRate[2] = 0x96;
				mBaudRate[3] = 0x00;
				mChecksumAddLength = 0x01;
				mChecksumAddCmd = 0x01;
				mChecksumMode = 0x01;
				mChecksumExtern = 0x00;
				mNeedAck = 0x01;
				mOkAck = 0xFF;
				mFailedAck = 0xF0;
				mIsValidProtocol = true;
				mCheckSumLength = 0x01;
				mDataLengthMode = 0x00;
				break;
			default:
				Log.e(TAG, "not support this can box type");
				break;
		}
	}

and then theres the commands

Code:

	//CanBox->HU
	public static final int CH_CMD_STEERING_WHEEL_KEY 		= 0x20;
	public static final int CH_CMD_TRIP_PER_MINUTE_INFO 	= 0x21;//每分钟油耗
	public static final int CH_CMD_INSTANT_TRIP_INFO 			= 0x22;//瞬时油耗
	public static final int CH_CMD_HISTORY_TRIP_INFO 			= 0x23;//历史油耗
	public static final int CH_CMD_BASE_INFO 							= 0x24;
	public static final int CH_CMD_TPMS_INFO 							= 0x25;
	public static final int CH_CMD_VEHICLE_SETTING 				= 0x26;
	public static final int CH_CMD_TRIP_BEFORE_15_MINUTE	= 0x27;//过去15分钟每分钟油耗
	public static final int CH_CMD_AIR_CONDITION_INFO 		= 0x28;//空调信息
	public static final int CH_CMD_STEERING_WHEEL_ANGLE 	= 0x29;//方向盘转角信息
	public static final int CH_CMD_PROTOCOL_VERSION_INFO 	= 0x30;//协议版本信息
	public static final int CH_CMD_AMPLIFIER_STATUS_INFO 	= 0x31;//攻放信息
	public static final int CH_CMD_SYSTEM_INFO 						= 0x32;//系统信息
	public static final int CH_CMD_OIL_ELEC_MIXED_INFO 		= 0x1F;//油电混合指示
	public static final int CH_CMD_REAR_RADAR_INFO				= 0x1E;//后雷达
	public static final int CH_CMD_FRONT_RADAR_INFO			= 0x1D;//前雷达
	public static final int CH_CMD_VEHICLE_SET_STATUS_INFO	= 0x50;//车辆设置状态
	public static final int CH_CMD_AC_PANEL_KEY_INFO			= 0x51;//空调面板设置信息(皇冠)
	public static final int CH_CMD_VECHILE_SET_RETURN_INFO= 0x52;//车辆设置返回信息(皇冠、汉兰达)
	public static final int CH_CMD_AIR_CONDITION_INFO2		= 0x58;//车型空调信息(皇冠)
	
	//HU->CanBox
	public static final int HC_CMD_SWITCH          						= 0x81;
	public static final int HC_CMD_VEHICLE_SET						= 0x83;//车身中控设定命令
	public static final int HC_CMD_COMMON_SET						= 0x84;//设定命令
	public static final int HC_CMD_REQ_CONTROL_INFO			= 0x90;//请求控制信息
	
	public static final int SWC_KEY_NONE									= 0x00;//无按键或者按键释放
	public static final int SWC_KEY_VOLUME_UP						= 0x01;//音量加
	public static final int SWC_KEY_VOLUME_DOWN					= 0x02;//音量键
	public static final int SWC_KEY_MENU_RIGHT						= 0x03;//方向键-右
	public static final int SWC_KEY_MENU_LEFT						= 0x04;//方向键-左
	public static final int SWC_KEY_SRC									= 0x07;//源切换
	public static final int SWC_KEY_SPEECH								= 0x08;//语音
	public static final int SWC_KEY_PICK_UP								= 0x09;//接听
	public static final int SWC_KEY_HANG_UP							= 0x0A;//挂断
	public static final int SWC_KEY_BOX									= 0x0B;//方框键
	public static final int SWC_KEY_MENU_UP							= 0x13;//方向键-上
	public static final int SWC_KEY_MENU_DOWN						= 0x14;//方向键-下
	public static final int SWC_KEY_BACK									= 0x15;//back
	public static final int SWC_KEY_ENTER								= 0x16;//enter
	public static final int SCROLL_KEY_VOLUME_UP					= 0x81;//音量旋钮-
	public static final int SCROLL_KEY_VOLUME_DOWN				= 0x82;//音量旋钮+
	public static final int SCROLL_KEY_CH_FLD_UP					= 0x83;//enter
	public static final int SCROLL_KEY_CH_FLD_DOWN				= 0x84;//enter
	public static final int SCROLL_KEY_TUNE_TRACK_UP			= 0x85;//收音调台-
	public static final int SCROLL_KEY_TUNE_TRACK_DOWN		= 0x86;//收音调台+
	public static final int SWC_KEY_POWER								= 0x87;//PWR
	public static final int SWC_KEY_MODE									= 0x88;//MODE

and the models are

Code:

	public static final short CAR_MODEL_VOLKSWAGEN_MAGOTAN    = 0;//大众迈腾
	public static final short CAR_MODEL_VOLKSWAGEN_SAGITAR    	= 1;//大众速腾
	public static final short CAR_MODEL_VOLKSWAGEN_GOLF7   		= 2;//大众高尔夫7
	public static final short CAR_MODEL_VOLKSWAGEN_POLO    		= 3;//大众波罗
	public static final short CAR_MODEL_VOLKSWAGEN_OCTAVIA    	= 4;//大众明锐
	public static final short CAR_MODEL_VOLKSWAGEN_17MAGOTAN= 5;//17款迈腾
	
	//本田系列(50-99)
	public static final short CAR_MODEL_HONDA_15CRV_L				= 50;//15CRV低配
	public static final short CAR_MODEL_HONDA_15CRV_H				= 51;//15CRV高配
	public static final short CAR_MODEL_HONDA_CROSSTOUR			= 52;//歌诗图
	public static final short CAR_MODEL_HONDA_ACCORD_9L			= 53;//雅阁9代低配
	public static final short CAR_MODEL_HONDA_ACCORD_9H			= 54;//雅阁9代高配
	public static final short CAR_MODEL_HONDA_CRIDER					= 55;//凌派2016
	public static final short CAR_MODEL_HONDA_JADE						= 56;//杰德
	public static final short CAR_MODEL_HONDA_ODYSSEY				= 57;//奥德赛
	public static final short CAR_MODEL_HONDA_FIDO						= 58;//飞度
	public static final short CAR_MODEL_HONDA_WISDOM				= 59;//缤智
	public static final short CAR_MODEL_HONDA_CITY						= 60;//锋范旗舰版2015
	public static final short CAR_MODEL_HONDA_12CRV					= 61;//12CRV
	
	//日产系列(100-149)
	public static final short CAR_MODEL_NISSAN_X_TRAIL				=	100;//奇骏
	public static final short CAR_MODEL_NISSAN_QASHQAI				=	101;//逍客
	public static final short CAR_MODEL_NISSAN_NEW_TEANA			=	102;//新天籁
	public static final short CAR_MODEL_NISSAN_TEANA					=	103;//天籁
	public static final short CAR_MODEL_NISSAN_TIIDA					=	104;//骐达
	public static final short CAR_MODEL_NISSAN_SUN						=	105;//阳光
	public static final short CAR_MODEL_NISSAN_LI_WEI					=	106;//骊威
	public static final short CAR_MODEL_NISSAN_BLUEBIRD				=	107;//蓝鸟
	public static final short CAR_MODEL_NISSAN_INIFINITI_QX50_L	=	108;//英菲尼迪QX50低配
	public static final short CAR_MODEL_NISSAN_INIFINITI_QX50_H=	109;//英菲尼迪QX50高配
	public static final short CAR_MODEL_NISSAN_MORNAO				=	110;//楼兰
	public static final short CAR_MODEL_NISSAN_CIMA_L					=	111;//西玛低配
	public static final short CAR_MODEL_NISSAN_CIMA_H					=	112;//西玛高配
	public static final short CAR_MODEL_NISSAN_VENUCIA_T70		= 113;//启辰T70
	public static final short CAR_MODEL_NISSAN_VENUCIA_T90		= 114;//启辰T90
	//丰田系列(150-199)
	public static final short CAR_MODEL_TOYOTA_RAV4					= 150;//RAV4
	public static final short CAR_MODEL_TOYOTA_VIOS					= 151;//威驰
	public static final short CAR_MODEL_TOYOTA_REIZ					= 152;//锐志	
	public static final short CAR_MODEL_TOYOTA_OVERBEARING		= 153;//霸道
	public static final short CAR_MODEL_TOYOTA_COROLLA				= 154;//卡罗拉
	public static final short CAR_MODEL_TOYOTA_HIGHLANDER		= 155;//汉兰达
	public static final short CAR_MODEL_TOYOTA_CAMRY					= 156;//凯美瑞
	public static final short CAR_MODEL_TOYOTA_CROWN				= 157;//皇冠
	
	//通用系列(200-249)
	public static final short CAR_MODEL_GM_HIDEN							= 200;//英朗
	public static final short CAR_MODEL_GM_CRUZE							= 201;//科鲁兹
	public static final short CAR_MODEL_GM_MALIBU						= 202;//迈锐宝
	public static final short CAR_MODEL_GM_16MALIBU_XL				= 203;//2016迈锐宝XL
	public static final short CAR_MODEL_GM_GL8								= 204;//GL8
	public static final short CAR_MODEL_GM_AVEO							= 205;//爱唯欧
	public static final short CAR_MODEL_GM_REGAL							= 206;//君威
	public static final short CAR_MODEL_GM_ENCORE						= 207;//昂科拉
	
	//标志雪铁龙系列(250-299)
	public static final short CAR_MODEL_PEUGEOT_16_308				= 250;//16款308
	public static final short CAR_MODEL_PEUGEOT_14_408				= 251;//14款408
	public static final short CAR_MODEL_PEUGEOT_ELYSEE				= 252;//爱丽舍
	public static final short CAR_MODEL_PEUGEOT_301					= 253;//301
	public static final short CAR_MODEL_PEUGEOT_2008					= 254;//2008
	public static final short CAR_MODEL_PEUGEOT_3008					= 255;//3008
	public static final short CAR_MODEL_PEUGEOT_C4L					= 256;//C4L
	public static final short CAR_MODEL_PEUGEOT_DS5LS					= 257;//DS5LS
	public static final short CAR_MODEL_PEUGEOT_C3XL					= 258;//C3XL
	public static final short CAR_MODEL_PEUGEOT_SEGA					= 259;//世嘉
	public static final short CAR_MODEL_PEUGEOT_4008					= 260;//4008

	//韩系(300-349)
	public static final short CAR_MODEL_KOREA_IX35						= 300;//IX35
	public static final short CAR_MODEL_KOREA_IX45						= 301;//IX45
	public static final short CAR_MODEL_KOREA_SONATA8				= 302;//索纳塔8
	public static final short CAR_MODEL_KOREA_SONATA9				= 303;//索纳塔9
	public static final short CAR_MODEL_KOREA_SORRENTO				= 304;//索兰托
	public static final short CAR_MODEL_KOREA_KIA_K5					= 305;//起亚K5
	public static final short CAR_MODEL_KOREA_KIA_KX5					= 306;//起亚KX5
	public static final short CAR_MODEL_KOREA_16MISTRA				= 307;//16名图
	public static final short CAR_MODEL_KOREA_KIA_16ELANTRA		= 308;//16领动
	public static final short CAR_MODEL_KOREA_KIA_16K3				= 309;//16K3
	
	//福特车系系列(350-399)
	public static final short CAR_MODEL_FORD_12_FUCOS				= 350;//2012款福克斯
	public static final short CAR_MODEL_FORD_13_KUGA					= 351;//2013款翼虎
	public static final short CAR_MODEL_FORD_13_ECO_SPORT		= 352;//2013款翼博
	public static final short CAR_MODEL_FORD_13_FIESTA				= 353;//2013款嘉年华
	public static final short CAR_MODEL_FORD_15_FUCOS				= 354;//2015款福克斯
	public static final short CAR_MODEL_FORD_17_KUGA					= 355;//2017款翼虎
	

	//奔腾车系
	public static final short CAR_MODEL_BESTURN_16_B50				= 400;//2016款奔腾B50
	public static final short CAR_MODEL_BESTURN_X80					= 405;//奔腾X80
	
	//广汽传祺车系
	public static final short CAR_MODEL_TRUMPCH_GA3					= 450;
	public static final short CAR_MODEL_TRUMPCH_GA3S					= 451;
	public static final short CAR_MODEL_TRUMPCH_GA6					= 452;
	public static final short CAR_MODEL_TRUMPCH_GS4					= 453;
	public static final short CAR_MODEL_TRUMPCH_GS5					= 454;
	public static final short CAR_MODEL_TRUMPCH_XINGLANG			= 455;//广汽吉奥星朗
	
	//吉利车系
	public static final short CAR_MODEL_GEELY_EMGRAND				= 500;//吉利帝豪
	public static final short CAR_MODEL_GEELY_EMGRAND_GS			= 501;//吉利帝豪GS
	public static final short CAR_MODEL_GEELY_NL_3						= 502;//吉利博越
	
	//中华车系
	public static final short CAR_MODEL_CHINA_MOTOR_V3				= 550;//中华V3
	public static final short CAR_MODEL_CHINA_MOTOR_H3				= 551;//中华H3
	
	//宝骏车系
	public static final short CAR_MODEL_BAO_JUN_560_2015			= 600;//2015宝骏560
	public static final short CAR_MODEL_BAO_JUN_730_2014			= 601;//2014宝骏730
	public static final short CAR_MODEL_BAO_JUN_730_2017			= 602;//2017宝骏730
	
	//吉普车系
	public static final short CAR_MODEL_JEEP_FREELIGHT_2015		= 650;//2015吉普自由光
	public static final short CAR_MODEL_JEEP_LIBERTY_2016			= 651;//2016吉普自由侠
	public static final short CAR_MODEL_JEEP_COMPASS_2017			= 652;//2017吉普指南者
	
	//长城车系
	public static final short CAR_MODEL_GREAT_WALL_H2				= 700;//长城H2

More to come once i've studied the java and .so sources

darkspr1te

royalhawk2002 · Mar 2, 2020 at 6:54 AM

darkspr1te said:

So I've found the sources that document the protocol between CANBOX and HeadUnit for some CANBOX models,

Code:

public class CanBoxProtocol

{

private final static String TAG = "CanBoxProtocol";

private boolean mIsValidProtocol = false;

private int mLengthFlag = 0x1;//0 = 长度在前，1 = 长度在后

private int mHeadLength = 0x00;//Head长度

private int[] mHeadTag = new int[]{0xFF,0xFF,0xFF};//协议头，不够补0xFF

private int[] mBaudRate = new int[]{0x00,0x00,0x00,0x00};//波特率

private int mChecksumAddLength = 0x1;//0 checksum计算不需要包含length;1 需要包含length

private int mChecksumAddCmd = 0x1;//0 checksum计算不需要包含cmd;1 需要包含cmd

private int mChecksumMode = 0x1;//0 &0xFF; 1 ^0xFF

private int mChecksumExtern = 0x0;//0 checksum不需要-1;1 不需要

private int mNeedAck = 0x1;//是否需要ACK

private int mOkAck = 0xFF;//成功ACK

private int mFailedAck = 0xF0;//失败ACK

private int mCheckSumLength= 0x01;//CheckSum长度

private int mDataLengthMode= 0x00;//0 Data部分的长度;1 除协议头以外所有的数据长度





public CanBoxProtocol(int canBoxType,int carModel)

{

updateCanBoxType(canBoxType,carModel);

}



public void updateCanBoxType(int canBoxType,int carModel)

{

Log.i(TAG, "updateCanBoxType:"+canBoxType+",carModel:"+carModel);

switch(canBoxType)

{

case CarModelDefine.CAN_BOX_RZC:

{

//睿智诚标志雪铁龙车系协议格式要单独处理

if(carModel >= 250 && carModel = 300 && carModel HU

public static final int CH_CMD_STEERING_WHEEL_KEY = 0x20;

public static final int CH_CMD_TRIP_PER_MINUTE_INFO = 0x21;//每分钟油耗

public static final int CH_CMD_INSTANT_TRIP_INFO = 0x22;//瞬时油耗

public static final int CH_CMD_HISTORY_TRIP_INFO = 0x23;//历史油耗

public static final int CH_CMD_BASE_INFO = 0x24;

public static final int CH_CMD_TPMS_INFO = 0x25;

public static final int CH_CMD_VEHICLE_SETTING = 0x26;

public static final int CH_CMD_TRIP_BEFORE_15_MINUTE= 0x27;//过去15分钟每分钟油耗

public static final int CH_CMD_AIR_CONDITION_INFO = 0x28;//空调信息

public static final int CH_CMD_STEERING_WHEEL_ANGLE = 0x29;//方向盘转角信息

public static final int CH_CMD_PROTOCOL_VERSION_INFO = 0x30;//协议版本信息

public static final int CH_CMD_AMPLIFIER_STATUS_INFO = 0x31;//攻放信息

public static final int CH_CMD_SYSTEM_INFO = 0x32;//系统信息

public static final int CH_CMD_OIL_ELEC_MIXED_INFO = 0x1F;//油电混合指示

public static final int CH_CMD_REAR_RADAR_INFO= 0x1E;//后雷达

public static final int CH_CMD_FRONT_RADAR_INFO= 0x1D;//前雷达

public static final int CH_CMD_VEHICLE_SET_STATUS_INFO= 0x50;//车辆设置状态

public static final int CH_CMD_AC_PANEL_KEY_INFO= 0x51;//空调面板设置信息(皇冠)

public static final int CH_CMD_VECHILE_SET_RETURN_INFO= 0x52;//车辆设置返回信息(皇冠、汉兰达)

public static final int CH_CMD_AIR_CONDITION_INFO2= 0x58;//车型空调信息(皇冠)



//HU->CanBox

public static final int HC_CMD_SWITCH          = 0x81;

public static final int HC_CMD_VEHICLE_SET= 0x83;//车身中控设定命令

public static final int HC_CMD_COMMON_SET= 0x84;//设定命令

public static final int HC_CMD_REQ_CONTROL_INFO= 0x90;//请求控制信息



public static final int SWC_KEY_NONE= 0x00;//无按键或者按键释放

public static final int SWC_KEY_VOLUME_UP= 0x01;//音量加

public static final int SWC_KEY_VOLUME_DOWN= 0x02;//音量键

public static final int SWC_KEY_MENU_RIGHT= 0x03;//方向键-右

public static final int SWC_KEY_MENU_LEFT= 0x04;//方向键-左

public static final int SWC_KEY_SRC= 0x07;//源切换

public static final int SWC_KEY_SPEECH= 0x08;//语音

public static final int SWC_KEY_PICK_UP= 0x09;//接听

public static final int SWC_KEY_HANG_UP= 0x0A;//挂断

public static final int SWC_KEY_BOX= 0x0B;//方框键

public static final int SWC_KEY_MENU_UP= 0x13;//方向键-上

public static final int SWC_KEY_MENU_DOWN= 0x14;//方向键-下

public static final int SWC_KEY_BACK= 0x15;//back

public static final int SWC_KEY_ENTER= 0x16;//enter

public static final int SCROLL_KEY_VOLUME_UP= 0x81;//音量旋钮-

public static final int SCROLL_KEY_VOLUME_DOWN= 0x82;//音量旋钮+

public static final int SCROLL_KEY_CH_FLD_UP= 0x83;//enter

public static final int SCROLL_KEY_CH_FLD_DOWN= 0x84;//enter

public static final int SCROLL_KEY_TUNE_TRACK_UP= 0x85;//收音调台-

public static final int SCROLL_KEY_TUNE_TRACK_DOWN= 0x86;//收音调台+

public static final int SWC_KEY_POWER= 0x87;//PWR

public static final int SWC_KEY_MODE= 0x88;//MODE

and the models are

Code:

public static final short CAR_MODEL_VOLKSWAGEN_MAGOTAN    = 0;//大众迈腾

public static final short CAR_MODEL_VOLKSWAGEN_SAGITAR    = 1;//大众速腾

public static final short CAR_MODEL_VOLKSWAGEN_GOLF7   = 2;//大众高尔夫7

public static final short CAR_MODEL_VOLKSWAGEN_POLO    = 3;//大众波罗

public static final short CAR_MODEL_VOLKSWAGEN_OCTAVIA    = 4;//大众明锐

public static final short CAR_MODEL_VOLKSWAGEN_17MAGOTAN= 5;//17款迈腾



//本田系列(50-99)

public static final short CAR_MODEL_HONDA_15CRV_L= 50;//15CRV低配

public static final short CAR_MODEL_HONDA_15CRV_H= 51;//15CRV高配

public static final short CAR_MODEL_HONDA_CROSSTOUR= 52;//歌诗图

public static final short CAR_MODEL_HONDA_ACCORD_9L= 53;//雅阁9代低配

public static final short CAR_MODEL_HONDA_ACCORD_9H= 54;//雅阁9代高配

public static final short CAR_MODEL_HONDA_CRIDER= 55;//凌派2016

public static final short CAR_MODEL_HONDA_JADE= 56;//杰德

public static final short CAR_MODEL_HONDA_ODYSSEY= 57;//奥德赛

public static final short CAR_MODEL_HONDA_FIDO= 58;//飞度

public static final short CAR_MODEL_HONDA_WISDOM= 59;//缤智

public static final short CAR_MODEL_HONDA_CITY= 60;//锋范旗舰版2015

public static final short CAR_MODEL_HONDA_12CRV= 61;//12CRV



//日产系列(100-149)

public static final short CAR_MODEL_NISSAN_X_TRAIL=100;//奇骏

public static final short CAR_MODEL_NISSAN_QASHQAI=101;//逍客

public static final short CAR_MODEL_NISSAN_NEW_TEANA=102;//新天籁

public static final short CAR_MODEL_NISSAN_TEANA=103;//天籁

public static final short CAR_MODEL_NISSAN_TIIDA=104;//骐达

public static final short CAR_MODEL_NISSAN_SUN=105;//阳光

public static final short CAR_MODEL_NISSAN_LI_WEI=106;//骊威

public static final short CAR_MODEL_NISSAN_BLUEBIRD=107;//蓝鸟

public static final short CAR_MODEL_NISSAN_INIFINITI_QX50_L=108;//英菲尼迪QX50低配

public static final short CAR_MODEL_NISSAN_INIFINITI_QX50_H=109;//英菲尼迪QX50高配

public static final short CAR_MODEL_NISSAN_MORNAO=110;//楼兰

public static final short CAR_MODEL_NISSAN_CIMA_L=111;//西玛低配

public static final short CAR_MODEL_NISSAN_CIMA_H=112;//西玛高配

public static final short CAR_MODEL_NISSAN_VENUCIA_T70= 113;//启辰T70

public static final short CAR_MODEL_NISSAN_VENUCIA_T90= 114;//启辰T90

//丰田系列(150-199)

public static final short CAR_MODEL_TOYOTA_RAV4= 150;//RAV4

public static final short CAR_MODEL_TOYOTA_VIOS= 151;//威驰

public static final short CAR_MODEL_TOYOTA_REIZ= 152;//锐志

public static final short CAR_MODEL_TOYOTA_OVERBEARING= 153;//霸道

public static final short CAR_MODEL_TOYOTA_COROLLA= 154;//卡罗拉

public static final short CAR_MODEL_TOYOTA_HIGHLANDER= 155;//汉兰达

public static final short CAR_MODEL_TOYOTA_CAMRY= 156;//凯美瑞

public static final short CAR_MODEL_TOYOTA_CROWN= 157;//皇冠



//通用系列(200-249)

public static final short CAR_MODEL_GM_HIDEN= 200;//英朗

public static final short CAR_MODEL_GM_CRUZE= 201;//科鲁兹

public static final short CAR_MODEL_GM_MALIBU= 202;//迈锐宝

public static final short CAR_MODEL_GM_16MALIBU_XL= 203;//2016迈锐宝XL

public static final short CAR_MODEL_GM_GL8= 204;//GL8

public static final short CAR_MODEL_GM_AVEO= 205;//爱唯欧

public static final short CAR_MODEL_GM_REGAL= 206;//君威

public static final short CAR_MODEL_GM_ENCORE= 207;//昂科拉



//标志雪铁龙系列(250-299)

public static final short CAR_MODEL_PEUGEOT_16_308= 250;//16款308

public static final short CAR_MODEL_PEUGEOT_14_408= 251;//14款408

public static final short CAR_MODEL_PEUGEOT_ELYSEE= 252;//爱丽舍

public static final short CAR_MODEL_PEUGEOT_301= 253;//301

public static final short CAR_MODEL_PEUGEOT_2008= 254;//2008

public static final short CAR_MODEL_PEUGEOT_3008= 255;//3008

public static final short CAR_MODEL_PEUGEOT_C4L= 256;//C4L

public static final short CAR_MODEL_PEUGEOT_DS5LS= 257;//DS5LS

public static final short CAR_MODEL_PEUGEOT_C3XL= 258;//C3XL

public static final short CAR_MODEL_PEUGEOT_SEGA= 259;//世嘉

public static final short CAR_MODEL_PEUGEOT_4008= 260;//4008



//韩系(300-349)

public static final short CAR_MODEL_KOREA_IX35= 300;//IX35

public static final short CAR_MODEL_KOREA_IX45= 301;//IX45

public static final short CAR_MODEL_KOREA_SONATA8= 302;//索纳塔8

public static final short CAR_MODEL_KOREA_SONATA9= 303;//索纳塔9

public static final short CAR_MODEL_KOREA_SORRENTO= 304;//索兰托

public static final short CAR_MODEL_KOREA_KIA_K5= 305;//起亚K5

public static final short CAR_MODEL_KOREA_KIA_KX5= 306;//起亚KX5

public static final short CAR_MODEL_KOREA_16MISTRA= 307;//16名图

public static final short CAR_MODEL_KOREA_KIA_16ELANTRA= 308;//16领动

public static final short CAR_MODEL_KOREA_KIA_16K3= 309;//16K3



//福特车系系列(350-399)

public static final short CAR_MODEL_FORD_12_FUCOS= 350;//2012款福克斯

public static final short CAR_MODEL_FORD_13_KUGA= 351;//2013款翼虎

public static final short CAR_MODEL_FORD_13_ECO_SPORT= 352;//2013款翼博

public static final short CAR_MODEL_FORD_13_FIESTA= 353;//2013款嘉年华

public static final short CAR_MODEL_FORD_15_FUCOS= 354;//2015款福克斯

public static final short CAR_MODEL_FORD_17_KUGA= 355;//2017款翼虎





//奔腾车系

public static final short CAR_MODEL_BESTURN_16_B50= 400;//2016款奔腾B50

public static final short CAR_MODEL_BESTURN_X80= 405;//奔腾X80



//广汽传祺车系

public static final short CAR_MODEL_TRUMPCH_GA3= 450;

public static final short CAR_MODEL_TRUMPCH_GA3S= 451;

public static final short CAR_MODEL_TRUMPCH_GA6= 452;

public static final short CAR_MODEL_TRUMPCH_GS4= 453;

public static final short CAR_MODEL_TRUMPCH_GS5= 454;

public static final short CAR_MODEL_TRUMPCH_XINGLANG= 455;//广汽吉奥星朗



//吉利车系

public static final short CAR_MODEL_GEELY_EMGRAND= 500;//吉利帝豪

public static final short CAR_MODEL_GEELY_EMGRAND_GS= 501;//吉利帝豪GS

public static final short CAR_MODEL_GEELY_NL_3= 502;//吉利博越



//中华车系

public static final short CAR_MODEL_CHINA_MOTOR_V3= 550;//中华V3

public static final short CAR_MODEL_CHINA_MOTOR_H3= 551;//中华H3



//宝骏车系

public static final short CAR_MODEL_BAO_JUN_560_2015= 600;//2015宝骏560

public static final short CAR_MODEL_BAO_JUN_730_2014= 601;//2014宝骏730

public static final short CAR_MODEL_BAO_JUN_730_2017= 602;//2017宝骏730



//吉普车系

public static final short CAR_MODEL_JEEP_FREELIGHT_2015= 650;//2015吉普自由光

public static final short CAR_MODEL_JEEP_LIBERTY_2016= 651;//2016吉普自由侠

public static final short CAR_MODEL_JEEP_COMPASS_2017= 652;//2017吉普指南者



//长城车系

public static final short CAR_MODEL_GREAT_WALL_H2= 700;//长城H2

More to come once i've studied the java and .so sources

darkspr1te

Excellent work. I have a lot of functionality on my 2010 jeep grand Cherokee (tpms, front and rear radar, etc.) That aren't displayed by the head unit....I hope you will find a way to customize it and I finally can use it for my car

Inviato dal mio SM-N960F utilizzando Tapatalk

darkspr1te · Mar 2, 2020 at 9:38 AM

royalhawk2002 said:
Excellent work. I have a lot of functionality on my 2010 jeep grand Cherokee (tpms, front and rear radar, etc.) That aren't displayed by the head unit....I hope you will find a way to customize it and I finally can use it for my car

Inviato dal mio SM-N960F utilizzando Tapatalk

Thanks, Yes extended functions will be available even in cars where they may not directly exist. Door open could be emulated by just sensing the door pin, but the electronics for a general car board that could be re-purposed for this I'am not sure exist in a good package.
maybe later on i'll look for a open source obd board that has additional input other than just OBD CAN and can isolate itself from the H/U.
Jeeps are known to me, I grazed my first knuckles on a 4L High output from the willies jeep body & early Cherokee, fun cars if they are not your daily driver.

darkspr1te

royalhawk2002 · Mar 2, 2020 at 10:24 AM

darkspr1te said:
Thanks, Yes extended functions will be available even in cars where they may not directly exist. Door open could be emulated by just sensing the door pin, but the electronics for a general car board that could be re-purposed for this I'am not sure exist in a good package.
maybe later on i'll look for a open source obd board that has additional input other than just OBD CAN and can isolate itself from the H/U.
Jeeps are known to me, I grazed my first knuckles on a 4L High output from the willies jeep body & early Cherokee, fun cars if they are not your daily driver.

darkspr1te

Door status display, manual headlight switch on, steering wheel commands and Steering angle sensor (dynamic lines in rear view cam) are the unique "CAN" implemented function on my Jeep Grand Cherokee WK head unit CanBus BOX. There are a lot info on the Can Bus that could be displayed on the HU, i.e. external temperature, TPMS, Parking Sensors, Compass, etc.

royalhawk2002 · May 2, 2020 at 10:52 AM

Any update?

Inviato dal mio SM-N960F utilizzando Tapatalk

royalhawk2002 · Oct 5, 2020 at 1:16 PM

Is this wonderful work abandoned ?

darkspr1te · Oct 6, 2020 at 3:48 PM

I've not abandoned the project, due to IRL commits and other projects to complete I just had not had the time to return to this, the project is still under development internally but writing the public document side is time consuming and i've not had that kinda time of late.

darkspr1te

karlnorth · Oct 20, 2020 at 12:41 AM

Canbus firmware file

I don't know if this is still useful for you, but here is a link for a firmware update for a VW-SS-07 VW canbus unit:
https://mega.nz/#!zXJBnQxZ!EOEbuxoIjO3Otyv9hxUuDBzLDuuNRbiMEo9-g2hBfAI

Here are the instructions for using it:
1. Confirm the model of your canbus decoder is VW-SS-07.
2. Download the software onto the root content of your sd card and insert it to the unit.
3. Enter Factory Settings and input the code "canupdates" instead of password.

Here's the page I found it on:
http://forum.autopumpkin.com/viewtopic.php?t=13120

-Karl.

darkspr1te said:
Hi All,
I have a PX5 radio that was supplied with fittings for 2006 Toyota RAV4 , sadly it didnt come with a CANBOX and supplier was not able to provide one that matched, I managed to get my hands on a Canbox for VW unit and decided to reverse engineer the unit.
Here are my findings.

Code:

Pinouts 1--2--3--4--5--6--7--8 9--10-11-12-13-14-15-16 1 GND 9 B+ 2 CANH 10 CANL 3 EMPTY 11 ACC 4 EMPTY 12 EMPTY 5 EMPTY 13 EMPTY 6 EMPTY 14 EMPTY 7 MCU_RXD_CAN 15 EMPTY 8 EMPTY 16 MCU_TXD_CAN

On power up the device sends a hex packet to TX Uart of the board (RX of the head unit) at 38400 baud,

the packet is as follows

Code:

0x0, 0x2E,0x21,0x5,0x0,0x10,0x0,0x0,0x0,0xC9 0x2E,0x21,0x5,0x0,0x10,0x0,0x0,0x0,0xC9, 0x2E0x21,0x5,0x0,0x10,0x0,0x0,0x0,0xC9, 0x2E,0x21,0x5,0x0,0x10,0x0,0x0,0x0,0xC9, 0x2E,0x22,0x4,0x1,0x1,0x1,0x1,0xD5, 0x2E,0x22,0x4,0x1,0x10x1,0x1,0xD5, 0x2E,0x22,0x4,0x1,0x1,0x1,0x1,0xD5, 0x2E,0x22,0x4,0xFE,0x2,0x1,0x1,0xD5, 0x2E,0x23,0x4,0x1,0x1,0x1,0x1,0xD4, 0x2E,0x23,0x4,0x1,0x1,0x1,0x1,0xD4, 0x2E,0x23,0x4,0x1,0x1,0x1,0x1,0xD4, 0x2E,0x23,0x4,0x1,0x1,0x1,0x1,0xFF,0xFF

Raw Packet

Code:

02E215010000C92E215010000C92E215010000C92E215010000C92E2241111D52E2241111D52E2241111D52E2241111D52E2341111D42E2341111D42E2341111D42E2341111D4FF

packet burst start with 0x0 then each packet start with 0x2e
My Assumption is the box acts as a translator converting each car specific CANBUS/KKL/KLINE/IR-bus protocol into a
pre-defined packet of information that it transmits to the headunit.
if this is confirmed then creating a open source version of the box should be easy within the ease of the cars can system ,
it may also open cars that dont have can bus to still use the canbus system of headunit, eg reading speed to adjust volume , monitor door open to display on screen using arduino.

If anyone has seen a lookup chart or information on the CANBOX/Decoders protocol to/from the headunit I would love the link.

next i will hookup to the headunit itself and send the same codes to see what effect they have.

darkspr1te
p.s if anyone knows of a firmware bin for canbus box then please let me know.

darkspr1te · Nov 3, 2020 at 10:25 AM

karlnorth said:
I don't know if this is still useful for you, but here is a link for a firmware update for a VW-SS-07 VW canbus unit:
https://mega.nz/#!zXJBnQxZ!EOEbuxoIjO3Otyv9hxUuDBzLDuuNRbiMEo9-g2hBfAI

Here are the instructions for using it:
1. Confirm the model of your canbus decoder is VW-SS-07.
2. Download the software onto the root content of your sd card and insert it to the unit.
3. Enter Factory Settings and input the code "canupdates" instead of password.

Here's the page I found it on:
http://forum.autopumpkin.com/viewtopic.php?t=13120

-Karl.

Thanks, I've pulled the files but not yet looked at them, time has been a strange partner of late

darkspr1te

CANBOX , CAN decoder reverse engineering

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member