Brute_Force_LCD_Write.ino

[YorkFieldX]

Hi!

Great work!

Can you please advise what is the purpose of Brute_Force_LCD_Write.ino?

Did you by any chance find a way to write arbitrary messages to stock DIM LCD?

Cheers

[Alfaa123]

Hi,

All the files in the sniffing folder are work-in-progress files related to sniffing the bus and discovering new functions.

I was not able to figure out how to write arbitrary messages to the LCD on the facelift DIMs (the ones with the LCD on the top middle). The method for writing messages to the LCD on older DIMS (with the LCD in the bottom left) is fairly well known and accessible. Check the hackingvolvo blog in the links for more information.

The Brute_Force_LCD_Write was an attempt to find the correct CAN ID required to get the new DIMs to respond to the messages that the old ones used, simply by repeating the messages and trying every CAN ID. It has not been successful so far, and I do not believe the old method will work on the newer cars. I suspect they may have removed that functionality altogether with the removal of the car-phone option.

[YorkFieldX]

Fair enough, I've got a cluster on a desk from a C30, also facelift (I believe facelift you refer to is P1 platform cars, and pre-facelift, with LCD on bottom left is P2 platform cars) for poking around & trying to find interesting things as well. My only hope so far to find a way to write arbitrary messages on P1 DIMs is C70, which displays "ROOF OPEN" and "ROOF CLOSED" messages. If this is implemented using arbitrary write mechanism, we are in luck, however it might also be hardcoded into DIM firmware and triggered like other messages.

In the meantime I'm trying to achieve a gauge sweep effect. I've successfully moved an RPM needle to 8K RPM with the help of your sniffing logs :) I'm still having issues with the speed needle though... If you happen to have more logs, please do share as they help a lot!

Thanks again :)

[Alfaa123]

You're correct, I meant to say P1 DIMs. I have a C70 DIM on my desk that I periodically play around with. I'm able to get the cluster to light up "idle" as you saw with the brute force sketch, but it always inevitably goes into "error" mode after a few seconds (yellow info light flashing). Even replaying the traffic directly from the low speed bus on my car doesn't prevent this.

I didn't think about the roof open/closed messages as being a vector for LCD control. I suppose it's certainly possible, but I don't have a C70 to test with.

The method for sending data to the DIM on older cars used the car phone module's frames that usually send caller-id data. Since a car phone was never an option on the P1 Volvos (as far as I'm aware) and because the cluster hardware between the P2 and P1 changed significantly, I have a feeling that functionality has been stripped from the firmware.

I added two more logs from SavvyCAN today. One with traffic from both the high and low speed buses, and one with just the low speed bus. These were captured with a Due with SavvyCAN, so they will be far far more complete (although when logging both busses at the same time, the Due still can't quite keep up).

Let me know if there's any more logs you'd like me to get. I don't have any while driving just yet, so maybe that will be helpful.

And lastly, I managed to come up with a method to allow me to sweep my tachometer at startup. I do this by receiving a frame from the car, modifying the bits that represent the tach position and IMMEDIATELY sending it back out. This way, I don't mess with anything but the tacho position. This works, but there is bounciness every once in awhile, most likely due to the replacement frame getting sent to arbitration and not getting sent in time. For the 2 second gauge sweep at startup, however, this is perfectly fine.

[YorkFieldX]

Thank you!

I will share some of my findings too-

1) ID16801028=ABS/Brake Failure Light. This can also be used to trigger various messages on DIM (i.e. "crash mode, see manual", "No DTCs Set", "Low Battery Power Save Mode", and some others. These messages seem to have "priority" and they get displayed even when DIM goes into Error mode (flashing yellow light), and even if there's priority warnings like SRS Airbag Service Urgent or Brake Failure Stop Safely.

2) 0x1AD10068- I managed to manipulate fuel level and low fuel icon on DIM using this CAN ID. Won't advise on exact message as I didn't put time into finding correlation between values and what's happening on the cluster.

3) 0x19F010FC- this also carries outside temperature (displayed on DIM)

4) 0x0E03D7F8- this ID with message of {0xF8, 0x2B, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00} will show Low Battery Warning on ICM screen (The radio/climate unit)

Notes: T1/T2 trip mode on DIM seems to be present somewhere on CAN (i.e. you can switch DIM's T1/T2 over CAN messages). How I found this- DIM keeps resetting into T2 mode on startup with existing CAN message data set, even if manually switched over to T1.

[Alfaa123]

Interesting, this is all very helpful! I'll try out the fuel gauge messages to see if I can get it to update fast enough to be useful for other data (like boost or something). I found the ID for the speedometer before, but I must have lost that comment file. I'll keep adding details to the files as the project continues!

[teddylarsen]

I know this is a long shot, since it's been more than a year since last post, but did you ever find anything on the speedometer ID? I need to read out the vehicle speed and for some reason I can't get any diagnostic messages to work on the high speed bus in my 2008 V50. I've been focusing on 1760E008 as you report this to have something to do with the cluster speed in the RX list.txt.

[Alfaa123]

If all you need is vehicle speed, look at codes.txt for a description of how to make VIDA requests. There's no reason to decode the frames going to the cluster to get information that you can request easily.

If you have any issues getting the vehicle to respond to those diagnostic requests, make a new issue and I'll see if I can help you get it working.