[fe7565]

I am referring to the CANBUS message identification process. I am not familiar with the BMW security software protocols, just that it seems to be all internal to the FEM as there are no CANBUS links going to the locks, only direct wiring.


As far as the software/hardware he uses: he taps into the actual CANBUS wires of the bus components he wants to map out, and with his python program visual-interface one can eliminate most non-applicable bus messages.

I am not planning to build a remote starter, but I am following this thread to learn about the CANBUS messages that I could use with an MMI.

More CANBUS ID info:

https://docs.google.com/spreadsheets...gid=2000294247

https://www.loopybunny.co.uk/CarPC/k_can.html

https://www.reddit.com/r/CarHacking/

https://www.m5board.com/threads/any-....214354/page-2

[ojuniour]

Originally Posted by fe7565

I am referring to the CANBUS message identification process. I am not familiar with the BMW security software protocols, just that it seems to be all internal to the FEM as there are no CANBUS links going to the locks, only direct wiring.


As far as the software/hardware he uses: he taps into the actual CANBUS wires of the bus components he wants to map out, and with his python program visual-interface one can eliminate most non-applicable bus messages.

I am not planning to build a remote starter, but I am following this thread to learn about the CANBUS messages that I could use with an MMI.

More CANBUS ID info:

https://docs.google.com/spreadsheets...gid=2000294247

https://www.loopybunny.co.uk/CarPC/k_can.html

https://www.reddit.com/r/CarHacking/

https://www.m5board.com/threads/any-....214354/page-2

That's what I'm doing with my brz. I thought about going external with the wiring using relays and stuff until I delve into the canbus world. The difficult part is finding the canbus id to perform the command by basically controlling the most of the stuff done here strictly through canbus. You will basically eliminate Every Relays. The hardest part would be the immobilizer bypass which required key seed and the algorithm to trick the bcm/ECU that you have the physical in key. In that case you would still need to have a spare key signing the car as already being done here.
Easy part regarding the can us CMD is the basic functionality like send command to lock/unlock doors and trunk, including roll up down windows and other various stuff like horn, lighting (such as hazard headlight taillights, gauge cluster rpm and various lights within the cluster that you can enable at will...all via canbus.
Hard part is finding the right command for ACC/IGN trigger and also the firing command to trigger the starter. I was able to finally got all those using techstream/Subaru ssm4 software by intercepting the messages that's being sent by the software. And I was able to have access to all those and more. I can't now start the engine and shut off and even full control of HVAC and more .. all via the canbus connected to just the high and low. Two wires . Just two simple wires. 😂
In comparison to what you have here it feels like technology from 20 years down the road.
Unfortunately I don't know what kind of software bimmer uses that's equivalent to Toyota/Subaru diagnostic software but if you can get your hand on it, then I believe you could definitely start something with it.
I'm almost done with my project..currently using Arduino mkr 1500 LTE with mkr can shield
connected to my Mqtt server. Even though this is a bummer forum, I'll try to post update and hopefully it may help out in moving to just canbus control which makes things a lot more super portable and less power consumption with no relays or barely any wires used

Good luck.

Sorry for any typo..typing from phone 😔

[fe7565]

Originally Posted by ojuniour

That's what I'm doing with my brz. I thought about going external with the wiring using relays and stuff until I delve into the canbus world. The difficult part is finding the canbus id to perform the command by basically controlling the most of the stuff done here strictly through canbus. You will basically eliminate Every Relays. The hardest part would be the immobilizer bypass which required key seed and the algorithm to trick the bcm/ECU that you have the physical in key. In that case you would still need to have a spare key signing the car as already being done here.
Easy part regarding the can us CMD is the basic functionality like send command to lock/unlock doors and trunk, including roll up down windows and other various stuff like horn, lighting (such as hazard headlight taillights, gauge cluster rpm and various lights within the cluster that you can enable at will...all via canbus.
Hard part is finding the right command for ACC/IGN trigger and also the firing command to trigger the starter. I was able to finally got all those using techstream/Subaru ssm4 software by intercepting the messages that's being sent by the software. And I was able to have access to all those and more. I can't now start the engine and shut off and even full control of HVAC and more .. all via the canbus connected to just the high and low. Two wires . Just two simple wires. ��
In comparison to what you have here it feels like technology from 20 years down the road.
Unfortunately I don't know what kind of software bimmer uses that's equivalent to Toyota/Subaru diagnostic software but if you can get your hand on it, then I believe you could definitely start something with it.
I'm almost done with my project..currently using Arduino mkr 1500 LTE with mkr can shield
connected to my Mqtt server. Even though this is a bummer forum, I'll try to post update and hopefully it may help out in moving to just canbus control which makes things a lot more super portable and less power consumption with no relays or barely any wires used

Good luck.

Sorry for any typo..typing from phone ��

I am interested, if you post later on your progress. It's a great challenge and at times comes with setbacks...but fun. Hope to learn from you...and do not hesitate posting any questions...someone here may be able to give you tips.

[sizanx]

Video:
https://www.youtube.com/watch?v=qO5-HMEZOW4

If you unlock before 3x lock, it won't trigger alarm and the car will remain locked - so it's quite usable atm.

I am quite certain that you don't need CAN and that it is a timing issue for disarming alarm trough A173*2B pin 30, previous BMWs use double pulse for unlocking, but how long the interval between pulses with or without central unlocking etc is uncertain.

Just have a regular multimeter, but can see that pin 30 has a voltage reading 3.85v when idle, 3.73v when locking and 3.81v when unlocking. Can't see if there are any double pulses with my equipment. Eventually something will pan out

[fe7565]

Originally Posted by sizanx

Video:
https://www.youtube.com/watch?v=qO5-HMEZOW4

If you unlock before 3x lock, it won't trigger alarm and the car will remain locked - so it's quite usable atm.

I am quite certain that you don't need CAN and that it is a timing issue for disarming alarm trough A173*2B pin 30, previous BMWs use double pulse for unlocking, but how long the interval between pulses with or without central unlocking etc is uncertain.

Just have a regular multimeter, but can see that pin 30 has a voltage reading 3.85v when idle, 3.73v when locking and 3.81v when unlocking. Can't see if there are any double pulses with my equipment. Eventually something will pan out

Works nice! Thanks for the video. Nice interior as well


Maybe you can connect the voltage reading to an Arduino port and run a program that uses the PULSE-IN https://www.arduino.cc/reference/en/...ed-io/pulsein/ or Analog-in pin.

Or use an oscilloscope. The Pico 2204A has a decent price and features for automotive as well. This guy has a lot of good videos with the Pico:
https://www.youtube.com/@MechanicMindset


Or an Arduino oscope: https://www.instructables.com/Oscill...no-Processing/ Don't expect nanoseconds resolution, but should be good for milliseconds and probably microseconds.

[sizanx]

Originally Posted by fe7565

Works nice! Thanks for the video. Nice interior as well


Maybe you can connect the voltage reading to an Arduino port and run a program that uses the PULSE-IN https://www.arduino.cc/reference/en/...ed-io/pulsein/ or Analog-in pin.

Or use an oscilloscope. The Pico 2204A has a decent price and features for automotive as well. This guy has a lot of good videos with the Pico:
https://www.youtube.com/@MechanicMindset


Or an Arduino oscope: https://www.instructables.com/Oscill...no-Processing/ Don't expect nanoseconds resolution, but should be good for milliseconds and probably microseconds.

Thank you Custom ambient lighting with aliexpress addressable kit for my no light package car, sniffed out the bluetooh low energy commands from their shitty app and programmed a esp32 that instantly connects which I control via 3 rotary encoders. Doing a thread on build soon

I'll look into PULSE-IN, thanks for the suggestion