[Ovmsdev] UDS write by identifier help

Mon Oct 25 20:50:21 HKT 2021

Shane,

hint: disable logging in the web shell (checkbox in the upper right) 
during command sessions.

Yes, that does look now like you need security access.

The actual key generation can be quite simple. On the VW e-Up et al, you 
simply add a PIN code to the seed:
https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3/blob/master/plugin/v-vweup/ecutoolkit/xvu-ecu.js#L328

…you "just" need to know the PIN codes needed for each device and access 
purpose. These PIN codes are in the service manuals, if you can get such 
for your car they could be worth a look.

Regards,
Michael

Am 25.10.21 um 14:36 schrieb Shane @ Kilve Engineering:
> Hi Michael,
>
> I have now switched to obdii requests
>
> Have now worked out the commands need to be sent quickly
>
> I now get
> OVMS# obdii can1 request device 735 7b5 1003
> 735[7b5] 1003: Response:
> 00 32 01 f4                                     | .2..
> I (57401468) webserver: HTTP POST /api/execute
> I (57401478) webcommand: HttpCommandStream[0x3f8b52a0]: 3499452 bytes free, executing: obdii can1 request device 735 7b5 2ee01040ea85ce
> OVMS# obdii can1 request device 735 7b5 2ee01040ea85ce
> 735[7b5] 2ee01040ea85ce: ERROR: request failed with response error code 33 securityAccessDenied
>
> So obviously do need security so have now done a
> OVMS# obdii can1 request device 735 7b5 1003
> 735[7b5] 1003: Response:
> 00 32 01 f4                                     | .2..
> I (64032248) webserver: HTTP POST /api/execute
> I (64032258) webcommand: HttpCommandStream[0x3f8b5268]: 3499932 bytes free, executing: obdii can1 request device 735 7b5 2701
> OVMS# obdii can1 request device 735 7b5 2701
> 735[7b5] 2701: Response:
> 3a 07 4e 87| :.N.
>
> And get a seed back :-)
>
> But without access to a services device I guess its going to be hard 
> to work out the encryption !
>
> Regards
> Shane
>> On 25 Oct 2021, at 12:46, Michael Balzer <dexter at expeedo.de 
>> <mailto:dexter at expeedo.de>> wrote:
>>
>> Shane,
>>
>> not sure why you don't use the OBD request command for this instead 
>> of manual frame assembly.
>>
>> However, regarding writes to PIDs:
>>
>> - You may need another session type. Most cars now won't accept 03 as 
>> a session with PID write access, but expect some custom session type 
>> to allow that. The NRC 7F means "serviceNotSupportedInActiveSession" 
>> (btw: the OBD command translates the most common NRCs for you), which 
>> is a hint you need another session.
>>
>> - You normally don't need tester presence if you send the request 
>> shortly after the session init. Most devices will keep a session 
>> logged in for at least 60 seconds, custom session types may expire 
>> faster. Use a script if in doubt, or start a tester presence signal 
>> using the "re obd tester" subcommand.
>>
>> - I doubt you do, but if (!) you really need security access (request 
>> 27), that will normally work differently. See section 9.4 in the ISO 
>> document: you need to create a key from the seed given by the server. 
>> So you need to know how to calculate the key, which normally involves 
>> some non-obvious encryption method. You may be able to derive the 
>> method from looking at CAN logs of a service device gaining access.
>>
>> I would try other session types first.
>>
>> Hint: you can use a script to walk through a range of session types 
>> and try the write after each one.
>>
>> See: 
>> https://docs.openvehicles.com/en/latest/userguide/scripting.html#ovmsvehicle 
>> <https://docs.openvehicles.com/en/latest/userguide/scripting.html#ovmsvehicle> 
>> → OvmsVehicle.ObdRequest(arguments)
>>
>> Be aware that's a synchronous call, so don't let the loop run for 
>> longer than 60 seconds to avoid the watchdog.
>>
>> Regards,
>> Michael
>>
>>
>> Am 25.10.21 um 11:06 schrieb Shane @ Kilve Engineering:
>>> Hi all,
>>>
>>> Can anyone give me some help trying to write data to the TPMS ecu?
>>>
>>> I can read for example FL tyre using
>>> can can1 tx standard 735 03 22 e0 10 00 00 00 00 (FL id e010 FR e020 
>>> etc.)
>>> And get back 07 62 e0 10 80 2d b9 d4
>>>
>>> I have confirmed that the tyre id is "80 2d b9 d4” with a tmps 
>>> reader wireless at the wheel
>>>
>>> I have then done a session control with
>>> can can1 tx standard 735 02 10 03 00 00 00 00 00
>>> And get back 06 50 03 00 32 01 f4 00
>>> So that looks ok ?
>>>
>>> So I then try
>>> can can1 tx standard 735 07 2e e0 10 40 ea 85 ce (the new id)
>>> And get back 03 7f 2e 7f
>>>
>>> So ive tried issuing
>>> can can1 tx standard 735 02 27 01 00 00 00 00 00
>>>
>>> But get no response??
>>>
>>>
>>> any pointers?
>>> p.s. do I also need to be sending tester present to the ecu? Or does 
>>> the fact im doing a session control take care of this?
>>>
>>>
>>> Regards
>>> Shane
>>> _______________________________________________
>>> OvmsDev mailing list
>>> OvmsDev at lists.openvehicles.com <mailto:OvmsDev at lists.openvehicles.com>
>>> http://lists.openvehicles.com/mailman/listinfo/ovmsdev
>>
>> -- 
>> Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal
>> Fon 02333 / 833 5735 * Handy 0176 / 206 989 26
>>
>>
>> _______________________________________________
>> OvmsDev mailing list
>> OvmsDev at lists.openvehicles.com <mailto:OvmsDev at lists.openvehicles.com>
>> http://lists.openvehicles.com/mailman/listinfo/ovmsdev
>
>
> _______________________________________________
> OvmsDev mailing list
> OvmsDev at lists.openvehicles.com
> http://lists.openvehicles.com/mailman/listinfo/ovmsdev

-- 
Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal
Fon 02333 / 833 5735 * Handy 0176 / 206 989 26

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openvehicles.com/pipermail/ovmsdev/attachments/20211025/d86154e7/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 203 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openvehicles.com/pipermail/ovmsdev/attachments/20211025/d86154e7/attachment-0001.sig>