Any CAN BUS sniffing experience in this forum?

K

kdmport

New member
I am doing a swap with a 2016 F150 ecoboost 3.5L.  I'm trying to keep the transfer case instead of switching to a manual one.  Long story short I need to inject the proper CAN msgs onto the HS3 bus to the Transfer Case Control Module so it will shift into 4H and 4L.

Mainly - I'm looking to verify the 4 wheel speed sensor IDs and the Steering Position Angle ID from the ABS module.

I'm new to CAN BUS sniffing, using an Arduino and SEEED CAN BUS shield (both read and write) - so any experience out there is appreciated!
 
ecoboostsho can likely help here.  He sniffed out info to help customize Torque Pro for the SHO.
 
kdmport said:
I am doing a swap with a 2016 F150 ecoboost 3.5L.  I'm trying to keep the transfer case instead of switching to a manual one.  Long story short I need to inject the proper CAN msgs onto the HS3 bus to the Transfer Case Control Module so it will shift into 4H and 4L.

Mainly - I'm looking to verify the 4 wheel speed sensor IDs and the Steering Position Angle ID from the ABS module.

I'm new to CAN BUS sniffing, using an Arduino and SEEED CAN BUS shield (both read and write) - so any experience out there is appreciated!
Click to expand...
I'd be happy to try and help although I've got a ton going on this weekend so I may not be very responsive until Monday. Take a look at this thread for what I did to sniff out the PIDs.

https://r.tapatalk.com/shareLink?url=http%3A%2F%2Fwww%2Eecoboostperformanceforum%2Ecom%2Findex%2Ephp%3Ftopic%3D3141%2E0&share_tid=3141&share_fid=56487&share_type=t

(Hopefully that works I'm on my phone)

I haven't messed with this for some time and while I've used an Arduino I haven't heard of the add on you are using. May have to check that out. First you need to determine the module address of the module you are trying to talk with. You should be able to do that by leveraging a well known PID that talks to it and just see what the hex address is. After that you could intercept it and then try to replay what you are doing on the CANBUS. That said I don't have much experience sending messages in the bus just reading them but if the Arduino Shield makes that easier then that would solve that challenge.

Sent from my XT1650 using Tapatalk

 
@ecoboostsho - very nice work.  So you started at 0x000, or in your nomenclature 22000, and just incremented up from there getting results (maybe skipping known obdii)?  I hadn't really thought of that approach.

These PIDs are like mining for bitcoin...

The CAN BUS shield is basically a network device that can read/write from/to the CAN BUS.  You can even set the baud rate for LS, MS, and HS CAN.  In my case I just spliced into the HS3 CAN network and then it prints to a serial monitor or you can log to a file/SD card.

How did you back out the equations from the values to get the math?  Just reverse engineer the returned values to known values?

Too bad you don't own a 2016 F150 and did all this work for me....

 
Well I actually didn't increment through them - I used a scan tool that already knew what the PID's were and then sniffed the bus to actually see what the PID was.  That may be a challenge in your situation since if you don't know what messages to send and/or the PID then my method doesn't really help you. 

As for the equations they were also reverse engineered in most cases either by finding two points on a line and doing some math or using some common sense logic along with trial and error.


So back to your issue - if you knew of a scan tool that could send the proper messages you could watch that with a serial sniffer and then try to replicate it with your arduino setup.  Beyond that as I mentioned above if you don't know the PID and can't replicate it then that is going to be significantly challenging...
 
I agree, I need more insight into the addresses.

I think I'm going to see if I can manually control the shift motor through the Arduino and a couple of relays.  If so, I know I can at least use the transfer case and keep going with my rebuild.

Then I can sniff my brother's F150 HS2 network which has the TCase control module and ABS module to see if I can capture what is going on.  It just isn't feasible without having either the components or knowing the addresses.

Thanks for the response.
 
For future search prosperity, I haven't successfully been able to inject a CAN message to shift into 4wd.  I have however been able to use the Arduino plus a relay shield and Nextion interface to control the shift motor on the transfer case.

I'll look to do a write-up when I can.

 
kdmport said:
For future search prosperity, I haven't successfully been able to inject a CAN message to shift into 4wd.  I have however been able to use the Arduino plus a relay shield and Nextion interface to control the shift motor on the transfer case.

I'll look to do a write-up when I can.
Click to expand...
That would be awesome! I'd like to use a setup like yours to have car put the advance Trac stability control in "sport" automatically without pushing the button every time. I was thinking I may be able to do that with a PID...

Sent from my XT1650 using Tapatalk

 
@rayjay Those are massive threads.  I don't know how he does all that work AND post it all.  In fact, I was originally going to do a mild restoration on the Bronco, saw that thread, and thought 'why not, sounds fun'.  I'm on budget now, but could easily blow through it building like that...  His work and ingenuity are pretty impressive!

I didn't see anything specific on the 4wd spoofing ABS unless I missed it - a lot there.  I think from my first read he was just grafting the old onto the new, keeping all the electronics and hardware, but I could be wrong.

@pdsho - I am in CO, but no, no weed sniffing here...
 
You must log in or register to reply here.

Similar threads

L
Did the 2013+ brake upgrade... Issues...
Replies
1
Views
3K
351Blueblood
3
C
2013 Ford Taurus Police - Steering Rack Issues
Replies
2
Views
7K
ZSHO
Z
E
HOW-TO: 2015 Explorer Tablet Installation For Torque Pro Gauge Display
Replies
2
Views
7K
Ecoboost_xsport
E
E
HOW-TO: 3.5L EcoBoost PTU Build Thread
Replies
5
Views
6K
Ecoboost_xsport
E
E
HOW-TO: 2015 Explorer Fancy Tow Hook Bling
Replies
0
Views
4K
Ecoboost_xsport
E
Back
Top