W211 CAN B Hacking
03-31-2018, 04:30 PM
#151
Newbie
Join Date: Mar 2018
Posts: 6
Likes: 0
Received 0 Likes
on
0 Posts
Mercedes CLA
I am looking to do the same thing, power up an NTG 4.X unit on a bench.
08-03-2018, 07:25 AM
#152
Junior Member
Join Date: Aug 2014
Location: Surrey, UK
Posts: 51
Received 0 Likes
on
0 Posts
CLK320 2009 (W209)
Would you say that 29-bit compatibility on a CAN reader was vital? I'm switching from a W216 to a W209 and wanted to be prepared for CAN experiments. Out of the box, the CANBus Triple does not have 29-bit and I've had problems in the past getting it to work with 83.3kbps, greaaat.
08-05-2018, 03:00 PM
#153
Member
Would you say that 29-bit compatibility on a CAN reader was vital? I'm switching from a W216 to a W209 and wanted to be prepared for CAN experiments. Out of the box, the CANBus Triple does not have 29-bit and I've had problems in the past getting it to work with 83.3kbps, greaaat.
The following users liked this post:
the88g (08-06-2018)
08-14-2018, 07:39 PM
#154
Newbie
Join Date: Mar 2018
Posts: 6
Likes: 0
Received 0 Likes
on
0 Posts
Mercedes CLA
I am trying to power up an NTG5 from Harman (NTG5*2) out of a W205 on a bench.
I thought I would be able to power in on using the control panel on/off button that is connected over CAN-A to the unit, but that is not working so far.
after about 20 seconds it goes into a lower power mode (drawing 0.020 amps) and doesn't respond.
does anyone know the can bus ignition on messages that come over CAN-HMI on that system?
I thought I would be able to power in on using the control panel on/off button that is connected over CAN-A to the unit, but that is not working so far.
after about 20 seconds it goes into a lower power mode (drawing 0.020 amps) and doesn't respond.
does anyone know the can bus ignition on messages that come over CAN-HMI on that system?
08-15-2018, 07:29 AM
#156
Newbie
Join Date: Mar 2018
Posts: 6
Likes: 0
Received 0 Likes
on
0 Posts
Mercedes CLA
if I stop sending these dummy messages, then it does shut off completely. however, I am trying to find the one (or more) magic messages that keeps it fully powered on. I assume they come from the EIS/EZS ignition switch but I don't have access to one of those to see what the messages from it are.
08-15-2018, 10:19 AM
#157
Member
Mackhack, I am sending a constant flow of messages on both CAN-A (250kpbs) and CAN-HMI (500kbps) and the NTG5 is talking back at those rates, that's what at least keeps it in the standby state drawing the 0.020 amps
if I stop sending these dummy messages, then it does shut off completely. however, I am trying to find the one (or more) magic messages that keeps it fully powered on. I assume they come from the EIS/EZS ignition switch but I don't have access to one of those to see what the messages from it are.
if I stop sending these dummy messages, then it does shut off completely. however, I am trying to find the one (or more) magic messages that keeps it fully powered on. I assume they come from the EIS/EZS ignition switch but I don't have access to one of those to see what the messages from it are.
Are you using socketcan ? If so, use the cangen from thw can-utils package, and send only arbitration id's (data length of 0)and gap to 200ms, and verbose, when it wakes up, crtl+c and try individual arb id's 1 by 1 using cansend.
Id be willing to bet it wakes up on an arbitration id itself , and pays no attention to the data for wakeup
08-15-2018, 11:31 AM
#158
Junior Member
Join Date: Sep 2010
Location: Johannesburg, South Africa
Posts: 48
Likes: 0
Received 2 Likes
on
2 Posts
Various Fiat
I am trying to power up an NTG5 from Harman (NTG5*2) out of a W205 on a bench.
I thought I would be able to power in on using the control panel on/off button that is connected over CAN-A to the unit, but that is not working so far.
after about 20 seconds it goes into a lower power mode (drawing 0.020 amps) and doesn't respond.
does anyone know the can bus ignition on messages that come over CAN-HMI on that system?
I thought I would be able to power in on using the control panel on/off button that is connected over CAN-A to the unit, but that is not working so far.
after about 20 seconds it goes into a lower power mode (drawing 0.020 amps) and doesn't respond.
does anyone know the can bus ignition on messages that come over CAN-HMI on that system?
Apart from getting the HU to work on a bench please explain exactly what you are wanting to accomplish.
08-15-2018, 11:41 AM
#159
Newbie
Join Date: Mar 2018
Posts: 6
Likes: 0
Received 0 Likes
on
0 Posts
Mercedes CLA
Are you using socketcan ? If so, use the cangen from thw can-utils package, and send only arbitration id's (data length of 0)and gap to 200ms, and verbose, when it wakes up, crtl+c and try individual arb id's 1 by 1 using cansend.
Id be willing to bet it wakes up on an arbitration id itself , and pays no attention to the data for wakeup
Id be willing to bet it wakes up on an arbitration id itself , and pays no attention to the data for wakeup
if I am sending no data at all, it drops to 0 amps. when I resume sending on CAN-HMI, it wakes up drawing over 1 amp for the 20 seconds or so, the drops down to the standby state.
all I know to try next is to vary the values in the packets; that is going to take a while. was hoping someone knew the exact data.
09-07-2018, 11:15 AM
#160
Member
Can anyone tell me where I can find the can hub for can-b in the w211? Can - c is under the front left side floorboard, where is the can-b equivalent for this ? Tia
09-07-2018, 12:59 PM
#161
MBWorld Fanatic!
Join Date: Jan 2014
Location: Republic of Texas
Posts: 3,343
Received 992 Likes
on
772 Posts
'99 and '05 E55 AMG
CAN B connector X30/4 located in passenger side footwell next to the passenger-side SAM under the floor.
CAN B connector X30/6 located passenger side HVAC case (sort of tucked up next to it near the transmission tunnel).
CAN B connector X30/7 located in driver's side rocker panel wiring trough; more towards the rear of the car as the CAN C connector should be more towards the front of the car in the same trough.
CAN B connector X30/6 located passenger side HVAC case (sort of tucked up next to it near the transmission tunnel).
CAN B connector X30/7 located in driver's side rocker panel wiring trough; more towards the rear of the car as the CAN C connector should be more towards the front of the car in the same trough.
Last edited by bbirdwell; 09-07-2018 at 01:01 PM.
03-22-2019, 05:36 AM
#163
Newbie
Join Date: Mar 2019
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
none
Awesome! Look forward to hearing your findings.
I suspect the information I provide below may not be that helpful cause the message positions might end up in different locations, but you never know.
One thing to note is that important information has higher priority so will appear as a lower message ID (Parameter ID in CAN terms)
For example I can see the rev counter on PID 002 but window controls are on PID 219 and steering wheel buttons are on PID 330.
You will be looking at logged packets for a while, it can be a slow process. You should be able to see everything on the CAN wires behind the Audio 20, but you may not be able to send everything through those cables cause of CAN firewalls but that is okay if you are mostly looking to capture information rather than control the car with your tablet (i.e I can send steering wheel button presses but can't send seat control module buttons).
With regards to sending information to the MFD, I have been spamming PID 328 (MFD/OEM display on a w215) and having a tough time figuring it out. I've managed to change the text by mistake a few times. It is sent in ASCII. You need to analyse what the current Audio 20 sends to the screen. I've also seen navigational arrows and remaining miles change on the NAVI screen, it just seems inconsistent. Problem is, the first byte rotates from 10 to 2F depending on the last message sent to the MFD.
My current OEM Display notes (All WIP, messy, scroll down to the colour coded section)
https://docs.google.com/spreadsheets...it?usp=sharing
First successful text change hahaa
http://imgur.com/vucYBka
Good luck!
I suspect the information I provide below may not be that helpful cause the message positions might end up in different locations, but you never know.
One thing to note is that important information has higher priority so will appear as a lower message ID (Parameter ID in CAN terms)
For example I can see the rev counter on PID 002 but window controls are on PID 219 and steering wheel buttons are on PID 330.
You will be looking at logged packets for a while, it can be a slow process. You should be able to see everything on the CAN wires behind the Audio 20, but you may not be able to send everything through those cables cause of CAN firewalls but that is okay if you are mostly looking to capture information rather than control the car with your tablet (i.e I can send steering wheel button presses but can't send seat control module buttons).
With regards to sending information to the MFD, I have been spamming PID 328 (MFD/OEM display on a w215) and having a tough time figuring it out. I've managed to change the text by mistake a few times. It is sent in ASCII. You need to analyse what the current Audio 20 sends to the screen. I've also seen navigational arrows and remaining miles change on the NAVI screen, it just seems inconsistent. Problem is, the first byte rotates from 10 to 2F depending on the last message sent to the MFD.
My current OEM Display notes (All WIP, messy, scroll down to the colour coded section)
https://docs.google.com/spreadsheets...it?usp=sharing
First successful text change hahaa
http://imgur.com/vucYBka
Good luck!
I've been trying to sniff the CAN B message for a W164 Climate Control Module (N22 -AAC) using Kvaser CANKing and Raptor CAN. I was wondering how/where I can get the full CAN messages to power it off-vehicle. In the vehicle, the unit comes on with just Power and CAN (brown and red-brown wires). Off the vehicle, I can't seem to figure out the full CAN message(s) that enables the unit to work.
03-22-2019, 06:03 AM
#164
Member
Interesting success!
I've been trying to sniff the CAN B message for a W164 Climate Control Module (N22 -AAC) using Kvaser CANKing and Raptor CAN. I was wondering how/where I can get the full CAN messages to power it off-vehicle. In the vehicle, the unit comes on with just Power and CAN (brown and red-brown wires). Off the vehicle, I can't seem to figure out the full CAN message(s) that enables the unit to work.
I've been trying to sniff the CAN B message for a W164 Climate Control Module (N22 -AAC) using Kvaser CANKing and Raptor CAN. I was wondering how/where I can get the full CAN messages to power it off-vehicle. In the vehicle, the unit comes on with just Power and CAN (brown and red-brown wires). Off the vehicle, I can't seem to figure out the full CAN message(s) that enables the unit to work.
11-05-2019, 03:42 PM
#165
Junior Member
If anyone is interested. I've created a project to get track information to be displayed on the W203's instrument cluster using an Arduino!. It should work on the W211's, but need some testers 
.
It uses an android app to relay track data of what song's playing to an Arduino via bluetooth, which the sends can frames to the car to display custom text on the IC.
Link to repo here:
https://github.com/UKSFM99/W203-canbus
.It uses an android app to relay track data of what song's playing to an Arduino via bluetooth, which the sends can frames to the car to display custom text on the IC.
Link to repo here:
https://github.com/UKSFM99/W203-canbus
11-05-2019, 03:54 PM
#166
Member
If anyone is interested. I've created a project to get track information to be displayed on the W203's instrument cluster using an Arduino!. It should work on the W211's, but need some testers .
It uses an android app to relay track data of what song's playing to an Arduino via bluetooth, which the sends can frames to the car to display custom text on the IC.
Link to repo here:
https://github.com/UKSFM99/W203-canbus
.It uses an android app to relay track data of what song's playing to an Arduino via bluetooth, which the sends can frames to the car to display custom text on the IC.
Link to repo here:
https://github.com/UKSFM99/W203-canbus
11-05-2019, 03:58 PM
#167
Junior Member
no problem! I'm doing this as part of my university project.
If you have any questions or issues please open up issues on the repository. I shall respond promptly.
Also, here is a Video I submitted to reddit of me getting Engine RPM to be displayed digitally
https://www.reddit.com/r/mercedes_be...3s_to_display/
If you have any questions or issues please open up issues on the repository. I shall respond promptly.
Also, here is a Video I submitted to reddit of me getting Engine RPM to be displayed digitally
https://www.reddit.com/r/mercedes_be...3s_to_display/
11-05-2019, 04:15 PM
#168
no problem! I'm doing this as part of my university project.
If you have any questions or issues please open up issues on the repository. I shall respond promptly.
Also, here is a Video I submitted to reddit of me getting Engine RPM to be displayed digitally
https://www.reddit.com/r/mercedes_be...3s_to_display/
If you have any questions or issues please open up issues on the repository. I shall respond promptly.
Also, here is a Video I submitted to reddit of me getting Engine RPM to be displayed digitally
https://www.reddit.com/r/mercedes_be...3s_to_display/
11-05-2019, 04:23 PM
#169
Junior Member
No. I only have 1 canshield at this moment in time.
That said, some PID's from Can C are filtered and sent in Can B. Thats what I'm playing with at the moment. I'm worried playing with Can C would invalidate my insurance in the UK.
My big project would be to reverse engineer the 722.6 controller, use an arduino in its place, and let my phone application 'tune' the transmission to define lock up points and shift points etc.
Baby steps first obviously
That said, some PID's from Can C are filtered and sent in Can B. Thats what I'm playing with at the moment. I'm worried playing with Can C would invalidate my insurance in the UK.
My big project would be to reverse engineer the 722.6 controller, use an arduino in its place, and let my phone application 'tune' the transmission to define lock up points and shift points etc.
Baby steps first obviously
The following users liked this post:
Mackhack (11-05-2019)
11-07-2019, 12:12 PM
#170
Junior Member
Big news
I'm now running 2 mcp2515s. 1 in canB and 1 in canC (using the instrument cluster as my connection points).
With the help of a friend, I took the untranslated parts from Alex's sheet of PIDs, and have been able to get transmission oil temperature on the IC display!
With the help of a friend, I took the untranslated parts from Alex's sheet of PIDs, and have been able to get transmission oil temperature on the IC display!
The following users liked this post:
Mackhack (11-07-2019)
11-07-2019, 01:39 PM
#171
In all seriousness, can you show a video?
Keep up the good work.
11-07-2019, 03:04 PM
#172
Junior Member
Can do a video tomorrow. It's quite late here in UK
Oh and I can add more readings. Coolant temp, rpm, speed, interior temp, exterior temp.
I'll try and tackle more transmission can readouts tomorrow's may be possible to get current gear and torque converter lockups
The following users liked this post:
Mackhack (11-07-2019)
11-07-2019, 03:35 PM
#173
MBWorld Fanatic!
Thanks!
Can do a video tomorrow. It's quite late here in UK
Oh and I can add more readings. Coolant temp, rpm, speed, interior temp, exterior temp.
I'll try and tackle more transmission can readouts tomorrow's may be possible to get current gear and torque converter lockups
Can do a video tomorrow. It's quite late here in UK
Oh and I can add more readings. Coolant temp, rpm, speed, interior temp, exterior temp.
I'll try and tackle more transmission can readouts tomorrow's may be possible to get current gear and torque converter lockups
11-07-2019, 03:55 PM
#174
Pressure sensor B/28 (E55) can be read via SD. Should have a corresponding PID I would assume. And I’m with you on that info.
11-07-2019, 07:16 PM
#175
MBWorld Fanatic!
I feel sure it does although I don’t own an M113k (I should because it is the most car for the money on the market). The S600 biturbo needs one too - I can’t think of a location in the W221 to place one. Distronic ring would not be ideal on that cluster - a digital representation would be nice. If you comb the firmware for a W221 cluster, there is a menu labeled “Smoke Screen” which is interesting.
