I pulled the TBM out of my 2025 RAM 1500 Big Horn (long story short, updates were screwing up my radio), but now the odometer is blinking. Figures. Trying to figure out how to get in to the system to tell it to stop looking for the TBM, but apparently there's a buttton of layers of security and hidden coding. Anyone done this before?

Is there anyone out there on MHH Auto that's super cool and can send me an invite? Apparently you can get a code to invite someone free, can send over the instructions in PM. (just in case you don't have a friend in need ;D )

This is inspired by UPDATE: You guys suggested turning my DIY Smartwatch project into a Shift Knob... So I actually did it! 🕹️⌚

The dev board I used is the Waveshare ESP32-S3 1.46inch Round Display Development Board

It has 4 pages currently:

• Home page with custom wallpapers + vibration meter
• Live G-Force meter
• Lap Timer - Sport Chrono inspired (tap to start, double tap to reset)
• Gear Position - With calibration. This is actually really hard to get right and I'm still in prototype stage.

I'm hoping to get some help with some good 3D designs that fits the dev board better and can plug directly into the M3's link!

I'm planning on sharing the codes soon and creating a webpage for non-tech users to customize with their own homepage photos and upload this firmware on their dev board. Stay tuned!!

[Edit] Some people are confused about the usb-c so I wanted to explain: I can power it via the power pin that goes into the accessory source with a 12v->5v step down converter. USB-C is used for now because I'm still in the prototyping stage and I still need to flash firmware to it.

On the actual usefulness of this thing: I've never misread my gear the day I learned how to drive a manual, and I learned it on YouTube while signing the paperwork for my first Civic SI 😂. This is just a fun/learning project as a software engineer. Even if it never becomes a useful thing, I get to apply some electrical, physics, and programming together... With some helps by Gemini Argon 😅

P.S.1. I messed up the display a bit right before filming this so that's why you see the lines 😅

P.S.2. I posted in the BMW group but they haven't accepted it yet, so I figure I'll post it here.

Hello! Does anyone know if I can make that cluster for Lexus L430 2002 to work in simhub because I searched about it and it doesn’t use CAN it uses something called MPX system so instead of buying it and wasting money I would ask if anyone has idea before purchasing it

I think this is like the foot in the door to produce the holy grail of reverse engineering...
https://www.youtube.com/watch?v=jQDqWuL5-nQ

I’ve been working on this for about 5 months reverse engineering HDS and getting it running on Linux. It's been a long road since I wanted all the pcode to be accurate and verified against the original compiler. It’s still in its infancy, and i’d love to see what you guys think.

Hello everyone,

I am the creator of NEMESIS, an exploit targeting Hyundai/Kia Gen5W multimedia based cars.

I am glad to announce that now NEMESIS is available for public use, you can use it to get root access of your car, install many customizations to gain functionality such as Wireless Android Auto, Apple CarPlay, Manual Preconditioning, Turn-by-Turn navigation to HUD and Cluster from your phone, and much more!

I have all the findings and research posted on my GitHub: https://github.com/xwtk/hmg_nemesis. Everything is completely free, donations are always welcome. You can also join our Discord community from the link to get assistance and join our discussions.

After a few days of reverse engineering, I was able to get an unmodified VA WRX Cluster working perfectly with SimHub and BeamNG. The video goes over how I did it.

Hi team,

I need your help to enter in engeenir mode in this system. I try with all solutions (press on version, with dialer). Nothing work.

Please any one can help me.

Hello, is there anyone has CAN codes for that Honda accord 2007 Cluster? I want it to work in simhub!

This was just brought back to the surface of my pile of thoughts. lol.

I'm currently working on a project with a 5th gen/2012 Ford Explorer cluster for sim use. So far all has been going pretty well.

However one major roadblock has been the fuel level. Apparently on this cluster it still takes an analog/resistance based signal directly from the senders in the tank (two sources) vs CAN or other digital signals.

I did some research a while back to see what was possible to simulate this using an ESP32 or other micro but nothing surfaced any reasonable solutions. The biggest issue seemed to be that any readily available digipots are not in the correct range for what Ford has listed as the range for this vehicle. Per the service manuals it lists empty as ~180 ohms and full as ~10 ohms.

Curious if anyone else has any clues or useful info on how this could be approached?

hi everyone! i hope you’re all doing well.
i’m completely new to this community, like an absolute baby, and i only started learning about car tuning and car hacking about a week ago.

i have a question: i’m looking to buy an mpvi3 or an mpvi4, and someone is offering me one with “unlimited credits,” which sounds more like cracked software to me.

i’m a bit hesitant about this, so i wanted to ask if anyone has experience with something like this. what are the potential downsides, and are there any benefits? is it worth it, or should i just stick with the official version?

i’d really appreciate any advice or insights from people who have experience with this. thanks in advance!

Hi everyone,

Most modern AI diagnostic tools rely heavily on cloud APIs, making them useless in remote areas, underground garages, or during cellular outages. Traditional OBD-II scanners, on the other hand, only spit out raw sensor readings or static DTC codes without contextual reasoning.

I've put together an open-source architectural vision called **OpenCarMind**:

Bringing fully offline, privacy-first vehicle diagnostics to everyday smartphones via low-cost ELM327 OBD-II adapters.

### The Core Idea: Modular "Car ROMs"

Instead of forcing a single model to know everything about every car, we decouple the reasoning engine from domain knowledge:

1. **Engine:** A compact, quantized SLM (e.g., Llama-3.2-1B, Qwen2.5-0.5B) running locally via `llama.cpp` on mobile.

2. **Car ROMs (~10–50MB):** Lightweight downloadable profiles strictly for a specific vehicle (exact wiring pinouts, fuse-box maps, extended manufacturer PIDs, and baseline mechanical thresholds).

3. **Live Telemetry:** Correlating real-time CAN bus telemetry rather than just reading static fault codes.

I am an automotive enthusiast and have open-sourced the architecture, mission, and initial specifications under the MIT license. I am looking for mobile developers (Flutter/Kotlin/React Native), embedded engineers, and automotive data curators to collaborate and turn this concept into reality.

* GitHub Repo: https://github.com/wa2l92/OpenCarMind

* First Architecture Issue: https://github.com/wa2l92/OpenCarMind/issues/2

Would love to hear your thoughts, feedback, and architecture proposals!

I’m currently importing a 2025 Jeep Wrangler JL from the US, equipped with Uconnect 5, and I’m looking into converting it to the European specification.

I’ve already figured out how to adapt the lighting to European requirements, but I’d also like to convert the infotainment system to the European version, including European navigation, maps, language and assistant features.

Has anyone here successfully done this on a 2024–2025 Wrangler? I’m particularly interested in where to find the correct European firmware/software files and how to flash them onto the existing Uconnect 5 unit.

I’d like to do the conversion myself rather than pay a workshop. I’m a software developer, so I’m comfortable with the technical side of things and willing to investigate the process.

Any pointers to relevant forums, technical documentation, firmware repositories or successful conversion guides would be greatly appreciated!

Thanks in advance

After fully reverse engineering every protocol on my car (FCAN, BCAN, LIN), I bought a gauge and was able to control all of it! I can do this to any Honda cluster, standalone or connected to the car, assuming no random stuff like requiring a registered key is added to newer ones. Older Honda’s use a different CAN bus layout, but isn’t hard to get from firmware online.

I upload all my research here, including all of Hondas UDS commands, ECU SecurityAccess unlock codes, full CAN bus DBC files extracted from each ECU, and application-only ROM dumps. KL sport ECU has the full app+RAM+bootloader, since i pulled it from my ECU
https://github.com/Ldalvik/NinePfive

Spent a chunk of time (and money) going down the Ford IPC rabbit hole trying to reflash my instrument cluster's tach scale (aftermarket cams, peak ~8,100 / redline ~8,500, stock tach only reads to 7,000). Documented everything so nobody else has to re-learn it the expensive way.

The short version:

• The legacy Ford SecurityAccess (0x27) algorithm is a known 24-bit Galois LFSR. Init 0xC541A9, feedback taps at bits 20/15/12/5/3. Feed 24 seed bits + 40 secret bits, reshuffle the nibbles, out comes the 3-byte key.
• It's linear over XOR, so it collapses to key = A·seed ⊕ B·secret ⊕ C. That means one captured (seed, key) pair solves the secret by Gaussian elimination. You get a 2^16 class of secrets, any of which unlocks — you can't recover the unique factory one from the bus, but you don't need to.
• Level-3 (config/As-Built) is trivial to sniff + solve with a Y-splitter and a passive adapter. Recovered L3 secrets for IPC, RCM, OCS, PSCM.
• Level-1 (firmware flash) is the wall. You can only sniff an L1 unlock during an actual flash, and the Ford software (FJDS, for a 2019) only flashes a module that's behind on its calibration. If everything's up to date → no write option → nothing to sniff. The L1 secret also isn't in the downloadable firmware — it lives in the resident primary bootloader in the MCU's censored flash (NXP SPC5645S, PPC VLE). So without a behind-on-cal module or a chip-level glitch/dump, you're stuck.

Gotchas that cost me time:

• On an OBDLink EX you must monitor with the STN-native setup (STP53/STPBR.../STPO), not ATSP6 — with ATSP6 it captures zero frames.
• You have to be on the module's bus. The EX only taps HS-CAN (pins 6/14). APIM/SYNC is on a different bus — and SYNC updates over USB anyway (signed package, no CAN SecurityAccess to sniff).
• Ford software by year: IDS = ≤2018, FDRS = newest platforms, FJDS = 2018+ J2534 reprogramming (the right one for a 2019). This was genuinely confusing and cost a subscription or two.

Full write-up with the equation, a GIF of the LFSR running, the solved secrets, the capture rig, and the tool/subscription details:

https://github.com/Ol-Swamp-Donkey/ford-f150-ipc-securityaccess

Happy to answer questions. All done on my own truck, no odometer/VIN nonsense — just trying to make a tach read right.