CANBus Hacking with Carloop
Next step is to load a simple program and see if I can get it communicating with the car via the OBD-II port. After that I'll figure out how to sniff the CAN bus, and then write a program that turns on my intercooler pump whenever the key is ON.
I'm new to this so feel free to chime in with advice. I'll ask specific questions below when they come up.
Your best bet is start talking to tuners as you are at preschool and the actual editing is way above my pay grade!
Your best bet is start talking to tuners as you are at preschool and the actual editing is way above my pay grade!
As you well know, Alex Angelov was able to source internal materials for a lot (all?) of the system's parameters and I wrote a script to translate the 3000+ lines of German into Russian and English. Analyzing the files, we immediately see the following goodies:
--- --- ZWP_EIN() Switch on the auxiliary water pump, offset:3, len:1
--- GW_C_B2 ID:0x0003
--- --- ZWP_EIN_MS() Switch on the auxiliary water pump, offset:56, len:1
--- SAM_B_A1 ID:0x008c
--- --- ZWP_LFT() Auxiliary water pump runs, offset:1, len:1
--- PFDS_A1 ID:0x02a8
--- --- PFDSMOT_ST() Status FDS pump motor, offset:6, len:2
--- --- PFDS_DEAKT() FDS pump deactivated, offset:3, len:1
--- --- P_PFDS(hPa) Supply pressure FDS pump, offset:11, len:5
Rock on, man.
Trending Topics
The Best of Mercedes & AMG
* - I admittedly don't know much about electrical, but based on a quick search most 3-,4- and 5- post relays will not do this. But a logical AND can be achieved quickly with two regular relays in series.
So what you have with the setup above (what I'm planning) is:
Pump on = (ECU says it should be on) OR ((car ignition is ON) AND (interior switch is ON))
A relic of the over-engineered W1XX cars. Remember the 'rest' heat option on those? For long drives at night there would be a button that would pump heat into the interior, I'm guessing this would run the AUX pump on a low setting to make sure the heater core has a longer supply of warmth. Also explains why this message can be sent over CANBUS instead of the ECU operating a relay directly (which is likely the case for the intercooler pump).
Last edited by jumph4x; May 17, 2017 at 05:32 PM.
I'll probably unplug the harness connector on the pump and run an entirely new circuit to it, pulling power off the back of the alternator and the relay signal from... ? Where should I grab the relay signal for when the key is ON? Somewhere in the engine compartment would be best, and I don't want to cut any wires. Can I tap into a fuse somewhere?
I will simplify this down to Pump on = car ignition is ON. Since I'm running a Killer Chiller with a tank and no H/X I want the pump on all the time.
I'll probably unplug the harness connector on the pump and run an entirely new circuit to it, pulling power off the back of the alternator and the relay signal from... ? Where should I grab the relay signal for when the key is ON? Somewhere in the engine compartment would be best, and I don't want to cut any wires. Can I tap into a fuse somewhere?
I wonder if I should just do the same. Can anyone think of a reason not to run the damn pump all the time? Seriously...
Possibly put a mechanical override switch/breaker inline for highway hauls and such. The only reason here being is possibly extending the pump's life.
I've got information there is a separate diagnosis can at the OBD port and you only get answers to diagnosis requests there.
Some say without requests it is just silent and you can't sniff anything.
So most information is not there and you may have to find the engine/chassis CANbus (green/white,green probably).
-This prevents people easily plugging stuff into CANbus and doing stuff that was un-intended (like starting the car I imagine)
Interested to know how you get on
Richard
See that red wire running through the middle of the fuse panel? It connects in the back left corner to a fuse tap that I bought at Autozone. I don't remember which fuse location it is, but if you check your fuse diagram (it should be behind the little panel on the left side of the dashboard; only accessible when the driver's door is open) you will see a couple fuses that can be put in two positions; one for continuous power, and one for accessory power. (one of them is the cigarette lighter; can't remember the other one)
Anyway, I tapped into the one that has accessory power so my pump will run whenever the key is in position 1 or 2. I ran the red wire through some of the black corrugated loom, across the top of the radiator over to the passenger side and down to the pump. If you look closely you can see where the ground wire pops out of the loom and attaches to the factory ground stud.
On the pump end, I simply unplugged the pump and wrapped the connector in some electrical tape to keep it clean in case I ever want to re-attach it. I bought a new plug from the dealer so I can just connect my wire to it and plug it into the pump.
This part was a little tricky, because when I ordered the plug, the only thing it came with was the plastic bits. There was no connector or weatherproofing bits. I think you can get them all from the dealer, but you will end up ordering 3 different part numbers just to make the plug. (sorry, I don't know what the numbers are) They are each only a few bucks though, so I think it would be worth it to avoid having to cut up the harness. Since I didn't want to wait for another week, I ran down to Fry's electronics and found the connector bits that go inside the plastic plug. I just skipped the weatherproofing bits.
Here's the packaging for the connectors from Fry's:
I love you all the same, regardless. Thanks, buddy!
EDIT for posterity:
Source: https://www.jaguarforums.com/forum/x...k-91611/page2/
Here are the Mercedes part numbers needed to build the plug that fits the 010 bosch pump:
Qty 1 of: 230-540-00-81 "COUPLING" - $2.70
Qty 2 of: 008-545-63-26 "PLUG" - $7.20 (total)
Qty 2 of: 000-54568-80 "RUBBER RIN" - $6.30 (total)
Total Price at local Mercedes dealer - $16.20
I did this on my XKR and works great and now modular!
Last edited by jumph4x; Dec 14, 2017 at 01:42 AM.
Sorry, I was off my game the day I did the install. I won't let it happen again. ;-)






