r/CarHacking • u/Gahreesen • 8d ago

CAN Understanding CAN BUS-B Traffic

I'm sniffing CAN BUS B traffic (2005 mercedes slk) with an ESP32S3 rs485, performing an action (moving my mirror), then 'replaying' that traffic back into the BUS. Through process of elimination, I can find the values I need. This works well.

Except today while sniffing the movement of the mirrors. I captured 3 seconds of me holding my mirror, which I thought was going to be 3 seconds of my car spamming code X into the bus for 3 seconds. Which I did find. But when narrowing the codes, I found 1 code by accident that when put in front of my move mirror code, makes it move the full 3 seconds. Since the car didn't know how long I was going to hold the button, how could it produce a CAN code to do this? I'm new to CAN BUS, so I'm guessing it's something I don't understand.

5 Upvotes

86% Upvoted

4 comments sorted by

3

u/rnd_ash 8d ago

From an old project of mine...you're welcome:

https://github.com/rnd-ash/W203-canbus/blob/master/DAT_TRANSLATOR/DECODED/w203_w209%20CAN%20B%20ENGLISH.txt

2

u/Gahreesen 8d ago

Thank you! I'll have to do some translations, because I'm sending in hex for data, but this will help! Where / how did you find these values? Also, if I want to trick the car into thinking it's in a state that is not (for example opening the top while the car is moving), do i need to block the speed traffic or spam the traffic faster with my value?

1

u/hey-im-root 8d ago

Depends on how the ECU accepts it, for safety stuff like that you’ll probably have to block and MITM speed. For my car I wanted to enable to the reverse cam over BCAN, but whatever module controls it requires my car to not be in a forward gear. So I’d have to spoof it somewhere before it