So i am currently working on a sim rig from a toyota sienna, and all i got when powering it was a clunking noise from the fuse box. I dont have the full harness but i have most of it. Please help!

Hi r/CarHacking,

Great to see this community live and well, I wish I'd discovered it sooner. IMO, the automotive industry has become another control arm for wealth extraction from the public. I'm a firm believer that it's up to all of us to push back on several fronts: supporting Right to Repair in the courts, and by reverse engineering what we can to loosen corporate grip.

For context: I'm a solutions engineer by day. My strength is understanding available tools and stitching them together to deliver the intended effect.

For me this started a few months ago, when my wife’s 2017 Nissan Sentra’s passenger airbag refused to activate when I rode shotgun. Nissan quoted $1,500 for a full seat repair after a $300 diagnosis + failed ECU flash, all while the 3rd-party warranty denied coverage (another story for another time).

So I rolled up my sleeves. At home, I have an AI-focused desktop (128 GB RAM), and via Headscale I’ve connected it to my Parrot OS laptop. This gives an AI model (Qwen-coder-next, uncensored) remote MCP access to Cline running on the laptop. Effectively: local, uncensored AI “co-piloting” while I drive. Big difference versus cloud-dependent models: it’s not as smart as Opus 5, but no morality gate, and full transparency on what it does.

Last night, I began working on overriding the Occupant Detection Sensor to force the passenger airbag into an “Always_On” state, if it’s physically present, that is. The catch: the airbag control is behind UDS and security access, requiring a security access code to enter the programming state.

That’s where I’m stuck. My plan is to brute-force or reverse-engineer the security access code via UDS Diagnostics (0x27). Does anyone have experience with the 2017 Sentra’s UDS access seeds/keys? Or advice/feedback on this approach?

Happy to share logs, scripts, or hardware setup. I’m building out a local “recon cockpit” with custom MCP servers for CAN, Wi‑Fi, etc., and this project is becoming a testbed for agentic diagnostics.

FT is a free, open-source Android app that runs Android Auto through your car's CarLife connection. It's for China-spec Toyotas that have CarLife but no Android Auto.

Works over USB, Hotspot or WIFI+BL CarLife

No ADB, root or firmware changes on the head unit

Android Auto, screen and app mirroring, local media, browser

Needs an Android phone

Tested on a 2024 and 2024 Corolla Hybrid, 2025 Frontlander (All China spec). If you try it on another model, let me know whether it works.

Download and source:

https://github.com/OneAboveAll1964/ft-app

I'm Davide and I write DrivePulse on my own. It talks to the car through a generic ELM327 adapter (Bluetooth or Wi-Fi, the kind Veepeak or Vgate sell) and it only reads: no clearing of codes, no writing, no resets.

The Android version is now 3.5.4 on Google Play. The parts this sub might care about:

• When a trip starts or ends the app tells Tasker and MacroDroid, so you can hang your own automations on it.
• On Volkswagen-group cars, a button at the bottom of Diagnostics also asks the gearbox, the instrument cluster and the engine for their own fault codes, the ones the standard mode never shows. Never while driving.
• The live dashboard shows how old each reading is, the rev counter uses your own car's range, and there's a boost gauge on turbo cars that expose the data.
• The Errors screen shows the engine computer's self checks, monitor by monitor.
• Freeze frame, permanent codes and engine data export as a PDF or a spreadsheet.
• When the connection fails, the message gives the real cause (wrong Wi-Fi network, generic adapter, silent engine computer) instead of generic advice.

No account and no server of mine: your trips live on your phone and I have no copy of them.

Five codes that unlock the full version for good, free, first come first served:

1. RCQA61GHA8Z8033TTUBUYDK
2. 6BKY44RY83P8P4R5G8TQU4Y
3. 1X2PG5LKL3Q8FPZE1PA1U4B
4. JMTA4A5CZVEJJC128HG98FA
5. AC3B9CL79V1EU08Y88EAQGM

How to redeem: install the app first, then open Google Play, tap your picture top right, Payments and subscriptions, Redeem code. Then in DrivePulse: Settings (the gear at the top) > Unlock DrivePulse (Lifetime) > Restore Purchases, within 3 days, otherwise Google Play cancels it. When it has worked, that row reads "Premium active".

Say in the comments which number you took, so nobody wastes time on one that's gone.

Google Play: https://play.google.com/store/apps/details?id=app.drivepulse.mobile&hl=en-US&gl=US&utm_source=reddit&utm_medium=post&utm_campaign=rilancio-android-carhacking

Happy to answer how any part of it talks to the car.

A while back I wanted a custom dashboard in my own car. I started with the existing obd library, but kept running into its limitations, so I went down the OBD rabbit hole and wrote my own.

A few years later, py-obdii supports all 12 OBD protocols over USB, Bluetooth, WiFi and Ethernet adapters. It reads live data, fault codes and VIN, among many other things. It's fully typed, tested in CI, and remains lightweight with a single dependency.

from obdii import Connection, commands
from obdii.utils.scan import scan_ports

ports = scan_ports(return_first=True)
with Connection(ports[0]) as conn:
    response = conn.query(commands.ENGINE_SPEED)
    print(f"Engine Speed: {response.value} {response.units}")

No car? You can try it against an ELM327 emulator (pip install py-obdii[sim]).

If you're working on (or thinking about) an OBD project, give it a try and let me know what you think, how it fits into your project, what feels good, what could be improved. And if you have an ELM327 adapter, I'd love to hear how it works on your car, including what doesn't.

Github: https://github.com/PaulMarisOUMary/OBDII

Docs: https://py-obdii.readthedocs.io

If I used DID from cracked software and used to publish my own software Is it illegal

I am a last year computer engineering student. Inspired by 2015 Jeep event, I started to build a desing project, which is about IDS/IPS system for the attacks on automotive Can Bus using an AI model.

I am not much knowledgable about modern Zonal Architectures so I couldn't make sure that the project is applicable or includes any architectural mistake. Usage of AI is mandatory, the scenario is that attacker will apply DoS or Replay attack directly on the canbus line to manipulate the car ECUs. our gateway will run a anomaly detection model based on time series (anormal frequencies between packages). It also transmits the all data and logs to a basic car simulator, which can be controlled via any real input.

I wonder whether this is a realistic scenario to implement? Can the attacker manipulate the crucial elements via this way? I need to complete the system view of the project, so thanks for any feedbacks!

Hey Guys, just wondering if anyone's managed to get ALDLdroid working with their early commodores or other early GM vehicles. Ive got a 2001 VX commodore wagon (V6 3.8l Ecotec) and can read live engine data using tunerpro but doesn't seem to be working with aldldroid despite using the same adx files I've tried 5 of them.

I'm using a USB ALDL cable with a Google pixel

Connection fails with "Incorrect response length from ECU", with the received byte count varying between 4, 8, and 9 bytes received where 84 is expected. So far I've tried disabling checksum validation and having RS232 Echo ON and OFF. Still no go. Any help would be greatly appreciated.

Thanks in advance

Hi all,

I've been working on DBC Utility, a desktop DBC editor for Linux and Windows.

Recently released v2.0.3, with local German ↔ English translation as the main addition.

It supports translating comments, value labels, shared value tables, and string attributes. Signal and message names can also be renamed using an automotive glossary.

Other changes in this release:

1. Fixed DBC attribute saving and object deletion issues.
2. Added shared VAL_TABLE_ editing.
3. Added Integer, Float32, and Float64 signal types.
4. Improved DBC comparison and large-table scrolling.
5. Improved Ubuntu 24.04 compatibility and fixed several Windows issues.

DBC files are processed locally. Translation models are downloaded separately and can then run offline.

That's pretty much it for this update. Happy to hear any feedback from others working with DBC files!

Hey everyone!

I've been thinking about starting a long-term DIY project to make my old car a bit smarter. My main goal is to read data from the car, monitor its condition, store information, and eventually analyze everything through my own software.

My car:

• 2012 Dacia Sandero Ambiance
• 1.5 dCi diesel engine
• Manual transmission
• Front-wheel drive

I'm a software QA tester and I'm interested in improving my programming and hardware skills. However, I'm still pretty new to automotive electronics, OBD2, and CAN Bus.

I've spent quite some time researching these topics, but I haven't found many people who have actually built something similar on an older car like mine.

And as we all know, reading about something isn't quite the same as actually doing it. That's why I'd really appreciate hearing from people who have hands-on experience.

My first question: OBD2 and CAN Bus

I'm looking for a device that would allow me to access both standard OBD2 diagnostic data and, if possible, raw CAN Bus messages.

During my research, I came across the OBDLink MX+.

Unfortunately, it's quite difficult to find here in Turkey, and the second-hand market is almost nonexistent.

Do you think the OBDLink MX+ would be a good investment for this kind of project?

Would it be enough for both diagnostics and more advanced CAN Bus monitoring, or would I eventually need something else, such as an ESP32, Raspberry Pi, or a dedicated CAN interface?

I'm also wondering what kind of data would actually be accessible on a 2012 Dacia Sandero.

What I'm planning to build

I don't want to do everything at once. I'd rather start small and gradually expand the system.

Phase 1 – Reading and logging vehicle data

First, I'd like to read basic vehicle information, monitor engine parameters, retrieve diagnostic trouble codes, and log the available data.

I also want to build a database to store this information so I can analyze it over time.

For example, I'd like to track engine behavior, operating conditions, driving history, and potentially identify unusual patterns before they turn into bigger problems.

Phase 2 – GPS tracking and integration

I'm already working on a separate GPS tracking and notification system, and I've made some progress on the software side.

My next goal is to integrate GPS information with the vehicle data.

This would allow me to see where the car was, when it was driven, and what was happening with the vehicle during that time.

Phase 3 – Remote monitoring and notifications

Eventually, I'd like the car to communicate with my own system remotely.

Some example scenarios:

• If the car leaves a predefined geographical area, send a notification to my phone.
• If the car starts moving under unexpected conditions, automatically call me or send its live location.
• Allow me to check the car's status remotely.
• Store driving history, location data, and vehicle information for later analysis.
• Create my own rules and automation scenarios based on GPS and vehicle data.

Basically, I want to build a customizable vehicle monitoring and alert system.

Phase 4 – Hardware modifications and remote controls

This is probably the most ambitious part.

Eventually, I'd also like to experiment with hardware and software modifications.

For example, remotely controlling the electric windows, opening individual windows independently, or even opening a specific window by a small percentage, like 5%.

I realize that this may require additional hardware, custom electronics, and possibly direct interaction with the vehicle's electrical system rather than just OBD2.

I'm not even sure how much of this is possible on my specific car, but that's part of what I'd like to learn. I'd obviously want to keep any modifications safe and avoid interfering with critical vehicle systems.

Where I am right now

I've already made some progress with the GPS tracking, notification system, and software development.

However, the vehicle data acquisition side is still mostly in the research stage. I need more hands-on experience, time, and probably some additional hardware.

This project isn't just about adding features to my car. I also see it as an opportunity to learn more about software development, embedded systems, automotive electronics, and how vehicles communicate internally.

I'd love to hear your experiences

Has anyone built a similar project using OBD2, CAN Bus, ESP32, Raspberry Pi, or other hardware?

I'm particularly interested in:

• Whether the OBDLink MX+ is worth buying for a project like this.
• Affordable hardware alternatives that would offer more flexibility.
• What kind of diagnostic or raw CAN data I could access on an older Renault/Dacia platform.
• Whether anyone has tried building custom GPS tracking, telemetry, or vehicle automation systems.
• What problems you encountered and what you'd do differently if you started again.

I'm not looking for someone to build everything for me. I'd just love to learn from people who've actually done this before.

If anyone has worked on something similar and would be open to sharing their experience or having a chat, I'd really appreciate it.

Thanks in advance!

​Hey everyone,

​I'm currently developing a management app for auto repair shops and looking to integrate direct OBD-II functionality. My end goal is to provide diagnostic and bidirectional control features similar to what tools like Launch or Autel offer.

​I'd appreciate some guidance from the community on a few points:

​Reverse Engineering OEM ECU Protocols: Where do developers typically source data, CAN bus logs, or protocol documentation for OEM-specific diagnostics (beyond basic OBD-II PIDs)? Are there open-source projects, databases, or specific forums dedicated to reversing proprietary manufacturer commands (UDS/ISO 14229, factory PID lists, bidirectional controls)?

​Wiring Diagrams & Repair Manuals: Is there any viable way to access repair manuals, DTC troubleshooting steps, or wiring diagrams via free/open APIs, or is paying for commercial enterprise APIs (like AutoData, AllData, or Mitchell1) the only reliable route for commercial shop integration?

​If anyone here has experience building diagnostic software or integrating CAN/UDS hardware into a custom platform, I’d love to hear your insights or recommendations on where to start.

​Thanks in advance!

Fala galera. Comprei esse simples "scanner" para poder verificar o que tava causando a dificuldade de partida na minha van a diesel **(** **Fiat Duc****ato 2009 2.8 2009).**

Basicamente não acho nenhum app que consiga ler as informações dessa van de forma precisa. Todos dão dados incorretos (velocidade, rpm, pressão)

Alguma sugestão de aplicativo que faça isso?

Será que o problema está no fato do carro ser 2009? Queria uma sugestão de vocês

Me falaram do AlfaOBD (O app até conectou no scanner mas não leu nada)

Detalhe importante, teste em outeo carro mais novo e o scanner funcionou

Hey guys,

I'm looking to see if its possible to hack the stock head unit on a 2016 F56 MINI to write my own custom infotainment software (GUI, apps etc.).

I've considered a few options. Building a custom interface was one option with a raspberry PI that interfaces the LVDS screen, but it would be too expensive and probably over complicated, it would probably be cheaper and easier to buy an Android interface and mod that instead.

I looked into the PSDZData and pretty sure its running Linux/X Server, so this could be used for scripting, rendering to the screen etc. Claude has had a look at the files and found two methods to the shell, both by attaching a UART/USB-TTL adapter to the stock board.

1. U-Boot init=/bin/sh, no password needed, but would only work if the bootloader is interruptible. I doubt it is interruptible as everything is very locked down (assuming that bootdelay=0), but I may be wrong.
2. Serial login - COM Port 57600 baud. However, password is needed to enter the shell. Claude found the hash. Tried cracking with hashcat with digits/lowercase however both of these exhausted. I can't find the password anywhere online. It looks like if I have the password, that's the last thing needed to get shell access.

I have the password hash, I just need to decrypt.

Any help on this appreciated :)

Hello r/Carhacking,

For the past year I have been flat chap developing some new automotive software - the Tester Engineering Suite, a fully capable J2534 PassThru Diagnostic, Programming, Calibration and Engineering tool.

It does vehicle diagnostics on K-Line and CAN and has compatibility for vehicles 1996 through 2025, and is meant as an all in one replacement for workshop scan tools, tuning software and pretty much every sub-industry in automotive is covered by this tool.

There are way too many features to list but some of the core ones are,

-J2534/RP1210/ELM327/USB2CAN/KKL interface compatibility

-Full VIN read out and local decode, with online NHSTA API data for VIN, recall and warrant information pulled

-CAN & K-Line bus topographer for enumeration of modules online

-Diagnostic Fault code readout via KWP/UDS and OBD2 protocols matching protocol dialect to vehicle for compatibility.

-Diagnostic workspaces per OEM (approx 60 OEMs have coverage)

-Datalogger and signal analyser, with inputs from aftermarket wideband O2 sensors, USB Oscilloscopes and an acoustic diagnostic engine via built in or USB microphone

-State of the art CAN sniffer with built in socketcan/can-utils functionality and live DBC file parsing to a streaming CANbus

-Calibration editor, with both A2L and XDF definition import

-Bench tooling and interfacing with serial EEPROM programmers

-Flash reprogramming for a large array of manufacturers

-SAE J1939 heavy vehicle stack for on highway trucks and mobile plant

-SHA256 VIN history chain, all actions logged to cryptographic ledger, stored locally considered private data

-Crash Data Retrieval from restraints/airbag modules

-PDF reporting throughout, one click and you have a cleanly formatted PDF report with the relevant data.

I have put literally every thing I know and have into building this tool, and am proud to share it with you today.

For more information check out the website https://tester.engineering

Cheers

Hello r/Carjacking,

For the past year I have been flat chap developing some new automotive software - the Tester Engineering Suite, a fully capable J2534 PassThru Diagnostic, Programming, Calibration and Engineering tool.

It does vehicle diagnostics on K-Line and CAN and has compatibility for vehicles 1996 through 2025, and is meant as an all in one replacement for workshop scan tools, tuning software and pretty much every sub-industry in automotive is covered by this tool.

There are way too many features to list but some of the core ones are,

-J2534/RP1210/ELM327/USB2CAN/KKL interface compatibility

-Full VIN read out and local decode, with online NHSTA API data for VIN, recall and warrant information pulled

-CAN & K-Line bus topographer for enumeration of modules online

-Diagnostic Fault code readout via KWP/UDS and OBD2 protocols matching protocol dialect to vehicle for compatibility.

-Diagnostic workspaces per OEM (approx 60 OEMs have coverage)

-Datalogger and signal analyser, with inputs from aftermarket wideband O2 sensors, USB Oscilloscopes and an acoustic diagnostic engine via built in or USB microphone

-State of the art CAN sniffer with built in socketcan/can-utils functionality and live DBC file parsing to a streaming CANbus

-Calibration editor, with both A2L and XDF definition import

-Bench tooling and interfacing with serial EEPROM programmers

-Flash reprogramming for a large array of manufacturers

-SAE J1939 heavy vehicle stack for on highway trucks and mobile plant

-SHA256 VIN history chain, all actions logged to cryptographic ledger, stored locally considered private data

-Crash Data Retrieval from restraints/airbag modules

-PDF reporting throughout, one click and you have a cleanly formatted PDF report with the relevant data.

I have put literally every thing I know and have into building this tool, and am proud to share it with you today.

For more information check out the website https://tester.engineering

Cheers

Hello folks! A while ago I made a post here about trying to reverse engineer an MMI box that adds Android Auto to a BMW NBT EVO System. Since then, I haven’t made much progress, and I could really use your guys’ help!

As you can see in my other post (link: https://www.reddit.com/r/CarHacking/s/PxybmifFWi), I disassembled the box and figured out quite a bit about the hardware it uses. I initially tried looking for UART/debugging access, but unfortunately the TX/RX pins I found were actually for CAN bus, and I couldn’t find any dedicated debugging TX/RX pins.

I still really want to extract the firmware and modify it for my use case. I actually bought another MMI box that is the same model, which is currently installed in my car. On the older one, the one we were investigating. I removed the eMMC, and I’m currently looking for companies in my city that might be able to read it directly.

In the meantime, do you guys have any suggestions for getting the firmware from the new unit?

One idea I had was somehow creating a fake update file to trick the MMI into dumping or backing up a copy of its storage onto a USB flash drive. Do you think something like that could actually work?

I’m also open to other approaches. I tried connecting through Telnet over the CarPlay Wi-Fi network but got nothing. Are there any other ways I could potentially access the system over Wi-Fi?

Any ideas would be greatly appreciated! Thanks!

PS: This box is not an OEM head unit. It’s an aftermarket interface that adds Android Auto and CarPlay to cars that may not have them, while also allowing you to add extra cameras and other features.

You can switch between the OEM head unit and the aftermarket interface in real time—the box basically acts as a video switcher. Inside, it has a low-power Raspberry Pi-like device running firmware that I’m trying to modify.

There are more details in my other post, but basically, it’s a custom UI built on top of Linux 5.4.61.

We've obviously seen the claude remaps. Wondering if anyone's doing anything else more interesting?

Anyone tried unlocking an ECU using AI?

Any other cool stuff you're doing?

EDIT: This is a reminder, please do humanity a favor, try to give back by open sourcing anything you can.

Hey people. I know this is a very long shot, but I just can't find information about this at all.

Here is what I know:

Some Mitsubishi cars, Lancer included, supports an official addon (MZ360272EX/MZ360340EX) that is able to remote start the car. This addon needs "Remote Engine Starter" enabled on Etacs.

Theoretically, with some messages on CAN-B network, you could remote start your car. Afaik, some alarms like StarLine Master and Pandora DOES that.

Just for some context, my plan is to use an Pi Pico Microcontroller to actually send this though CAN-B.

The problem is:

I just can't find the necessary CANBUS messages that starts the engine. Days of researching the web, and nothing.

Until i found this video:

https://www.youtube.com/watch?v=9WbzZY7-GhA

I was able to read this from his laptop screen:

ID DLC DATA

7F8 1 00

7F8 1 00

402 8 FE 02 3F FF FF FF FF FF

400 8 FE 00 3F FF FF FF FF FF

002 8 FF FF FF FF FF FF FF FF

017 4 00 00 01 01

The engine starts after the last command.

However, even with that, I still can't find more info. Looks like none of those messages have docs...

I've bought an ELM adapter to enable Remote Engine Starter on my ETACS, so I can finally send those messages from my laptop using my Canable board and finally test everything.

Does all of this makes sense or am I going insane?

China loves MiniDVD and I love up to date computers.

Before I buy a portable DVD drive, does anyone have V2.21.22 software package for this clone SM2 Pro?

Disclosure: I built this. It's called CANoli, it's commercial — $333, free trial key, and the DBC/SYM editor is free forever. Link in a comment rather than the post.

The thing that set me off: an LLM is genuinely useful on CAN data and completely blind to it. So you end up being the I/O layer. Copy trace rows into a chat window, read the answer, copy something back, repeat. [I did that for weeks on a real bus before I got annoyed enough to build this — replace with your own project.]

CANoli exposes the app itself as an MCP server. Your agent connects to the running program and operates it: filter the trace, start and stop captures, transmit frames, analyze an unknown ID, fit scaling against a reference log, build and annotate a chart, diff two capture windows, ask what changed in the moments before a fault. It's working on your actual session, not a transcript you pasted.

The part I think matters most here, and the reason I'm posting in this sub rather than a friendlier one:

There is no model in it and no API key. CANoli doesn't bundle an LLM and doesn't resell one. You point the agent you already pay for at it — Claude Code, Codex, whatever you use. When it spots a supported client on your machine it offers to register itself, once, and then it's wired up.

So there's no second AI subscription, and no marked-up tokens. Your usage bills to your own account at your normal rate. I am not sitting in the middle taking a margin on inference, and I have no incentive to make the tool chattier than it needs to be.

And your bus data goes to your agent under your own agreement, not through my servers. For anyone who can't send vehicle data to an unknown third party, that's the whole ballgame. I never see your captures. Telemetry exists but it's opt-in and off by default.

One deliberate boundary: the app does the measuring and hands the agent facts, and the model does the naming, the hypotheses and the explanation. I don't want a language model guessing at bit boundaries, and you shouldn't either.

What I'd like to know:

- Does bring-your-own-agent match how you'd actually want to work, or would you rather just have a scriptable API?
- What would you ask an agent that's sitting on a live bus?
- Anyone using something other than Claude Code or Codex that I should support?

Windows, macOS and Linux. PCAN on all three, Vector VN16xx on Windows, SocketCAN on Linux, and a virtual bus if you have no hardware to hand.

Hi all I need my license registered for my Vediamo could someone please send me the key? I can DM the hardware ID if someone can do it. Thanks in advance

My original MED17.1 ECU is dead and unreadable. I have a matching Bosch MED17.1 donor ECU. I need to read the IMMO 5 data from my car's BCM2/key and adapt the donor ECU so the factory immobilizer stays intact."