Bit of time waste

[domtorredo]

Been long time since touched all this staff. But last couple of days got some spare time and did some can bus work.
Not a best start but findings for now are
Cd30 and tid doesn't send code over can bus but uses ID instead which changes with code change.
So conclusion is to work out how that code and id is related to each other or some serial number etc.
With known code and id can reset both over can.



Sent from my F3111 using Tapatalk

[soulman]

Hi Dom.

Been busy myself with other stuff, I need to look into the insignia stuff now for retrofits and need to sort out the checksums for vin number changes

[domtorredo]

Hi Dom.

Been busy myself with other stuff, I need to look into the insignia stuff now for retrofits and need to sort out the checksums for vin number changes

Hi soulman
Uhh checksums, could take a while to sort out.
Have you tried summing all bytes and xoring them? Could be just sum of vin bytes and xor. Sure all this can be worked out if you know where crc bytes are stored.


Sent from my F3111 using Tapatalk

[domtorredo]

Hi Dom.

Been busy myself with other stuff, I need to look into the insignia stuff now for retrofits and need to sort out the checksums for vin number changes

right maybe you got idea

bytes 83 95 code 1914
bytes f3 67 code 0000
bytes 74 c7 code 1000

they do not appear in dump nor can messages reveals anything
if you got any idea would be great

[soulman]

yes have an idea... will reply tomorrow when got some examples, currently making bluetooth looms

[domtorredo]

yes have an idea... will reply tomorrow when got some examples, currently making bluetooth looms

Ah great im still trying to figure out more data

Sent from my F3111 using Tapatalk

[domtorredo]

Right shame again
Looks like id is not code related
Found this
If same code is used again it keeps last byte and adds a new one
Like this
AA BB next one will be BB XX
Ah and there is protection too
On continuous id request radio goes in radio safe mode but not setting a counter and not changing timer just in unusable state, power off completely and its back to normal.

Sent from my F3111 using Tapatalk

[domtorredo]

Work stopped at this point
There isnt any reply to request messages
So no code can be pulled over can bus.
Useful information pulled from all this

Screens and radio are tied together with ID which gets assigned when code is set.

(Current work) If ID can be located in dumps then dumps can be married with 3rd party software.

Units with known code can stay in car as ID can be pulled out over can bus. (still needs more testing)


Anyone got any ideas or suggestions is it worth going further or lets stick with what available now.




Sent from my F3111 using Tapatalk

[domtorredo]

An update again
Found id in tid screen dump
And it matches can bus transmitted one.

soulman did you fancy a bit head scratching?

Got bytes from cd30 blaupunkt which somehow makes up an id
But haven't figured out yet how

Will double check if these bytes are transmitted over can maybe will narrow down something from 13 bytes which i got now


Sent from my F3111 using Tapatalk

[soulman]

sure dom.. send me the info to look for.. will have a play at weekend, also still need to message you about the insignia stuff... just been too busy building looms