How do you know ? Did every single brick factory in our plane of existence and beyond stopped their production line while you were filming and editing ?
You're a good teacher Paul and make tech fun! Canbus reminds me so much of how modbus and profibus works, why did you use 16bits when on savvy can it says 8 for the data length? Super curious.
Do you mean 8 bytes for the data length of an ID, 2 bytes of which (16 bits) indicated the voltage. Remember, I'm new at this! I also notice you bring up modbus a bit. Also, you especially are going to love my next video later this week :)
@@TradieTrevIt's maths mate! Hex is simple. Look up my video on hex. Also, next video will have a guest electrician in it. Nothing fancy like your stuff though.
Once you dissect the valuable info and remote start function of the new car you should also make a video of you creating the sensors to get that functionality into home assistant. I use onstar2mqtt to remote start my Bolt EV but I would love to switch to esp32+can bus of some sort. Edit: although your remote start might be behind firewall like mine. But it's Chinese so prolly not ;)
@@TallPaulTech Haha, dangers of the trade I guess! 😁 I can confirm the products we design are used world wide and is part of the support and aftermarket service chain for big vehicle makers. Great work on the topic. Will have to look into the usbip, seems really interesting and gives some nice potential for products.
@@TallPaulTechYea, for some reason all the big VCI-networks use coded or sometimes even encrypted data packages (I look at you BMW). 😬 Mostly mumbo jumbo unless you have the vehicle-vendors proprietary CAN DBC file or reverse engineering. I (and the company I work for) only do the hardware + drivers (and minimal software) to interface to the bus, not the decoding/handling of the data. 😢
next episode: using usbip i'll demonstrate how to make nice 64x64 px images out of Starlink's constellation from the comfort of your own couch by manually placing each of swarm node over night sky using this simple Python script ;d bonus: presentation of some niche image processing library grabbed from abandoned github repo abandoned 13 years ago allowing to create reversible pixel art that from Earth you'll see image of Mario, but when looking from the Moon it would be Pikachu actually awesome content, i am not always into tech-creative videos but when i am, i watch TPT ^^
This opens up a whole new way of doing canbus stuff not just EV related but even with ICE cars and so much more (as you mentioned Tesla Powerwall uses canbus) I think some people are still stuck on the idea that canbus is automotive only. Great video, keep this type of content coming. Warm regards from Port Elizabeth, South Africa
1. If you have a car diagnostic, it would be easy to find ID's. Just sniff the communication between the car and the diagnostic tool. 2. Watch the data streaming and just unplug the module, and you will no longer see packets from that module. 3. Snifing the network and changing the values and states of the switches in the car, controllably 4. Send a CAN message to a car with a certain ID and value and look for changes.
You can buy multi-brand diagnostic tools, or just buy an official VCI (Vehicle Communication Interface)... they are just expensive, there is nothing secret about it.
One guess how you could start to figure out which ID corresponds to the voltage is to use a similar ID how cheat engine on Windows is used to find the corresponding memory addresses for variables in Windows games. You can start to narrow the ID:s down through property based testing. For example, while charging, you know approximately how much the battery voltage is going to go up over time. Now you just go write a program to filter out all the ID:s which are not matching the expected upwards trend. So after doing that you might only have a few ID:s left, so you would probably have to repeat the similar experiments to narrow it down to one ID.
This is beautiful. Wonder if you can also enable / disable features. What would need to happen to make the data bidirectional in terms of read/write? Also, how difficult would you say one can brick their Teslas with these experiments?
Nice! I have no idea how people find what values means what sometimes, the advice is always simple, like "oh see what changes when you roll down the window", then they forget the rest of the owl and show things like "rear car tire pressure on last tueday scaled to 3^2" on a value that never changes.
One way to narrow down where the messages come from is to set up a dual CAN interface that bridges all packets then MiTM the various modules on the bus. Eg you can narrow down messages coming from the LBC by MiTMing the LBC at it's CAN bus interface and observing outbound packets. Looking forward to doing more of this with my Leaf soon when my new USB CAN adapters arrive. Thanks for the tip for the AliExpress one in your other video BTW :)
Many of the Tesla values were decoded and documented because there is a canbus viewer in diagnosticMode on the model S MCU. Take the MCU out of a model S play back a CAN capture and browse the messages as you filter the playback. Good luck with the BYD.
In the US there is a legal requirement (was?) to have a standardised OBDII port for service info. This means that at least for petrol cars there is a whole string of standardised data packets that an ICE car producer has to supply. There may be an extension of this standard to EV's and if there is you may want to make enquiries first and compare that data with what you're seeing before you put in too much primordial effort.
This is the best video I've found so far on how to interface to the CANBUS on Tesla, I have a Tesla Model 3, 2020. I want to pick up the following signals, Left/Right Indication, Brakes, Lights and Reverse, any suggestion on how I identify the codes for these?
Great video! I envy your approach to tinker around with such expensive equipment. I also have a Tesla but I'm not yet brave enough to connect to it's can network like that. But in the past already retro-fitted cruise control to a car that never had one using data from canbus so I'm not a strager to that. Great work and looking forward to more videos from this topic!
Running HA on the Pi Zero would be a bad idea. Push messages to your MQTT broker running on different hardware is better. Or.. do as the rest of us.. Run TeslaMate and don't look back :P
That’s really cool. Nice to see the walk through. Can you do a detailed one from start to finish that we could use on any CANbus system. Say Nissan motors or BMS batteries talking to each other. And how to figure out, or where to search the decoding of the messages to find out what they are. I’m sure there are documents for that. I also would like to see the OTA USB
There's foam around it in that hole so that it doesn't rattle. That plug isn't generally used when servicing the car, because most diagnostics can be displayed on the internal display and the car also sends diagnostic info over its cellular connection. That connector is essentially just for backup.
I am interested in hacking an Atto3. I have a written off Atto3 that we can mess with as much as we want. Let me know if you are interested. I am also in Qld and have done other cars already (MG, Imiev, EC11 Van)
cool video. I have just set up a raspberry pi zero 2 w running GQRX sweet. I did have to overclock to 1200mhz, increase swap file size to 1024, install zram and set the desktop to 720p. I even installed VNC and now can remote into the SDR Pi (that lives in my shed) over wifi and tune around. I did also set up a bluetooth speaker as well. on another raspberry pi zero 2 w project, I have one running Openwebrx+ and just use a web browser to access the web page and decode anything on the SDRplay tuner card. My third raspberry pi zero 22 w project had a 1Tb SD card streaming media via minidlna server. I even enabled web page browsing of the media directory so users can watch films via the web browser or on a smart tv with dlna. These pi zero 2 w are a great little cheap pc.
I remember helping one out when I was about 16 because he had a broken finger. The only thing I learned was that Lada Nivas fall apart when you touch them.
Have you found this device reliable? I have a Raspberry Pi 0 W, the USB adapter only stays up for 5 seconds then all the lights except power go out and the can0 device is removed from the operating system, unplugging and plugging in again restores can0 but I then have to initialise it again...any advice?
My Tesla Model 3 is 2020, the panel under the display looks different and I don't have the same connectivity or at least I don't think I do there, where else can I hook into the CAN Bus?
I'm having so much problems getting the USB device to be stable and reliable, can you please help, I have Ubuntu 22.04 as a Virtual Machine, I connect to the Raspberry Pi 0 W with ssh. I can see when I power up that all the Lights on the USB CAN module are on for approx.8 seconds, then they go out and only the RED LED is left on, but there is no can0 listed when I type ip link....
@@TallPaulTech I reformatted the SD card with Raspbian 11 and did all the configuration for the usbip and it all works, so I won’t update because I think it was a buggy update that messed everything up.
hi, i just getting started with canbus, so please maybe you can help me with a link or a reference to find the information to decode canframes for an specific vehicle?
Looking at the data flow at 9mins38sec, I think you have the wrong field for smaller significant volts, I wager it's field 1big2small not 1big0small. Field 2 creeps up from 57 to 58 ... To 5A in those few seconds
Telsa has different arrangement on its new CyberTruck where the signals are propagated through an ethernet loop which is much higher speed... and I think the devices that are connected still use CanBus presumably wth some translator. Electrical power upgraded from 12V to 48V where they can now use smaller guage and less cable to transmit power saving significant amounts of copper/weight. You have to ask why haven't the car industry done this previously?
Tesla may need a high speed comms bus to reduce latency for many devices connected to bus... with sophisticated system in these cars eg autonomous driving, steer by wire, 4wheel steering etc etc probably 100s of connected devices on bus.
We all know why Tesla did it, but I suspect it's a case of legacy auto concerned with how 10's of 1000's of dealers and private shops might handle a 48V bus with all their legacy test gear. I think there will still be a demand for cars that at least have the user accessory bus at 12V.
I've heard allsorts of stories about people crashing the canbus causing airbag explosions and other bad things. Not sure how much truth is in the stories but it's enough of a risk that I've stayed away from such things.
It would however be super handy for gain of function and read data remotely. Some cars already have remote windows, door unlocking, window wash control etc, I suspect the TESLA does have a lot but most cars don't. I've also seen on a lot of older cars that its controlled over canbus so being able to simulate pressing buttons could also be used to add functions to older cars.
@@Invenciblemario This is exactly the learning process. If you are messing around with CANBUS, you CAN send the crash message on that bus. It might happen on accident by doing cat /dev/random > /dev/can0 but You can't say that you guarantee that nothing will happen if you do that.
Ah electric vehicles... fire crackers on wheels....if you smell smoke while in the drivers seat, don't bring out the fire extinguisher, just get out and RUN !
@@hubert06299 simple advice, don't watch the nightly news show when it comes to the information that many of the EV's are catching fire from run away thermal combustion, because they won't tell you about that.
@@zchannel5973Sure, EV fires are a lot worse than traditional car fires, but they're a lot more rare. Look up the statistics from an unbiased peer-reviewed report and stop falling for oil company propaganda.
@@TallPaulTech I did, but missed the part about it utilising socket can. That turns all the communication over Ethernet stuff from needlessly complicated into a pretty neat capability. That means theoretically you could even use a lot of the commercial can development software
No bricks were created during the making of this video.
How do you know ? Did every single brick factory in our plane of existence and beyond stopped their production line while you were filming and editing ?
@@fractalphilosophorum9405 ...there's always one
But was your Raspberry Pi bussed by Tesla?
😢 the dumb stay that way 😅
Pretty cool. Would be nice to have easy access to the car's current conditions without paying extra for it.
You're a good teacher Paul and make tech fun! Canbus reminds me so much of how modbus and profibus works, why did you use 16bits when on savvy can it says 8 for the data length? Super curious.
Do you mean 8 bytes for the data length of an ID, 2 bytes of which (16 bits) indicated the voltage. Remember, I'm new at this! I also notice you bring up modbus a bit. Also, you especially are going to love my next video later this week :)
@@TallPaulTech Yes, that's correct. My hex and binary math is total garbage and really need a refresher on it.
@@TradieTrevIt's maths mate! Hex is simple. Look up my video on hex. Also, next video will have a guest electrician in it. Nothing fancy like your stuff though.
Once you dissect the valuable info and remote start function of the new car you should also make a video of you creating the sensors to get that functionality into home assistant. I use onstar2mqtt to remote start my Bolt EV but I would love to switch to esp32+can bus of some sort. Edit: although your remote start might be behind firewall like mine. But it's Chinese so prolly not ;)
I work with designing CAN interfaces, why am I watching this on a saturday? 😂
The same reason I do network shit at all hours of the day!
@@TallPaulTech Haha, dangers of the trade I guess! 😁 I can confirm the products we design are used world wide and is part of the support and aftermarket service chain for big vehicle makers. Great work on the topic.
Will have to look into the usbip, seems really interesting and gives some nice potential for products.
I did a video on it. It's pretty basic really. Now, about that CAN info.... ;)
@@TallPaulTechYea, for some reason all the big VCI-networks use coded or sometimes even encrypted data packages (I look at you BMW). 😬
Mostly mumbo jumbo unless you have the vehicle-vendors proprietary CAN DBC file or reverse engineering.
I (and the company I work for) only do the hardware + drivers (and minimal software) to interface to the bus, not the decoding/handling of the data. 😢
@@DavidtheDoom I'm surprised some of them aren't encrypted by now.
next episode: using usbip i'll demonstrate how to make nice 64x64 px images out of Starlink's constellation from the comfort of your own couch by manually placing each of swarm node over night sky using this simple Python script ;d
bonus: presentation of some niche image processing library grabbed from abandoned github repo abandoned 13 years ago allowing to create reversible pixel art that from Earth you'll see image of Mario, but when looking from the Moon it would be Pikachu actually
awesome content, i am not always into tech-creative videos but when i am, i watch TPT ^^
That's what I like to hear.
excellent tool i was writing my own crap to do this
This opens up a whole new way of doing canbus stuff not just EV related but even with ICE cars and so much more (as you mentioned Tesla Powerwall uses canbus) I think some people are still stuck on the idea that canbus is automotive only. Great video, keep this type of content coming. Warm regards from Port Elizabeth, South Africa
1. If you have a car diagnostic, it would be easy to find ID's. Just sniff the communication between the car and the diagnostic tool.
2. Watch the data streaming and just unplug the module, and you will no longer see packets from that module.
3. Snifing the network and changing the values and states of the switches in the car, controllably
4. Send a CAN message to a car with a certain ID and value and look for changes.
If my auntie had balls she'd be my uncle
Step 1. Acquire proprietary stolen hardware
Step 2. Make a video and share it with the world that you own stolen property.
Step 3. ????
@@BGraves Change my name to Paula to get away with it?
You can buy multi-brand diagnostic tools, or just buy an official VCI (Vehicle Communication Interface)... they are just expensive, there is nothing secret about it.
@@TallPaulTech 2 3 and 4 doesn't require anything to be bought. But diag tools can be really cheap.
If my grandma had wheels she would be a bicycle
what's on the pi's microsd?
One guess how you could start to figure out which ID corresponds to the voltage is to use a similar ID how cheat engine on Windows is used to find the corresponding memory addresses for variables in Windows games. You can start to narrow the ID:s down through property based testing. For example, while charging, you know approximately how much the battery voltage is going to go up over time. Now you just go write a program to filter out all the ID:s which are not matching the expected upwards trend. So after doing that you might only have a few ID:s left, so you would probably have to repeat the similar experiments to narrow it down to one ID.
I have a question. Are you wearing pants when fimling this?
These are the big issues. You can see in the shot where I plug it into the car.
This is beautiful. Wonder if you can also enable / disable features. What would need to happen to make the data bidirectional in terms of read/write? Also, how difficult would you say one can brick their Teslas with these experiments?
Nice! I have no idea how people find what values means what sometimes, the advice is always simple, like "oh see what changes when you roll down the window", then they forget the rest of the owl and show things like "rear car tire pressure on last tueday scaled to 3^2" on a value that never changes.
👏👏👏 very good man!!
One way to narrow down where the messages come from is to set up a dual CAN interface that bridges all packets then MiTM the various modules on the bus. Eg you can narrow down messages coming from the LBC by MiTMing the LBC at it's CAN bus interface and observing outbound packets. Looking forward to doing more of this with my Leaf soon when my new USB CAN adapters arrive. Thanks for the tip for the AliExpress one in your other video BTW :)
my slug old leaf went from 11seconds to 5.7 ;) nippy city car
Many of the Tesla values were decoded and documented because there is a canbus viewer in diagnosticMode on the model S MCU. Take the MCU out of a model S play back a CAN capture and browse the messages as you filter the playback. Good luck with the BYD.
Diagnostic mode isn't readily available to me as far as I'm aware.
Legend. That was everything, cheers.
In the US there is a legal requirement (was?) to have a standardised OBDII port for service info. This means that at least for petrol cars there is a whole string of standardised data packets that an ICE car producer has to supply. There may be an extension of this standard to EV's and if there is you may want to make enquiries first and compare that data with what you're seeing before you put in too much primordial effort.
There is OBD port on Tesla. It's giving only necessary information, doesn't give full access to whole CAN network.
This hacker needs a hoodie, nice job sir.
This is the best video I've found so far on how to interface to the CANBUS on Tesla, I have a Tesla Model 3, 2020. I want to pick up the following signals, Left/Right Indication, Brakes, Lights and Reverse, any suggestion on how I identify the codes for these?
No, but I'll sell you a Model S
@@TallPaulTech Do you have any details on the adapter cable from your box which has a socket on it?
Great video! I envy your approach to tinker around with such expensive equipment. I also have a Tesla but I'm not yet brave enough to connect to it's can network like that. But in the past already retro-fitted cruise control to a car that never had one using data from canbus so I'm not a strager to that. Great work and looking forward to more videos from this topic!
Here's an idea: Run Home Assistant on the Pi, push the canbus data there, then you can display it on the Tesla touchscreen.
I have a better idea... rip the shitty computer out, and put an Aliexpress one in with a simple interface to control aircon/radio shit.
Running HA on the Pi Zero would be a bad idea. Push messages to your MQTT broker running on different hardware is better. Or.. do as the rest of us.. Run TeslaMate and don't look back :P
Remember, it's for sale if you want it @@mortenmoulder
That’s really cool. Nice to see the walk through. Can you do a detailed one from start to finish that we could use on any CANbus system. Say Nissan motors or BMS batteries talking to each other. And how to figure out, or where to search the decoding of the messages to find out what they are. I’m sure there are documents for that. I also would like to see the OTA USB
Impressive speed of work here Paul.
Cant say Im impressed with Tesls coming up with a different can bus plug and then just leaving it floating around to create a rattle in the dash
That's just how Tesla is
There's foam around it in that hole so that it doesn't rattle. That plug isn't generally used when servicing the car, because most diagnostics can be displayed on the internal display and the car also sends diagnostic info over its cellular connection. That connector is essentially just for backup.
There are probably enough nodes on the cars internal network that 1 extra 60ohm node wouldn't be enough to matter.
I've been looking for something like this for ages. Very interesting.
I am interested in hacking an Atto3. I have a written off Atto3 that we can mess with as much as we want. Let me know if you are interested.
I am also in Qld and have done other cars already (MG, Imiev, EC11 Van)
Mate, email me!
woooooooooooow
Ok, thats cool
Awesome vid
Maybe you will find an honest electric car next time.
Very interesting! Thank you for making this!
Canbridge that P100D , intercept VCU and inverter and turnit up !
just google it, someone probably has posted a list of the IDs, then try to write to the can bus as well. remote start etc :)
Find me them for a BYD.
@@TallPaulTech Baidu BYD CAN ?
This is great, thanks for sharing.
Seriously cool videos mate! Well done.
cool video.
I have just set up a raspberry pi zero 2 w running GQRX sweet.
I did have to overclock to 1200mhz, increase swap file size to 1024, install zram and set the desktop to 720p.
I even installed VNC and now can remote into the SDR Pi (that lives in my shed) over wifi and tune around.
I did also set up a bluetooth speaker as well.
on another raspberry pi zero 2 w project, I have one running Openwebrx+ and just use a web browser to access the web page and decode anything on the SDRplay tuner card.
My third raspberry pi zero 22 w project had a 1Tb SD card streaming media via minidlna server. I even enabled web page browsing of the media directory so users can watch films via the web browser or on a smart tv with dlna.
These pi zero 2 w are a great little cheap pc.
It would be nice if we could find a way to use the compute in the Tesla for fun stuff ;)
we already can :)
Can you share the canbus adapter you’re using?
Check previous video
You couldn't resist
You got me
Does that make you an auto-sparkie now? 😂
I remember helping one out when I was about 16 because he had a broken finger. The only thing I learned was that Lada Nivas fall apart when you touch them.
I'm very interested in what your find with the BYD.
I've heard the nanny state driver warnings have to be turned off every time, like in the Tesla. I'll have to find a way around that.
@@TallPaulTech That's true if you want to turn the "safety" features off but you can set them to warning mode and that will stick.
Brilliant!
Cheers
Do you have any spec on the 12 to 5 v convertor or will do?
If I wanted to send the data to website database, how would you do it?
it was 31kOhms not Meg ohms lol :D
Yes, but it doesn't matter in parallel with 60 omhs.
I realised that when editing. The concept remains though. At least you also said meg ohms and not megaohms. You must be old school.
He knows, he's just giving me shit.
Have you found this device reliable? I have a Raspberry Pi 0 W, the USB adapter only stays up for 5 seconds then all the lights except power go out and the can0 device is removed from the operating system, unplugging and plugging in again restores can0 but I then have to initialise it again...any advice?
You did take the resistor off didn't you?
@@TallPaulTech yes, I did that after I watched your video weeks ago
My Tesla Model 3 is 2020, the panel under the display looks different and I don't have the same connectivity or at least I don't think I do there, where else can I hook into the CAN Bus?
in the backseat behind the center console under the usb c ports there a plastic panel you can take off
@@James-cq9dp , I've connected to that, but its not as simple as just connecting, there are other variables such as connection speed.
I'm having so much problems getting the USB device to be stable and reliable, can you please help, I have Ubuntu 22.04 as a Virtual Machine, I connect to the Raspberry Pi 0 W with ssh. I can see when I power up that all the Lights on the USB CAN module are on for approx.8 seconds, then they go out and only the RED LED is left on, but there is no can0 listed when I type ip link....
I hope you don't have the termination resistor on do you?
@@TallPaulTech, No I removed immediately.
@@TallPaulTech I reformatted the SD card with Raspbian 11 and did all the configuration for the usbip and it all works, so I won’t update because I think it was a buggy update that messed everything up.
hi, i just getting started with canbus, so please maybe you can help me with a link or a reference to find the information to decode canframes for an specific vehicle?
Don't know, but if you find a good one, let me know
Check out r/CarHacking. There's some pinned threads in there that you may like.
Looking at the data flow at 9mins38sec, I think you have the wrong field for smaller significant volts, I wager it's field 1big2small not 1big0small. Field 2 creeps up from 57 to 58 ... To 5A in those few seconds
Tesla canbus traffic is no secret anymore.
I just never bothered to look at it before
Was probably leaked by a former Tesla employee
Openpilot project has completely reversed all this stuff back in 2018. Was just a lot of hard work! OpenDbc project has almost all the can messages.
Telsa has different arrangement on its new CyberTruck where the signals are propagated through an ethernet loop which is much higher speed... and I think the devices that are connected still use CanBus presumably wth some translator. Electrical power upgraded from 12V to 48V where they can now use smaller guage and less cable to transmit power saving significant amounts of copper/weight. You have to ask why haven't the car industry done this previously?
The previous standard was good enough. If it ain’t broke, don’t fix it.
Tesla may need a high speed comms bus to reduce latency for many devices connected to bus... with sophisticated system in these cars eg autonomous driving, steer by wire, 4wheel steering etc etc probably 100s of connected devices on bus.
We all know why Tesla did it, but I suspect it's a case of legacy auto concerned with how 10's of 1000's of dealers and private shops might handle a 48V bus with all their legacy test gear. I think there will still be a demand for cars that at least have the user accessory bus at 12V.
Scan my Tesla app has done all of this work for you - not sure why you'd want to reinvent the wheel?
Probably for Fun, and for learning. That would be my reasons.
That's like saying, why do anything if someone else has already done it.
Thanks @CubbyTech , installed... ✅
I've heard allsorts of stories about people crashing the canbus causing airbag explosions and other bad things. Not sure how much truth is in the stories but it's enough of a risk that I've stayed away from such things.
It would however be super handy for gain of function and read data remotely.
Some cars already have remote windows, door unlocking, window wash control etc, I suspect the TESLA does have a lot but most cars don't.
I've also seen on a lot of older cars that its controlled over canbus so being able to simulate pressing buttons could also be used to add functions to older cars.
Stop spreading FUD.
Are you writing to the bus?
If so, are you writing to a known id?
This is not black magic, stop spreading FUD.
@@Invenciblemario This is exactly the learning process. If you are messing around with CANBUS, you CAN send the crash message on that bus. It might happen on accident by doing cat /dev/random > /dev/can0 but You can't say that you guarantee that nothing will happen if you do that.
Ah electric vehicles... fire crackers on wheels....if you smell smoke while in the drivers seat, don't bring out the fire extinguisher, just get out and RUN !
@@hubert06299 simple advice, don't watch the nightly news show when it comes to the information that many of the EV's are catching fire from run away thermal combustion, because they won't tell you about that.
@@zchannel5973Sure, EV fires are a lot worse than traditional car fires, but they're a lot more rare. Look up the statistics from an unbiased peer-reviewed report and stop falling for oil company propaganda.
This is way to invalid warranty. Try own your risk
We always own our own risk
Also keep an eye out for DBC files.
googling: tesla DBC files
You're doing this the hard way. Get rid of the pi and get something that uses socket can which will go into savy and pro software like busmaster
Did you watch the video? That was SocketCAN and SavvyCAN.
@@TallPaulTech I did, but missed the part about it utilising socket can. That turns all the communication over Ethernet stuff from needlessly complicated into a pretty neat capability. That means theoretically you could even use a lot of the commercial can development software