|Did you know? Some GM vehicles allows CAN bus access to open and lock doors.|
AutoPi: Abilities and Features
AutoPi.io is specializing in connected car solutions to securely connect vehicles to the internet and gain data of automotive usage to help car owners improve remote access and control over their vehicle’s functionality. The AutoPi device not just allows users to be connected to the internet, but also to control and create actions via that, like unlocking a car without using a physical key. Therefore in the following blog, we will highlight one example, wherein the AutoPi device connects to a Ford Mondeo MK4 2009.
For this to work, the bus system through which the doors are controlled, has to be exposed on the OBD port. In our case, with the Ford Mondeo, the following article explains that the door control is achieved on MS-CAN with rate 125kbit/s. Since the OBD connector on Mondeo MK4 is compatible with the AutoPi (read more about AutoPi CAN-BUS User Guide), it is possible to decode the messages on the AutoPi and replay it.
How To Record and Play
Build on the information on how to record and play CAN bus messages provided on our community site, the process can be accomplished as follows:
- Once the device is online, go to “Car Explorer” -> “CAN Analyzer”.
- In the second step, you need to find the protocol settings required for your specific make and model. For our model, the following article explains the required protocol settings. However, the description yet fails to give up all the information and details such as payload size (#bits) and data length code (DLC) on our Mondeo MK4 are not provided, therefore an experimental approach is required.a. Select the bus and protocol you want to use as part of your trial, and then press record. In our case, we have four different MS protocols.b. Click on test in terminal and adjust the duration of recording to a sensible length. In this example, it lasts for 5 seconds. The trick is to save the file as in the screenshot below where the file is named “unlock1.txt”.
- The device makes a "beep" sound when the recording begins and another one when the recording ends. Make sure that the CAN command you want to record is happening between the two sounds (like door unlock).
- If the right protocol settings were applied for the car model you should see hex messages from the CAN bus in your file. Moreover, the recording is now stored on the device and you can play it back immediately using the CAN player on the right-hand side of the screen
a. If no message is recorded you have to continue with the next protocol settings, and name a new output file e.g. “unlock2.txt”.
- You will see that a lot of data is returned from the bus that finds the specific command for your function. We recommend using the filters. Typically, a lot of the data is repetitions, so you can start out by removing all the duplicates.a. Another option is Divide-and-Conquer, i.e. split the file in two using obd play.slice option.If the first part works - great - repeat slicing the identified segment. If the first part did not work try the second part.
- With the filters, narrow down the results to as few as possible. Then you can replay the commands one by one and see if you can find the command controlling the function you are looking for.
- When you have found your command you can always resend it by using the obd.play as shown below.
Alternatively, if the exact hex message is known it is possible to apply obd.send, e.g. <obd.send 048#801804092002F0A0 protocol=51 baudrate=125000>
Not all vehicles may be that easy to allow door lock/unlock control by reading the CAN messages and replaying the same content. However it is possible if the door control is exposed and the reader has an idea which messages are intended for door-specific commands for it to become a reality.
Please note that this is an experimental approach and experimenting with your vehicle is at your own risk.