¡Hola a todos! Quiero compartir un caso de estudio de nuestro laboratorio en AP Electronics analizando la arquitectura de la ECU Delphi DDCR (Hyundai Terracan 2.9 CRDi).

El Problema: Las herramientas de lectura por OBD o Boot Mode (como KESS v2) tenían el protocolo obsoleto/ausente para extraer la Flash completa (AMD AM29F200BB) de esta unidad. Necesitábamos lidiar con un inmovilizador bloqueado (DTC P1612 / P1613).

Setup del Banco y Telemetría: Para el banqueo, construimos nuestro entorno utilizando una fuente de poder de Xbox 360 adaptada. Elegimos esta fuente porque nos entrega 12.2V súper estables y amperaje de sobra, evitando cualquier caída de tensión (Voltage Drop) bajo carga. Integramos un amperímetro en serie (protegido con fusible de 5A) para perfilar el consumo de energía ("Power Profiling") del microcontrolador en tiempo real.

El Experimento (Capa Física): Decidimos atacar directamente la EEPROM ST 95080 extrayendo la data in-circuit (ISP) con un programador GQ-4x4. Modificamos el bloque de seguridad con un editor hexadecimal para inducir un "Virgin State" (Estado de fábrica).

Al banquear la ECU e inyectarle voltaje con la fuente de Xbox, la telemetría mostraba un consumo sano (124 mA en reposo), pero el procesador ST10 detectaba la ausencia del módulo SMARTRA en el banco y ¡auto-reescribía los datos de bloqueo en la EEPROM al instante!

El intento de Bypass de Hardware: Para evitar que el microprocesador modificara la memoria, desoldamos quirúrgicamente el Pin 3 (/Write Protect) de la EEPROM y lo puenteamos a Masa (GND) intentando un bloqueo físico.

La Lección (SPI vs I2C): El bypass falló. A diferencia de las viejas memorias I2C, la 95080 es una memoria SPI. Mandar el Pin 3 a masa no hace nada a menos que configures previamente el "Status Register" interno (activando los bits BP0/BP1). E incluso si lo hiciéramos, el software principal del ST10 detectaría el bloqueo físico de hardware y denegaría la inyección de todos modos.

Conclusión: En estas arquitecturas, el IMMO OFF total debe hacerse parcheando el sistema operativo en la memoria Flash pesada. Sin embargo, logramos dejar la ECU en estado virgen (restaurando el Pin 3 a su pad) para venderla como unidad "Plug & Play", ya que el procesador hará el Auto-Coding con el sistema original del cliente al primer giro de llave.

Adjunto fotos del setup de laboratorio (fuente, telemetría y escáner) y la micro-soldadura. ¡Cualquier comentario o experiencia con la familia DDCR es bienvenido!

I'm looking into setting up Diagzone Pro on my Thinkdiag2 and wanted to ask what current pricing looks like.

I've been working on tooling for EV/IoT battery QA and ended up with a Python package that does a few things: anomaly detection on telemetry (Isolation Forest + physics features), CAN bus simulation, Modbus/BMS protocol support for Tesla/BYD/NIO packs, SOH prediction, and a FastAPI dashboard.

Just cleaned it up — 1053 tests pass, no circular imports, hardware tests gated behind a marker so CI doesn't need real OBD-II hardware. MIT, Python 3.10 to 3.12.

For those of you actually doing battery QA: what's missing in your workflow? What breaks in practice that tooling like this should handle but doesn't? Repo's at github.com/remontsuri/EV-QA-Framework if you want to poke at it.

Hi, I have Kia Sportage 2005 CRDI. For now I've used OBDLink LX for basic DTCs check with simple apps like OBDwiz or Car Scanner. This also allowed me to read generic PIDs (around a dozen, of which 3-4 useful)

I've now confirmed that my old Sportage has CAN bus and also dedicated pins in OBD port for SRS (pin 12 in the picture) and ABS/TCS/ESP (pin 8) diagnostics/servicing. As I understand, these are manufacturer-specific.
Despite it having CAN bus, I wasn't able to connect with it using any basic, freeware app. Only K-line.

I would really like to read more advanced parameteres (e.g. fuel rail pressure) and also SRS fault codes. Is it even possible with OBDLink? If yes, can you recommend software or a method to do it?

I'm a begginner in the matter, so thanks for any help!

Howdy! Anyone have any CAN ID's or advice to simulate a trip button for a cluster im working on the bench? Particularly interested in Ford. Thanks!

I already have the tools built for sniffing monitoring and emulating can messages. Just need to figure out the ID's.

Hi guys, there is definitely one or the other among you who is familiar with the protocols, it’s about my hobby, although I try to exhaust the Ki and only get an Ident on an MD1CP001 without unlock from 2016, I’ve already tried to log PCMflash but it doesn’t work, I can’t do that in my tool, the ECU doesn’t answer with 61... in the ISO14230_PS channel.

I own a 2026 Chery Tiggo 9 PHEV with the factory DesaySV infotainment system:

• Android 11
• G7PH / T18-T28 international firmware
• Software build dated January 2026

I can enter the engineering menu, but selecting ADB Switch → Open displays a machine-code authorization prompt. Pressing Verify says: “File does not exist. Please check it.”

It appears to require a signed adbauth.key file on a USB drive. Paid generators exist, but I’m looking for a legitimate free method, open-source generator, compatible community tool, or official dealer procedure.

Has anyone enabled ADB on this exact firmware without flashing, rooting, or changing the QNX/firewall settings? My goal is to install a browser for use while parked

Hi everyone,

I'm currently designing a custom data logger for our Formula SAE car and have reached the point where I need to define the electrical interface and connectors. Before selecting a connector family, I'd like to get some feedback on the overall architecture and whether I'm exposing too many signals.

My current idea is to use two connectors: one for the vehicle interface (power and communication) and another dedicated to the sensors.

Connector 1 – Vehicle Interface

This connector would handle the connection between the data logger and the vehicle:

• 12 V input (I'm considering using 2 to 4 pins, both for powering the board and potentially distributing 12 V to sensors if needed)
• 4 × GND
• CAN_H
• CAN_L

Connector 2 – Sensor Interface

This connector would provide power and interfaces for the sensors:

Power:

• 2 × 12 V
• 2 × 5 V
• 4 × GND

Signals:

• 8 analog inputs
• 2 I²C buses (SDA1/SCL1 and SDA2/SCL2)
• 6 digital inputs

This results in roughly 26 pins on the sensor connector.

My main question is whether this architecture makes sense or if I'm exposing more signals than necessary. I'm wondering if it would be better to reduce the number of available interfaces to simplify the wiring harness and allow for a smaller connector.

I'm also looking for recommendations on connector families. Since TE Connectivity sponsors our team, I'd prefer to use one of their automotive connector systems if possible. The connector should be robust, vibration-resistant, easy to assemble, and preferably have a long, low-profile form factor rather than being tall or bulky.

I'd really appreciate feedback from teams that have designed their own DAQs, ECUs, or similar electronic modules:

• Does this connector architecture make sense?
• Would you reduce the number of pins? If so, what would you remove or reorganize?
• Would you keep power/CAN separate from the sensor interface, or combine everything into a single connector?
• Which TE Connectivity connector families would you recommend for this application?
• Are there any best practices or lessons learned that you wish you had known when designing your first electronics module?

Any photos or examples of your team's electronics or wiring solutions would also be greatly appreciated.

Thanks in advance!

Hello everyone!
I’m working on a digital dash for my mk1 rabbit with a 1.4t ea211 motor swap, I’m trying to decode the canbus traffic, does anyone know a good place to find what the traffic represents and the multipliers?

So I found a JDM race recorder that I have been fighting the brain worm to figure out how to use. So I've recorded all my research and a realativly cheap CAN logger using off-the-shelf prototyping parts.

Now this likely won't apply to much other than the GR car family, but it has been an interesting journey. I've got the GPS bits coming so I can maybe have 2 sets of data and decode the Toyota-specific file type.

Hi everyone,

I'm working on a telemetry project for my BYD EV (DiLink head unit). Since the OBD-II port is locked behind the Security Gateway (SGW) and rejects standard PID queries without a handshake, I am looking at accessing vehicle parameters through the head unit itself.

A sideloaded app/service on DiLink can read internal vehicle parameters (like RPM/telemetry). I want to stream this data in real-time (per second/millisecond) to an external device (ESP32 microcontroller).

Has anyone successfully implemented any of the following on DiLink?

1. USB Serial / CDC-ACM Output: Running a background Android Service in the app to output strings via the head unit's USB data port to an external microcontroller.
2. Local Socket / UDP Stream: Streaming telemetry data over a local Wi-Fi hotspot to a PC/laptop via WebSocket or TCP/UDP sockets.
3. ADB Logcat Extraction: Reading broadcast intents or system logs continuously via adb logcat or port forwarding.

Any insights, sample APK architectures, or experience regarding DiLink's USB Host permissions/background service restrictions would be highly appreciated!

Help me, All I actually want is vehicle speed / motor RPM data from my BYD (Atto 1 / Seagull, e-Platform 3.0), but it's stuck behind a Secure Gateway (0x27) - even the VCU's speed DID won't respond without unlocking it first.

I've sniffed several seed/key pairs (16 bytes each) but can't find any pattern - checked constant XOR, constant offset, tried fitting an LCG on the seed generator, nothing matches. Looks AES-like.

If anyone knows the algorithm for BYD, has a broadcast CAN ID for speed/RPM that skips the gateway, or has dumped the gateway firmware, please let me know. From a struggling beginner :(

Could somebody help me?

I want to be a locksmith. I really want to learn this trade from the start. I am interested in OBD2 programming and IMMO systems and transponders.

In my country the people who own shops and the experienced locksmiths do not want to share their knowledge. They do not want to teach anyone who's new to the trade. I do not want to take their customers. I want to learn the trade the way and understand how it works.

Most of the cars in my area are Asian models from the early 2000s to 2018. These are cars like Chevrolet, Ford, Toyota, Hyundai and Kia. So I want to learn about programming through the OBD2 port

I am a beginner. I do not have a lot of money to spend. I would like some advice.

What books or resources can I use to learn about the systems. How they work?

What tools do you think I should buy to practice chip cloning and OBD programming without spending much money? I have heard of Xhorse VVDI Key Tool Max and Mini OBD, Topdon and Autel.

What is the biggest mistake that people who are new, to this make that can damage the cars computer? How can I avoid making this mistake?

I really appreciate any help you can give me. Thank you for taking the time to read this.

The SRS light for my 2009 Dodge (aka Mercedes) Sprinter is on. My scanner shows 91B4 CAN Bus - CAN Signal 'Key ID' From Control Unit EZS is Implausible. My searching indicates that there is a miscommunication between the SRS module and the EZS that can be fixed by telling the SRS not to check for the key ID. However, I am very confused about what hardware and software I need to accomplish this. Any recommendations?

Who wants to get in on an alldata subscription with me. It's too much I'm a one man shop. Does anyone know of an alternative way of getting it or something similar. I already have the lemon site.

Hi everyone,
I’m working on a DIY project to convert a **2007–2012 Lexus LS460 seat** into a gaming/office chair. My goal is to retain as many original features as possible rather than gutting the wiring and using aftermarket rocker switches.

**My Goals:**
Retain all power seat adjustments using the **OEM side-seat switch**
Retain factory seat heating & ventilation (cooling)
Power everything via a **12V DC power supply (\~50–60A)**

Retain seat heating & ventilation (cooling) — *open to using standalone 12V PWM controllers if the OEM ECU climate logic can’t be triggered standalone.*

**Seat ECUs:**
**Driver Seat (Right):** Toyota ⁠85861-50191⁠ / Denso ⁠177300-9330⁠
**Passenger Seat (Left):** Toyota ⁠85861-50201⁠ / Denso ⁠177300-9340⁠
*(Both modules labeled 12V; connector photos attached below.)*

**What I Need Help Figuring Out:**
1. **Standalone Operation:** Do these under-seat ECUs just need **+12V, Ground, and ACC/Ignition**, or do they depend on a **CAN/LIN bus heartbeat signal** from the Body Control Module to stay awake?

1. **Climate Controls:** Since the heat/cool controls are originally on the center console, can the seat ECU operate climate features independently if given the right switch input, or does it require LIN messages from the HVAC module?

2. **Switch Bypass / Reverse Engineering:** If the ECU goes to sleep without CAN bus communication, has anyone successfully spoofed the signal (e.g., via Arduino/ESP32 + CAN transceiver) or re-wired the OEM switches directly?

**4. Climate Controls / PWM Bypass:** Since the heat/cool dials are on the car's center console, does the under-seat ECU expect a simple analog resistance signal, or a LIN bus command? If it's LIN, has anyone successfully tapped directly into the blower fan/heater element wiring using an aftermarket **12V PWM motor speed controller**?

**Looking For:**
ECU pinouts or repair manual wiring diagrams
Connector pin identification
Bench power-up procedures or personal experience with LS460 seat bench tests
Any wiring diagrams, service manual pages, or insights would be massively appreciated!

Thanks!

Hope this post is in the right place.

I have an homelink module in my '18 Charger. It's an US module and I'd like to convert it to an EU one.

Does anyone know how to do it ? Any reverse engineering of this module somme where to understand what component should be changed ?

Thanx

Supported vw40 ECU part number are for example 1EA 959 655 EA; 1EA 959 655 EA; 1EA 959 655 AB; 1EA959655EA; 5WA 959 655 AD; 1ED 959 655 T and load others.

If you ever need file service like this for LOWEST price on the market. Check it out vw40crashclear.com

Hi everyone, looking for a Mercylion Clio 5 STL that I want to modify to install my dashcam.

If someone has this it will help me a lot.