[Ovmsdev] Tips needed for reverse engineering CAN bus

I am considering doing some work on an OVMS version for the iMiev/iOn/C-Zero, but am puzzled as to how the existing versions reverse engineered the CAN bus. I have lots of info about reading the status from the CAN bus, and I think this would allow all available features, but I wouldn't know where to start on the write-side. How have the current versions reverse engineered the commands required for setting features? Without an ability to set features there is little gained over the existing support and so little point doing the work. Matt Beard