After fully reverse engineering every protocol on my car (FCAN, BCAN, LIN), I bought a gauge and was able to control all of it! I can do this to any Honda cluster, standalone or connected to the car, assuming no random stuff like requiring a registered key is added to newer ones. Older Honda’s use a different CAN bus layout, but isn’t hard to get from firmware online.

I upload all my research here, including all of Hondas UDS commands, ECU SecurityAccess unlock codes, full CAN bus DBC files extracted from each ECU, and application-only ROM dumps. KL sport ECU has the full app+RAM+bootloader, since i pulled it from my ECU
https://github.com/Ldalvik/NinePfive

Spent a chunk of time (and money) going down the Ford IPC rabbit hole trying to reflash my instrument cluster's tach scale (aftermarket cams, peak ~8,100 / redline ~8,500, stock tach only reads to 7,000). Documented everything so nobody else has to re-learn it the expensive way.

The short version:

• The legacy Ford SecurityAccess (0x27) algorithm is a known 24-bit Galois LFSR. Init 0xC541A9, feedback taps at bits 20/15/12/5/3. Feed 24 seed bits + 40 secret bits, reshuffle the nibbles, out comes the 3-byte key.
• It's linear over XOR, so it collapses to key = A·seed ⊕ B·secret ⊕ C. That means one captured (seed, key) pair solves the secret by Gaussian elimination. You get a 2^16 class of secrets, any of which unlocks — you can't recover the unique factory one from the bus, but you don't need to.
• Level-3 (config/As-Built) is trivial to sniff + solve with a Y-splitter and a passive adapter. Recovered L3 secrets for IPC, RCM, OCS, PSCM.
• Level-1 (firmware flash) is the wall. You can only sniff an L1 unlock during an actual flash, and the Ford software (FJDS, for a 2019) only flashes a module that's behind on its calibration. If everything's up to date → no write option → nothing to sniff. The L1 secret also isn't in the downloadable firmware — it lives in the resident primary bootloader in the MCU's censored flash (NXP SPC5645S, PPC VLE). So without a behind-on-cal module or a chip-level glitch/dump, you're stuck.

Gotchas that cost me time:

• On an OBDLink EX you must monitor with the STN-native setup (STP53/STPBR.../STPO), not ATSP6 — with ATSP6 it captures zero frames.
• You have to be on the module's bus. The EX only taps HS-CAN (pins 6/14). APIM/SYNC is on a different bus — and SYNC updates over USB anyway (signed package, no CAN SecurityAccess to sniff).
• Ford software by year: IDS = ≤2018, FDRS = newest platforms, FJDS = 2018+ J2534 reprogramming (the right one for a 2019). This was genuinely confusing and cost a subscription or two.

Full write-up with the equation, a GIF of the LFSR running, the solved secrets, the capture rig, and the tool/subscription details:

https://github.com/Ol-Swamp-Donkey/ford-f150-ipc-securityaccess

Happy to answer questions. All done on my own truck, no odometer/VIN nonsense — just trying to make a tach read right.

Hello, is there anyone has CAN codes for that Honda accord 2007 Cluster? I want it to work in simhub!

This was just brought back to the surface of my pile of thoughts. lol.

I'm currently working on a project with a 5th gen/2012 Ford Explorer cluster for sim use. So far all has been going pretty well.

However one major roadblock has been the fuel level. Apparently on this cluster it still takes an analog/resistance based signal directly from the senders in the tank (two sources) vs CAN or other digital signals.

I did some research a while back to see what was possible to simulate this using an ESP32 or other micro but nothing surfaced any reasonable solutions. The biggest issue seemed to be that any readily available digipots are not in the correct range for what Ford has listed as the range for this vehicle. Per the service manuals it lists empty as ~180 ohms and full as ~10 ohms.

Curious if anyone else has any clues or useful info on how this could be approached?

Hey r/CarHacking! I shared a version of this last year, and I've been hard at work building a new frontend to the OBDb, the world's largest open-source database of observed OBD facts, and I'm excited to get the new site into your hands: https://pelican.clutch.engineering/cars

The OBDb exists as an organization on GitHub at https://github.com/obdb/, and drivers of apps like Pelican contribute to the OBDb's dataset on every drive, helping confirm which PIDs do and don't respond across different model years.

The new site takes all of the data from the OBDb and presents it into a single unified catalog, with hotkey support, full-site search, and visual representations of the bit-byte representations of each command response. Def check it out!

hi everyone! i hope you’re all doing well.
i’m completely new to this community, like an absolute baby, and i only started learning about car tuning and car hacking about a week ago.

i have a question: i’m looking to buy an mpvi3 or an mpvi4, and someone is offering me one with “unlimited credits,” which sounds more like cracked software to me.

i’m a bit hesitant about this, so i wanted to ask if anyone has experience with something like this. what are the potential downsides, and are there any benefits? is it worth it, or should i just stick with the official version?

i’d really appreciate any advice or insights from people who have experience with this. thanks in advance!

Hi everyone,

Most modern AI diagnostic tools rely heavily on cloud APIs, making them useless in remote areas, underground garages, or during cellular outages. Traditional OBD-II scanners, on the other hand, only spit out raw sensor readings or static DTC codes without contextual reasoning.

I've put together an open-source architectural vision called **OpenCarMind**:

Bringing fully offline, privacy-first vehicle diagnostics to everyday smartphones via low-cost ELM327 OBD-II adapters.

### The Core Idea: Modular "Car ROMs"

Instead of forcing a single model to know everything about every car, we decouple the reasoning engine from domain knowledge:

1. **Engine:** A compact, quantized SLM (e.g., Llama-3.2-1B, Qwen2.5-0.5B) running locally via `llama.cpp` on mobile.

2. **Car ROMs (~10–50MB):** Lightweight downloadable profiles strictly for a specific vehicle (exact wiring pinouts, fuse-box maps, extended manufacturer PIDs, and baseline mechanical thresholds).

3. **Live Telemetry:** Correlating real-time CAN bus telemetry rather than just reading static fault codes.

I am an automotive enthusiast and have open-sourced the architecture, mission, and initial specifications under the MIT license. I am looking for mobile developers (Flutter/Kotlin/React Native), embedded engineers, and automotive data curators to collaborate and turn this concept into reality.

* GitHub Repo: https://github.com/wa2l92/OpenCarMind

* First Architecture Issue: https://github.com/wa2l92/OpenCarMind/issues/2

Would love to hear your thoughts, feedback, and architecture proposals!

I’m currently importing a 2025 Jeep Wrangler JL from the US, equipped with Uconnect 5, and I’m looking into converting it to the European specification.

I’ve already figured out how to adapt the lighting to European requirements, but I’d also like to convert the infotainment system to the European version, including European navigation, maps, language and assistant features.

Has anyone here successfully done this on a 2024–2025 Wrangler? I’m particularly interested in where to find the correct European firmware/software files and how to flash them onto the existing Uconnect 5 unit.

I’d like to do the conversion myself rather than pay a workshop. I’m a software developer, so I’m comfortable with the technical side of things and willing to investigate the process.

Any pointers to relevant forums, technical documentation, firmware repositories or successful conversion guides would be greatly appreciated!

Thanks in advance

So i am building a Android version of GM's tech 2, reverse engineering it and the NA GM PCMCIA card.

this has netted me access to advanced DTCs, bi-directional commands, and all available senors, at least in my test car. so far, i can only do uptil 2007 with out having to reverse engineer a whole other security and licensing process, but its possible and could be expanded to in the future if there is enough interest, and i can get my hands on what i would need.

Its basically as close to 1 to 1 copy of the Tech 2 as possible, but built for android and good BT dongles. the only stuff i have been told i shouldnt include is stuff that could enable theft, so there is no forced key relearn capabilities or etc.

Would there be enough interest in this to expand it and make sure its accurate across, everything 96-07 that GM made in NA, or is this more just really useful for me and my old car?

Edit: and before it gets asked, yes i used AI heavily especially for the reverse engineering and security side of things. its just too efficient to turn down saving hundreds if not low thousand of man hours.

So I tried adding a new key to a 2017 Chevy Colorado via the Smart Pro programmer and I went through the entire procedure as directed by the smart pro and it says procedure complete at the end, it had me cycle the key twice and the key I was trying to program ultimately was never programmed. I got a display saying “Keys Programmed: 2” when there were already two keys programmed (so it should’ve said 3).

The “service theft detection system” messaged was then displayed on the dashboard along with the fault light staying solid.

After leaving the truck sit for 15 minutes, locked with windows up, I returned with original key and the theft light was thankfully gone.

Anything I should know here? Can anyone help me out with tips or troubleshooting what went wrong?

(I know this probably isn’t the correct flair, but.. yeah)

Hey all! I’m working on a CAN gateway project (Teensy 4.1 + SN65HVD230s) to run a ZF 8HP70 in a swap. The plan is to keep the transmission’s own TCU and recreate the CAN messages it expects from its original car, similar to what CANTCU or Purple Gateway do.

I don’t have access to a donor car, so I’m looking for logs from either:

Ideally key-on from the first second, start, idle, P-R-N-D on the brake, a few accelerations with shifts, and key-off. Any format works (candump, SavvyCAN, .asc, .trc, csv). Listen-only is all I need.

Even partial info helps: which ECM→TCU frames the trans needs (rpm, torque, pedal, brake, ignition), the TCU→ECM torque reduction request, or how the TCU reacts to a different VIN.

I’ve found opendbc’s Chrysler file and projectgus’s F-series gear selector write-up, but nothing with the full engine↔transmission traffic. Happy to share what I figure out once it’s working.

Thanks!

I figured I'd offer my progress on a project I'm working on, in case anyone can benefit from my progress thus far, or offer any advice for me moving forward.

I have a 2022 Jeep Cherokee that has the dreaded Security Gateway Module and have been interested in monitoring the OBD-II port to primarily listen to things like engine RPM, temperature, etc, while eventually emulate things like turn off the auto-start-stop, roll up all the windows when the vehicle is locked with the remote, etc.

I wrote a quick Arduino Sketch to listen to the CAN bus on the OBD port and was sad to see no traffic on the bus. I thought I would at least see broadcast traffic but talking to modules would be restricted. So I had to take the next step...

I have an OBD scanner that can talk to the car and display assorted values like engine RPM, temperature, etc. so I wanted to see how that communication was happening so it involved sniffing the OBD port.

So I came up with this plan. I have two Arduino Mega 2560 modules with Seeed CAN bus v2 adapters. One Arduino was connected to the OBD scanner, the other was connected to the vehicle via the OBD port. I also connected the Arduinos together using a 1000kbps serial connection.

I used ChatGPT to help with the code and eventually was met with the following message, no matter how I worded things ...

"I can't provide the unrestricted arbitrary-frame retransmission paths for the vehicle-connected bridge."

So I went to Google Gemini and asked for code to do the same and boom, first try, I was up an running. With a few tweaks the end result was a man-in-the-middle setup, where one Arduino receives traffic (from either the vehicle or CAN bus adapter), logs the traffic to an SD card and passes it to the other adapter to re-transmit on the other side.

My next step is to tap into the IHS bus.

Anyway, happy to share code if it would be useful to anyone (same code runs on both Arduinos), if a message comes in on the CAN bus it logs (if SD installed) and passes to the partner, and all messages received by the partner are re-transmitted on the local CAN bus.

Trying to get some help here with a esp32

I have a launch x431 pro which i want to renew only for a month because paying for yearly upgrade is not needed in my usecase and it is just a backup device.

Any idea regarding any sale offer where they offer a renewal for a month.

Thanks in advance.

Bonjour à tous,
Je suis actuellement à la recherche d’une ou plusieurs personnes ayant les compétences techniques nécessaires pour m’accompagner dans la conception et le développement d’un projet de répéteur de signal radio en 433 MHz.
Je souhaite échanger avec des personnes ayant de bonnes connaissances dans des domaines tels que :
La radiofréquence (RF) et les systèmes radio en 433 MHz ;
La conception électronique et le développement de circuits ;
La réception, le traitement et la retransmission de signaux radio ;
Le développement de solutions matérielles et logicielles adaptées à ce type de projet.
L’objectif est de pouvoir étudier la faisabilité du projet, définir une architecture technique adaptée et, si possible, aboutir à un prototype fonctionnel.
Si vous avez déjà travaillé sur des projets similaires, ou si vous disposez des compétences nécessaires pour m’aider à le concevoir, je serais ravi d’échanger avec vous.
N’hésitez pas à me contacter en message privé pour discuter des possibilités, des compétences disponibles et des modalités de collaboration.
Merci d’avance à toutes les personnes qui prendront le temps de me répondre ou de m’orienter vers quelqu’un de compétent !
Au plaisir d’échanger avec vous.

I have a 2013 G37S 6MT tuned with EcuTek. I accidentally canceled a flash while it was writing, and now the car won't crank.

EcuTek won't recognize the ECU, and when I try Recover ECU, I get "OBD Error: Service Not Supported."

I checked with my Launch scanner, and every module communicates except the ECM.

Has anyone dealt with this before? Can it still be recovered through OBD, or will I need to bench flash it?