I'd like to know if anyone has hacked into the ECU. I bought a decent scanner app for $4.99 and an ELM327 reader (Which is v1.5 aka a clone :/ ) anyway every single time I search for DTC's I get zero and also every time I search the freeze frame data I get the P0327 from a cold start. It usually has a temp of about 60 degrees - 125 degrees F. I've been messing around in the terminal a little and read most of the OBDII wiki. I know that if i issue code 04 in the terminal it'll erase the DTC's and freeze frame data. This ECU seems to allow it while the engine is running and the code doesn't come back until it cools off and I start it back up. Another thing I noticed is that it is during open loop. I don't think that OBDII can do chassis codes. That's why I am wondering if anyone has had any experience cracking or sniffing or hacking these ECU's. Apparently, the ELM327 is horrible and the absolute cheapest way possible to do this.

 

I've read that most Asian cars are the ISO 9141-2 protocol which I use on my scanner app and seems to work fine. The scanner app establishes a connection to where you can use the terminal right away after connecting with no initialization commands. You can type in AT commands similar to a modem. like ATSP3 to Set Protocol 3 (ISO 9141-2) then you can type ATH1 (Turn Headers on) and ATE0 (Echo off so you don't see your command getting echoed in the terminal) from there you can type 0100 to see what PID's 1-20 it is capable of. It is bit coded and you have to convert each byte to bits to see what is 1 meaning supported and what is 0 being unsupported. Which I think there are only about 30ish sensors that OBD2 supports for the G35. You can type 0120 in the terminal to see the PID's 21-40. Might be a good idea to set headers to zero (ATH0) so you don't see the priority of the message (First byte) or the Source byte or destination byte (first and second byte). Really just type 03 to see how many DTC's and 07 for Pending DTC's and I think 0A for Permanent DTC's and 04 to clear them and any freeze frame data.

It's all here. https://en.wikipedia.org/wiki/OBD-II_PIDs

Now if someone could just figure out how to talk to the BCM
I think it is mode 08 that we are after. It's what communicates to all the other control modules. With this I am pretty sure you can roll up and down the windows and turn the lights on and off. I used a pretty expensive snap-on scanner a couple times on my car and it had modules for the door the TPMS and loads of others I got a bit confused but I was able to turn off the SLIP/VDC lights but it came right back on.

 

That's so far over my pay grade it's making my head spin Never been into coding much so you're talking 1's and 0's to someone that doesn't understand.

Personally I'm more traditional in my troubleshooting, P0327, ring out both conductors to the ECU to verify a continuous circuit, replace sensor if the circuit is intact.

 

Lol, I've been a command line junkie in the past with Linux. Didn't know 0's 1's either, but the ODB2 wiki explains it. All you need is a hex calculator to convert a byte to bits.

 

I've been thinking about using this:

https://www.sparkfun.com/products/13262

Hacking the Can bus would also allow us to make aftermarket type arduino gauges and or controlling all sorts of fun stuff!

Edit: Yes, the Elm327 is about the slowest way to get anything from the ECU and a big PITA. A good Kline scanner, Uprev (includes scanner), or datascan. Pretty much any software that uses a VAG cable works very well and updates close to real time.

 

I considered doing the same for a while, and tried to find somebody at least passingly familiar with CAN-BUS and arduino or raspberry pi to build an interface that would include climate controls and such. No luck, and I really don't want to learn all that on my own.

I think reaching out to the iDatalink Maestro engineers might be able to get them to do up something for our cars, it's kinda their thing. Then any compatible radio could handle climate controls.