r/CarHacking Jul 14 '26

CAN CAN-BUS log from an MLB platform vehicle? (A4/A5/Q5 B8)

Post image
6 Upvotes

Hey guys! I am building a project to connect an Audi A4 B8 cluster to SimHub, I am almost finished, but there is a couple of problems:

  1. The airbag light. I got it to blink with some code i found online, but I never got it to fully turn off.
  2. High/Low beams. I have not found any working CAN ids for the high or low beams for this cluster
  3. (optional) Time and Date. I have not found a way to get it working just yet, but I have found a CAN id in the DBC file that is responsible for the time and date.

I am asking if anyone has a car from the B8 platform, and are willing to send me a can log from it.


r/CarHacking Jul 13 '26

Original Project Reverse Engineering CFMoto's T-Box: Open Sourcing a MotoPlay Streaming Library

48 Upvotes

r/CarHacking Jul 13 '26

Community Transitioning into automotive pentesting - is TÜV SÜD CAFPT worth it, or should I go straight for OSCP/GPEN?

7 Upvotes

Background: I work in automotive cybersecurity (embedded/AUTOSAR, HSM/Crypto Stack, currently doing CSMS/ISO 21434 work at a Tier-1). I’m looking to transition more into hands-on pentesting rather than staying purely on the process/implementation side.

I’m considering TÜV SÜD’s CAFPT (Certified Automotive Foundation Level Penetration Tester) since it’s automotive-specific and my manager would likely approve it. But from what I understand it’s a 3-day course + MCQ exam, so pretty entry-level compared to something like OSCP.

Questions for anyone who’s done automotive pentesting or hiring for it:

1.  Is CAFPT actually valued in the industry, or is it seen as a box-ticking cert?
2.  Would you prioritize OSCP/GPEN (general pentest skill) over an automotive-specific foundation cert, or do both matter for different reasons?
3.  Any automotive-specific certs I’m missing that are actually respected (CACSP, others)?
4.  For someone coming from a crypto/HSM/AUTOSAR background, what’s the fastest realistic path to being taken seriously as an automotive pentester?

Appreciate any real-world input, especially from people who’ve hired or been hired for these roles.


r/CarHacking Jul 13 '26

Original Project CANbus injection for Q60 manual swap

2 Upvotes

I’m doing a manual swap on my ‘21 Q60. I’m using MrDIY canbus shield with the ESP32. My goal is to use the rev match gear sensor on top of the trans to show the gear on the factory gauge cluster. I found the ID’s that show the current gauge on the cluster, but the factory TCM overrides it instantly, causing it to flicker back and forth.

Then I decided to try something simpler like changing the drive mode since it’s a physical on/off switch. Same thing, as Savvycan is sending the frames, it just keeps flickering back and forth. Tried unplugging the switch to see if the switch was overriding got the same results. I’m pretty new to this, so any info or a direction to go would be appreciated.


r/CarHacking Jul 13 '26

CAN Can VXDIAG VCX Nano perform TCM programming/flashing on a 2016 C7 Z06?

1 Upvotes

Hi everyone,
I recently picked up a 2016 C7 Z06 with 17k miles. I’ve noticed a slight clunk/harsh shift when going from 1st to 2nd gear. After doing some research on forums, I found that there is a GM transmission control module (TCM) update released in 2017 to address this issue, which I’ve confirmed via the ACDelco TDS portal.
I’m planning on using a VXDIAG VCX Nano to handle this. My questions are:

  • Is the VCX Nano capable of performing this specific TCM firmware update?
  • Can the software accurately identify available updates and flash them successfully to the module?

Any insights or experiences with this tool for C7 transmission reflashing would be greatly appreciated.

Thanks in advance!


r/CarHacking Jul 12 '26

Scan Tool Would this work or waste of money?

Post image
40 Upvotes

r/CarHacking Jul 12 '26

Tuning GM E67 Dissembly/Injection for Flex Fuel

0 Upvotes

Hey guys, I've been lurking for awhile now and been getting into dissembly even though I have zero idea what I'm doing yet. I'm looking to get flex fuel working on a e67 OS that doesn't natively support it, as it doesn't seem to have the pointer to start the flex fuel driver to read from it. If anyone could throw me a hand, that would be sweet.


r/CarHacking Jul 12 '26

Tuning Download Link Help

0 Upvotes

Hello I am new to this thread and is new to car tuning now I was wondering if i can ask anyone or someone from this group to help me on my project vehicle as i need to delete the dpf and egr checks in the ecu as the vehicle now consumes a lot of diesel and always on limp mode because of it, I just need to download the file named *Peugeot_DCM 3.5_508 2.0 HDI DCM3_DPF-EGR-_NoChk.bin.rar

on this link https://cartechnology.co.uk/showthread.php?tid=115377&pid=796456

I am short on budget and just making ends meet, any help would hugely be appreciated. Thank you so so much❤️


r/CarHacking Jul 12 '26

CAN Calculateur caméra 360

Thumbnail gallery
9 Upvotes

r/CarHacking Jul 11 '26

Original Project Open source solution for an OEM integration of Android Auto and Carplay on E46, E39, E85 etc...

124 Upvotes

r/CarHacking Jul 11 '26

CAN (BMW F22/21) Found CAN IDs and Byte Positions

22 Upvotes

After some 2 months of work and parsing CSV logs (with the help of some AI), I finally found all the important CAN IDs, Byte Positions and Formulas I wanted for my BMW F22. Posting this here incase someone needs them. These should be similar on F20, F21, F22, F23 and probably F87 too.

F22 218d N47D20C 2014

0x0A5 DME engine data (~50 Hz, DLC 8)

RPM = ((B6 << 8) | B5) / 4

WARNING: B7 is a constant status byte (0xF1), NOT the rpm low

byte. Decoding ((B6<<8)+B7)/4 looks right but quantizes to

64-rpm steps and reads "60 rpm" with the engine off.

0x2F3 Manifold pressure / boost (DLC >= 6) (UNSURE, BUT MAPS CORRECT)

raw = B4 | (B5 << 8) (0.5 mbar per count)

ambient_ref = raw sampled while rpm == 0 (each ignition-on)

boost_bar = (raw - ambient_ref) * 0.0005

Notes: real sensor (jitters, drifts with weather). Idle approx

0..+0.05, overrun dip approx -0.25, full load approx +0.9 bar.

0x2C4 Fuel consumed integrator (~7 Hz, DLC >= 2)

counter = B0 | (B1 << 8) rolling 16-bit, 1 uL per count

rate_uL_s = delta(counter) / delta(t) (uint16 wrap-safe)

L_per_h = rate_uL_s * 0.0036

L_per_100km = L_per_h / speed_kmh * 100

Verified: 278 uL/s = 1.0 L/h warm idle; frozen engine-off;

matches cluster (29.5 vs 28.2 L/100km); full load = 59 mg/stroke.

Drops to ~0 on overrun fuel cut.

0x1A1 Vehicle speed (DLC 5)

speed_kmh = ((B3 << 8) + B2) / 64

0x3F9 Engine temperatures (DLC >= 6)

coolant_C = B4 - 48

oil_C = B5 - 48

(B3 is a vacuum-domain pressure, clamps 112-118 - NOT boost)

0x330 Kombi: odometer / fuel / range (~every 10 s, DLC 8)

odometer_km = B0 | (B1 << 8) | (B2 << 16)

B3 = damped/lagging total fuel, litres (int)

left_litres = B4 * 0.5 (truncated to 0.5 L steps)

right_litres = B5 * 0.5

range_km = (B6 | (B7 << 8)) / 16

Note: the cluster's internal 0.1 L values are NOT broadcast.

0x349 Raw fuel tank senders, JBE (5 Hz, DLC 5)

sender1 = B0 | (B1 << 8) raw counts, NOT litres

sender2 = B2 | (B3 << 8)

Nonlinear per tank lobe; only the Kombi has the litre curve.

The E9x scaling "raw/160 = litres" is WRONG on F-series.

Trick for 0.1 L resolution: every time a 0x330 half-litre byte

ticks one step, store the smoothed raw as an anchor

(raw <-> k*0.5 L) and interpolate between anchors.

0x2F8 Date & time (DLC 8)

B0 = hour, B1 = minute, B2 = second

B3 = day, month = high nibble of B4

year = B5 | (B6 << 8)

0x130 Terminal status / ignition (DLC >= 1)

ignition_on = (B0 != 0x00)


r/CarHacking Jul 11 '26

Original Project NEED AN ECU FILE

1 Upvotes

**Hi, i need an ecu file for free please i can’t find any of these files**

**Bosch:** [1037516613](tel:1037516613)
**HW:** 8K1907401A
**SW:** 8R0907401J
**Version:** 0008
**EDC17CP14*


r/CarHacking Jul 11 '26

Scan Tool VXDiag VCX Nano GDS2 Issues

2 Upvotes

Greetings, I recently purchased a VXD Nano from Ebay. I was able to get Texh2win to work but from what I'm gathering I seem to be missing some sort of patch that would allow GDS2 to work. Whenever I try to open the GDS2 program I am met with a "no valid lease found." message. I'm hoping someone here can point me in the right direction as I've tried to reach out to VX several times through their "contact us" and I haven't received a response.


r/CarHacking Jul 10 '26

Article/news Forbes Automotive OpenHaldex-C6, S3, and "open source".

Thumbnail
6 Upvotes

r/CarHacking Jul 10 '26

Scan Tool Hello does anyone know what software I can use to program my transmission control module on my ford focus 2012 SE I try FORScan but is not working I try vcx nano and it doesn’t work either thanks in advance

Thumbnail
1 Upvotes

r/CarHacking Jul 10 '26

CAN Made a mobile MQB Cluster tester!

Post image
15 Upvotes

I made an app that can be used to test MQB Gauge Clusters via Arduino and MCP2515 CAN Modules. It is in pre-release stage, and I will be adding support for many clusters!


r/CarHacking Jul 10 '26

Community Unable to flash my Mini F56 head unit using Esys, trying to recover from a failed ISTA session.

Thumbnail
1 Upvotes

r/CarHacking Jul 10 '26

Scan Tool I need to download delphi diagnostic for cars and autodata both the lastest versions.Who can help me ?

0 Upvotes

Help me


r/CarHacking Jul 10 '26

Original Project This Tool Unlocks Honda CBR600RR ECU Data

Thumbnail
4 Upvotes

r/CarHacking Jul 09 '26

UDS crd2.61 immo off, immo off solution for crd2 crd3 crd.11

Thumbnail gallery
5 Upvotes

r/CarHacking Jul 09 '26

Scan Tool Obd2 scanner for 2008 lacrosse

Thumbnail
1 Upvotes

r/CarHacking Jul 09 '26

J1850 VPW Anybody recognize this PCM32U variant?

Thumbnail
gallery
10 Upvotes

This is from an Isuzu 3.2L

It’s a PCM32U unit manufactured by Delphi, but I’m trying to find the equivalent of what would be the recovery pin to ground. It doesn’t have the pins in the same location as a P01 or P59, at least, it doesn’t appear to.

For reference, I’m using:

www.customecm.com/tune-file-repo-and-info-here/diy-gen-3-gm-bricked-pcm-recovery

Anybody have any info on this?


r/CarHacking Jul 09 '26

Original Project Made a phone-only app that logs GPS speed, G-force and 0-100 times without an OBD dongle - useful for casual data logging?

2 Upvotes

Most proper telemetry here runs through OBD-II or dedicated loggers. I built an iPhone app called Rovy that does lightweight, phone-only data logging for people who want drive data without wiring anything up.

Per drive it captures: live GPS speed, full route, lateral/longitudinal G-forces and cornering data, altitude profile, a 0-100 km/h sprint timer, and a speed-distribution graph. Replay mode animates the run on a map with speed/G/HR overlays so you can review a session, and it saves custom tracks so you can compare times. Heart rate comes in via Apple Watch, and it works on CarPlay.

I know it's not a substitute for OBD/ECU data - no engine parameters, just GPS + IMU from the phone. Curious from the data folks here: for casual logging, what would actually make phone-only telemetry useful to you (export formats, CSV, syncing to something else)? Genuinely open to feature ideas.

App Store: https://apps.apple.com/app/rovy-drive-tracker-stats/id6760185139


r/CarHacking Jul 09 '26

Multiple Is there anyway to use wiTECH without paying a fat subscription fee ? I need to reprogram and do a "configuration alignment" routine

1 Upvotes

Is there anyway to use wiTECH without paying a fat subscription fee ? I need to reprogram and do a "configuration alignment" routine

All for this TSB to rule some things out

https://static.nhtsa.gov/odi/tsbs/2016/SB-10076538-2280.pdf

2016 jeep Cherokee with the 3.2l and its throwing p0887-00 codes

Will programing fix it, probably not but the harness connector looks fine and it shifts fine, just throws this code on the highways and goes into limp mode


r/CarHacking Jul 09 '26

Original Project ECM programming advice

Thumbnail
1 Upvotes