W211 CAN B Hacking
#26
I have finally received USB CAN BUS module (previous one was not sent).
But I can't get it working.
I have W211 Audio 20 CD.
It has following Pinout based on info from Internet:
I have connected:
Module GND Radio Connector 1: PIN 15: Ubat-
Module CANH Radio Connector 2: PIN 1: CAN high
Module CANL Radio Connector 2: PIN 2: CAN low
With module I have received software for PC.
I have set up following settings:
CAN bps: 83333
Tried all modes: Normal, Loopback, Silent
Car was on ignition, radio was working, MFD was updated by radio.
But I have not seen any CAN messages in application.
120 Ohm resistor jumper is applied.
Any ideas?
Is there maybe a better software for CAN USB/COM? Linux? Raspberry PI?
Thanks for help in advance.
Jacek
But I can't get it working.
I have W211 Audio 20 CD.
It has following Pinout based on info from Internet:
I have connected:
Module GND Radio Connector 1: PIN 15: Ubat-
Module CANH Radio Connector 2: PIN 1: CAN high
Module CANL Radio Connector 2: PIN 2: CAN low
With module I have received software for PC.
I have set up following settings:
CAN bps: 83333
Tried all modes: Normal, Loopback, Silent
Car was on ignition, radio was working, MFD was updated by radio.
But I have not seen any CAN messages in application.
120 Ohm resistor jumper is applied.
Any ideas?
Is there maybe a better software for CAN USB/COM? Linux? Raspberry PI?
Thanks for help in advance.
Jacek
#27
Junior Member
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes
on
0 Posts
CLK320 2009 (W209)
Hey mate,
Do you know if there is a command you need to send to the USB serial device to start logging, for example, I know on the CANBus Triple, it will not log any data until I send the command 03 01 02, I'm wondering if this CANBus interface has something similar.
Double check you need a 120 Ohm resistor, cause I didn't. There should be one already on both ends of the CAN network and you are simply tapping inbetween them.
Software wise, I'm using CoolTermWin.
Maybe try changing the extended frame setting. It is also possible that the CANBus interface doesn't support 83.3kbps, and so the manual setting you have provided is not supported by the hardware. Contact the vendor if you can.
Do you know if there is a command you need to send to the USB serial device to start logging, for example, I know on the CANBus Triple, it will not log any data until I send the command 03 01 02, I'm wondering if this CANBus interface has something similar.
Double check you need a 120 Ohm resistor, cause I didn't. There should be one already on both ends of the CAN network and you are simply tapping inbetween them.
Software wise, I'm using CoolTermWin.
Maybe try changing the extended frame setting. It is also possible that the CANBus interface doesn't support 83.3kbps, and so the manual setting you have provided is not supported by the hardware. Contact the vendor if you can.
#28
I'm about to start digging into CAN B on my S211 too.
I want to hook up an Arduino to the CAN bus to capture steering wheel buttons, to control bluetooth audio on my phone (via AVRCP). Since I have no actual AUX in on my Audio 20, I've had to solder directly on to the CD audio path and use a silent CD.
It'd be awesome to replace the "Track x" in the MFD with actual artist and track info (also via AVRCP).
Is there a central repository of some kind that info on which units and commands are what?
I want to hook up an Arduino to the CAN bus to capture steering wheel buttons, to control bluetooth audio on my phone (via AVRCP). Since I have no actual AUX in on my Audio 20, I've had to solder directly on to the CD audio path and use a silent CD.
It'd be awesome to replace the "Track x" in the MFD with actual artist and track info (also via AVRCP).
Is there a central repository of some kind that info on which units and commands are what?
#29
Junior Member
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes
on
0 Posts
CLK320 2009 (W209)
Not that I know of but that would be handy. Now that there is more sunlight left in the day, I'm looking to continue trying to dig into the CAN. Maybe we could start a wiki.
#30
#31
Junior Member
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes
on
0 Posts
CLK320 2009 (W209)
Ah yes, I've seen this guys spreadsheet. You can see his work in getting the initial hack in place here;
http://www.honeysw.com/canproject.php
The PIDs are different from my car and probably going to be different from all other Mercedes, but it is nice to see the attempts of other can bus hackers.
http://www.honeysw.com/canproject.php
The PIDs are different from my car and probably going to be different from all other Mercedes, but it is nice to see the attempts of other can bus hackers.
#32
Ah yes, I've seen this guys spreadsheet. You can see his work in getting the initial hack in place here;
http://www.honeysw.com/canproject.php
The PIDs are different from my car and probably going to be different from all other Mercedes, but it is nice to see the attempts of other can bus hackers.
http://www.honeysw.com/canproject.php
The PIDs are different from my car and probably going to be different from all other Mercedes, but it is nice to see the attempts of other can bus hackers.
I'm hoping to get started on logging this week, if the weather gets a wee bit better.
I added a blank google sheet to the wikia page. I think you should be able to request access.
#34
#35
Hi,
Unfortunately still no luck with getting communication to my W211.
With received device I have tried all options:
-with/without resistor (but I guess there should be not)
-83,3k
-normal/extended frames
-Bus monitor
I also tried using ELM327 OBD 2 by creating socket with CAN B signals.
Cable looks ok as using Voltage meter I see:
CAN LOW:
-inactive: ~11V
-active: ~4,65V
CAN HIGH:
-inactive: ~0,025V
-active: ~0,65 V.
which is according to specification
but here again using ATMA (to monitor all communication) nothing happens.
Do You know any working interface with bluetooth/usb or how to get it working?
J.
Unfortunately still no luck with getting communication to my W211.
With received device I have tried all options:
-with/without resistor (but I guess there should be not)
-83,3k
-normal/extended frames
-Bus monitor
I also tried using ELM327 OBD 2 by creating socket with CAN B signals.
Cable looks ok as using Voltage meter I see:
CAN LOW:
-inactive: ~11V
-active: ~4,65V
CAN HIGH:
-inactive: ~0,025V
-active: ~0,65 V.
which is according to specification
but here again using ATMA (to monitor all communication) nothing happens.
Do You know any working interface with bluetooth/usb or how to get it working?
J.
#36
Junior Member
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes
on
0 Posts
CLK320 2009 (W209)
It is possible 83.3k is simply not supported on that unit. I know that on the CANBus Triple device, it required a firmware update for 83.3 to work
Through the OBD port will be a different speed also, try a higher baud rate for the OBD port
Through the OBD port will be a different speed also, try a higher baud rate for the OBD port
#38
MBWorld Fanatic!
I'm about to start digging into CAN B on my S211 too.
I want to hook up an Arduino to the CAN bus to capture steering wheel buttons, to control bluetooth audio on my phone (via AVRCP). Since I have no actual AUX in on my Audio 20, I've had to solder directly on to the CD audio path and use a silent CD.
It'd be awesome to replace the "Track x" in the MFD with actual artist and track info (also via AVRCP).
Is there a central repository of some kind that info on which units and commands are what?
I want to hook up an Arduino to the CAN bus to capture steering wheel buttons, to control bluetooth audio on my phone (via AVRCP). Since I have no actual AUX in on my Audio 20, I've had to solder directly on to the CD audio path and use a silent CD.
It'd be awesome to replace the "Track x" in the MFD with actual artist and track info (also via AVRCP).
Is there a central repository of some kind that info on which units and commands are what?
https://navtv.com/products/NTV-KIT510/streamblue.html fig 2 in the diagram
#40
Jacek, wouldn't it be easier to use an OBD adapter, instead of connecting directly to CAN-B wiring? CAN L and H are both present on the OBD connector - I guess what we need is the right software driver which can supports sending messages on the bus... The "Carly for Mercedes" Android app can write to MFD, so it must be possible. But for that feature, one must use their "Generation 2" OBD adapter. I guess not all OBDs support those CAN lines directly... Demo:
Last edited by MilanP; 07-10-2016 at 02:53 PM.
#41
Junior Member
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes
on
0 Posts
CLK320 2009 (W209)
That looks interesting. I havent had any luck with an OBDLink MX yet though, just hangs on verifying connection. Does anyone know what changed in terms of OBD communication between a 2003 CL and a 2005 CL?
#42
Newbie
Join Date: Dec 2013
Posts: 11
Likes: 0
Received 0 Likes
on
0 Posts
1993 Mazda LS1 RX7, 04 BMW 525i
Has anyone been able to successfully receive packets from both the CAN B and CAN C networks with the CANbus Triple? It appears that kidturbo was having trouble with CAN B, but his participation in the thread faded away. It seems like the88g hasn't had any issues. I don't know if that's just the way I'm reading it or if he's had real success.
If you're reading CAN B without problems, what exactly did you have to do with the CBT firmware to hit the 83.3kbps baudrate?
Lane
If you're reading CAN B without problems, what exactly did you have to do with the CBT firmware to hit the 83.3kbps baudrate?
Lane
#43
Junior Member
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes
on
0 Posts
CLK320 2009 (W209)
I was gutted that Carly software doesn't seem to work with my car. It seems you'll have better luck if your car is 2005 or newer. Infact even if you have a W215 or W220 model that is 2005 or newer, even though the software says it is supported, it doesn't and I only found that out from the customer support, they asked me to try W211 instead and it connected but no ECUs responded.
I downloaded the latest firmware from the CBT forums and 83.3kbps worked flawlessly from the beginning, but only when set manually (auto-detect doesn't work) and the 11-bit version. The 29-bit version set off a bunch of errors on my dash! Don't try it with 83.3kbps, it doesn't have the correct MCP2515 values.
I downloaded the latest firmware from the CBT forums and 83.3kbps worked flawlessly from the beginning, but only when set manually (auto-detect doesn't work) and the 11-bit version. The 29-bit version set off a bunch of errors on my dash! Don't try it with 83.3kbps, it doesn't have the correct MCP2515 values.
Last edited by the88g; 07-29-2016 at 11:53 AM.
#44
Is this still active? A few years ago I sniffed pretty much the entire interior of one of my W211's CAN B. I'm still trying to find out message IDs and device ID of my power trunk closer.
#45
Junior Member
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes
on
0 Posts
CLK320 2009 (W209)
I've unfortunately put my entire project on hold until I get a 05 or newer plate MB. Are you using any particular software to help narrow down message IDs? Something that will ignore the constantly changing values and provide you with the message IDs that change when you press buttons in the interior. The software that comes with the CANBus Triple ain't too bad for this.
#46
I've unfortunately put my entire project on hold until I get a 05 or newer plate MB. Are you using any particular software to help narrow down message IDs? Something that will ignore the constantly changing values and provide you with the message IDs that change when you press buttons in the interior. The software that comes with the CANBus Triple ain't too bad for this.
#47
Hi guys.
I received mcp2515 module today and I thought it would be easy to sniff packages from my car. I connected it to an arduino, tried different libraries, but no luck. I started looking deeply into libraries code and mcp2515 datasheet and found that it should be configured by setting 3 config registers depending on band rate and crystal on module. I played with this values and it did effect on results, but everything that I got was just garbage or noise.
When I back to home, I started to search about it and found this calculator
https://www.kvaser.com/support/calcu...ng-calculator/
Not sure what T1, T2, BTQ, SP% and SJW values should be set to.
But as I understand the best setup is cnf1 = 02, cnf2 = 9a, cnf3 = 07
I will try it tomorrow and will let you know.
The main question is "Was somebody able to read packages from W211 or similar cars with mcp2515 chinise module? And if yes, what was config values?"
Thanks.
I received mcp2515 module today and I thought it would be easy to sniff packages from my car. I connected it to an arduino, tried different libraries, but no luck. I started looking deeply into libraries code and mcp2515 datasheet and found that it should be configured by setting 3 config registers depending on band rate and crystal on module. I played with this values and it did effect on results, but everything that I got was just garbage or noise.
When I back to home, I started to search about it and found this calculator
https://www.kvaser.com/support/calcu...ng-calculator/
Not sure what T1, T2, BTQ, SP% and SJW values should be set to.
But as I understand the best setup is cnf1 = 02, cnf2 = 9a, cnf3 = 07
I will try it tomorrow and will let you know.
The main question is "Was somebody able to read packages from W211 or similar cars with mcp2515 chinise module? And if yes, what was config values?"
Thanks.
#48
Which garbage CAN Bus shield did you get? Where did you connect the shield with the car? What cable did you use?
Chinese CAN Bus shields like the one from Seeed Studio (black) and SKPang (red) use a modified pin out so they can sell you their own (configured) OBD cable. A standard OBD cable that follows the OBD standard won't work and you get garbage readings.
Either you build an adapter to map the pins, you design our own shield like I did, or you buy a real can Bus sniffer which I frequently use on my W211s.
Chinese CAN Bus shields like the one from Seeed Studio (black) and SKPang (red) use a modified pin out so they can sell you their own (configured) OBD cable. A standard OBD cable that follows the OBD standard won't work and you get garbage readings.
Either you build an adapter to map the pins, you design our own shield like I did, or you buy a real can Bus sniffer which I frequently use on my W211s.
#49
I used module like this https://sc01.alicdn.com/kf/HTB1hqvLF...Xq6xXFXXXL.jpg
I connected it to wires that go to telephone(I believe) in armrest. There're about 7 wires in connector, two of them are brown and brown-red. I measured voltage on them and it's 3.2v and 1.8v, so I believe it's can bus.
Before it I tried to connect to obd socket to pin 6,14 and 5 as ground according to this image
https://i.stack.imgur.com/b3kaj.png
I checked pictures of this Seeed Studio module, it seems to have the same mcp2515 chip. So if you have, can you send me a working arduino project for this shield, the does work with our cars?
I connected it to wires that go to telephone(I believe) in armrest. There're about 7 wires in connector, two of them are brown and brown-red. I measured voltage on them and it's 3.2v and 1.8v, so I believe it's can bus.
Before it I tried to connect to obd socket to pin 6,14 and 5 as ground according to this image
https://i.stack.imgur.com/b3kaj.png
I checked pictures of this Seeed Studio module, it seems to have the same mcp2515 chip. So if you have, can you send me a working arduino project for this shield, the does work with our cars?
Last edited by angelovAlex; 01-29-2017 at 08:51 AM.
#50
Cars have multiple different CAN buses. Interior CAN bus B, Motor CAN Bus C, and others. You can't assume to connect your little dingy on the Interieur CAN bus and get Motor CAN info. It's. It that simple.
Hint: interior CAN bus is brown and red brown, motor CAN is white and green'ish.
Hint: interior CAN bus is brown and red brown, motor CAN is white and green'ish.
Last edited by Mackhack; 01-29-2017 at 11:28 AM.