I'm trying to read the interior CAN bus (CAN-B, 83.3 kbps) on a Mercedes C-Class W203 using an ESP32 (built in TWAI controller) and an SN65HVD230 transceiver module (the WCMCU-230 board, VP230 chip). I tap the CAN pair at the radio connector.

The problem: I get absolutely nothing. Zero frames and zero bus errors, at both 83.3k and 500k, and with either wire polarity.

What I already verified. I ran a TWAI loopback self test (NO_ACK mode, self reception through the board's onboard 120 ohm) and it received its own frames perfectly, 39 in a row, no errors. So the ESP, the TWAI controller, the transceiver TX and RX, and the wiring between ESP and transceiver are all proven good. A raw digital read of the RX pin on a live bus shows it sitting almost always high with only tiny noise blips, so no framed traffic is reaching the pin.

Then I measured the actual CAN wires at the radio. There is no continuity between them (no 60 ohm termination), and the idle levels are about 0.5V and 4.5V, not 2.5V and 2.5V. That looks like low-speed fault-tolerant CAN (ISO 11898-3), not high-speed.

Here is where I'm stuck. The author of a well known W203 CAN project told me high-speed transceivers read fault-tolerant CAN-B just fine in normal operation and that he used a TJA1050 without issues. So the transceiver type may not be the blocker. My board has a 120 ohm termination resistor (R2) permanently between CANH and CANL. Low-speed fault-tolerant CAN is supposed to be terminated with 500 ohm to 6k per node, never 120 ohm, so I suspect that 120 ohm is overloading the weakly driven low-speed bus and collapsing the signal. The SN65HVD230 datasheet also rates the bus pins for only -2V to +7.5V, which matters if CANL actually sits near 11V when dormant.

My questions. Has anyone read Mercedes interior CAN-B with an ESP32 plus a plain high-speed transceiver like the SN65HVD230 or TJA1050? Is the onboard 120 ohm the likely culprit here, and should I just remove it for a mid-bus tap? Or is there something about reading low-speed fault-tolerant CAN with a high-speed transceiver that I'm missing? Any help appreciated, I've been going in circles for days.

Hi everyone,

I'm currently building an MQB testbench on my desk to sniff CAN data. My setup includes:

• MIB2 Unit: 3Q0 035819 C
• Gateway (J533): 5Q0 907 530 E
• BCM (J519): 5Q0 937 084 AJ

The Problem: Im using an Arduino with an MCP2515 on the Convenience CAN bus to wake up the system. Currently, I am injecting 0x3C0 with payload 0x03 (Terminal 15 ON). However, because my BCM is connected and doesn't see a physical key turn, it is aggressively broadcasting 0x3C0 with payload 0x00 (Ignition OFF). The Gateway forwards both conflicting messages to the Infotainment CAN, causing my MIB2 screen to constantly flash on and off.

My Questions:

Does anyone know the specific CAN ID and payload for the Steering Column Electronics (J527) or KESSY module that simulates the physical key turn / Terminal 15 ON command on the Convenience CAN?

Thanks in advance for any help or pointers to relevant .dbc files :)

Am in the stage of developing the software of my Can sniffer, {Esp32 + sn65hvd230}, i succeed gaining raw can bus data, BUT i want to upgrade t the level of diagnostic scanner,
So am learning about Licenses and ISO communication Protocols, The thing is that am a totally beginner, and this step will have direct treatment with ecus,
So am seeking some resources about this and how to develop this kind of communication, it will really take my device to a next level, ill be thankful to receive some resources and guidness.

I’ve been looking at autel and foxwell I need a reader that can program a Ecu if I replace it and that could read Srs codes any suggestions please and thank you

I don’t know much about cars but I’ve been telling my friend that I don’t remember any pink bits when I last put the OBD in.. I did research on ai and he still thinks I’m just being overly paranoid.

New things I noticed that he brushed off
* new beeping sound
* beeping sound coming from the driver side
* beeping sound stops when he walks away with the key
* max speed @ 50km started showing
* EPC light came on
*am I overly thinking things or is there like some sort of glue residue out of the obd holes
* there’s a loose item somewhere where I can hear it occasionally when driving
* battery drain in car

Also I’m aware that the original Audi wiring are wrapped in black? No? Correct me if I’m wrong

Hi, I followed this tutorial (https://logos-red.com/blog/how-to-hack-a-car-wirelessly-sending-remote-commands/ ) on how to get can bus data from the obd port. Assuming i soldered everything correctly, why am I not seeing anything on SavvyCAN? I used the esp32 and I tested it on a Golf 8.5 GTI, the gateway behind the obd port blocks the sniffing or there is something else in the tutorial I used? Using another microcontroller would help?

Hi guys,
Honestly I read most of what exists online about these modules, but my BCM module from my XC90 D5 suddenly threw "Brake failure stop safely" + ABS + anti-skid, speedo dead. VIDA shows CEM-1A5F (communication with BCM missing), BCM not visible on network. I cleared all DTCs in VIDA — nothing else comes back, only the no-connection to BCM. No accident, no water damage, fault appeared out of nowhere.

Before blaming the module I checked the car properly:

12V at BCM connector supply pins with ignition on and off, grounds OK, all fuses OK (checked both sides with meter)
Checked all CAN wiring related to BCM in the car including at the CEM connector - all good
CAN at BCM plug seems alive: 2.6V / 2.3V idle
Termination checks out: ~130 Ω harness side, ~135 Ω module side (2×62 Ω internal), ~60 Ω together
VIDA talks to ECM/TCM fine through the CEM
Connector cleaned, pins good

So the car is 100% healthy. Then I opened the module (cut the welded case) and put it on the bench (12V to pins 1/32/4, GND to 16/47). Findings:

Draws stable 225 mA @ 12V - wakes up, no shorts
Resoldered all the press-fit pins first (the usual weak point) — no change
All rails present: 12V, 5V (at the ASIC), 3.3V + 1.8V for the MCU. The 3.3/1.8 come from the 14-pin Motorola 9369.1D — I measured it: 12V in, both rails out, two switch pins running ~47 kHz. So on my board this chip is WORKING (I know it's the famous killer on modules marked MK60 (or MK25) - not my case)
Crystal oscillates, 5.50 MHz stable
The MCU (TI TMS471 R1VF34A2PZQ) is definitely running - several pins show digital bursts repeating about every 1 second, looks like a fault/retry loop
B82790 CAN choke windings OK (0.4 Ω)
But the module NEVER transmits. I scoped the choke pads (ASIC side) through multiple power cycles with normal trigger - total silence, not even one attempt at boot. Same at pins 11/15.

So by elimination everything in the chain is good except the CAN transceiver section inside the big ATE ASIC 0990-9377.1D3 (5CC6L7TB, made by TI). It has 5V, it has a running MCU next to it, and it never says a word.
I know what most people will say - send it for professional repair, and I've read all the recommendations. But I'd rather fix it myself than spend that money. I enjoy soldering, I have hot air and decent equipment, and I have time to experiment. Worst case I learn something and the pro repair option is still there.
My questions:

Can anyone confirm the CAN physical layer in these Volvo units is inside the 0990-9377? Does anyone have any pinout info for this ASIC (CANH/CANL to the choke, TX/RX from the MCU, enable pin)?
Has anyone actually fixed the "no communication but everything else runs" by swapping the 9377? Or does this signature usually mean the CAN peripheral in the TMS471 itself (bond wires)?
Is there some init handshake between the TMS471 and the ASIC (SPI config, enable, EEPROM check) that can fail and keep CAN dead like this?

Photos of the board and my best take at making a schema attached. Thanks in advance - happy to do more measurements if someone tells me where to probe.

Cracked SecurityAccess seed and key on the Kefico CPEGD ECU (TriCore based) in a 2014 Veloster Turbo 1.6 T-GDI, verified live over CAN, and also believe that I understand flash checksum algorithm so patched calibration files validate correctly. I'm coming at this from the reverse engineering and embedded side rather than a traditional tuning background so go easy on me if I'm missing something obvious, but I think this is solid progress on a platform that doesn't have much public documentation, only expensive commercial solutions.

I would love to compare notes with anyone else working on Kefico or Hyundai/Kia ECUs, and would really appreciate any OEM bins from other years, trims, or calibration IDs, or any documentation like A2L files, XDF definitions, or disassembly notes.

Thanks!

Hello everyone,

Has anyone found a way to unlock SFD1 on VW vehicles?

I'm trying to make a few coding changes on my car. I have a clone VCDS, which is able to retrieve the SFD challenge token, but I don't have a way to complete the unlock.

For my use case, paying €180/year for an OBDeleven subscription just to unlock SFD once or twice doesn't make much sense. I'm mainly looking for a free or at least a cheaper alternative.

If anyone has found another method or knows of a service/tool that can do this without the yearly subscription, I'd really appreciate it if you could share it.

Thanks!

​

I've been working on an app off and on with Google since I can't seem to find the type of app that I've been looking for for quite some time, I have it posted up on GitHub and I would really like it if you guys could take a look at it and give me any feedback for changes that I can make or new features that I can implement. This is the first app that I've ever made, so please go easy on me and any help would be greatly appreciated.

https://github.com/Freshman0000/OBDash

I have an APK I have a version of the app that I can email to you if that's something that you're interested in.

If any of you have been using AI to work on an app, I'm sure you're already aware that even though it's helpful, it's still a pain in the ass to try to get it to do the things that you want. Especially look the way you want. So, it's taken me a little bit longer than I had originally anticipated. Like, by three months.

I’ve been working on a project inspired by the TurboXS DTEC, an early-2000s tuning device that used a Game Boy Advance as its display and interface.

The idea was to take that general concept and do something similar with a DS, using a homebrew ROM running on the original hardware.

The current prototype uses a cheap ELM327 adapter to retrieve live vehicle data, which is sent to the DS over a custom link. At the moment I’m working with data such as:

* Vehicle speed

* RPM

* Coolant temperature

* Battery voltage

The longer-term goal is to move beyond the generic OBD interface and interface directly with the vehicle CAN bus, allowing the DS to receive more detailed vehicle data.

Still very much a work in progress, but I thought it would be interesting.

I've been working on a personal app project and testing it with a vLinker MC. It's working well to capture OBD2 and CAN bus data, but I'd like to test it with generic ELM327 or other devices to see if there are any compatibility differences I should address before publishing. If you've experienced any problems with specific brands or models of OBD2 adapters, regardless of which software you're using, I'm interested in learning which one. Unwanted disconnections, buffer problems, pairing issues, or similar issues in particular.

As an aside, I've yet to find an adapter that supports both OBD2 PID and raw CAN at the same time. Is this just not possible?

Selling a new and unused Lexus NX(2015-2017 ) Lexion Linux Monitor for CarPlay® and Android Auto™

Ordered it in and didn’t even up installing.

Save a few hundred off the website price.

This will work on Lexus NX(2015-2017)
Vehicle Controller Type - Touchpad

Comes with AHD Rear Camera as well.

[https://lexionautomotive.com/lexion-lx10s-carplay-monitor\](https://lexionautomotive.com/lexion-lx10s-carplay-monitor)

Upgrade your Lexus with the Lexion LX10S—the world’s first Linux-based CarPlay monitor. Swap your outdated 7inch stock screen for a stunning 10.25-inch wide, high-res display. Enjoy lightning-fast 5–10 second boot times, seamless CarPlay and Android Auto, and premium Mark Levinson sound through factory Bluetooth. No SIM, no YouTube distractions—just a safer, smarter ride. Fully supports aftermarket cameras and all stock features at an unbeatable price.

Linux-Powered Performance: Linux OS monitor, 5-second boot

Stunning Display: Upgrades 7inch to 10.25inch wide screen.

Seamless Integration: Full CarPlay® and Android Auto™ support

Premium Audio: Factory Bluetooth delivers flawless sound.

Easy Install: Plug-and-play, retains all OEM functions.

Will ship anywhere in North America, asking $500 Canadian or $350 US.

Message me

Selling a new and unused Lexus NX(2015-2017 ) Lexion Linux Monitor for CarPlay® and Android Auto™

Ordered it in and didn’t even up installing.

Save a few hundred off the website price.

This will work on Lexus NX(2015-2017)
Vehicle Controller Type - Touchpad

Comes with AHD Rear Camera as well.

[https://lexionautomotive.com/lexion-lx10s-carplay-monitor\](https://lexionautomotive.com/lexion-lx10s-carplay-monitor)

Upgrade your Lexus with the Lexion LX10S—the world’s first Linux-based CarPlay monitor. Swap your outdated 7inch stock screen for a stunning 10.25-inch wide, high-res display. Enjoy lightning-fast 5–10 second boot times, seamless CarPlay and Android Auto, and premium Mark Levinson sound through factory Bluetooth. No SIM, no YouTube distractions—just a safer, smarter ride. Fully supports aftermarket cameras and all stock features at an unbeatable price.

Linux-Powered Performance: Linux OS monitor, 5-second boot

Stunning Display: Upgrades 7inch to 10.25inch wide screen.

Seamless Integration: Full CarPlay® and Android Auto™ support

Premium Audio: Factory Bluetooth delivers flawless sound.

Easy Install: Plug-and-play, retains all OEM functions.

Will ship anywhere in North America, asking $500 Canadian or $350 US.

Message me

hello everyone

Can anyone suggest a free online course for diesel engines diagnostics ??

thank you

Bonjour, je vous serais très reconnaissant si quelqu'un pouvait télécharger ces fichiers pour moi. Je suis bloqué avec 25 ans de base de données Audi, mais elle ne contient pas les fichiers dont j'ai vraiment besoin... Si quelqu'un pouvait m'aider, que Dieu le bénisse. :

https://mhhauto.com/attachment.php?aid=281579

https://mhhauto.com/attachment.php?aid=714536

Hi,

I have a question about a car ECU. I bought an ECU from a Mercedes W205 C220 CDI. I downloaded the wiring diagram from the internet, and based on it I identified the required pins (I tried to upload pictures showing the pinout). I connected +12 V, IGN, and GND to a laboratory power supply. I also connected CAN High, CAN Low, GND, and +12 V to an bought OBD2 connector. I tried to connect to the ECU using a diagnostic scanner (autoscan - older version), but I couldn't establish communication.

Does anybody have experience with this ECU or know what I might be missing?

I have the autel maxipro mp808.

Hello, i need help with making the launch x431 smartlink show up as an option to select in fdrs device manager, so I can scan vehicle

Hi everyone,

I'm looking to purchase a used car privately and would like to use an OBD scanner that will help me detect mileage discrepancies and check that the VINs on the modules all match the cars actual VIN. This will hopefully help me from clone vehicles. But I can't seem to find the me that's suitable that I can get on Amazon next day delivery or a store in the UK. The only one I can find is CARLY but they don't have next day delivery and not available next day delivery on Amazon either.

I require a scanner such as Carly, OBDEleven, etc that have a small scanner, and an app. The reason is that I'm not sure how to use the complex scanners that mechanics and diagnostics use. Is there anything that can help me?

Hello everyone, I have recently been diving into the UDS part of my cluster. I only have the cluster as of now, (im a teenager i only have so much money ;-;) and I have somewhat been able to get uds to work. That was 3 days ago, the UDS now doesnt work. I need to know exactly what every pin is for, to find a solution to this, as I am also trying to emulate a J533 on a arduino paired with a MCP2515. Any help would be appreciated, thank you!

Pins I already know:
Pin 1, 12v +
Pin 10, Ground
Pin 17, Can L
Pin 18, Can H

Ingles

Hello everyone,

I'm trying to reverse engineer the Engineering Mode authentication of a 2025 MG ZS 1.5 Petrol (Europe).

Software version:

DS04A_ZS11_MCE3_EUUK_VAVE_20240604_593_V

The old passwords such as:

1234@ABCd

1234ABCd

200519

no longer work.

The unit now requests an 8-digit numeric PIN.

Every time I open the Engineering Mode screen, it displays a different 3-digit number (for example 972, 431, etc.).

After more than one year testing, I noticed that some 3-digit values eventually repeat, so it appears to be a challenge-response authentication rather than a fixed password.

I have already researched:

- XDA Developers

- MGEVs

- MG4 Forum

- GoingElectric

I also found the old MG4 Engineering Password Generator created by Tommaso Vietina, but it does not work with this new MCE3 platform.

I'm NOT looking for random passwords.

I'm looking for technical information.

Has anyone:

• Reverse engineered the DS04A / ZS11 MCE3 FICM?

• Extracted the Engineering APK?

• Found the 8-digit PIN algorithm?

• Obtained the firmware package?

• Used SIPS or VNCI with this infotainment unit?

I can perform tests on my own vehicle and provide photos, videos or any requested information.

Any technical information would be greatly appreciated.

Thank you.

______________________

Español

Hola a todos.

Estoy intentando analizar el sistema de autenticación del Modo Ingeniería de un MG ZS 1.5 gasolina 2025 (Europa).

Versión del software:

DS04A_ZS11_MCE3_EUUK_VAVE_20240604_593_V

Las antiguas contraseñas como:

1234@ABCd
1234ABCd
200519

ya no funcionan.

Ahora el sistema solicita un PIN numérico de 8 dígitos.

Cada vez que abro la pantalla del Modo Ingeniería aparece un número diferente de 3 cifras (por ejemplo 972, 431, etc.).

Después de más de un año realizando pruebas, he comprobado que algunos de esos números vuelven a repetirse con el tiempo, por lo que todo indica que se trata de un sistema de autenticación tipo "challenge-response" y no de una contraseña fija.

He investigado en:

- XDA Developers
- MGEVs
- MG4 Forum
- GoingElectric

También encontré el antiguo generador de contraseñas del MG4 desarrollado por Tommaso Vietina, pero no funciona con esta nueva plataforma MCE3.

No busco que alguien me diga una contraseña al azar.

Lo que busco es información técnica.

¿Alguien ha:

• Analizado el FICM DS04A / ZS11 MCE3?
• Extraído el APK del Modo Ingeniería?
• Descubierto el algoritmo que genera el PIN de 8 dígitos?
• Conseguido el firmware de esta unidad?
• Utilizado SIPS o VNCI con este sistema multimedia?

Puedo realizar cualquier prueba en mi vehículo y aportar fotografías, vídeos o cualquier información adicional que sea necesaria.

Mi objetivo no es modificar sistemas críticos del vehículo. Únicamente quiero comprender cómo funciona este nuevo sistema de autenticación del Modo Ingeniería y acceder a las opciones avanzadas de configuración del sistema multimedia.

Cualquier información técnica será muy bienvenida.

Muchas gracias.