Chevy Bolt EV Forum banner

1 - 14 of 14 Posts

·
Registered
Joined
·
293 Posts
Discussion Starter #1
Now that Onstar is ending complementary phone keyfob support and pissing off virtually every app user out there, does anybody have any information or ideas on what CAN bus commands would need to be issued to remote start and unlock the car? Should we look to OwnStar?

You see where I'm going with this... OK Google, TURN ON CAR
 

·
Registered
Joined
·
293 Posts
Discussion Starter #3
I already have Alexa who turns on my car about 10 times a week.
That's cool and good to know. I don't see where this can be done from the my.chevrolet.com - Is that strictly an Alexa thing? Sorry, I'm risking going off topic...

Back to the point, does anybody know about the CAN commands or otherwise pertaining to pre-conditioning the car? This is more of a prep for the onstar end-of-times.

Thanks
 

·
Registered
Joined
·
230 Posts
That's cool and good to know. I don't see where this can be done from the my.chevrolet.com - Is that strictly an Alexa thing? Sorry, I'm risking going off topic...

Back to the point, does anybody know about the CAN commands or otherwise pertaining to pre-conditioning the car? This is more of a prep for the onstar end-of-times.

Thanks
Some Volt owners figured out the commands - they must be sent on the low-speed single wire CAN line unfortunately, adapters for that are harder to find than normal twisted-pair CAN.

See Hacking my Volt with a Raspberry Pi - Part 1 for example. I have a Macchina P1 on order to see if the same commandset works on the Bolt. Either way, it looks like sniffing the low speed bus will work for finding the commands.

The main CAN bus (primary CAN pair on the OBD2 port) has almost no traffic that isn't predictably periodic. 0x101 is one of the few non-periodic messages, I haven't figured out what triggers it yet, it isn't a wakeup message and the contents are always the same. 0x170 with a content of 00 00 00 seems to be a wakeup frame - it's usually (but not always) the first message on the bus after traffic resumes. (If not the first, within the first few). Events that can cause a bus resume:
Car plugged in
Door unlocked
Car unplugged
Charge termination cycle. (The vehicle wakes up for about 107 seconds at the end of a charge cycle then goes back to sleep). Always around 2740 packets/second with almost no change in CAN IDs seen depending on car state (turned off and charging vs. actively driving).

Below is a list of CAN IDs seen on the primary bus, number of packets seen during the capture period, and number of packets divided by time of capture (giving the message frequency on the bus in Hz). As you can see, it's all periodic other than something internally on the vehicle requesting a set of OBD Service 22 (GM Custom) PIDs. One of them is ambient air temperature so maybe the infotainment system is asking for that info. Many of the other PIDs requested are not on the list @Telek maintains.

Note that in addition to these frequencies, some CAN messages do get retransmitted on change of state/contents - I've seen this for at least one periodic 1 Hz message. For example message 0x140 gets broadcast at 1 Hz plus when a change occurs. According to Katie's reverse engineering, this is a set of on/off flags including turn signals - bt_interface.cpp · master · PinkPandaKatie / M2RET
Code:
0xaa 8580 79.94338676872246
0xbc 8573 79.87816489140532
0xbd 4286 39.93442374018001
0xbe 8580 79.94338676872246
0xc1 10706 99.75220265104227
0xc5 10706 99.75220265104227
0xc9 8580 79.94338676872246
0xd1 10706 99.75220265104227
0xd3 8573 79.87816489140532
0xf1 10714 99.82674193940471
0x101 10 0.09317411045305649
0x120 108 1.00628039289301
0x12a 1073 9.99758205161296
0x130 108 1.00628039289301
0x135 1072 9.988264640567655
0x137 1072 9.988264640567655
0x139 1072 9.988264640567655
0x140 110 1.0249152149836214
0x142 1071 9.97894722952235
0x148 107 0.9969629818477044
0x160 1072 9.988264640567655
0x161 1072 9.988264640567655
0x170 1 0.00931741104530565
0x17d 1071 9.97894722952235
0x182 1071 9.97894722952235
0x186 8573 79.87816489140532
0x197 4286 39.93442374018001
0x1a1 4290 39.97169338436123
0x1a3 4290 39.97169338436123
0x1c3 4290 39.97169338436123
0x1c4 4290 39.97169338436123
0x1c5 4290 39.97169338436123
0x1c6 5353 49.876101325521134
0x1c8 10706 99.75220265104227
0x1cf 1073 9.99758205161296
0x1df 4286 39.93442374018001
0x1e1 3574 33.300427075922386
0x1e5 10697 99.66834595163452
0x1e9 5353 49.876101325521134
0x1ed 8580 79.94338676872246
0x1ef 8580 79.94338676872246
0x1f1 1075 10.016216873703572
0x1f3 3574 33.300427075922386
0x1f4 4290 39.97169338436123
0x1f5 4286 39.93442374018001
0x1f7 4286 39.93442374018001
0x1fc 2141 19.948577047999393
0x210 2141 19.948577047999393
0x214 2141 19.948577047999393
0x222 1074 10.006899462658266
0x226 215 2.0032433747407143
0x22a 1071 9.97894722952235
0x22e 1074 10.006899462658266
0x230 2141 19.948577047999393
0x232 2141 19.948577047999393
0x233 54 0.503140196446505
0x234 1070 9.969629818477044
0x235 54 0.503140196446505
0x236 1071 9.97894722952235
0x237 429 3.997169338436123
0x238 10710 99.78947229522349
0x239 428 3.9878519273908175
0x23d 54 0.503140196446505
0x260 1071 9.97894722952235
0x261 1071 9.97894722952235
0x262 1071 9.97894722952235
0x263 1071 9.97894722952235
0x264 1071 9.97894722952235
0x265 1071 9.97894722952235
0x287 4290 39.97169338436123
0x2c3 2145 19.985846692180615
0x2c7 4285 39.92510632913471
0x2f1 1070 9.969629818477044
0x2f9 2142 19.9578944590447
0x32a 1072 9.988264640567655
0x348 2141 19.948577047999393
0x34a 2141 19.948577047999393
0x34c 2141 19.948577047999393
0x350 2142 19.9578944590447
0x362 2142 19.9578944590447
0x368 4286 39.93442374018001
0x3c1 1072 9.988264640567655
0x3c7 1073 9.99758205161296
0x3c9 1073 9.99758205161296
0x3cf 1071 9.97894722952235
0x3d1 1073 9.99758205161296
0x3d3 1073 9.99758205161296
0x3d9 1073 9.99758205161296
0x3dc 1073 9.99758205161296
0x3dd 1071 9.97894722952235
0x3e3 1072 9.988264640567655
0x3e9 1073 9.99758205161296
0x3ed 1 0.00931741104530565
0x3f1 429 3.997169338436123
0x3f5 429 3.997169338436123
0x3f9 429 3.997169338436123
0x3fb 429 3.997169338436123
0x3fc 429 3.997169338436123
0x3fe 429 3.997169338436123
0x40d 22 0.20498304299672426
0x451 1072 9.988264640567655
0x4a3 108 1.00628039289301
0x4c1 215 2.0032433747407143
0x4c5 215 2.0032433747407143
0x4c7 215 2.0032433747407143
0x4c9 215 2.0032433747407143
0x4cb 215 2.0032433747407143
0x4d1 215 2.0032433747407143
0x4d4 107 0.9969629818477044
0x4db 215 2.0032433747407143
0x4e1 108 1.00628039289301
0x4e9 108 1.00628039289301
0x4f1 108 1.00628039289301
0x4fb 215 2.0032433747407143
0x4ff 108 1.00628039289301
0x500 107 0.9969629818477044
0x514 108 1.00628039289301
0x52a 108 1.00628039289301
0x52b 108 1.00628039289301
0x530 108 1.00628039289301
0x770 108 1.00628039289301
0x771 108 1.00628039289301
0x772 108 1.00628039289301
0x773 107 0.9969629818477044
0x778 107 0.9969629818477044
0x779 107 0.9969629818477044
0x782 107 0.9969629818477044
0x787 108 1.00628039289301
0x7e0 1 0.00931741104530565
0x7e4 9 0.08385669940775084
0x7e8 1 0.00931741104530565
0x7ec 9 0.08385669940775084
0x20000004 1 0.00931741104530565
0x2000000c 2 0.0186348220906113
 

·
Registered
Joined
·
230 Posts
Why would you think that?
I think he's talking about KeyPass which can operate phone<->vehicle without going out to GM's services, and may live in a place that has weak or nonexistent 4G coverage.

The myChevrolet app is horrendously unreliable in my garage since the system uses cellular for everything even though that's extremely weak in my garage but wifi is rock solid down there for example.
 

·
Registered
Joined
·
293 Posts
Discussion Starter #9
And even when we do have connectivity, the connectivity is pretty terrible and unreliable. Anyways, good work on sniffing those packets, I've given up for the moment and did something rather goofy, which is to take a cheap off-brand remote and hook it to an ESP8266, which only works in my driveway, sure, but with Homeassistant and ESPHome, it sure is a lot easier to voice start the car, lock, unlock, and automate a few features, like automatically locking the car late at night in case I forgot, etc.
 

·
Registered
Joined
·
230 Posts
My Macchina P1 finally came in. Unfortunately the setup for lighting up the third SWCAN bus is currently almost completely undocumented... Basically I need to dig through the schematics which don't exactly have the best naming conventions to figure out where the MCP2515 is wired, and then try and get the Octavo to recognize it. Since the AM3358 already has two dedicated CAN MACs, not many people have tried getting an MCP2515 lit up, and even fewer have succeeded it seems. I might have it lit up in the next day or to, or I might not.
 

·
Registered
Joined
·
230 Posts
So I have the Macchina up and running, and can sniff AND send messages to the SWCAN bus. Sending a high voltage wakeup command works (I see other participants on the bus wake up) but so far I have yet to successfully trigger an unlock or precondition state. Either the Bolt is firewalling those specific messages if they come in over the OBD port (unlike the Volt), or the Bolt requires a few additional messages and I haven't figured out what they are yet.

Does anyone have the schematics for CANbus wiring of the Bolt from a service manual? Is there a firewall between the OBD port and the rest of the SWCAN? (If there is, it's pretty slick, because it seems to appropriately forward high voltage wakeup messages - I see different levels of bus activity depending on which wakeup messages I send.)
 

·
Registered
Joined
·
230 Posts
OK, one final thing for now:

All of the info I can find says that MY2017 and later vehicles do indeed have a Serial Data Gateway module firewalling some of the CAN buses from each other.

As far as I can tell, the OnStar module and OBD connector are on opposite sides of the SDGM. As a result, you cannot trigger OnStar behaviors from the OBD port, implementing "fake onstar" will require splicing into wiring elsewhere on the vehicle or building a passthrough/breakout cable to be inserted somewhere else in the vehicle.

Also, supposedly Volts had the high voltage battery management CANbus wired to the OBD connector on pins 3+11, but the Bolt has those pins unpopulated, so getting access to high-resolution battery data at quicker update rates than OBD2 PIDs would also require splicing/breakouts.

I have access to a pretty wide variety of crimp tools for various automotive connectors, but I really need a schematic or at least a block diagram to go further.
 

·
Registered
Joined
·
447 Posts
I don't know if this would give you access to what you are after but I do know from investigation into Openpilot for the Bolt that 2019 and later MY have a security gateway behind the OBDII port. For Openpilot integration, others have used the camera connector behind the rearview mirror to gain access to the CAN bus and this is not sitting behind the security gateway.
 

·
Registered
Joined
·
230 Posts
I don't know if this would give you access to what you are after but I do know from investigation into Openpilot for the Bolt that 2019 and later MY have a security gateway behind the OBDII port. For Openpilot integration, others have used the camera connector behind the rearview mirror to gain access to the CAN bus and this is not sitting behind the security gateway.
Not useful to anyone who doesn't have DCII.

Also Jason's very vague about a lot of low level technical details. For example the Giraffe has a 3-pin connector for the Chassis CAN bus (which is PROBABLY where the BMS traffic I'm interested in monitoring passively is on the Bolt), but no details on where this chassis CAN is spliced from - it's not on the camera connector.
 
1 - 14 of 14 Posts
Top