Research on CAN BUS Protocol

[seemakhan.pro]

Hello Guys,
I am doing a search on CAN BUS Protocol, long story short, I am able to receive CAN Packets from my car although we usually get packets on OBD pin6 (CAN-H) and pin14 (CAN-L) but I'm receiving CAN-L packets on pin11 anyway that's not an issue the issue is I am not able to transmit packets.
So I need direct access to CAN-H and CAN-L wires where i can find these wires BTW my car is Daihatsu Mira Model 2015

[Hassan1991]

From obd2 port. You need to filter the data from each module then send headers before sending any pid.
What you are receiving right now is the communication between different modules.

[Xulfiqar]

what are you trying to achieve with sending a packet? - do you have all the PID ping and start information and are wanting to emulate something thats not on the vehicle?

and you are getting traffic on pin 11? - thats a bit odd, is it the same traffic as the CAN-L?

[seemakhan.pro]

Yes getting traffic on pin 11 and its CAN-L getting CAN-H on pin 6 for now i'm just retransmitting captured packets, but retransmission is NOT working, I have done bit research on this and read on some forum that it could be because of firewall and to retransmit packets we need direct access of both wires , so where i can find these two wires in my car is Daihatsu Mira Model 2015

[seemakhan.pro]

for now I'm just retransmitting same captured packets for example blinker turn on/off etc...

[Xulfiqar]

You dont have a gateway per se in your car, the can lines on the dlc are taps not terminus.

Find the wiring diagram of your car, it will also show the can flow chart, or you can start digging it yourself and see which module has can wiring.

[Hassan1991]

Sending packets doesn't work like that. Ecu will discard it.
You have to put ecu in listening mode using initialization bytes then it will list to your demand and reply. Not easy though.
Follow sir Xulfiqar instructions.
Between can h and can l are inverted images of same sequence.
Which device you are using?

[Xulfiqar]

What are you trying to achieve? Adding new modules/functions to the vehicle?

[seemakhan.pro]

Well i created device using MCP2515 module with Arduino, So basically my background is in cyber security and its a research project in which we are showing cars security and vulnerabilities.

so where can i find my car's wiring diagram and how can i make sure its 100% same in my car ?
secondly how can i put my cars ecu in listening mode ?

Sorry Guys i'm not an expert in car communication as i said my background is cyber security A Great Thanks for helping me out

[seemakhan.pro]

We are trying to create a wireless device though which we can give instructions to car to turn on/off head lights or lock doors etc...
so as i said
till now are getting CAN data but when we are transmitting this data its not working

[Hassan1991]

You are using mcp2515 can bus shield.
Send a specific Headers to ecu to put it in listing mode then send required pid.
Codes are available online.
Download a can sniffing software and use it to filter data out.
This will help.

[seemakhan.pro]

Send a specific Headers to ecu

I don't understand this can you please give little detail what do mean by "Send a specific Headers to ecu"

also let me watch the video you send

Thanks a lot

[seemakhan.pro]

and how can i put ECU in listening mode ? can you please also provide link or document where i can read more about it great thanks for your time and help!

[Hassan1991]

For example 7E0 is usually engine module headers. Send this plus mode and pid after it ecu should reply. (if these are the correct headers).

[seemakhan.pro]

thanks a lot let me read about it i'll get back to you

[Xulfiqar]

if you are trying to showcase vulnerabilities in vehicles and working on CAN-BUS then you are on the wrong avenue, because the bus traffic only starts with awake systems. Once the car shuts down the systems go to sleep after a few minutes. And the only way to awaken them is by providing the security hash that is in the key itself which is RF.

You are putting the cart before the horse here.

[seemakhan.pro]

I think you haven't understand our scenario, So car is in start mode person is sitting in the car, another person controlling few ECU connected components from outside of car via wireless device (the device we already build as i told we are receiving CAN Packets the only issue is We are NOT able to transmit these packets)

[Xulfiqar]

So basically you are doing what we mechanics do everyday with our 2 way scan tools that have a bluetooth dongle connected to the DLC3 under the steering.

To send a specific message you need to know the exact request header and the command sequence at the correct speed. This information is not available from the manufacturer, you can however try to decipher it by sniffing the data being exchanged on a scan tool like techstream.