Peugeot gear selector hacking

Introduction and miscellaneous that we haven't created categories for, yet
Post Reply
AMP3R
Posts: 37
Joined: Sun Oct 09, 2022 8:32 pm
Has thanked: 10 times
Been thanked: 3 times

Peugeot gear selector hacking

Post by AMP3R »

Hello! I'm trying to hack this gear selector from PSA group cars. The hardware I'm using is an arduino + mcp2515 can board.
20221027_142210.jpg
Gear selector always sends these ID's. The only thing I've discovered for now is illumination.
ezgif-2-d179584ba4.gif
I have a couple of thoughts:

- The message 4FE looks encouraging because it only has one constantly changing byte (maybe counter or checksum, although it looks to change semi-randomly which makes me think checksum).

- This gear selector needs one reply ID from gearbox or BSI module and I want to discover it.

So what can you say about all of this? Maybe someone could capture CAN log from modern peugeot 3008/5008? Thanks in advance.
User avatar
johu
Site Admin
Posts: 5682
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 153 times
Been thanked: 960 times
Contact:

Re: Peugeot gear selector hacking

Post by johu »

Once you have hacked it you can add your findings here: https://openinverter.org/wiki/Peugeot_Gear_Lever

Thanks!
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
AMP3R
Posts: 37
Joined: Sun Oct 09, 2022 8:32 pm
Has thanked: 10 times
Been thanked: 3 times

Re: Peugeot gear selector hacking

Post by AMP3R »

I've found ID 0x349, which activates gear lever and illuminates "P" symbol. It has 8 bytes, byte6 is a double counter.

When I'm sending a message from ID 0x349 every 30ms, byte1 of the ID 0x4FE is updating from E1 to 01.
While pressing the parking button and pushing the selector forward and backward, byte2 is changing from 08 to 18. That's all. Nothing is changing anymore. There is no response from pressing "M" and "Unlock" buttons.

There is a lot of work to be done :?

Screenshot from 2023-02-14 15-07-33.png
photo_2023-02-14_15-24-53.jpg
AMP3R
Posts: 37
Joined: Sun Oct 09, 2022 8:32 pm
Has thanked: 10 times
Been thanked: 3 times

Re: Peugeot gear selector hacking

Post by AMP3R »

Some progress here. I have found almost all states of that gear lever. Image is playable.
ezgif-4-81167189ec.gif
For example to set a "Drive" you need to send this message every 30 ms.
ID 0x349 03 55 00 13 00 00 F4 20
ID 0x349 03 55 00 13 00 00 E5 20
ID 0x349 03 55 00 13 00 00 D6 20
ID 0x349 03 55 00 13 00 00 C7 20
ID 0x349 03 55 00 13 00 00 B8 20
ID 0x349 03 55 00 13 00 00 A9 20
ID 0x349 03 55 00 13 00 00 9A 20
ID 0x349 03 55 00 13 00 00 8B 20
ID 0x349 03 55 00 13 00 00 7C 20
ID 0x349 03 55 00 13 00 00 6D 20
ID 0x349 03 55 00 13 00 00 5E 20
ID 0x349 03 55 00 13 00 00 4F 20
ID 0x349 03 55 00 13 00 00 30 20
ID 0x349 03 55 00 13 00 00 21 20
ID 0x349 03 55 00 13 00 00 12 20
ID 0x349 03 55 00 13 00 00 03 20
Screenshot from 2023-05-15 11-29-08.png
The last thing what need to be found is how to unlock the "unlock" button.
User avatar
EV_Builder
Posts: 1199
Joined: Tue Apr 28, 2020 3:50 pm
Location: The Netherlands
Has thanked: 16 times
Been thanked: 33 times
Contact:

Re: Peugeot gear selector hacking

Post by EV_Builder »

Best is to make a DBC file with the correct fields.
Converting an Porsche Panamera
see http://www.wdrautomatisering.nl for bespoke BMS modules.
Post Reply