I'm trying to figure out how to lock and unlock the doors of a 2010 Toyota RAV4 using the CAN bus via the OBD-II port. I have a microcontroller attached via an CAN controller and a CAN receiver, and I've written some firmware to capture and replay messages.
If I unlock the doors either via the key fob or the door button, I get a flurry of messages on an otherwise silent bus (key is out). However, replaying them does nothing. I suspected that it might be some kind of authentication issue, so I tried something less sensitive -- the headlights. Interestingly, when I replay the messages from turning the headlights on, the headlight indicator in the instrument cluster lights briefly, but the actual headlights do nothing.
I guess I have several questions:
1) Should this be possible over the CAN bus exposed on the OBD-II port? I've seen sources saying that doors are controlled by a different, slower bus, but I've also seen devices advertised that will lock the doors when you reach a particular speed.
2) Are the other buses exposed in any way?
3) Is there any way I can find out the meaning of the messages I've captured without paying vast amounts of money to Toyota?