W211 CAN B Hacking
11-17-2017, 10:13 AM
#126
Newbie
Join Date: Nov 2017
Posts: 5
Likes: 0
Received 0 Likes
on
0 Posts
cls350
Can anybody tell me the right can codes for w211 ignition-on ?
I have tested ID = 0x000 with 1 byte 0xFF.
This is not right for ignition on ??
Anybody can help ?
Many thanks in advance
I have tested ID = 0x000 with 1 byte 0xFF.
This is not right for ignition on ??
Anybody can help ?
Many thanks in advance
12-14-2017, 01:19 AM
#128
Super Member
Going to revive this real quick.
I'm trying to emulate steering wheel buttons and having no luck. A I've already mentioned, I'm using the Parktronic/Airmatic button canbus wires to tap in as mentioned above in this thread.
Looking at the document Alex sourced and I translated (source: https://github.com/angelovAlex/can-b...er/EN_PIDS.txt), I see two areas documenting steering wheel buttons.
On line 536:
And on line 503:
So I try sending the various button commands on both listed PIDs: the 01ca and 032a to no avail.
Tried these:
I replaced my steering wheel and in the process glitched out the SCM (steering control module) to a permanent LIN bus communication error (DTC 9001) so I can no longer *sniff* the actual packets to make this work, help!
I'm trying to emulate steering wheel buttons and having no luck. A I've already mentioned, I'm using the Parktronic/Airmatic button canbus wires to tap in as mentioned above in this thread.
Looking at the document Alex sourced and I translated (source: https://github.com/angelovAlex/can-b...er/EN_PIDS.txt), I see two areas documenting steering wheel buttons.
On line 536:
--- KOMBI_A8 ID:0x032a
------ KI_STAT_MSS() Status Combi, offset:0, len:8
--- --- BUTTON_1_1_MSS() Next screen, offset:15, len:1
--- --- BUTTON_1_2_MSS() Previous display, offset:14, len:1
--- --- BUTTON_2_1_MSS() reserve, offset:13, len:1
--- --- BUTTON_2_2_MSS() reserve, offset:12, len:1
--- --- BUTTON_3_1_MSS() Button "", offset:11, len:1
--- --- BUTTON_3_2_MSS() Button "-", offset:10, len:1
--- --- BUTTON_4_1_MSS() Phone Send, offset:9, len:1
--- --- BUTTON_4_2_MSS() Phone End, offset:8, len:1
------ KI_STAT_MSS() Status Combi, offset:0, len:8
--- --- BUTTON_1_1_MSS() Next screen, offset:15, len:1
--- --- BUTTON_1_2_MSS() Previous display, offset:14, len:1
--- --- BUTTON_2_1_MSS() reserve, offset:13, len:1
--- --- BUTTON_2_2_MSS() reserve, offset:12, len:1
--- --- BUTTON_3_1_MSS() Button "", offset:11, len:1
--- --- BUTTON_3_2_MSS() Button "-", offset:10, len:1
--- --- BUTTON_4_1_MSS() Phone Send, offset:9, len:1
--- --- BUTTON_4_2_MSS() Phone End, offset:8, len:1
--- KOMBI_A5 ID:0x01ca
--- --- KI_STAT() Status Combi, offset:0, len:8
--- --- BUTTON_1_1() Next screen, offset:15, len:1
--- --- BUTTON_1_2() Previous display, offset:14, len:1
--- --- BUTTON_2_1() reserve, offset:13, len:1
--- --- BUTTON_2_2() reserve, offset:12, len:1
--- --- BUTTON_3_1() Button "", offset:11, len:1
--- --- BUTTON_3_2() Button "-", offset:10, len:1
--- --- BUTTON_4_1() Phone Send, offset:9, len:1
--- --- BUTTON_4_2() Phone End, offset:8, len:1
--- --- KI_STAT() Status Combi, offset:0, len:8
--- --- BUTTON_1_1() Next screen, offset:15, len:1
--- --- BUTTON_1_2() Previous display, offset:14, len:1
--- --- BUTTON_2_1() reserve, offset:13, len:1
--- --- BUTTON_2_2() reserve, offset:12, len:1
--- --- BUTTON_3_1() Button "", offset:11, len:1
--- --- BUTTON_3_2() Button "-", offset:10, len:1
--- --- BUTTON_4_1() Phone Send, offset:9, len:1
--- --- BUTTON_4_2() Phone End, offset:8, len:1
Tried these:
00 01 00 00
-
00 02 00 00
-
00 04 00 00
-
00 02 00 00
-
00 04 00 00
12-14-2017, 07:26 PM
#129
Member
Going to revive this real quick.
I'm trying to emulate steering wheel buttons and having no luck. A I've already mentioned, I'm using the Parktronic/Airmatic button canbus wires to tap in as mentioned above in this thread.
Looking at the document Alex sourced and I translated (source: https://github.com/angelovAlex/can-b...er/EN_PIDS.txt), I see two areas documenting steering wheel buttons.
On line 536:
And on line 503:
So I try sending the various button commands on both listed PIDs: the 01ca and 032a to no avail.
Tried these:
I replaced my steering wheel and in the process glitched out the SCM (steering control module) to a permanent LIN bus communication error (DTC 9001) so I can no longer *sniff* the actual packets to make this work, help!
I'm trying to emulate steering wheel buttons and having no luck. A I've already mentioned, I'm using the Parktronic/Airmatic button canbus wires to tap in as mentioned above in this thread.
Looking at the document Alex sourced and I translated (source: https://github.com/angelovAlex/can-b...er/EN_PIDS.txt), I see two areas documenting steering wheel buttons.
On line 536:
And on line 503:
So I try sending the various button commands on both listed PIDs: the 01ca and 032a to no avail.
Tried these:
I replaced my steering wheel and in the process glitched out the SCM (steering control module) to a permanent LIN bus communication error (DTC 9001) so I can no longer *sniff* the actual packets to make this work, help!
Are you on can-c or can-b?
12-14-2017, 07:33 PM
#131
Super Member
12-23-2017, 03:13 AM
#132
MBWorld Fanatic!
I really wish someone could develop a module that would take from a factory sensor or aftermarket sensor and display a digital bar graph or numeric boost gauge in the cluster. That would be awesome for those of us with S600s, E55s, and all the other vehicles out with forced induction. I proposed this idea to Mid City years ago, and they seemed interested, but nothing ever came of it.
12-26-2017, 09:10 PM
#133
I really wish someone could develop a module that would take from a factory sensor or aftermarket sensor and display a digital bar graph or numeric boost gauge in the cluster. That would be awesome for those of us with S600s, E55s, and all the other vehicles out with forced induction. I proposed this idea to Mid City years ago, and they seemed interested, but nothing ever came of it.
12-27-2017, 06:20 PM
#134
Super Member
I really wish someone could develop a module that would take from a factory sensor or aftermarket sensor and display a digital bar graph or numeric boost gauge in the cluster. That would be awesome for those of us with S600s, E55s, and all the other vehicles out with forced induction. I proposed this idea to Mid City years ago, and they seemed interested, but nothing ever came of it.
12-30-2017, 11:50 AM
#135
Going to revive this real quick.
I'm trying to emulate steering wheel buttons and having no luck. A I've already mentioned, I'm using the Parktronic/Airmatic button canbus wires to tap in as mentioned above in this thread.
Looking at the document Alex sourced and I translated (source: https://github.com/angelovAlex/can-b...er/EN_PIDS.txt), I see two areas documenting steering wheel buttons.
I'm trying to emulate steering wheel buttons and having no luck. A I've already mentioned, I'm using the Parktronic/Airmatic button canbus wires to tap in as mentioned above in this thread.
Looking at the document Alex sourced and I translated (source: https://github.com/angelovAlex/can-b...er/EN_PIDS.txt), I see two areas documenting steering wheel buttons.
I checked the code and it seems that I use another PID and it has only 2 bytes. I dont remember where I got that information, I believe I just sniffed it long time ago.
In source code on github there are 4 functions, ic_env_w, ic_env_a, ic_env_s and ic_env_d. (W,A,S,D buttons
) They are implementing pressing on buttons that are at left on steering wheel.canB.sendMsg(424, 2, 0x04, 0x00); //will press one of them
Added: note that 424 is a decimal.
Last edited by angelovAlex; 12-30-2017 at 11:55 AM.
12-30-2017, 07:53 PM
#136
Super Member
Ping me in skype next time you need help. I have simulated pressing steering wheel buttons for long time, and never had issues with that. It just as simple as controlling windows.
I checked the code and it seems that I use another PID and it has only 2 bytes. I dont remember where I got that information, I believe I just sniffed it long time ago.
In source code on github there are 4 functions, ic_env_w, ic_env_a, ic_env_s and ic_env_d. (W,A,S,D buttons ) They are implementing pressing on buttons that are at left on steering wheel.
canB.sendMsg(424, 2, 0x04, 0x00); //will press one of them
Added: note that 424 is a decimal.
I checked the code and it seems that I use another PID and it has only 2 bytes. I dont remember where I got that information, I believe I just sniffed it long time ago.
In source code on github there are 4 functions, ic_env_w, ic_env_a, ic_env_s and ic_env_d. (W,A,S,D buttons
) They are implementing pressing on buttons that are at left on steering wheel.canB.sendMsg(424, 2, 0x04, 0x00); //will press one of them
Added: note that 424 is a decimal.
12-31-2017, 01:13 PM
#137
Newbie
Join Date: Dec 2017
Posts: 11
Likes: 0
Received 0 Likes
on
0 Posts
mercdes 350CLS
About 12 years ago, I built a canbus interface for my E320. I used it to intercept the steering wheel buttons to control an after market Bluetooth phone adaptor. I'll have to see if I can find any notes on how I interfaced it, but I do recall CANB is fault tolerant so needs the right interface chip to correctly interpret the voltage levels. I have found the source code for the PIC16F84 code I was using and I was filtering on 01 A8 messages, so these were the ones I established were for the steering wheel controls.
ou trouver les fils du CANBUS des commandes au volant .
pour pouvoir les brancher sur mon SEICANE qui ne fonctionne pas car les connecteur ne sont pas les meme que la mercedes
12-31-2017, 02:47 PM
#139
Newbie
Join Date: Dec 2017
Posts: 11
Likes: 0
Received 0 Likes
on
0 Posts
mercdes 350CLS
CAN BUS Commande volant
[QUOTE = JacekD; 6707982] Salut!
Pouvez-vous partager ce que vous avez réussi à réaliser?
J'essaie de faire semblable. J'ai tablette Android avec OTG, où je vais avoir la navigation. Je veux afficher les informations suivantes sur le
MF2 W211: -Informations sur la navigation -La
limite de vitesse actuelle (et peut-être avertir si elle est dépassée)
-traffic informations / avertissements (accidents et autres).
En outre, je veux commander la table avec des boutons de volant.
J'attends juste l'arrivée de l'interface CAN BUS que je connecte à l'hôte USB dans la tablette.
Je vais obtenir des fils CAN (GND, CAN H, CAN L) à l'arrière de Audio 20.
Je suis prêt à partager avec mes résultats, mais je voudrais commencer en fonction des connaissances actuelles.
.
bonjour
Avez-vous pu identifier, les fils du CANBUS des commandes au volant ?
Il me faut les brancher sur mon SEICANE .
Il ne fonctionne pas car les connecteurs ne sont pas les meme que sur ma mercedes 350 cls W219 ?
Merci
Jean
Pouvez-vous partager ce que vous avez réussi à réaliser?
J'essaie de faire semblable. J'ai tablette Android avec OTG, où je vais avoir la navigation. Je veux afficher les informations suivantes sur le
MF2 W211: -Informations sur la navigation -La
limite de vitesse actuelle (et peut-être avertir si elle est dépassée)
-traffic informations / avertissements (accidents et autres).
En outre, je veux commander la table avec des boutons de volant.
J'attends juste l'arrivée de l'interface CAN BUS que je connecte à l'hôte USB dans la tablette.
Je vais obtenir des fils CAN (GND, CAN H, CAN L) à l'arrière de Audio 20.
Je suis prêt à partager avec mes résultats, mais je voudrais commencer en fonction des connaissances actuelles.
.
bonjour
Avez-vous pu identifier, les fils du CANBUS des commandes au volant ?
Il me faut les brancher sur mon SEICANE .
Il ne fonctionne pas car les connecteurs ne sont pas les meme que sur ma mercedes 350 cls W219 ?
Merci
Jean
01-10-2018, 02:27 PM
#140
Junior Member
Join Date: Sep 2010
Location: Johannesburg, South Africa
Posts: 48
Likes: 0
Received 2 Likes
on
2 Posts
Various Fiat
Forgot about that thread, actually thought it's dead already. Glad to see that there's still some interest.
The short answer is no. But if you really want it, it can be done somehow. Instrumental cluster is very limited, it's designed to do what it does. It doesn't support creating of additional menu, but you can change existing menu, like service menu, but for this you need to inject you device between instumental cluster and CGW. Another option is to draw it on phone, or navi, or music menu. Unfortunately, that menus are also limited and you can draw only 2 big text lines in the center and 1 small text line at the top. The third option is to draw whatever you want with diagnostic messages, you can draw text, lines, squares and even single pixels, but for each command it takes about a second to update, so if you want to draw a menu with 5 text lines it will take 5 seconds
Sorry, but there's no PIDS for this door. The button on that door is connected directly to the controller that opens and closes that door. It can't be controlled over the CAN Bus.
The short answer is no. But if you really want it, it can be done somehow. Instrumental cluster is very limited, it's designed to do what it does. It doesn't support creating of additional menu, but you can change existing menu, like service menu, but for this you need to inject you device between instumental cluster and CGW. Another option is to draw it on phone, or navi, or music menu. Unfortunately, that menus are also limited and you can draw only 2 big text lines in the center and 1 small text line at the top. The third option is to draw whatever you want with diagnostic messages, you can draw text, lines, squares and even single pixels, but for each command it takes about a second to update, so if you want to draw a menu with 5 text lines it will take 5 seconds
Sorry, but there's no PIDS for this door. The button on that door is connected directly to the controller that opens and closes that door. It can't be controlled over the CAN Bus.
01-12-2018, 03:14 PM
#144
Junior Member
Join Date: Sep 2010
Location: Johannesburg, South Africa
Posts: 48
Likes: 0
Received 2 Likes
on
2 Posts
Various Fiat
The W211 ECU is in the CAN C system that runs @ 500kps. The interior CAN B system works @ 83.3kps. The PCB on the door of the CD changer has a TJA1054 CAN transceiver IC which can run up to a maximum baud rate of 125kps.
The W211 schematic diagram of the upper control panel where the CD opening/closing door is situated clearly shows it's connection to the CAN B system.
Your reply please.
The W211 schematic diagram of the upper control panel where the CD opening/closing door is situated clearly shows it's connection to the CAN B system.
Your reply please.
01-13-2018, 01:20 AM
#146
01-13-2018, 08:23 AM
#147
Junior Member
Join Date: Sep 2010
Location: Johannesburg, South Africa
Posts: 48
Likes: 0
Received 2 Likes
on
2 Posts
Various Fiat
A pop up toaster, washing machine or any other electrical household appliance can also be called an ECU as they all control something.
FYI an ECU in the automotive industry is another name for the ECM which controls engine management functions. Our friend Google will send your request to Wikipedia for you to better understand.
Seeing that this is a Mercedes Benz car forum and the thread is discussing CAN BUS hacking I think your reply to the question I asked should have been something like this.
" The controller Angelo is referring to could be the rear SAM where all the interior CAN BUS signals are generated, but having said that I could be wrong and you should wait for Angelo to reply"
I'll wait for Angelo to reply.
02-01-2018, 04:00 PM
#149
Junior Member
Join Date: Sep 2010
Location: Johannesburg, South Africa
Posts: 48
Likes: 0
Received 2 Likes
on
2 Posts
Various Fiat
You still at it I see. Let me feed your ignorance. In the W211 the EIS/EZS is the master CANBUS distributor and works together with the CGW. And I did not find this on the internet, instead the knowledege comes from repairing/reprogramming on a daily basis all the boxes you call ECU in Mercedes Benz cars for Mercedes Benz dealerships.
02-01-2018, 04:09 PM
#150
Junior Member
Join Date: Sep 2010
Location: Johannesburg, South Africa
Posts: 48
Likes: 0
Received 2 Likes
on
2 Posts
Various Fiat
Forgot about that thread, actually thought it's dead already. Glad to see that there's still some interest.
The short answer is no. But if you really want it, it can be done somehow. Instrumental cluster is very limited, it's designed to do what it does. It doesn't support creating of additional menu, but you can change existing menu, like service menu, but for this you need to inject you device between instumental cluster and CGW. Another option is to draw it on phone, or navi, or music menu. Unfortunately, that menus are also limited and you can draw only 2 big text lines in the center and 1 small text line at the top. The third option is to draw whatever you want with diagnostic messages, you can draw text, lines, squares and even single pixels, but for each command it takes about a second to update, so if you want to draw a menu with 5 text lines it will take 5 seconds
Sorry, but there's no PIDS for this door. The button on that door is connected directly to the controller that opens and closes that door. It can't be controlled over the CAN Bus.
The short answer is no. But if you really want it, it can be done somehow. Instrumental cluster is very limited, it's designed to do what it does. It doesn't support creating of additional menu, but you can change existing menu, like service menu, but for this you need to inject you device between instumental cluster and CGW. Another option is to draw it on phone, or navi, or music menu. Unfortunately, that menus are also limited and you can draw only 2 big text lines in the center and 1 small text line at the top. The third option is to draw whatever you want with diagnostic messages, you can draw text, lines, squares and even single pixels, but for each command it takes about a second to update, so if you want to draw a menu with 5 text lines it will take 5 seconds
Sorry, but there's no PIDS for this door. The button on that door is connected directly to the controller that opens and closes that door. It can't be controlled over the CAN Bus.
