W211 CAN B Hacking
Newbie
Joined: Mar 2018
Posts: 6
Likes: 0
Mercedes CLA
I am looking to do the same thing, power up an NTG 4.X unit on a bench.
Junior Member
Joined: Aug 2014
Posts: 51
Likes: 0
From: Surrey, UK
CLK320 2009 (W209)
Would you say that 29-bit compatibility on a CAN reader was vital? I'm switching from a W216 to a W209 and wanted to be prepared for CAN experiments. Out of the box, the CANBus Triple does not have 29-bit and I've had problems in the past getting it to work with 83.3kbps, greaaat.
Member
Joined: Mar 2014
Posts: 95
Likes: 8
From: Murfreesboro TN
2006 E55 AMG Kompressor
Would you say that 29-bit compatibility on a CAN reader was vital? I'm switching from a W216 to a W209 and wanted to be prepared for CAN experiments. Out of the box, the CANBus Triple does not have 29-bit and I've had problems in the past getting it to work with 83.3kbps, greaaat.
Newbie
Joined: Mar 2018
Posts: 6
Likes: 0
Mercedes CLA
I am trying to power up an NTG5 from Harman (NTG5*2) out of a W205 on a bench.
I thought I would be able to power in on using the control panel on/off button that is connected over CAN-A to the unit, but that is not working so far.
after about 20 seconds it goes into a lower power mode (drawing 0.020 amps) and doesn't respond.
does anyone know the can bus ignition on messages that come over CAN-HMI on that system?
I thought I would be able to power in on using the control panel on/off button that is connected over CAN-A to the unit, but that is not working so far.
after about 20 seconds it goes into a lower power mode (drawing 0.020 amps) and doesn't respond.
does anyone know the can bus ignition on messages that come over CAN-HMI on that system?
Newbie
Joined: Mar 2018
Posts: 6
Likes: 0
Mercedes CLA
if I stop sending these dummy messages, then it does shut off completely. however, I am trying to find the one (or more) magic messages that keeps it fully powered on. I assume they come from the EIS/EZS ignition switch but I don't have access to one of those to see what the messages from it are.
Member
Joined: Mar 2014
Posts: 95
Likes: 8
From: Murfreesboro TN
2006 E55 AMG Kompressor
Mackhack, I am sending a constant flow of messages on both CAN-A (250kpbs) and CAN-HMI (500kbps) and the NTG5 is talking back at those rates, that's what at least keeps it in the standby state drawing the 0.020 amps
if I stop sending these dummy messages, then it does shut off completely. however, I am trying to find the one (or more) magic messages that keeps it fully powered on. I assume they come from the EIS/EZS ignition switch but I don't have access to one of those to see what the messages from it are.
if I stop sending these dummy messages, then it does shut off completely. however, I am trying to find the one (or more) magic messages that keeps it fully powered on. I assume they come from the EIS/EZS ignition switch but I don't have access to one of those to see what the messages from it are.
Are you using socketcan ? If so, use the cangen from thw can-utils package, and send only arbitration id's (data length of 0)and gap to 200ms, and verbose, when it wakes up, crtl+c and try individual arb id's 1 by 1 using cansend.
Id be willing to bet it wakes up on an arbitration id itself , and pays no attention to the data for wakeup
Junior Member
Joined: Sep 2010
Posts: 48
Likes: 2
From: Johannesburg, South Africa
Various Fiat
I am trying to power up an NTG5 from Harman (NTG5*2) out of a W205 on a bench.
I thought I would be able to power in on using the control panel on/off button that is connected over CAN-A to the unit, but that is not working so far.
after about 20 seconds it goes into a lower power mode (drawing 0.020 amps) and doesn't respond.
does anyone know the can bus ignition on messages that come over CAN-HMI on that system?
I thought I would be able to power in on using the control panel on/off button that is connected over CAN-A to the unit, but that is not working so far.
after about 20 seconds it goes into a lower power mode (drawing 0.020 amps) and doesn't respond.
does anyone know the can bus ignition on messages that come over CAN-HMI on that system?
Apart from getting the HU to work on a bench please explain exactly what you are wanting to accomplish.
MB World Stories
The Best of Mercedes & AMG
8 Oddball Mercedes Ideas That Actually Made it to Production
Verdad Gallardo
Dubai Tuner Gives the Mercedes G-Class An Entirely New Look
Verdad Gallardo
Six Gift Ideas Your AMG Loving Dad or Grad Will Cherish
7 Craziest Things AMG Gas Ever Built
Verdad Gallardo
New Electric Mercedes-AMG GT 4-Door Coupe Unveiled: 10 Things You Need to Know
Verdad Gallardo
6 Mercedes Models That Did NOT Age Well (But Are Somehow Still Cool)
Verdad Gallardo
Manual Mercedes? 6 Times Sindelfingen Let Drivers Have All The Fun
Verdad Gallardo
Mercedes SLR McLaren 722 S Is Extremely Rare Example Modified by McLaren
Verdad Gallardo
8 Classic Boxy Mercedes Designs That Have Aged Like Fine Wine
Verdad Gallardo
Newbie
Joined: Mar 2018
Posts: 6
Likes: 0
Mercedes CLA
Are you using socketcan ? If so, use the cangen from thw can-utils package, and send only arbitration id's (data length of 0)and gap to 200ms, and verbose, when it wakes up, crtl+c and try individual arb id's 1 by 1 using cansend.
Id be willing to bet it wakes up on an arbitration id itself , and pays no attention to the data for wakeup
Id be willing to bet it wakes up on an arbitration id itself , and pays no attention to the data for wakeup
if I am sending no data at all, it drops to 0 amps. when I resume sending on CAN-HMI, it wakes up drawing over 1 amp for the 20 seconds or so, the drops down to the standby state.
all I know to try next is to vary the values in the packets; that is going to take a while. was hoping someone knew the exact data.
MBWorld Fanatic!
Joined: Jan 2014
Posts: 3,975
Likes: 1,321
From: Republic of Texas
'99 and '05 E55 AMG
CAN B connector X30/4 located in passenger side footwell next to the passenger-side SAM under the floor.
CAN B connector X30/6 located passenger side HVAC case (sort of tucked up next to it near the transmission tunnel).
CAN B connector X30/7 located in driver's side rocker panel wiring trough; more towards the rear of the car as the CAN C connector should be more towards the front of the car in the same trough.
CAN B connector X30/6 located passenger side HVAC case (sort of tucked up next to it near the transmission tunnel).
CAN B connector X30/7 located in driver's side rocker panel wiring trough; more towards the rear of the car as the CAN C connector should be more towards the front of the car in the same trough.
Last edited by bbirdwell; Sep 7, 2018 at 01:01 PM.
Newbie
Joined: Mar 2019
Posts: 1
Likes: 0
none
Awesome! Look forward to hearing your findings.
I suspect the information I provide below may not be that helpful cause the message positions might end up in different locations, but you never know.
One thing to note is that important information has higher priority so will appear as a lower message ID (Parameter ID in CAN terms)
For example I can see the rev counter on PID 002 but window controls are on PID 219 and steering wheel buttons are on PID 330.
You will be looking at logged packets for a while, it can be a slow process. You should be able to see everything on the CAN wires behind the Audio 20, but you may not be able to send everything through those cables cause of CAN firewalls but that is okay if you are mostly looking to capture information rather than control the car with your tablet (i.e I can send steering wheel button presses but can't send seat control module buttons).
With regards to sending information to the MFD, I have been spamming PID 328 (MFD/OEM display on a w215) and having a tough time figuring it out. I've managed to change the text by mistake a few times. It is sent in ASCII. You need to analyse what the current Audio 20 sends to the screen. I've also seen navigational arrows and remaining miles change on the NAVI screen, it just seems inconsistent. Problem is, the first byte rotates from 10 to 2F depending on the last message sent to the MFD.
My current OEM Display notes (All WIP, messy, scroll down to the colour coded section)
https://docs.google.com/spreadsheets...it?usp=sharing
First successful text change hahaa
http://imgur.com/vucYBka
Good luck!
I suspect the information I provide below may not be that helpful cause the message positions might end up in different locations, but you never know.
One thing to note is that important information has higher priority so will appear as a lower message ID (Parameter ID in CAN terms)
For example I can see the rev counter on PID 002 but window controls are on PID 219 and steering wheel buttons are on PID 330.
You will be looking at logged packets for a while, it can be a slow process. You should be able to see everything on the CAN wires behind the Audio 20, but you may not be able to send everything through those cables cause of CAN firewalls but that is okay if you are mostly looking to capture information rather than control the car with your tablet (i.e I can send steering wheel button presses but can't send seat control module buttons).
With regards to sending information to the MFD, I have been spamming PID 328 (MFD/OEM display on a w215) and having a tough time figuring it out. I've managed to change the text by mistake a few times. It is sent in ASCII. You need to analyse what the current Audio 20 sends to the screen. I've also seen navigational arrows and remaining miles change on the NAVI screen, it just seems inconsistent. Problem is, the first byte rotates from 10 to 2F depending on the last message sent to the MFD.
My current OEM Display notes (All WIP, messy, scroll down to the colour coded section)
https://docs.google.com/spreadsheets...it?usp=sharing
First successful text change hahaa
http://imgur.com/vucYBka
Good luck!
I've been trying to sniff the CAN B message for a W164 Climate Control Module (N22 -AAC) using Kvaser CANKing and Raptor CAN. I was wondering how/where I can get the full CAN messages to power it off-vehicle. In the vehicle, the unit comes on with just Power and CAN (brown and red-brown wires). Off the vehicle, I can't seem to figure out the full CAN message(s) that enables the unit to work.
Member
Joined: Mar 2014
Posts: 95
Likes: 8
From: Murfreesboro TN
2006 E55 AMG Kompressor
Interesting success!
I've been trying to sniff the CAN B message for a W164 Climate Control Module (N22 -AAC) using Kvaser CANKing and Raptor CAN. I was wondering how/where I can get the full CAN messages to power it off-vehicle. In the vehicle, the unit comes on with just Power and CAN (brown and red-brown wires). Off the vehicle, I can't seem to figure out the full CAN message(s) that enables the unit to work.
I've been trying to sniff the CAN B message for a W164 Climate Control Module (N22 -AAC) using Kvaser CANKing and Raptor CAN. I was wondering how/where I can get the full CAN messages to power it off-vehicle. In the vehicle, the unit comes on with just Power and CAN (brown and red-brown wires). Off the vehicle, I can't seem to figure out the full CAN message(s) that enables the unit to work.
Junior Member
Joined: Sep 2019
Posts: 73
Likes: 46
From: Reading, UK
2003 E55 AMG
If anyone is interested. I've created a project to get track information to be displayed on the W203's instrument cluster using an Arduino!. It should work on the W211's, but need some testers 
.
It uses an android app to relay track data of what song's playing to an Arduino via bluetooth, which the sends can frames to the car to display custom text on the IC.
Link to repo here:
https://github.com/UKSFM99/W203-canbus
.It uses an android app to relay track data of what song's playing to an Arduino via bluetooth, which the sends can frames to the car to display custom text on the IC.
Link to repo here:
https://github.com/UKSFM99/W203-canbus
Member
Joined: Mar 2014
Posts: 95
Likes: 8
From: Murfreesboro TN
2006 E55 AMG Kompressor
If anyone is interested. I've created a project to get track information to be displayed on the W203's instrument cluster using an Arduino!. It should work on the W211's, but need some testers .
It uses an android app to relay track data of what song's playing to an Arduino via bluetooth, which the sends can frames to the car to display custom text on the IC.
Link to repo here:
https://github.com/UKSFM99/W203-canbus
.It uses an android app to relay track data of what song's playing to an Arduino via bluetooth, which the sends can frames to the car to display custom text on the IC.
Link to repo here:
https://github.com/UKSFM99/W203-canbus
Junior Member
Joined: Sep 2019
Posts: 73
Likes: 46
From: Reading, UK
2003 E55 AMG
no problem! I'm doing this as part of my university project.
If you have any questions or issues please open up issues on the repository. I shall respond promptly.
Also, here is a Video I submitted to reddit of me getting Engine RPM to be displayed digitally
https://www.reddit.com/r/mercedes_be...3s_to_display/
If you have any questions or issues please open up issues on the repository. I shall respond promptly.
Also, here is a Video I submitted to reddit of me getting Engine RPM to be displayed digitally
https://www.reddit.com/r/mercedes_be...3s_to_display/
Banned
Joined: Feb 2008
Posts: 0
Likes: 118
no problem! I'm doing this as part of my university project.
If you have any questions or issues please open up issues on the repository. I shall respond promptly.
Also, here is a Video I submitted to reddit of me getting Engine RPM to be displayed digitally
https://www.reddit.com/r/mercedes_be...3s_to_display/
If you have any questions or issues please open up issues on the repository. I shall respond promptly.
Also, here is a Video I submitted to reddit of me getting Engine RPM to be displayed digitally
https://www.reddit.com/r/mercedes_be...3s_to_display/
Junior Member
Joined: Sep 2019
Posts: 73
Likes: 46
From: Reading, UK
2003 E55 AMG
No. I only have 1 canshield at this moment in time.
That said, some PID's from Can C are filtered and sent in Can B. Thats what I'm playing with at the moment. I'm worried playing with Can C would invalidate my insurance in the UK.
My big project would be to reverse engineer the 722.6 controller, use an arduino in its place, and let my phone application 'tune' the transmission to define lock up points and shift points etc.
Baby steps first obviously
That said, some PID's from Can C are filtered and sent in Can B. Thats what I'm playing with at the moment. I'm worried playing with Can C would invalidate my insurance in the UK.
My big project would be to reverse engineer the 722.6 controller, use an arduino in its place, and let my phone application 'tune' the transmission to define lock up points and shift points etc.
Baby steps first obviously
Junior Member
Joined: Sep 2019
Posts: 73
Likes: 46
From: Reading, UK
2003 E55 AMG
Big news
I'm now running 2 mcp2515s. 1 in canB and 1 in canC (using the instrument cluster as my connection points).
With the help of a friend, I took the untranslated parts from Alex's sheet of PIDs, and have been able to get transmission oil temperature on the IC display!
With the help of a friend, I took the untranslated parts from Alex's sheet of PIDs, and have been able to get transmission oil temperature on the IC display!
Banned
Joined: Feb 2008
Posts: 0
Likes: 118
In all seriousness, can you show a video?
Keep up the good work.
Junior Member
Joined: Sep 2019
Posts: 73
Likes: 46
From: Reading, UK
2003 E55 AMG
Can do a video tomorrow. It's quite late here in UK
Oh and I can add more readings. Coolant temp, rpm, speed, interior temp, exterior temp.
I'll try and tackle more transmission can readouts tomorrow's may be possible to get current gear and torque converter lockups
MBWorld Fanatic!
Joined: Nov 2004
Posts: 1,691
Likes: 143
W221 S600, W220 S55 AMG Kompressor, W124 300E, W140 S320, W210 E3204M W164 ML320 Bluetec
Thanks!
Can do a video tomorrow. It's quite late here in UK
Oh and I can add more readings. Coolant temp, rpm, speed, interior temp, exterior temp.
I'll try and tackle more transmission can readouts tomorrow's may be possible to get current gear and torque converter lockups
Can do a video tomorrow. It's quite late here in UK
Oh and I can add more readings. Coolant temp, rpm, speed, interior temp, exterior temp.
I'll try and tackle more transmission can readouts tomorrow's may be possible to get current gear and torque converter lockups
Banned
Joined: Feb 2008
Posts: 0
Likes: 118
Pressure sensor B/28 (E55) can be read via SD. Should have a corresponding PID I would assume. And I’m with you on that info.
MBWorld Fanatic!
Joined: Nov 2004
Posts: 1,691
Likes: 143
W221 S600, W220 S55 AMG Kompressor, W124 300E, W140 S320, W210 E3204M W164 ML320 Bluetec
I feel sure it does although I don’t own an M113k (I should because it is the most car for the money on the market). The S600 biturbo needs one too - I can’t think of a location in the W221 to place one. Distronic ring would not be ideal on that cluster - a digital representation would be nice. If you comb the firmware for a W221 cluster, there is a menu labeled “Smoke Screen” which is interesting.
