I understand that generic OBD2 readers gives a limited set of vehicle data (PIDs). Enhanced set of vehicle data could be aquired via the protocols which is car manufacturer specific (not published). Have below questions in this regard -

  1. Do we get the vehicle parameters in this category NOT the one's that come on OBD-II PIDs (https://en.wikipedia.org/wiki/OBD-II_PIDs)

  2. How can we reverse engineer the manufacturer specific protocol to acquire enhanced set of vehicle data?

  • I'm not sure (not published) is correct in many cases. Sure, it's different per manufacturer, but many are available, especially to service centres.
    – Rory Alsop
    Nov 24, 2016 at 10:45
  • @RoryAlsop "Available to service centers" is an easy phrase to throw around. At most a prebuilt scan tool is available to service centers. The information on how to speak to the communications bus and what the data means down to the bit level is generally not publicly available.
    – vini_i
    Nov 24, 2016 at 11:05
  • I have no reputation on this StackExchange site so I am posting my input as a new answer. The way I started monitoring OBDII communication is to use Putty to read the serial communication on the data bus at the OBDII connector. You can do this by getting a usb to serial connector for a laptop (unless you have a super old laptop with a serial port) and making a 2 wire cable to connect to the OBDII harness. Put a 120 Ohm resistor between the two wires bus wires. Also, tie into the OBDII harness from behind the vehicle connector, since you will need the real scanner to be plugged in normally. The
    – Eric Engel
    Jun 1, 2017 at 18:01

1 Answer 1


The disclaimer is that i have never worked with automotive CAN directly. I was a mechanic for a long time and then got into other things. I have worked with embedded CAN applications.

First you need a tool to connect to the CAN bus. The more flexible the tool is the better. There are two problems with reverse engineering CAN. One is that CAN is message based. This means that no two module ever directly speak to each other. Every module broadcasts its data to the whole bus and that data is coded with a message ID. That message ID identifies what that data is to everyone and whoever is interested in the data reads it in. The simplest implementation of CAN has 2000 IDs. The more advanced systems have hundreds of thousands. The second problem is that everyone is talking on the bus at the same time. The difficulty is to filter out what is data you want and what is irrelevant.

Once your connected to the bus start listening. Capturing the data and then analyzing it in a spread sheet would probably be best. Engine RPM would probably be the easiest to identify. Once you've identified a particular message ID and what it means the flexibility of your tool comes in to play. Tell the tool to filter out the message IDs that you already know.

Once you passively identify most of the data on the bus comes a choice. There is a hard way and an easy way from here. CAN supports data requests. The hard way involves transmitting data requests to the car and listening to the reply and then trying to analyze what the returned data means. The easy way involves borrowing a scan tool and listening to the bus while the tool is requesting data from the car. Then analyzing it to identify what request messages get what data and the message IDs.

  • "The easy way involves borrowing a scan tool and listening to the bus while the tool is requesting data from the car." - I am not able to find any online resources on how to set it up. Can you please help. Is there a setup available in which I can use a scan tool, press any button and see what commands it is sending?
    – Soumya Sen
    May 25, 2017 at 9:56
  • @SoumyaSen You need two tools. One that can talk to the car (scan tool). The second, to listen to the bus (sniffer). First identify as many messages on the bus as possible with the sniffer then filter them out. Then send commands or request data with the scan tool. Record the messages the correlate them later.
    – vini_i
    May 25, 2017 at 12:59
  • Yeah, I understand that process. I am not finding any resource as to how to record the command sent by the scan tool. What kind of setup do I need? Any resources you can help me with? I mean, if I press show DTC for ABS control module, I should see somewhere that the tool is sending say 7E3 02 xxxxx, something like this.
    – Soumya Sen
    May 25, 2017 at 14:07
  • @SoumyaSen This is something like what you need besides the scan tool. There are others, this is just the first one i found. youtube.com/watch?v=WfSZdWHiM9k
    – vini_i
    May 25, 2017 at 14:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .