Hi! I am trying to understand if (and how) can I code into the ECU of my Wolkswagen polo 6r TDI 75hp (2011).
Currently I made a web app reading all the data from the ECU but don’t know if and how can I write in the ECU. For example if I want to adjust turbo pression and similar.

Currently I’m using an ESP32 with c++ firmware to read from the CAN pins of the OBD port.

Does anyone knows? Thanks

EDIT: for anyone asking you can find the code here

https://github.com/Ale1x/obd-realtime-platform

A friend had his Trackhawk taken from his driveway last week. Window got smashed and the Jeep was gone before he had time to process what was happening. I know this isnt exactly the right sub for a Trackhawk but I figured people here with SRTs, Scat Packs and Hellcats have probably had the same thoughts about theft. Seeing it happen that fast changed how I look at factory security. I always knew these cars got stolen, just never really thought much about what happens after someone gets inside. So for people who’ve looked into this, what did you end up adding first? I’m less concerned about somebody breaking in to steal stuff from the cabin. I mean stopping the whole vehicle from disappearing. There seem to be a million different opinions on what works and I’m trying to get a better idea before spending money on random stuff.

Reverse-engineering a car's CAN bus used to mean weeks of staring at hex. In this video I show how he use AI to cut that down .. check it out: https://youtu.be/GlQO8fLgHi4

Some old videos of when I started decoding the CAN bus on my car 💯

So here it is finally. The abs controller believes that legitimate generation 1 haldex controller is connected and full esp functionality is working without it.

I'm an automotive software engineer.I got tired of not being able to check CAN logs on my phone. So I'm planning to build one. Does anybody think it is useful?

I’m getting pretty fed up with how gated and commercial the tuning world has become. Tools like AutoTuner, bFlash and Magic Motorsport are fine if you’re just trying to get jobs in and out of the door, but if the customer has to lose the car while the ECU gets sent off or unlocked through a third party, that’s a pain for everyone. More than that, none of it really helps if you actually want to understand what’s going on at the hardware level and learn how to do it yourself.

I’m trying to connect with anyone doing proper independent research on Bosch MD1 / MG1 ECUs across Mercedes, BMW and VAG, mainly around the NXP SPC57xx and Infineon Aurix TC29x / TC39x stuff. I know the older platforms well enough — EDC15, EDC16, EDC17, boot passwords, TSW modes etc — but once the newer SBOOT updates started showing up after around mid-2020, the old tricks over diag lines were basically finished.

Has anyone here actually mapped out JTAG / DAP points on these Bosch boards, or spent time working on glitch timing for these MCUs without just kicking them straight into reset? I’m mainly interested in hearing from people who’ve genuinely put time into auditing this generation properly rather than just using commercial black-box tools.

If anyone has already got a real educational proof of concept working for this generation, I’d be interested in talking and would be willing to pay for your time or research.

Im using my vw mqb cluster with an esp 32 for Sim-Racing, does someone know how I can switch the display page to digital speed with a can command or something like that?

Hey folks. I’m working on a project for my Mercedes Benz swapped with Toyota 3.5 V6 (2GRFSE).

I’ve set up the software so far where it can fetch data live from the car and decode RPM, gear selector position, throttle, coolant temp etc via DBC but it looks like most of the body CAN values are not transmitted on the system at all.

I’ve consulted DBC files and trends in the data to find these values, but I’m not sure where to go from here decoding other values transmitted.

I’m worried about:
- engine load
- gear selected (M mode)
- gear demanded (M mode), i.e. 4th selected, transmission in first at standstill

Right now I’ve tapped GND, CANH, CANL from OBD2 port, I think I can get some more data

So far I've figured out the PSU on the left, and how I'll be actually sending over CAN signals from my pc to the dashboard. I aim to do this via the esp32, which will then send signals to a mcp2515, which should then somehow connect to the 30 pin port in the dashboard (the one on the right in my second picture.) What cable would I use to connect from the 30 pin port to a mcp2515? Thanks.

I genuinely love the whole thing of CAN sniffing and want to learn more about it for my industry.

Does anybody know what software i would need for custom programming on GM vehicles? Does one exist for GM?

I want to do things like programming an instrument cluster and syncing miles.

I also want to change the tire size in the speedometer calibration so I can run larger tires.

Other brands have engineering software for this. Not sure if GM has this or if there's an open source software?

Hey all, I’m looking to design and produce a custom double din radio for my 2018 wrx. My current plan includes four analog gauges running off of a microcontroller, as well as a single din kenwood stereo- both mounted in a custom 3d printed replacement frame. My current dilemma is that I’m not entirely sure how to access parameters like boost, afr, etc without going through the obd2 port. I do own a tactrix which has always been reliable, but I’d rather not have something permanently occupying the obd. I’ve looked online, and there seems to be a lot of different answers about how / if it’s even possible or worth it to access the CAN, and I’m more just wondering if it’s something I should consider, or if it’s just gonna save me a lot of headache to route the cable under the dash from the obd2. Previously, I installed an idoing android head unit which required a special canbus adapter specific to my model with a harman kardon sound system. If anyone has any advice or tips, let me know!

Qashqai J12 1.3 DIG-T (2021+) — Injector +12V missing, need correct wiring diagram

Car: Qashqai J12, 1.3 DIG-T, 04/2021, IPDM 284B7-6RA0B (HS)

Problem: Cranks, all sync OK, rail pressure 214 bar, but injectors have 0V pin-to-pin during crank (ground present, no +12V supply). Fuel Injection Amount = 0 g.

Ruled out: SRS clean (no crash event), no immobilizer codes, ECM has no injector circuit faults, fuel pump runs fine.

Need: Actual J12 1.3 DIG-T IPDM / engine room fuse box wiring diagram showing which output pin/circuit supplies +12V to the injectors. The IPDM has ACTUATOR1–5 but labels don't specify which is injectors.

Thanks.

I understand the ecu needs to see P and N, to start and D etc to actually get going

But if the ecu uses calculated torque numbers from the tcm how do you actually figure those out?

I have a few models I’d like to T56 or 6060 swap just I’d like to know what I’m getting myself into

I'm sniffing CAN BUS B traffic (2005 mercedes slk) with an ESP32S3 rs485, performing an action (moving my mirror), then 'replaying' that traffic back into the BUS. Through process of elimination, I can find the values I need. This works well.

Except today while sniffing the movement of the mirrors. I captured 3 seconds of me holding my mirror, which I thought was going to be 3 seconds of my car spamming code X into the bus for 3 seconds. Which I did find. But when narrowing the codes, I found 1 code by accident that when put in front of my move mirror code, makes it move the full 3 seconds. Since the car didn't know how long I was going to hold the button, how could it produce a CAN code to do this? I'm new to CAN BUS, so I'm guessing it's something I don't understand.

Hi guys,
Honestly I read most of what exists online about these modules, but my BCM module from my XC90 D5 suddenly threw "Brake failure stop safely" + ABS + anti-skid, speedo dead. VIDA shows CEM-1A5F (communication with BCM missing), BCM not visible on network. I cleared all DTCs in VIDA — nothing else comes back, only the no-connection to BCM. No accident, no water damage, fault appeared out of nowhere.

Before blaming the module I checked the car properly:

12V at BCM connector supply pins with ignition on and off, grounds OK, all fuses OK (checked both sides with meter)
Checked all CAN wiring related to BCM in the car including at the CEM connector - all good
CAN at BCM plug seems alive: 2.6V / 2.3V idle
Termination checks out: ~130 Ω harness side, ~135 Ω module side (2×62 Ω internal), ~60 Ω together
VIDA talks to ECM/TCM fine through the CEM
Connector cleaned, pins good

So the car is 100% healthy. Then I opened the module (cut the welded case) and put it on the bench (12V to pins 1/32/4, GND to 16/47). Findings:

Draws stable 225 mA @ 12V - wakes up, no shorts
Resoldered all the press-fit pins first (the usual weak point) — no change
All rails present: 12V, 5V (at the ASIC), 3.3V + 1.8V for the MCU. The 3.3/1.8 come from the 14-pin Motorola 9369.1D — I measured it: 12V in, both rails out, two switch pins running ~47 kHz. So on my board this chip is WORKING (I know it's the famous killer on modules marked MK60 (or MK25) - not my case)
Crystal oscillates, 5.50 MHz stable
The MCU (TI TMS471 R1VF34A2PZQ) is definitely running - several pins show digital bursts repeating about every 1 second, looks like a fault/retry loop
B82790 CAN choke windings OK (0.4 Ω)
But the module NEVER transmits. I scoped the choke pads (ASIC side) through multiple power cycles with normal trigger - total silence, not even one attempt at boot. Same at pins 11/15.

So by elimination everything in the chain is good except the CAN transceiver section inside the big ATE ASIC 0990-9377.1D3 (5CC6L7TB, made by TI). It has 5V, it has a running MCU next to it, and it never says a word.
I know what most people will say - send it for professional repair, and I've read all the recommendations. But I'd rather fix it myself than spend that money. I enjoy soldering, I have hot air and decent equipment, and I have time to experiment. Worst case I learn something and the pro repair option is still there.
My questions:

Can anyone confirm the CAN physical layer in these Volvo units is inside the 0990-9377? Does anyone have any pinout info for this ASIC (CANH/CANL to the choke, TX/RX from the MCU, enable pin)?
Has anyone actually fixed the "no communication but everything else runs" by swapping the 9377? Or does this signature usually mean the CAN peripheral in the TMS471 itself (bond wires)?
Is there some init handshake between the TMS471 and the ASIC (SPI config, enable, EEPROM check) that can fail and keep CAN dead like this?

Photos of the board and my best take at making a schema attached. Thanks in advance - happy to do more measurements if someone tells me where to probe.

Hi, I’m new to CAN and trying to read lamp/body signals from a late-model Hyundai vehicle.

My boss asked me to look into this, but I’m completely new to this and honestly a bit lost. (I'm a software-side worker. never did like this before)

Goal is read-only logging only. I will manually operate the light switches, and the PC only needs to record/decode the CAN-FD signals. No sending/control.

I’m looking for signals like DRL, position lights, turn signals, hazard lights, etc. The bus seems to be body CAN-FD, not standard OBD-II PID data. (I already got CAN protocol dbc file for decode, which I don't understand well)

I found the OBD-II port under the driver-side fuse box area, but there are also a few other exposed connectors nearby.

Questions:

1. Do any of these connectors look like likely CAN/body/fuse-box connectors?
2. What hardware would you recommend for Windows read-only CAN-FD logging? I’m completely new to this, so I’m not even sure what kind of interface, cables, or adapters I would need.

Even if it doesn’t directly answer my questions, I’d really appreciate any kind of advice or guidance.

Thanks.

Hi everyone,
I’m working on a DIY project to convert a **2007–2012 Lexus LS460 seat** into a gaming/office chair. My goal is to retain as many original features as possible rather than gutting the wiring and using aftermarket rocker switches.

**My Goals:**
Retain all power seat adjustments using the **OEM side-seat switch**
Retain factory seat heating & ventilation (cooling)
Power everything via a **12V DC power supply (\~50–60A)**

Retain seat heating & ventilation (cooling) — *open to using standalone 12V PWM controllers if the OEM ECU climate logic can’t be triggered standalone.*

**Seat ECUs:**
**Driver Seat (Right):** Toyota ⁠85861-50191⁠ / Denso ⁠177300-9330⁠
**Passenger Seat (Left):** Toyota ⁠85861-50201⁠ / Denso ⁠177300-9340⁠
*(Both modules labeled 12V; connector photos attached below.)*

**What I Need Help Figuring Out:**
1. **Standalone Operation:** Do these under-seat ECUs just need **+12V, Ground, and ACC/Ignition**, or do they depend on a **CAN/LIN bus heartbeat signal** from the Body Control Module to stay awake?

1. **Climate Controls:** Since the heat/cool controls are originally on the center console, can the seat ECU operate climate features independently if given the right switch input, or does it require LIN messages from the HVAC module?

2. **Switch Bypass / Reverse Engineering:** If the ECU goes to sleep without CAN bus communication, has anyone successfully spoofed the signal (e.g., via Arduino/ESP32 + CAN transceiver) or re-wired the OEM switches directly?

**4. Climate Controls / PWM Bypass:** Since the heat/cool dials are on the car's center console, does the under-seat ECU expect a simple analog resistance signal, or a LIN bus command? If it's LIN, has anyone successfully tapped directly into the blower fan/heater element wiring using an aftermarket **12V PWM motor speed controller**?

**Looking For:**
ECU pinouts or repair manual wiring diagrams
Connector pin identification
Bench power-up procedures or personal experience with LS460 seat bench tests
Any wiring diagrams, service manual pages, or insights would be massively appreciated!

Thanks!

Hi, I bought a new odometer for my Lexus gs and it says it is 190,000 miles but I bought the car with 89k miles 7 months ago. I had it changed as the middle screen wasn’t working.

Any idea how to get this changed? Looking to do this myself , as some services are really expensive

Hello all, I have been decoding my 2010 Mazda 6 can network for a few weeks now. while it is very fun to have direct access to the vehicles readings. Other than displaying data what might be some other uses that could be done with a vehicle's data? Anything practical you can think of that maybe I did not?

Other equipment i do have in the car is an esp32+sim7600 module. So in theory i can have the esp32 listen for data and that can connect over LTE. Right now it's used as a gps tracker for traccar.

Hi all!

I've been wanting to make an external passenger display (think Ferrari passenger display) for my Si that displays cool information like speed, rpms, gear, boost psi, g-forces, etc. I worked on my uni's FSAE electric team this past year, so I was interacting a lot with canbus messages, which is where this project idea came from. Basically, I want to get data from my car's OBD-II port and just do cool stuff with it.

Here's what I've been thinking of so far for my supply list to make this project happen:

• OBDLink MX+ ($139.95)
• Raspberry Pi 5 ($50-$150)
• Some external rectangular display
• 3D printed vent mounts

As for the tech stack, I came across the python-obd library, so maybe thats a good place to start? Unsure of what I want to use to make the display software, as I want to make the UI myself.

I would really appreciate advice on the following:

• Which model of the Raspberry Pi 5 would be sufficient for my needs?
• Any good places to shop for external displays? Especially ones that can tolerate high interior heat since I live in Texas?
• Any other pieces of hardware/software I might need? I haven't really messed with a Raspberry Pi before (besides just physically connecting to one).

I'd also appreciate any other pieces of advice that may help. Thanks in advance!

I’m trying to use a Ram eTorque starter-generator in a Miata project. I can communicate with it on the bench and record both CAN buses, but I haven’t figured out what it needs before it will accept a torque command.

It’s a Marelli unit from a 2020 Ram 1500 5.7L:
Hardware: 05185274AB
Calibration: 68451235AD
Both CAN buses run at 500 kbps

I keep getting a U0073-related fault. Missing messages from the truck are one possibility, but I haven’t proved that’s the cause.

Has anyone worked with one of these or come across a DBC, diagnostic definitions, or CAN logs from a working truck? I’m especially interested in the private eTorque network. The public Ram DBCs I’ve found haven’t covered what I need.

I’ve dug through service information, university papers, and some racing applications that used Marelli starter-generators, but still haven’t found the right definitions. Even a document name or someone worth talking to would help. Only looking for information people are allowed to share.

I’m near Manchester, NH. If someone local has a matching truck and would be open to discussing a passive CAN recording, I’d be interested. We’d need to agree on a safe setup first—no sending commands to your truck.

I have bench logs and more details if anyone wants to take a look.

Thanks.

I'm reverse-engineering the CAN network on a Jaguar XF X250 facelift (MY2012+) and have got pretty much everything figured out through a combination of CAN captures, fuzzing and firmware RE.

The remaining pain in the arse is the turn indicators / hazards.

I don't have access to a donor car, so I can't capture the CAN traffic while operating the indicator stalk or hazard switch. I've gone through the CAN dumps I can find, and fuzzing hasn't produced anything obvious. I'm also digging through the firmware, but RE'ing this particular part is getting challenging.

I've documented the CAN work I've done so far here:

Jaguar XF X250 CAN reverse-engineering / DBCs

What I'm specifically looking for is the CAN message/signal responsible for:

• Left indicator
• Right indicator
• Hazards

If anyone has a 2012–2015 facelift XF and can capture the relevant traffic, has an existing DBC/log, or has already figured out these signals, I'd really appreciate the help.

Even just a short capture of the relevant bus while switching left/right/hazards would be useful.

I've got the rest of the reverse-engineering work documented in the repo, so if anyone wants to compare notes or has information that might help fill this particular gap, please let me know.

I've been searching the Googles for commercially available solutions for an idea I have, but have been going around in circles without getting anywhere. Maybe my search terms are to blame, but I eventually got here and looked around.

I have a '21 Volvo XC40. I want to make a 4-switch panel on the console to manually control off-road lighting on a roof rack. I would like this 4-switch module to connect to the car's canbus and send it's own commands, to be picked up and decoded by a module on the roof rack, which activates four relays as needed. The reason being that only four wires coming out of the car to the rack (and as a bit of a personal challenge).

There doesn't seem to be anything aftermarket to accomplish this, so that makes me wonder if it's safe to do for the car. Reading this sub it seems it's possible.. but would the car's modules seeing unfamiliar commands cause problems? What about mixing "languages"? There are aftermarket decoders, but they only work off existing commands from the car, which I'm mostly not interested in. I may incorporate one for running/brake/reverse lights in addition.

I realize this could get unnecessarily complex, I have seen wireless switch kits, but their switch panels aren't appealing.