11KW StreetScooter charger group hack

[crasbe]

Only thing left to crack is the CRC required. Some can logs are incoming so we should soon have everything we need to get these chargers operational.

Hit me up on Discord, when you got the logs. We can throw my CRC Cracker script at it.

[Jacobsmess]

I'm hoping to be of more use once I get my can logging setup working again.....

[Jacobsmess]

So i got my CAN setup running again finally...
Interestingly, sending the wakeup of 0x570 as per LRBens previous message I get the response (with the previous DBC file loaded in Savvycan)...
0x611 - ACDC_BMS_STATUS
0x612 - ACDC_BMS_FDBck
0x613 - ACDC_BMS_Temperature
0x614 - ACDC_BMS_FDBck2
0x6C0
0x6FF

On the PT Can. There's no response on the hybrid CAN.

So slightly different from Ben's ID response

[Jacobsmess]

So I finally got a canlog from a running vehicle.
Playing back the attached* I get the following IDs...
0x619
0x618 - BMS_ACDC_CONTROL
0x652
0x321 - SAS_HECU_SteerInf
0x06E - BMS_VCU_ICU_Status
0x430 - BMS_BCM_FcBck
0x485 - BMS_VCU_BatLim
0x00A - BMS_VCU_CrashState
0x185 - BMS_VCU_BatPackSum
0x285 - BMS_VCU_Status
0x375 - BMS_VCU_CDIS_currLimit
0x385 - BMS_Service
0x280 - VCU_EHPS_Enable
0x205 - VCU_HECU_TqInfo
0x255 - VCU_HECU_SpdPedal
0x265 - VCU_HECU_SysSt
0x258 - HECU_VCU_FailLmp
0x208 - HECU_VCU_WhlSpd
0x218 - HECU_VCU_VehSpd
0x100 - AVAS_BCM_Status
0x411 - DC_VCU_BCM_Failue
0x500 - VCU_BCM_DisplatCtrl
0x510 - VCU_BCM_CoolReq
0x620 - ICU_VCU_BCM_Temperature
0x499
0x509
0x617
0x538
0x335
0x275
0x400
0x336
0x390
0x382
0x600
0x007
0x536
0x550
0x560

Edit Will add more DBC defs later, I've run out of time!

[crasbe]

The link does not work for me. But you can put the .blf file into a .zip archive and upload it then.

[Jacobsmess]

The link does not work for me.

Odd it is still working for me, I've attached the zipped Can log above now.

[crasbe]

Since I didn't really want to get into changing my Magic Byte Cracker script, I just wrote a small script to convert BLF files to the typical SavvyCAN format:

Code: Select all

########################################################
# Convert the BLF File Format to SavvyCAN CSV format
#
# This script requires the python-can module to work:
#   python -m pip install python-can
#
# Author: crasbe, 2024
########################################################


import can
import csv

# Object Format of a CAN message
# can.Message(timestamp=1677163869.3135324, arbitration_id=0x258, is_extended_id=False, channel=1, dlc=8, data=[0x0, 0x5e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0])

blfFile = can.BLFReader("2023-02-23_15-51-05_Run062_Performance_B-ON_S17-06_MaxBox_Prod.blf")

with open("output.csv", "w", newline="") as csvfile:
    csvOutput = csv.writer(csvfile)
    csvOutput.writerow(["Time Stamp","ID","Extended","Dir","Bus","LEN","D1","D2","D3","D4","D5","D6","D7","D8"])

    for msg in blfFile:

        line = ["{:016d}".format(int(msg.timestamp * 10**6)), "{:03X}".format(msg.arbitration_id), \
                str(msg.is_extended_id).lower(), "Rx", msg.channel, msg.dlc]

        for i in range(0, 8): # not all messages are 8 bytes long
            if (i < msg.dlc):
                line.append("{:02X}".format(msg.data[i]))
            else:
                line.append('')

        line.append('') # SavvyCAN puts an empty row in each data line, so we have to do it too

        csvOutput.writerow(line)

It appears that some of the messages in fact use the VAG Magic Byte format:

Code: Select all

ID: 007, Magic Bytes: 0xE8,
ID: 00A, Magic Bytes: 0x2C,0x7F,0x8A,0xD9,0x35,0x66,0x93,0xC0,0x1E,0x4D,0xB8,0xEB,0x07,0x54,0xA1,0xF2,
ID: 185, Magic Bytes: 0x06,
ID: 205, Magic Bytes: 0x51,0x3D,0x40,0x5C,0xC2,0xC9,0x52,0xAB,0x16,0x00,0x5E,0xAE,0x83,0xA2,0x1D,0x18,0xED,0x54,0x3B,0x23,0xAB,0x17,0xB0,0x72,0x0A,0xF2,0x8D,0x72,0x43,0x80,0x04,0x17,0x26,0x21,0xE2,0x7B,0x03,0xD2,0xE3,0x9B,0x27,0x3F,0x45,0x31,0x44,0x1C,0xB2,0x81,0x6F,0x93,0x97,0xAB,0xFD,0xB1,0x27,0xDC,0x9E,0xFD,0xED,0xB7,0x3A,0x0C,0xD7,0xA7,0x0D,0x62,0xBA,0xC5,0xAC,0x6D,0xDC,0xC5,0x49,0x3D,0x2B,0xF0,0x3A,0x93,0xD4,0x22,0xA4,0x55,0x01,0x7D,0x48,0x99,0xCC,0x75,0x6A,0x98,0x8C,0x65,0x93,0xDD,0x21,0x2A,0x08,0x4B,0x25,0x80,0x31,0xC1,0x2D,0x65,0x8C,0x1A,0x73,0xF0,0xCE,0x09,0xBA,0xD8,0x18,0x46,0x79,0x1E,0x42,0x7A,0x6F,0x33,0xB9,0x6F,0x0A,0x80,0x4B,0x99,0xF8,
ID: 208, Magic Bytes: 0xE8,0x29,0x4A,0x3F,0xC6,0x2A,0x98,0x37,0x1C,0xD8,0xB3,0xB6,0x24,0x98,0xA6,0x44,0x10,0x98,0x3D,0x32,0x41,0x9F,0x0F,0xFB,0xEB,0x4E,0x64,0x9A,0xAF,0x25,0x76,0x90,0xE2,0xF7,0x12,0xFB,0xEB,0x72,0x52,0xE2,0x9B,0xDE,0xF5,0xBA,0x28,0xCA,0xF2,0x66,0x6D,0x99,0xCA,0xFF,0x39,0xE6,0x5A,0x61,0x79,0x04,0x82,0x11,0x0A,0x27,0xE1,0x7D,0xBF,0x42,0x89,0x8A,0x98,0x3E,0xF7,0x49,0x97,0xC3,0x2A,0xF4,0x15,0x07,0x0A,0xFB,0xA1,0x9E,0xE4,0xF2,0xA0,0x05,0x12,0x4F,0xDD,0xC7,0x52,0x3F,0x08,0x38,0x95,0x3D,0x6A,0xD3,0x82,0x7A,0x5E,0x06,0x3E,0xE4,0x3B,0xF1,0x27,0xC8,0xF0,0xD8,0xB1,0xC3,0xF3,0x84,0x2B,0x50,0x52,0xC2,0x21,0x5A,0xFE,0xC5,0x26,0x36,0xBF,0xEC,0x79,0xD0,0x32,0xAE,0x83,0x58,0x17,0x28,0x8C,0x2B,0x67,0x69,0x9A,0x48,0x39,0x21,0x4B,0x9C,0xF6,0x0C,0x3C,0x48,0xEF,0x3C,0x2A,0x1E,0x5E,0xF9,0xAF,0x25,0xBC,0x5F,0xF9,0x11,0xE0,0x2E,0xA6,0x8A,0x33,0xA5,0xA2,0x03,0xFC,0x44,0xD1,0x86,0x2C,0xB4,0xB2,0xC7,0xEC,0xB3,0x06,0x24,0x10,0xF6,0x07,0xE9,0x7D,0x30,0xB1,0xE5,0x6E,0x3F,0xE2,0xE3,0xD8,0x19,0xDF,0x56,0x4A,0x21,0x5C,0x16,0x64,0xC4,0xC1,0x53,0xE3,0xFD,0xFC,0x03,0x0E,0x63,0xDE,0x80,0x8C,0x66,0x8B,0x1D,0x70,0x47,0x2B,0x4F,0xEA,0x7F,0x0F,0x01,0x3F,0xB2,0xC3,0x71,0xC3,0xAD,0x9C,0x58,0xF0,0x8C,0x10,0x4C,0x41,0x71,0xAC,0x41,0x5E,0x5E,0xFF,0x76,0x12,0x8C,0x2C,0x04,0x58,0xB8,0x2A,0xAB,0x65,0xF5,0x96,0xED,
ID: 218, Magic Bytes: 0xD0,
ID: 255, Magic Bytes: 0xE8,
ID: 258, Magic Bytes: 0xE8,0xB9,0x8A,0x7E,0x6A,0x9E,0xAD,0xDF,0x39,0xD4,0xE7,0x13,0xA2,0xF3,0xC0,0x8E,0xE7,0x20,0xD4,0x46,0x44,0xD2,0x7C,0x9F,0xBB,0xEA,0x1D,0x1A,0x4B,0x50,0xA4,0x97,0x63,0xF1,0x05,0x36,0x23,0x11,0xEA,0x5E,0x0E,0x9C,0xFB,0x5B,0xCA,0x01,0x7E,0x4D,0xDC,0xAF,0x7A,0x89,0xBD,0xE7,0x36,0xE1,0xCB,0x59,0x17,0x79,0x75,0xD2,0x26,0x8A,0xD5,0x50,0x87,0x32,0x59,0xBF,0x01,0x78,0x8C,0xBF,0x54,0xD9,0x88,0x08,0xDF,0xCF,0x3B,0x8A,0xF8,0x4D,0xB9,0x65,0xCC,0xFA,0x56,0x32,0x5C,0x03,0xF7,0xD1,0x9E,0x5C,0x7A,0xE8,0xC0,0x36,0x07,0x24,0xFA,0x54,0x17,0x85,0x44,0x61,0x77,0x93,0xE1,0xF1,0xA0,0x32,0xC6,0xB3,0x01,0xFE,0x0A,0x39,0xCD,0x5F,0xAB,0x98,0x6C,0xF9,0x2E,0x3E,0x6F,0x58,0x09,0x9F,0x6B,0x94,0x60,0x76,0xA7,0x35,0xC1,0xF2,0x06,0x00,0xF4,0x12,0x10,0x82,0x53,0x45,0x14,0x4E,0xBA,0x89,0x7D,0xEF,0xBE,0x28,0xDC,0x62,0x24,0xA5,0x51,0xC3,0x92,0x04,0x53,0x0F,0x0D,0x6D,0x25,0xAE,0x5A,0x19,0xA1,0xB8,0x6F,0xDA,0x8B,0x3A,0xED,0xE2,0xDC,0xD5,0xD7,0xB7,0xE6,0x74,0x80,0x45,0xF5,0x16,0x14,0x04,0x76,0x31,0xB5,0x70,0xD7,0x8D,0xDA,0x69,0xBE,0xDA,0xCF,0x1D,0x3C,0x38,0x58,0xAC,0xB8,0x22,0xAA,0xA8,0xE5,0x55,0x90,0x73,0x00,0xA1,0x12,0x60,0x47,0x2A,0x19,0xFA,0xDA,0x2E,0x0A,0xE9,0xB3,0xF5,0xC8,0x80,0x05,0x43,0xD5,0x36,0xA1,0x42,0x45,0x92,0xF6,0xF4,0x62,0x33,0x3A,0x48,0x28,0xDC,0x6D,0x99,0x0F,0x62,
ID: 265, Magic Bytes: 0x94,
ID: 280, Magic Bytes: 0xE8,
ID: 285, Magic Bytes: 0x7F,
ID: 321, Magic Bytes: 0x7A,0x3D,0x1A,0x8C,0x7C,0x6B,0x7F,0x7F,0x20,0xF1,0x34,0x51,0xF4,0x52,0x0B,0x75,0xA8,0x9E,0x91,0x29,0xCD,0xF1,0xA2,0xEF,0xE5,0xAB,0x6E,0x67,0x4C,0x89,0x25,0xF1,0x62,0xF2,0x98,0xDC,0x61,0x85,0x92,0x7A,0x70,0x38,0xC1,0x68,0x4A,0xD6,0x80,0xC1,0x02,0x51,0x9D,0x83,0xF8,0xB9,0x9D,0x3D,0x51,0x10,0x23,0x02,0x04,0xFB,0xAD,0x37,0x32,0x51,0x5B,0x43,0x43,0x89,0x89,0x0D,0x51,0x0B,0xEA,0xB6,0xC7,0x1C,0x6B,0x85,0xEA,0xB9,0x08,0x4C,0x51,0xA4,0x8A,0x1C,0x01,0x97,0x97,0x70,0x9E,0x15,0x0E,0x2F,0xF1,0xB5,0x1A,0xAE,0x51,0x2A,0xEC,0x19,0x6B,0x86,0x43,0x92,0x1C,0x86,0xFE,0xD3,0xE3,0x98,0xAE,0x29,0x67,0x98,0x20,0xAE,0xA1,0xC4,0x1A,0xE0,0x64,0xD5,0xAE,0xA1,0x46,0x2C,0x7C,0xBC,0x7C,0x5B,0x54,0x19,0xA2,0x89,0x9D,0xBA,0xF1,0x76,0x61,0xFB,0xDA,0x89,0x94,0x45,0xDC,0x9D,0x5E,0x91,0x3D,0x1A,0xD9,0xC2,0xDA,0xA1,0x5E,0xF2,0xEF,0x62,0xE0,0x91,0x61,0x52,0xE3,0x0B,0xD6,0x3D,0x6B,0x23,0x4A,0xB3,0x46,0x7C,0x1F,0xA4,0x3B,0xAD,0x43,0x62,0x75,0x8F,0x15,0x64,0xDA,0x52,0x8F,0x52,0x10,0xD9,0x0B,0xE6,0x2A,0x97,0x8F,0xA8,0x31,0x8F,0xC4,0xA1,0x10,0x3D,0x10,0x0D,0x68,0xDA,0x57,0xFE,0x70,0x25,0x5D,0x04,0x52,0xC2,0x6B,0xB9,0x04,0xFB,0x5E,0xCE,0x75,0x6E,0x4C,0x57,0x02,0xAD,0x6B,0x2A,0x61,0xA8,0xBF,0x19,0xA1,0x89,0x6E,0x2A,0xD3,0x9E,0x4A,0x8A,0x7A,0x2C,0x79,0xC4,0x1A,0xBA,0xEA,0x75,0x15,0xA1,0x40,0x6E,0x40,0xA7,
ID: 375, Magic Bytes: 0x4C,0x1F,0xEA,0xB9,0x55,0x06,0xF3,0xA0,0x7E,0x2D,0xD8,0x8B,0x67,0x34,0xC1,0x92,
ID: 382, Magic Bytes: 0x65,0x58,0x8D,0xF2,0x64,0xC5,0x0D,0x14,0xF2,0x5C,0x66,0x0D,0x36,0x53,0x60,0x94,0x37,0x82,0xCA,0x82,0xA4,0x50,0xB4,0x40,0xBF,0x4B,0x71,0xD5,0x22,0xD6,0xE5,0xB1,
ID: 385, Magic Bytes: 0xC6,
ID: 390, Magic Bytes: 0xE8,0x1C,0x2F,0xDB,0x49,0xBD,0x8E,0x7A,0x85,0x71,0x42,0xB6,0x24,0xD0,0xE3,0x17,0x32,0xC6,0xF5,0x01,0x93,0x67,0x54,0xA0,0x5F,0xAB,0x98,0x6C,0xFE,0x0A,0x39,0xCD,0x73,0x87,0xB4,0x40,0xD2,0x26,0x15,0xE1,0x1E,0xEA,0xD9,0x2D,0xBF,0x4B,0x78,0x8C,0xA9,0x5D,0x6E,0x9A,0x08,0xFC,0xCF,0x3B,0xC4,0x30,0x03,0xF7,0x65,0x91,0xA2,0x56,0xF1,0x05,0x36,0xC2,0x50,0xA4,0x97,0x63,0x5B,0x0E,0x2B,
ID: 420, Magic Bytes: 0xEA,
ID: 430, Magic Bytes: 0x19,
ID: 485, Magic Bytes: 0x0A,0x42,0xE2,0x00,0x48,0xDE,0x7B,0x74,0xC6,0xDE,0x0F,0x47,0x11,0xD8,0x17,0x35,
ID: 550, Magic Bytes: 0x4D,
ID: 600, Magic Bytes: 0x5B,0xCE,0xA4,0x7F,0x96,0x82,0x36,0x42,0xA5,0x70,0x17,0x9E,0x5D,0x9C,0xE8,0x1C,0x97,0xBF,0x17,0x93,0x19,0x6B,0xCF,0xCD,0xFE,0x1D,0xDE,0x44,0xC2,0x9D,0x88,0x2A,0xB7,0xC9,0xBE,
ID: 601, Magic Bytes: 0xA2,
ID: 611, Magic Bytes: 0x99,
ID: 612, Magic Bytes: 0x88,
ID: 613, Magic Bytes: 0x35,
ID: 614, Magic Bytes: 0x22,
ID: 617, Magic Bytes: 0x2E,
ID: 618, Magic Bytes: 0xFF,
ID: 632, Magic Bytes: 0x80,
ID: 652, Magic Bytes: 0x37,
ID: 675, Magic Bytes: 0xDF,0x8C,0x79,0x2A,0xC6,0x95,0x60,0x33,0x40,0x13,0xE6,0xB5,0x59,0xA7,0x52,0x01,
ID: 711, Magic Bytes: 0x34,

This is a lot of stuff and most of it is not relevant, because not all messages use Counter, CRC and therefore magic bytes.
Noteworths are the following messages:

Code: Select all

ID: 00A, Magic Bytes: 0x2C,0x7F,0x8A,0xD9,0x35,0x66,0x93,0xC0,0x1E,0x4D,0xB8,0xEB,0x07,0x54,0xA1,0xF2,
ID: 375, Magic Bytes: 0x4C,0x1F,0xEA,0xB9,0x55,0x06,0xF3,0xA0,0x7E,0x2D,0xD8,0x8B,0x67,0x34,0xC1,0x92,
ID: 382, Magic Bytes: 0x65,0x58,0x8D,0xF2,0x64,0xC5,0x0D,0x14,0xF2,0x5C,0x66,0x0D,0x36,0x53,0x60,0x94,0x37,0x82,0xCA,0x82,0xA4,0x50,0xB4,0x40,0xBF,0x4B,0x71,0xD5,0x22,0xD6,0xE5,0xB1,
ID: 485, Magic Bytes: 0x0A,0x42,0xE2,0x00,0x48,0xDE,0x7B,0x74,0xC6,0xDE,0x0F,0x47,0x11,0xD8,0x17,0x35,
ID: 675, Magic Bytes: 0xDF,0x8C,0x79,0x2A,0xC6,0x95,0x60,0x33,0x40,0x13,0xE6,0xB5,0x59,0xA7,0x52,0x01,

0x382 is interesting because it uses a counter that goes up to 0x13 instead of 0x0F.

There are some messages that aren't 8 byte long but might have a CRC and Magic Bytes, but currently the script can't analyze it.

[Jacobsmess]

Hoping to start looking at this again soon, and a belated thanks for crunching the logs through the CRC cruncher.
Right now I'm trying to crack a VAG-MQB steering rack. would you mind sharing your CRC cracking tool for it?

[crasbe]

It is already shared: viewtopic.php?p=48154#p48154