3 ms·

I used to work for a company that made third party scan tools. We had racks of ecus disconnected from the car with just a diagnostic connector and power. nothin

by bluGill 8mo ago

I used to work for a company that made third party scan tools. We had racks of ecus disconnected from the car with just a diagnostic connector and power. nothing got to a real car without first trying it on the rack. I remember on time we figured out a bmw (pre obdii) had the bytes offset from the standard documentation (it was a semi-standard protocol that some other cars used at the time), we went from we communicate but nothing is wrong to a very long list of dtcs on that controller. (All our competitors also showed nothing wrong, but the official bmw tool showed dtcs)

nandomrumber 8mo ago
Diagnostic Trouble Codes?
- KindOne 8mo ago
  Yes.
colechristensen 8mo ago
I spent the last week successfully reverse engineering my car / various scan tools to get the right information to diagnose a fuel pump problem (and to do so without the incredible awkwardness of many of the tools) It's pretty amazing what Claude + Ghidra + knowledgable coaching can accomplish. It was basically just setting direction, setting up an incremental workflow with the right kind of documentation, and questioning some of its theories and assumptions from time to time. I'd love to release a lot of it but I'm torn between releasing artifacts created with expensive software I paid for and thinking that many of those things should really be freely available to anyone (specifically the things which definte the protocol to talk to the car and mapping of what various things are reported vs what they actually mean.
- tclancy 8mo ago
  Wait, why wouldn’t you post it/ write it up?
  - bluGill 8mo ago
    If you release it people expect you to support it an answer questions. Some of them are not even nice about it. It pays to release this only if there is a group of people who will be constructive in helping make it better, otherwise it is a thankless effort.
  - colechristensen 8mo ago
    The difference in ethics between reverse engineering something to be able to fully use/repair it vs. reverse engineering something to clone it. Also violating a license agreement I freely accepted and exposing myself to liability for IP theft. But is the IP just gatekeeping vehicle manufacturers hiding information from owners or is the IP the creation of this tool company or is it something in between
- seany 8mo ago
  Just dump it in a gist. That your of knowledge should be free
- jcgrillo 8mo ago
  +1 on the "plz tell me how" train!
  - colechristensen 8mo ago
    The prompt I'm happy to share https://gist.github.com/cole-christensen/cb9119e2f6b0f29b56872798e8ebb840 https://gist.github.com/cole-christensen/cb9119e2f6b0f29b568...
- zxexz 8mo ago
  Sorry, what are you talking about? Just release it? Are you talking about trying to make money off it? Are you claiming you reverse engineered ecu tuning software you paid for?
- stolsvik 8mo ago
  You really must be new to this, huh? Expensive software that you paid for?! Claude? Yes, the question is whether you want to share knowledge that cost you literally nothing, and will bring humanity one microscopic step in a better direction - or not, feeling superior in that only you have access to that knowledge. You have a choice!
- sokoloff 8mo ago
  > I'd love to release a lot of it but I'm torn between releasing artifacts created with expensive software I paid for and thinking that many of those things should really be freely available to anyone Release it or not, but either way you’re almost certainly going to get paid back the same amount of money: $0.
- markb139 8mo ago
  I’ve recently built a disassembler and emulator using Claude to help reverse engineer a 90’s ECU based on an Intel embedded cpu. It was quite impressive to watch when Claude started to use the emulator to help understand how bits of the code worked.
  - colechristensen 8mo ago
    The juxtaposition of Claude+Ghidra being able to take apart understand and reimplement the core features of this thing in hours while also having to babysit it "no, those encrypted packets going over the CAN bus aren't from wifi" and "please actually look at the code you just decompiled instead of guessing how they work" was pretty amusing.
jcgrillo 8mo ago
That's super cool, I'm currently struggling with scan tools for a 1999 Mercedes E300 Turbodiesel. I had one that worked OK for about a decade (Autel something or other) with a 38pin connector, but it recently bricked itself with a message like "connect via USB to Updata" which I assume means its firmware somehow erased itself. Cannot figure out how to "updata" it, doesn't seem to connect via USB, the Autel software runs under Wine but doesn't appear to recognize the device... gave up and bought an iCarsoft device which sorta kinda works. It can talk to every module except for the ECU (Bosch MSA 25.1 I believe?) however if I tell the device that my car is a different model (1995-1997 naturally aspirated) I can blindly clear ECU DTCs, which is good enough because this thing is barely more complicated than a toaster. All that is to say, this space is ripe for some open hardware/software love.
- Maxion 8mo ago
  > All that is to say, this space is ripe for some open hardware/software love. There's just so many computers and what-not in modern cars that this is a very tall ask. You'd need a project on-par with HomeAssistant to get anywhere.
  - jcgrillo 8mo ago
    Yeah, it seems like more modern technology has settled on standard protocols (maybe a naive impression--someone will shout at me if that's the case) but there's probably a very long tail of bizarre false starts if you want full coverage of models back to the early 90s when computers became more commonplace.
    - bluGill 8mo ago
      After 2006/2007 nearly everyone did CAN. I think that is even mandatory in the US, though I have no clue how to look that up (I assume there are details and exceptions) However before then everyone did their own thing. Often with custom chips that haven't been made since 2004 (or even 1999): good luck finding one that works if it breaks. CAN is cheap and allows a lot of power while hiding most of the protocol complexity. The things before that were often not as powerful as CAN, while being in practice a lot more complex because the complexity wasn't hidden.
ErroneousBosh 8mo ago
You don't know anything about late-90s Lucas/SAGEM GEMS ECUs do you, or Range Rover BeCMs? I'm currently picking apart the firmware in those because it is now impossible to get replacement ignition key fobs, and it just can't be that difficult...
- bluGill 8mo ago
  It was 16 years ago, and I only worked with what got to the US. I don't remember much and not those at all. I saw a few how to program key fob documents but we decided that was a dealer service and so I never implemented it. still generally just send the right 4-8 bytes and press a button on the fob in a minute. In any case it sounds like you want a different end: making a fob or bypassing them was never something I got anything on.

by bluGill 8mo ago

nandomrumber 8mo ago

Diagnostic Trouble Codes?

KindOne 8mo ago
Yes.

colechristensen 8mo ago

I spent the last week successfully reverse engineering my car / various scan tools to get the right information to diagnose a fuel pump problem (and to do so without the incredible awkwardness of many of the tools) It's pretty amazing what Claude + Ghidra + knowledgable coaching can accomplish. It was basically just setting direction, setting up an incremental workflow with the right kind of documentation, and questioning some of its theories and assumptions from time to time. I'd love to release a lot of it but I'm torn between releasing artifacts created with expensive software I paid for and thinking that many of those things should really be freely available to anyone (specifically the things which definte the protocol to talk to the car and mapping of what various things are reported vs what they actually mean.

tclancy 8mo ago
Wait, why wouldn’t you post it/ write it up?
- bluGill 8mo ago
  If you release it people expect you to support it an answer questions. Some of them are not even nice about it. It pays to release this only if there is a group of people who will be constructive in helping make it better, otherwise it is a thankless effort.
- colechristensen 8mo ago
  The difference in ethics between reverse engineering something to be able to fully use/repair it vs. reverse engineering something to clone it. Also violating a license agreement I freely accepted and exposing myself to liability for IP theft. But is the IP just gatekeeping vehicle manufacturers hiding information from owners or is the IP the creation of this tool company or is it something in between
seany 8mo ago
Just dump it in a gist. That your of knowledge should be free
jcgrillo 8mo ago
+1 on the "plz tell me how" train!
- colechristensen 8mo ago
  The prompt I'm happy to share https://gist.github.com/cole-christensen/cb9119e2f6b0f29b56872798e8ebb840 https://gist.github.com/cole-christensen/cb9119e2f6b0f29b568...
zxexz 8mo ago
Sorry, what are you talking about? Just release it? Are you talking about trying to make money off it? Are you claiming you reverse engineered ecu tuning software you paid for?
stolsvik 8mo ago
You really must be new to this, huh? Expensive software that you paid for?! Claude? Yes, the question is whether you want to share knowledge that cost you literally nothing, and will bring humanity one microscopic step in a better direction - or not, feeling superior in that only you have access to that knowledge. You have a choice!
sokoloff 8mo ago
> I'd love to release a lot of it but I'm torn between releasing artifacts created with expensive software I paid for and thinking that many of those things should really be freely available to anyone Release it or not, but either way you’re almost certainly going to get paid back the same amount of money: $0.
markb139 8mo ago
I’ve recently built a disassembler and emulator using Claude to help reverse engineer a 90’s ECU based on an Intel embedded cpu. It was quite impressive to watch when Claude started to use the emulator to help understand how bits of the code worked.
- colechristensen 8mo ago
  The juxtaposition of Claude+Ghidra being able to take apart understand and reimplement the core features of this thing in hours while also having to babysit it "no, those encrypted packets going over the CAN bus aren't from wifi" and "please actually look at the code you just decompiled instead of guessing how they work" was pretty amusing.

jcgrillo 8mo ago

That's super cool, I'm currently struggling with scan tools for a 1999 Mercedes E300 Turbodiesel. I had one that worked OK for about a decade (Autel something or other) with a 38pin connector, but it recently bricked itself with a message like "connect via USB to Updata" which I assume means its firmware somehow erased itself. Cannot figure out how to "updata" it, doesn't seem to connect via USB, the Autel software runs under Wine but doesn't appear to recognize the device... gave up and bought an iCarsoft device which sorta kinda works. It can talk to every module except for the ECU (Bosch MSA 25.1 I believe?) however if I tell the device that my car is a different model (1995-1997 naturally aspirated) I can blindly clear ECU DTCs, which is good enough because this thing is barely more complicated than a toaster. All that is to say, this space is ripe for some open hardware/software love.

Maxion 8mo ago
> All that is to say, this space is ripe for some open hardware/software love. There's just so many computers and what-not in modern cars that this is a very tall ask. You'd need a project on-par with HomeAssistant to get anywhere.
- jcgrillo 8mo ago
  Yeah, it seems like more modern technology has settled on standard protocols (maybe a naive impression--someone will shout at me if that's the case) but there's probably a very long tail of bizarre false starts if you want full coverage of models back to the early 90s when computers became more commonplace.
  - bluGill 8mo ago
    After 2006/2007 nearly everyone did CAN. I think that is even mandatory in the US, though I have no clue how to look that up (I assume there are details and exceptions) However before then everyone did their own thing. Often with custom chips that haven't been made since 2004 (or even 1999): good luck finding one that works if it breaks. CAN is cheap and allows a lot of power while hiding most of the protocol complexity. The things before that were often not as powerful as CAN, while being in practice a lot more complex because the complexity wasn't hidden.

ErroneousBosh 8mo ago

You don't know anything about late-90s Lucas/SAGEM GEMS ECUs do you, or Range Rover BeCMs? I'm currently picking apart the firmware in those because it is now impossible to get replacement ignition key fobs, and it just can't be that difficult...

bluGill 8mo ago
It was 16 years ago, and I only worked with what got to the US. I don't remember much and not those at all. I saw a few how to program key fob documents but we decided that was a dealer service and so I never implemented it. still generally just send the right 4-8 bytes and press a button on the fob in a minute. In any case it sounds like you want a different end: making a fob or bypassing them was never something I got anything on.