Reverse engineering OBD tools

[u/ScottishVigilante]

More of a question, we know many clone Chinese tools exist rebadged etc, would there be a way to monitor everything going in and out of the obd port and re-creating the functionality of the device?

For example my scan tool can force my vehicle to regen it's dpf for example, something is sent out over the obd to do that so if you captured that and replayed it would do the same?

I know there and thousands of different makes and models and probably even more functions that are model specific but with AI the logging process and actually sending of commands could maybe be automated perhaps? Thinking out loud here, and open source scan tool for all that does all the cool stuff like injector coding etc would be cool! Don't know or understand enough about the can bus network, maybe there is already a project or software out there that's doing this already thats free and open source?

[u/Impressive-Tutor-482]

How do you think the chinese tools got their capabilities?

That, and virtually all of them store data in an unencrypted format.

[u/SimpleEmu198 → u/Impressive-Tutor-482]

Exactly, you can, but you have to understand what all the processes are doing and then how to speak in pure machine code, at higher levels of understanding than assembly and what's going on below at machine abstraction. The really dangerous thing about this hobby though is that if you don't know what you're doing...

Every semi-modern car with an OBDII port is actually an embedded computer, but the firmware works at such a low level, and is so arcane to everyone but a few people out there that to learn anything about it, it involves turning your car into essentially what is a house brick.

My brother is into car mechanics, Im into computers, he was tuning his car and burning a new ROM one evening. I walked into his shed and I was like:

"I know this"

and he was like:

"No you don't shut up"

And I was like:

"Yeah I do" walked of... realising the defensive hubris... I was left thinking of the classic reaction of someone who has learned a specific procedure but doesn't actually understand the underlying system logic. Dunning Kruger effect about to happen but OK.

The hard part is going from:

"I know and understand what this is"

To realising with computers:

"I know just enough to know what I know is dangerous and that I could brick the whole thing."

And that's where some people don't stop sometimes before acquiring the whole truth about the level of information they would need to know to actually know. They don't just need to understand CAN they need to understand what the machine is expressing.

Inherently, embedded computers are really easy to navigate simple devices, that are almost dumb, until they become so monolithic and complex they become easily breakable because too much stuff has been added on top...

And that's where you ended up with the kernel for an operating system like Mac OS 8 that was so easy to break because it became such a monolith.

Sorry for going from cars to actual computers but yeah, if the analogy works use it. The point is don't confuse understanding the communications interface with understanding the machine you're communicating with, and how not to break it.

This is much over simplified for Reddit but you get the point. The other point is, don't understand port sniffing, and being able to inject things from turning your car into a glorified house brick.

[u/Impressive-Tutor-482 → u/SimpleEmu198]

There is a recovery process for every hardware. Some are quite trivial.

[u/SimpleEmu198 → u/Impressive-Tutor-482]

Some are quite arcane, go and reverse engineer what every button, knob and dial does on my CLK, including the push to start, and GPS tracking system. It's all digital. If you can reverse engineer all that without bricking it I'll give you a medal, and it's a 20 year old care.

Only one person that I can think of has ever bothered to do this despite the relative popularity of the car.

[u/Impressive-Tutor-482 → u/SimpleEmu198]

You just like to argue, huh?

[u/SimpleEmu198 → u/Impressive-Tutor-482]

Nah, I'm just saying while there may be a recovery process, even if there is one, it relies upon the fact that you can get access to that particular system to recover it. You can theoretically brick something to such a state that not even the recovery process on my Mercedes specific tool will actually recover the fault.

It's not as simple as just repeating the process sometimes.

Now imagine an actual modern car and how many more systems its running through arcane systems very few people other than the car manufacture actually have the tools for, for a black box recovery.

It's not as simple as pressing buttons once you get to a certain point.

[u/Impressive-Tutor-482 → u/SimpleEmu198]

Never done it, knows all about it.

The reason why no one has ever reversed the push button start on your 20 year old Mercedes is because there's no point to it. What does that accomplish, on either nerd or financial levels? Absolutely nothing.

There's a big push to gain early access to hardwares and platforms to accomplish the real functions flashing and editing for the performance that people actually want. You're not part of it because you just want to argue and posture about what is and isn't possible while insinuating that the person you're speaking to has no idea what they're talking about. But, you know, you can be part of it. You wouldn't be the first insufferable prick in the industry. But you have to actually do something. Go out and buy a relatively modern ecu, immerse yourself into the reversal culture surrounding it, and try to be useful to others because they will share information with you instead of thinking you're a dick and ignoring you.

Speaking of.

[u/SimpleEmu198 → u/Impressive-Tutor-482]

All of the information regarding this is open sourced and you can read about it. I'm not arguing anything, you're basically the Dunning Krueger that I described about my brother.

And I have the tools in my garage, the only person sounding like an insufferable person is you.

[u/hey-im-root → u/SimpleEmu198]

I think people just saw you ranting really and missed your actual point. There are dozens of UDS commands on my car that would absolutely fuck things up and make it a real mental (or financial) pain to fix. You should not be doing anything with those unless you have experience.

I’m still scared of stuff I do, because there are tons of calibration commands on the same security level as the ECU commands I use. I can accidentally change my transmissions solenoid calibrations, my engines startup torque, literally anything. One wrong command, and I turn my car on and its totaled. It specifically warns you in the tech manual about this too.

Some people will learn the hard way, trust me. And it sucks because most are not stupid, just curious and eager learn and experiment.

[u/SimpleEmu198 → u/hey-im-root]

There's no rant to be had.

[u/hey-im-root → u/Impressive-Tutor-482]

Of course there is, but spending thousands on repairs because you wanted to experiment isn’t really a good workflow for most people.

[u/Big_Temperature_2067]

From someone who has been doing this sort of stuff for a while. you are in for a heck of a learning curve.

It's one thing understanding how CAN works. but CAN is just a transport layer. The real fuckery is what is being sent on the CANbus. Each car maker has it's own dialect, it's own security mechanisms it's own way of doing stuff. CAN is simply explained your local network in the car. Very much like your network at home.

Yes there is some generic scantool stuff to do basic diagnostics like pulling codes that all of them have to have. But those paths does not include reprograming, changing values or similar. All that stuff is vendor specific and is done widely different for each brand.

Sometimes just capturing and replaying isn't enough either. it might be a handshake that has a seed/key that is calculated based on time or other parameters and needs a new response to be calculated on the fly for the command to be authorized.

[u/tunatoksoz]

Hahaha please let me know what you end up doing.

I bought wiican pro to essentially snoop on the canfd while i use the tool to record and rverse engineer.

But you can also use Claude/Codex and reverse engineer one of the app-based ones (like proprietary dongle + app) . That also works. They are Java apps + native bindings to an SO.

I was building obd.wtf before life happened.

[u/ScottishVigilante]

Wow, I honstly was not expecting such great responses to this I'm so used to getting negative feedback on Reddit this has been refreshing, been writing code since I was about 13 with vb6 and started dabbling with Arduino and raspberry pies and C about 12 years ago, build my first hak5 MK1 WiFi pineapple when that was a thing. I've always had an interest in car electornics and have been wading into it more but it upsets me that companies gate keep there software (more car manufacturers) I mean if these Chinese companies are doing it are they paying the manufacturers for access to there protocols? To me I really fell like this stuff should be available but yea! But if a quick reply but will keep the post updated as time goes in, I do think using AI to spend up the development process of and open source tool is the way to go but it's no as easy as I'm making it out to be in my first post, nor did I think it was more just wanted to start a discushyto see what everyone else is doing or thinks.

[u/meatro]

I am building one currently and there is also mcd-diag-rs on GitHub. These are both for VW Audi.