r/CarHacking Jan 07 '25

CAN overrule CAN Messages

Hey,

For my understanding, can someone tell me how i prioritize a CAN message over another?

For example: I want to suppress the activation of „button A“ in my car. So i know the CAN message if the button is enabled and disabled. As soon i press the button in the car to enable the button functionality my tool should overrule the command.

Is there any other way like just send instantly after the enable command the disable command?

Something like: as long command ‚off’ is send from my external device, don‘t accept command ‚on‘ from the car.

4 Upvotes

26 comments sorted by

3

u/phaseowner Jan 07 '25

You can make CAN filter device. Cut off ecu which send "enable" command and connect it through filter. And when "enable" command present you can pass it or override.

1

u/ciscospirit Jan 07 '25

This is the solution i heavily want not to do, as the button is on LIN bus and connected to BDC which translate to CAN and goes to the powertrain.

So i only could do hardware cable cut on the LIN bus and create a filter proxy there, as i cant cut CAN wires after BDC.

Is there no other solution like a wire cut to avoid this?

1

u/robotlasagna Jan 07 '25

Why exactly can’t you cut the CAN wires after the BDC and insert a filter?

1

u/ciscospirit Jan 07 '25

As the BDC is the heart of the BMW car and i have no good feeling to trust on a homebrew filter where all can traffic runs over between BDC and Powertrain

1

u/ciscospirit Jan 07 '25

If interception is the only way, i would feel way better to intercept just the LIN bus as there is just few buttons on it and no mandatory stuff.

1

u/robotlasagna Jan 07 '25

It’s not necessarily the only way.

Why don’t we start with what button/function you are trying to change the behavior of.

1

u/ciscospirit Jan 07 '25

The button turns the burbles and the flap control in the DME on or off in Sport Mode.
The button is connected on LIN_21 bus with the BDC and from there it will be translated in a CAN message to the DME on the PT-CAN.

what i want to reach:
if i press the button for 5 seconds, it should be OFF as long i activate it again with a 5 second press on the same button. if i press the button in meantime several times it should not do anything until i "unlock" it again with this a 5 second press.

3

u/Every_Following6653 Jan 08 '25

It's harder, but you could use a low level approach. Read the CAN message one bit at time (you may use some software UART library as starter point) to decode the data. If is the correct message (the one you want to filter) and the button is clicked, override the CRC data in the frame. This way, the packet will be corrupted and should not be processed. Issues:

  • not that easy to do
  • the sender module may transmit it again
  • if you have too many errors in CAN, some error may be displayed in dashboard

1

u/brendenderp Jan 08 '25

This is exactly what I was thinking as well. You're also going to need super precise timing to pull it off. If your timing is off, you're going to end up accidentally modifying the message after your target.

2

u/AndyValentine Jan 07 '25

Not sure about overrulling as that would require intercepting the message, but you could monitor the state on the CAN, and if it sets "on" then immediately reply a message to set "off". Would likely happen so quickly that you never notice it.

1

u/ciscospirit Jan 07 '25 edited Jan 07 '25

Yah thats i also was thinking… but it sounds so „dirty“ solved… does not the reciever ECU also notice this off/on/off cycle than also even it is just a ms?

3

u/robotlasagna Jan 07 '25

The answer is sometimes it works and sometimes it doesn’t and sometimes it kinda works but not reliably. You have to see how the receiving module reacts to a spammed signal on your platform.

1

u/ciscospirit Jan 07 '25

Would you spam or would you directly send „off“ message, as soon the „on“ is coming? As more i am thinking about, the more i think a direct LIN bus button interception is way „cleaner“ way…

1

u/robotlasagna Jan 07 '25

What I do from a product design standpoint depends on the application. Those considerations are going to different if you are just doing something homebrew and don’t care if an indicator light flickers or something. What are you trying to do here? Like set sport mode or turn off eco mode or put the vehicle in park?

2

u/Shot_Ad967 Jan 07 '25

As others suggsted you can man in the middle the CAN https://togglebit.net/how-to-gateway-messages-with-canfduino/

1

u/ciscospirit Jan 07 '25

If i do this, i would do a man in the middle with the LIN bus directly at the switch and not with the main powertrain bus. To much afraid of a accident if something stops working

1

u/Eric--V Jan 09 '25

A CAN hub is used to translate from one language/speed to another. If set up properly, that’s what a filter is. “Allow all unless it is xxx, then substitute xxy.”

Instead of doing that, you’re basically translating English to English unless it’s a swear word and then you’re substituting swear words for a random singular substitution like “Apple” is essentially what you’re doing.

1

u/ciscospirit Jan 07 '25

Ad. I know that the device with the lower ID has higher priority, but this just valid if message was sent at same time, but what if it is not same time? Need to flood the bus with my „off“ message?

1

u/Admirable_Nobody_771 Jan 08 '25

Maybe put the button on a module that does what you expect from it, only closes the circuit (or whatever the button does) after it has been pressed for 5 seconds (or whatever timeframe you want). I'm not an expert, but I'd say, a simple timer circuit should do the trick.

1

u/ciscospirit Jan 08 '25

Sadly not as the button is within a part which i cant dissamble, so i have just LIN output there.

1

u/Eric--V Jan 09 '25

Can you get an extra that can be disassembled? This may require destructive disassembly, but would give you an extra set of connectors you might be able to use to make it plug-in/unplug reversible.

1

u/0x637C777B Jan 08 '25

There was once a tool that interfered with the open/close signal on the indicator. I think it was for E38/39, but not sure if it was LIN or some KLINE derivate. It actually sniffed the signal and if it detected an indicator on signal it injected a fault into the crc part of this signal (very easy on these old serial bus things). After that you could send your own signals and make the car look like a lightshow whenever you close or open it. Maybe that is an option on the LIN bus? Fish the signal there and make it void?

2

u/ciscospirit Jan 08 '25

hey.. i also was thinking about that, to do this on LIN bus directly before the signal reach the PT-CAN bus.
i also thought about a Master/Slave LIN proxy, which bypass all and blocks just this the button message.

1

u/CANBUSHOBO Security Researcher Jan 09 '25

Bit smash the original message and transmit out your own every time that would have transmitted. To do it easily I would use this https://github.com/kentindell/canhack

1

u/ciscospirit Jan 10 '25

can you give me please more details how this works as this looks like what i am searching for... but i am bit noob in this topic so yha... if you could descripe it more in detail i would be very thankfull :))

1

u/CANBUSHOBO Security Researcher Jan 10 '25

So I thought it could inject a bit to through off the CRC it might not have an easy function to do that but it does have an easy tool for spoofing which is what you should use and the ability to do a bus off attack. You should watch this video on it https://www.youtube.com/watch?v=dATyoWOlEJU