Notices
Audio & Electronics Use this forum to discuss audio and electronic upgrades for your Mercedes-Benz.

W211 CAN B Hacking

Thread Tools
 
Search this Thread
 
Rate Thread
 
Old 03-25-2016, 04:09 AM
  #26  
Newbie
 
JacekD's Avatar
 
Join Date: Feb 2016
Posts: 13
Likes: 0
Received 0 Likes on 0 Posts
W211
I have finally received USB CAN BUS module (previous one was not sent).





But I can't get it working.

I have W211 Audio 20 CD.

It has following Pinout based on info from Internet:



I have connected:

Module GND Radio Connector 1: PIN 15: Ubat-
Module CANH Radio Connector 2: PIN 1: CAN high
Module CANL Radio Connector 2: PIN 2: CAN low

With module I have received software for PC.
I have set up following settings:
CAN bps: 83333
Tried all modes: Normal, Loopback, Silent



Car was on ignition, radio was working, MFD was updated by radio.

But I have not seen any CAN messages in application.

120 Ohm resistor jumper is applied.

Any ideas?

Is there maybe a better software for CAN USB/COM? Linux? Raspberry PI?

Thanks for help in advance.

Jacek
Old 03-30-2016, 05:08 AM
  #27  
Junior Member
 
the88g's Avatar
 
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes on 0 Posts
CLK320 2009 (W209)
Hey mate,

Do you know if there is a command you need to send to the USB serial device to start logging, for example, I know on the CANBus Triple, it will not log any data until I send the command 03 01 02, I'm wondering if this CANBus interface has something similar.

Double check you need a 120 Ohm resistor, cause I didn't. There should be one already on both ends of the CAN network and you are simply tapping inbetween them.

Software wise, I'm using CoolTermWin.

Maybe try changing the extended frame setting. It is also possible that the CANBus interface doesn't support 83.3kbps, and so the manual setting you have provided is not supported by the hardware. Contact the vendor if you can.
Old 04-16-2016, 02:21 PM
  #28  
Newbie
 
repvik's Avatar
 
Join Date: Jan 2009
Posts: 7
Likes: 0
Received 0 Likes on 0 Posts
'86 W124 300E
I'm about to start digging into CAN B on my S211 too.

I want to hook up an Arduino to the CAN bus to capture steering wheel buttons, to control bluetooth audio on my phone (via AVRCP). Since I have no actual AUX in on my Audio 20, I've had to solder directly on to the CD audio path and use a silent CD.
It'd be awesome to replace the "Track x" in the MFD with actual artist and track info (also via AVRCP).

Is there a central repository of some kind that info on which units and commands are what?
Old 04-18-2016, 07:53 AM
  #29  
Junior Member
 
the88g's Avatar
 
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes on 0 Posts
CLK320 2009 (W209)
Not that I know of but that would be handy. Now that there is more sunlight left in the day, I'm looking to continue trying to dig into the CAN. Maybe we could start a wiki.
Old 04-18-2016, 11:44 AM
  #30  
Newbie
 
repvik's Avatar
 
Join Date: Jan 2009
Posts: 7
Likes: 0
Received 0 Likes on 0 Posts
'86 W124 300E
Originally Posted by the88g
Not that I know of but that would be handy. Now that there is more sunlight left in the day, I'm looking to continue trying to dig into the CAN. Maybe we could start a wiki.
I just stumbled over an existing one today: http://vehicle-reverse-engineering.w.../wiki/Mercedes
Old 04-19-2016, 06:01 AM
  #31  
Junior Member
 
the88g's Avatar
 
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes on 0 Posts
CLK320 2009 (W209)
Ah yes, I've seen this guys spreadsheet. You can see his work in getting the initial hack in place here;

http://www.honeysw.com/canproject.php

The PIDs are different from my car and probably going to be different from all other Mercedes, but it is nice to see the attempts of other can bus hackers.
Old 04-19-2016, 06:18 AM
  #32  
Newbie
 
repvik's Avatar
 
Join Date: Jan 2009
Posts: 7
Likes: 0
Received 0 Likes on 0 Posts
'86 W124 300E
Originally Posted by the88g
Ah yes, I've seen this guys spreadsheet. You can see his work in getting the initial hack in place here;

http://www.honeysw.com/canproject.php

The PIDs are different from my car and probably going to be different from all other Mercedes, but it is nice to see the attempts of other can bus hackers.
Oh... I read that page like 5-6 years ago

I'm hoping to get started on logging this week, if the weather gets a wee bit better.

I added a blank google sheet to the wikia page. I think you should be able to request access.
Old 04-19-2016, 06:20 AM
  #33  
Junior Member
 
the88g's Avatar
 
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes on 0 Posts
CLK320 2009 (W209)
Yeah it is ancient hahaa.

Sounds good. Look forward to hearing some of your progress. I've made none during these cold months.
Old 04-19-2016, 06:49 AM
  #34  
Newbie
 
repvik's Avatar
 
Join Date: Jan 2009
Posts: 7
Likes: 0
Received 0 Likes on 0 Posts
'86 W124 300E
Originally Posted by the88g
Yeah it is ancient hahaa.

Sounds good. Look forward to hearing some of your progress. I've made none during these cold months.
Cold? How many meters of snow have you seen this winter?
Old 04-25-2016, 03:14 AM
  #35  
Newbie
 
JacekD's Avatar
 
Join Date: Feb 2016
Posts: 13
Likes: 0
Received 0 Likes on 0 Posts
W211
Hi,

Unfortunately still no luck with getting communication to my W211.

With received device I have tried all options:
-with/without resistor (but I guess there should be not)
-83,3k
-normal/extended frames
-Bus monitor

I also tried using ELM327 OBD 2 by creating socket with CAN B signals.

Cable looks ok as using Voltage meter I see:
CAN LOW:
-inactive: ~11V
-active: ~4,65V

CAN HIGH:
-inactive: ~0,025V
-active: ~0,65 V.

which is according to specification

but here again using ATMA (to monitor all communication) nothing happens.

Do You know any working interface with bluetooth/usb or how to get it working?

J.
Old 04-28-2016, 05:46 AM
  #36  
Junior Member
 
the88g's Avatar
 
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes on 0 Posts
CLK320 2009 (W209)
It is possible 83.3k is simply not supported on that unit. I know that on the CANBus Triple device, it required a firmware update for 83.3 to work

Through the OBD port will be a different speed also, try a higher baud rate for the OBD port
Old 05-11-2016, 04:32 AM
  #37  
Junior Member
 
the88g's Avatar
 
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes on 0 Posts
CLK320 2009 (W209)
JacekD, are you in the UK per chance? There is a meet and greet this Saturday and was wondering if you were attending.
Old 05-11-2016, 06:00 AM
  #38  
MBWorld Fanatic!
 
jbondox's Avatar
 
Join Date: Apr 2007
Location: Cleveland Ohio
Posts: 2,430
Received 12 Likes on 12 Posts
beater with a heater
Originally Posted by repvik
I'm about to start digging into CAN B on my S211 too.

I want to hook up an Arduino to the CAN bus to capture steering wheel buttons, to control bluetooth audio on my phone (via AVRCP). Since I have no actual AUX in on my Audio 20, I've had to solder directly on to the CD audio path and use a silent CD.
It'd be awesome to replace the "Track x" in the MFD with actual artist and track info (also via AVRCP).

Is there a central repository of some kind that info on which units and commands are what?

https://navtv.com/products/NTV-KIT510/streamblue.html fig 2 in the diagram
Old 05-11-2016, 10:33 AM
  #39  
Newbie
 
JacekD's Avatar
 
Join Date: Feb 2016
Posts: 13
Likes: 0
Received 0 Likes on 0 Posts
W211
I am not in UK. A am from Warsaw in Poland.
Old 07-10-2016, 02:44 PM
  #40  
Newbie
 
MilanP's Avatar
 
Join Date: Jul 2016
Posts: 1
Likes: 0
Received 0 Likes on 0 Posts
W211
Jacek, wouldn't it be easier to use an OBD adapter, instead of connecting directly to CAN-B wiring? CAN L and H are both present on the OBD connector - I guess what we need is the right software driver which can supports sending messages on the bus... The "Carly for Mercedes" Android app can write to MFD, so it must be possible. But for that feature, one must use their "Generation 2" OBD adapter. I guess not all OBDs support those CAN lines directly... Demo:

Last edited by MilanP; 07-10-2016 at 02:53 PM.
Old 07-13-2016, 08:43 AM
  #41  
Junior Member
 
the88g's Avatar
 
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes on 0 Posts
CLK320 2009 (W209)
That looks interesting. I havent had any luck with an OBDLink MX yet though, just hangs on verifying connection. Does anyone know what changed in terms of OBD communication between a 2003 CL and a 2005 CL?
Old 07-21-2016, 05:58 PM
  #42  
Newbie
 
halfspec's Avatar
 
Join Date: Dec 2013
Posts: 11
Likes: 0
Received 0 Likes on 0 Posts
1993 Mazda LS1 RX7, 04 BMW 525i
Has anyone been able to successfully receive packets from both the CAN B and CAN C networks with the CANbus Triple? It appears that kidturbo was having trouble with CAN B, but his participation in the thread faded away. It seems like the88g hasn't had any issues. I don't know if that's just the way I'm reading it or if he's had real success.

If you're reading CAN B without problems, what exactly did you have to do with the CBT firmware to hit the 83.3kbps baudrate?

Lane
Old 07-29-2016, 11:50 AM
  #43  
Junior Member
 
the88g's Avatar
 
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes on 0 Posts
CLK320 2009 (W209)
I was gutted that Carly software doesn't seem to work with my car. It seems you'll have better luck if your car is 2005 or newer. Infact even if you have a W215 or W220 model that is 2005 or newer, even though the software says it is supported, it doesn't and I only found that out from the customer support, they asked me to try W211 instead and it connected but no ECUs responded.

I downloaded the latest firmware from the CBT forums and 83.3kbps worked flawlessly from the beginning, but only when set manually (auto-detect doesn't work) and the 11-bit version. The 29-bit version set off a bunch of errors on my dash! Don't try it with 83.3kbps, it doesn't have the correct MCP2515 values.

Last edited by the88g; 07-29-2016 at 11:53 AM.
Old 12-14-2016, 02:15 PM
  #44  
Banned
 
Mackhack's Avatar
 
Join Date: Feb 2008
Posts: 0
Received 115 Likes on 98 Posts
Is this still active? A few years ago I sniffed pretty much the entire interior of one of my W211's CAN B. I'm still trying to find out message IDs and device ID of my power trunk closer.
Old 01-03-2017, 04:48 AM
  #45  
Junior Member
 
the88g's Avatar
 
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes on 0 Posts
CLK320 2009 (W209)
I've unfortunately put my entire project on hold until I get a 05 or newer plate MB. Are you using any particular software to help narrow down message IDs? Something that will ignore the constantly changing values and provide you with the message IDs that change when you press buttons in the interior. The software that comes with the CANBus Triple ain't too bad for this.
Old 01-03-2017, 09:08 AM
  #46  
Banned
 
Mackhack's Avatar
 
Join Date: Feb 2008
Posts: 0
Received 115 Likes on 98 Posts
Originally Posted by the88g
I've unfortunately put my entire project on hold until I get a 05 or newer plate MB. Are you using any particular software to help narrow down message IDs? Something that will ignore the constantly changing values and provide you with the message IDs that change when you press buttons in the interior. The software that comes with the CANBus Triple ain't too bad for this.
I use filters and lots of eye power to see changes.
Old 01-28-2017, 03:09 PM
  #47  
Junior Member
 
angelovAlex's Avatar
 
Join Date: Jan 2017
Posts: 17
Likes: 0
Received 12 Likes on 5 Posts
2005 E320
Hi guys.
I received mcp2515 module today and I thought it would be easy to sniff packages from my car. I connected it to an arduino, tried different libraries, but no luck. I started looking deeply into libraries code and mcp2515 datasheet and found that it should be configured by setting 3 config registers depending on band rate and crystal on module. I played with this values and it did effect on results, but everything that I got was just garbage or noise.
When I back to home, I started to search about it and found this calculator
https://www.kvaser.com/support/calcu...ng-calculator/
Not sure what T1, T2, BTQ, SP% and SJW values should be set to.
But as I understand the best setup is cnf1 = 02, cnf2 = 9a, cnf3 = 07
I will try it tomorrow and will let you know.

The main question is "Was somebody able to read packages from W211 or similar cars with mcp2515 chinise module? And if yes, what was config values?"

Thanks.
Old 01-28-2017, 03:25 PM
  #48  
Banned
 
Mackhack's Avatar
 
Join Date: Feb 2008
Posts: 0
Received 115 Likes on 98 Posts
Which garbage CAN Bus shield did you get? Where did you connect the shield with the car? What cable did you use?

Chinese CAN Bus shields like the one from Seeed Studio (black) and SKPang (red) use a modified pin out so they can sell you their own (configured) OBD cable. A standard OBD cable that follows the OBD standard won't work and you get garbage readings.

Either you build an adapter to map the pins, you design our own shield like I did, or you buy a real can Bus sniffer which I frequently use on my W211s.
Old 01-29-2017, 08:46 AM
  #49  
Junior Member
 
angelovAlex's Avatar
 
Join Date: Jan 2017
Posts: 17
Likes: 0
Received 12 Likes on 5 Posts
2005 E320
I used module like this https://sc01.alicdn.com/kf/HTB1hqvLF...Xq6xXFXXXL.jpg
I connected it to wires that go to telephone(I believe) in armrest. There're about 7 wires in connector, two of them are brown and brown-red. I measured voltage on them and it's 3.2v and 1.8v, so I believe it's can bus.
Before it I tried to connect to obd socket to pin 6,14 and 5 as ground according to this image
https://i.stack.imgur.com/b3kaj.png

I checked pictures of this Seeed Studio module, it seems to have the same mcp2515 chip. So if you have, can you send me a working arduino project for this shield, the does work with our cars?

Last edited by angelovAlex; 01-29-2017 at 08:51 AM.
Old 01-29-2017, 11:19 AM
  #50  
Banned
 
Mackhack's Avatar
 
Join Date: Feb 2008
Posts: 0
Received 115 Likes on 98 Posts
Cars have multiple different CAN buses. Interior CAN bus B, Motor CAN Bus C, and others. You can't assume to connect your little dingy on the Interieur CAN bus and get Motor CAN info. It's. It that simple.

Hint: interior CAN bus is brown and red brown, motor CAN is white and green'ish.

Last edited by Mackhack; 01-29-2017 at 11:28 AM.


You have already rated this thread Rating: Thread Rating: 0 votes,  average.

Quick Reply: W211 CAN B Hacking



All times are GMT -4. The time now is 07:32 AM.