Take the 2-minute tour ×
Motor Vehicle Maintenance & Repair Stack Exchange is a question and answer site for mechanics and DIY enthusiast owners of cars, trucks, and motorcycles. It's 100% free, no registration required.

I'm trying to figure out how to lock and unlock the doors of a 2010 Toyota RAV4 using the CAN bus via the OBD-II port. I have a microcontroller attached via an CAN controller and a CAN receiver, and I've written some firmware to capture and replay messages.

If I unlock the doors either via the key fob or the door button, I get a flurry of messages on an otherwise silent bus (key is out). However, replaying them does nothing. I suspected that it might be some kind of authentication issue, so I tried something less sensitive -- the headlights. Interestingly, when I replay the messages from turning the headlights on, the headlight indicator in the instrument cluster lights briefly, but the actual headlights do nothing.

I guess I have several questions:

1) Should this be possible over the CAN bus exposed on the OBD-II port? I've seen sources saying that doors are controlled by a different, slower bus, but I've also seen devices advertised that will lock the doors when you reach a particular speed.

2) Are the other buses exposed in any way?

3) Is there any way I can find out the meaning of the messages I've captured without paying vast amounts of money to Toyota?

share|improve this question

4 Answers 4

Usually the OBD CAN bus is 'bridged' onto the other CAN buses of the vehicle, in order to facilitate diagnostics of ECUs on the other buses. However, the bridge may only pass diagnostic messages onwards :( It's different on every platform.

In terms of the protocol - its a classic reverse engineering problem. You need to capture a few traces of the CAN activity when you press the unlock button and figure out what the format of the messages is. Your headlight example may indicate that there are multiple buses and you only have access to one of them (which goes to the dashboard unit, and not to the headlamps in this case)

With the door locks - it's quite possible there is also some kind of challenge-response going on which stops your simple "replay-attack".

share|improve this answer
    
Quite possible that the headlights themselves aren't even on a CAN bus, instead relying on dedicated wiring and relays; while the headlight indicator is on the CAN bus with the rest of the instrument cluster. –  mac Nov 11 '13 at 15:30
    
@mac - indeed so –  Martin Thompson Nov 11 '13 at 16:13

If I were the guy who designed the electronics, I would make it impossible to do this via CAN-Bus simply because you get bluetooth adapters for OBD2 that someone standing outside the car could pair with and send the unlock instruction to.

It's a safety hazard, so I wouldn't support it.

share|improve this answer
1  
Bluetooth adapters don't do anything unless you already have access to the car to plug in a Bluetooth receiver. Anyway, it turns out it is possible. –  Derecho Aug 17 '13 at 7:20
    
That's scary thought. FYI: you get wifi OBD-ii adapters too and their range is substantial. –  Juann Strauss Nov 11 '13 at 13:32

What you are wanting to do is possible. I've had similar experience and desire for my 2010 Camry. From my experience, reading messages from the OBD-II port wasn't getting me anywhere. It was like the CAN messages were only a response to me manually manipulating the the car.

I would get a message response from locking or unlocking the doors with the key FOB, but sending that same message didn't do anything.

What you should do is get an OBD-II splitter cable and a copy of Toyota Techstream with a "mini VCI cable". This will allow you to read the messages the Techstream software sends to through the OBD-II port.

You should be able to:

1- Lock and Unlock driver/all doors

2- Pop trunk

3- Turn on low and high beams and flashers

4- Honk the horn

5- Roll up and down windows

6- Etc.

..or at least it all worked for me!!

YMMV and good luck! :D

(I'm not responsible for damages to self or car.)

share|improve this answer
    
Mccoy, I am trying to do exactly what you have posted. I installed Techstream and have the usb adapter cable hooked up to my 2012 Corolla but it does not seem to be pushing any of the customizations. Could you please let me know how you were able to achieve this goal? Thanks –  Reyson Sioson yesterday

Even if you connect to the correct bus and broadcast the correct CAN message you still run into the issue, of transmitting a CAN message that is already being transmitted by another ECU.

The way CAN works, every can message has an Arbitration ID also referred to as the message id. Under normal operation, no ECU will ever broadcast a message with the same ID on the Same bus. When you do this. In theory you should be able to lock or unlock the door, by flooding the bus, with the desired message, but it will not be something I would use inside of a product, since your abuse of the bus will interefere with the communication of ECU's on the bus that broadcast at a lower priority.

Now again, if the CAN message for locking and unlocking the door, is completely event driven, and not periodically broadcasted then what your trying to do completely feasible.

Also, the messages that you are sniffing, that change when you lock or unlock the door, may not be the ones of interest. Status messages are often gatewayed on to other buses, you would have to broadcast the correct message on the bus that it originates from.

Hint: Search online for the pin out for the OBD connector in your vehicle.

1) Should this be possible over the CAN bus exposed on the OBD-II port? I've seen sources saying that doors are controlled by a different, slower bus, but I've also seen devices advertised that will lock the doors when you reach a particular speed.

Yes, it may be possible, but you need to know the pin out for the OBDII in your car which probably is not public information, but you can figure out which ones are of interest by eliminating the standard OBDII pins.

2) Are the other buses exposed in any way?

As answered above, I think there is a good chance, eliminate the standard OBD pins, and the remaining pairs, will be the ones of interest. Each can data channel has a Data high, and Data low.

3) Is there any way I can find out the meaning of the messages I've captured without paying vast amounts of money to Toyota?

You need a CAN tool, to watch the data on the suspect pins, the good news is you will only catch can messages when connected to the correct pins. Otherwise tool will throw errors. and You may need a tool that can automaticly detect the baud rates, or you can guess.

Its going to require a good bit of time, and hacking.

share|improve this answer
    
Transmission and collisions isn't a problem. The CAN controller takes care of all that -- that's what it's there for. I have the wiring diagram for the car, and there is only one bus throughout. I have a dongle that locks the doors at a set speed (about 5mph), and this broadcasts the 'lock door' message a single time. It looks like this should be pretty easy to replicate. –  Derecho Jan 19 at 19:38
    
Your probably right, but in practice, multple ECU's do not transmit, the same message id at the same time on the same bus. But if your simple replicating, a dongle, its a matter of coping the messages coming from it, and seeing which bits flip, or when the message is sent if it is event based. –  am6sigma Jan 19 at 19:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.