2003 Mini Cooper CAN messages

[AndreyB]

I need a break from KiCad so while I am waiting for the Frankenstein 0.1 I'll see if I can sniff any CAN messages from the 2003 Mini Cooper.

I was lucky to be referred to a couple of articles which cover exactly the same vehicle -
DEFCON-21-Staggs-How-to-Hack-Your-Mini-Cooper-WP.pdf and DEFCON-21-Staggs-How-to-Hack-Your-Mini-Cooper-Updated.pdf

Another source of data: http://bobodyne.com/web-docs/robots/MINI/CAN/Presentation/

So I'll start with the info from these articles:

message 0x153 Speedometer
byte 2

message 0x1F0 ?
message 0x1F3 ?
message 0x1F5 ?

message 0x316 Tachometer
byte 3

message 0x329 Indicator Lights

message 0x61A tachometer LED message

message 0x61F Tachometer + Indicator Lights
PS: some cool CAN-related links:
https://mbed.org/users/foxdie/code/GMLAN-Sniffer/
http://vehicle-reverse-engineering.wikia.com/wiki/Vehicle_Reverse_Engineering_Wiki

[AndreyB]

I've started with a OBD2 16-Pin Male to Female Diagnostic Extension Cable - for $5.46 including shipping you cannot beat the price.





In this random extension cable
#4 GNDchassis red
#5 GNDsignal yellow
#6 CAN+ green
#14 CAN- brown-white
#16 BAT green/white

[AndreyB]

It's unbelievable - the diagnostic connector on this car does not have CAN wired up! I am supposed to hack into the wiring, that's a face palm


http://www.bmw-planet.com/lib/mini/BUS%20SYSTEM.pdf

[AndreyB]

Two messages are needed to have TACH operational

Code: Select all

function setTwoBytes(data, offset, value)
	value = math.floor(value)
	data[offset + 2] = value >> 8
	data[offset + 1] = value & 0xff
end

R52_RPM = 0x316

data = { 0, 0, 0, 00, 0, 0 , 0, 0 }

rpm = 7000

function onTick()
	rpm = rpm + 300
	if rpm > 8000 then
		rpm = 0
	end

	setTwoBytes(data, 2, rpm * 6.39)

	txCan(1, R52_RPM, 0, data)


	-- 1 ABS and warm-up light but no tach
	-- 3 blinker and alive
	-- 4 ABS and alive
	--
	status2 = 2

	-- status3 = 0xC0
	status3 = 0x0

	status4 = 0x0
	-- status4 = 0xC0
	-- with ABS with blinker with warm-up light
	-- status4 = 0xFF

	txCan(1, 0x61f, 0, { 0, 0, status2, status3, status, 0 , 0, 0 })
end

[AndreyB]