rnd-ash / mercedes-hacking-docs

Documents on hacking and reverse engineering Mercedes vehicles
188 stars 30 forks source link

reverse engineering formulas from xsmonitor_frame #4

Open aIecxs opened 2 years ago

aIecxs commented 2 years ago

If signal has UNIT, sometimes there is also calculation required. for example temperatures. Would love to see calculation formula in parse_dat_v4.py

Created some formulas based on guesswork (which work). Identified 15 unknown padding bytes in frame, unfortunately I don't know how reverse engineer formulas from that.

The (working) formulas are: https://github.com/angelovAlex/can-bus-w211/issues/3#issuecomment-895824445

The full frame example is:

Click to expand ``` 05 80 02 00 08 53 41 4d 5f 56 5f 41 32 00 17 00 |.....SAM_V_A2...| 00 00 00 00 04 00 07 80 00 01 00 0a 54 5f 41 55 |............T_AU| 53 53 45 4e 5f 42 00 08 02 01 00 00 00 00 00 00 |SSEN_B..........| 00 3f 00 00 20 c2 02 b0 43 13 41 75 df 65 6e 6c |.?.. ...C.Au.enl| 75 66 74 74 65 6d 70 65 72 61 74 75 72 07 80 00 |ufttemperatur...| 02 00 08 50 5f 4b 41 45 4c 54 45 08 10 02 01 00 |...P_KAELTE.....| 00 00 00 cd cc cc 3d 00 00 00 00 03 62 61 72 17 |......=.....bar.| 44 72 75 63 6b 20 4b e4 6c 74 65 6d 69 74 74 65 |Druck K.ltemitte| 6c 20 52 31 33 34 61 07 80 00 03 00 08 54 5f 4b |l R134a......T_K| 41 45 4c 54 45 18 10 02 01 00 00 00 00 cd cc cc |AELTE...........| 3d 00 00 20 c1 02 b0 43 1c 54 65 6d 70 65 72 61 |=.. ...C.Tempera| 74 75 72 20 4b e4 6c 74 65 6d 69 74 74 65 6c 20 |tur K.ltemittel | 52 31 33 34 61 07 80 00 04 00 06 49 5f 4b 4f 4d |R134a......I_KOM| 50 28 08 02 01 00 00 00 00 00 00 20 41 00 00 00 |P(......... A...| 00 02 6d 41 21 53 74 72 6f 6d 20 4b 6f 6d 70 72 |..mA!Strom Kompr| 65 73 73 6f 72 2d 48 61 75 70 74 72 65 67 65 6c |essor-Hauptregel| 76 65 6e 74 69 6c |ventil| ```
rnd-ash commented 2 years ago

the UNIT calculation can be hard to workout, and is not present in the XSMonitor files. For instance, T_OEL in gearbox (722.6) can be calculated as

T_OEL - 50

Where as the same signal but from the engine is

T_OEL - 40

So In general, I guess the formula and just see what makes most sense based on actual values in DAS.

aIecxs commented 2 years ago

Hm.. I can find the same bytes on other signals where the same formula applies. Maybe we can create some formula database, at least?

aIecxs commented 2 years ago

have partially found formula. there is two bytes 02 01 followed by 3x binary32

53 53 45 4e 5f 42 00 08  02 01 00+00+00+00 00+00+ |SSEN_B..........|
00+3f 00+00+20+c2 02 b0  43 13 41 75 df 65 6e 6c  |.?.. ...C.Au.enl|

still don't know what the first one is but the others are multiplier + addend

00+00+00+00
00+00+00+3f                       # multiplier (0.5) Float Little Endian (DCBA)
00+00+20+c2                       # addend     (-40) Float Little Endian (DCBA)
Click to expand ``` # msg header 05 80 # Identifier for next can frame 02 00 08 # str len SAM_V_A2 # string (ECU NAME) 00 17 # id 00 00 00 00 00 04 # msg count (4) 00 # msg position 07 80 # Identifier for next msg pos frame 00 01 00 # pos number (1/4) 0A # str len T_AUSSEN_B # string (MSG NAME) 00 # offset 08 # length 02 01 00 00 00 00 00 00 00 3F # multiplier (0.5) Float Little Endian (DCBA) 00 00 20 C2 # addend (-40) Float Little Endian (DCBA) 02 # str len °C # string (unit) 13 # str len Außenlufttemperatur # string (description) ```
rnd-ash commented 2 years ago

This is super cool! I never glanced at those bytes before! Thank you so much! I will get to work on a v4 parser with this knowledge.

Now assuming you have XSMonitor, there is a CSV file in there which contains a huge CAN matrix showing which ECUs send which can frames, and which ECUs read those can frames, as well as transmit intervals. This has been a huge pain for me as I can't seem to find any reference to this kind of information in the .dat files.

Any ideas? 😁

aIecxs commented 2 years ago

No clue, I am completely beginner started learning about CAN two months ago, don't have any of that tools. Let's see what bytes left

edit: today started learning python but it is really hard to me (used to write shell scripts)

have modified your parse_dat_v3.py to create C structs but it doesn't work with enum. I fill the structs with memcpy() so these structs are packed bitfields. guess have to add enum as comments-only information.

What I don't know is how to print formulas (comments-only too?) if you don't mind send me commit on gitlab you are author of that script and the only one who can fix