RKS+CAN Adapter für CAN-Bus Sniffing
CAN-Interface
CAN Hardware, CAN Software, CAN Protokolle - CAN-Bus Forum für Dein CAN-Bus Projekt. CAN-Bus und Elektronik.

Ateca Windows


 
Neues Thema beginnen Auf Beitrag antworten Weitergeben, Thema teilen Lesezeichen setzen Druckansicht CANhack.de - Übersicht » Innenraum- / Komfort CAN
Autor Nachricht
DatafoxChris



CAN Hacker seit: 03.05.2018
Beiträge: 32
Karma: +9 / -0   Danke, gefällt mir!


Premium Support

CAN-Diagnose gefällt das.
Beitrag14-07-2018, 8:19    Titel: Ateca Windows Antworten mit Zitat

These codes do not work when the car is parked and off. They only work at moments when the window-buttons would work.

Window Right-Front:
185#8000000000000000 Full Open
185#4000000000000000 Down
185#1000000000000000 Up
185#2000000000000000 Full Close

Window Left-Front:
185#0800000000000000 Full Open
185#0400000000000000 Down
185#0100000000000000 Up
185#0200000000000000 Full Close

Window Right-Back:
185#0080000000000000 Full Open
185#0040000000000000 Down
185#0010000000000000 Up
185#0020000000000000 Full Close

Window Left-Back:
185#0008000000000000 Full Open
185#0004000000000000 Down
185#0001000000000000 Up
185#0002000000000000 Full Close


Does anyone know why the front-left window (the door with the four window-buttons) doesn't respond to these codes, but all other windows do ?
Regards,
Chris


Zuletzt bearbeitet am 14-07-2018, 9:15, insgesamt 3-mal bearbeitet.
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Skype  
CAN-Diagnose
Administrator
Administrator
Avatar-CAN-Diagnose

CAN Hacker seit: 07.06.2011
Beiträge: 538
Karma: +27 / -0   Danke, gefällt mir!
Wohnort: Ländle



Beitrag14-07-2018, 9:19    Titel: Ateca Windows Antworten mit Zitat

Hi

Zitat:
Does anyone know why the front-left window (the door with the four window-buttons) doesn't respond to these codes, but all other windows do ?


my guess is, beacuse it steers the other window positions. But I am quite sure there is a way via CAN to let it go up and down: When you press the close/open button on the key's remote control, you can open/close all 4 windows.

Best regards, Rainer
Dipl.-Ing. (FH) Rainer Kaufmann - Kaufmann Automotive GmbH
CANhack.de CAN-Bus Interface RKS+CAN: CAN-Bus Interface
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Website dieses Benutzers besuchen
DatafoxChris



CAN Hacker seit: 03.05.2018
Beiträge: 32
Karma: +9 / -0   Danke, gefällt mir!


Premium Support

Beitrag14-07-2018, 9:22    Titel: Controlling Windows Antworten mit Zitat

Yes, i am trying to find these codes now, but the log i recorded while closing the windows using the remote key, i get a log with a size of 211 kb icon_wink.gif

Any idea on which code (like 185 for the windows) i should look at? The 185 code doesn't show in this log.

MessageID Message-Count
17334600 1
17FC0114 2
17FE0114 2
17FE010E 3
16A95493 4
17331101 4
17331901 5
17331A01 5
17331B01 5
17332101 5
66E 6
671 6
386 7
5F5 7
5F7 7
52A 8
58C 8
643 8
64E 8
658 8
6A6 8
6AE 8
6B2 8
6B6 8
6B7 8
6B8 8
6B9 8
16A95497 8
16A95499 8
17331210 8
585 9
17330310 9
17330910 9
17330C10 9
17330D10 9
17330E10 9
17331310 9
17330110 11
17332710 12
3D4 13
65A 13
17332310 13
569 15
588 15
5BB 15
5E0 15
5EA 15
5EB 15
5F4 15
65E 15
6B0 15
6B5 15
16A95498 15
17330810 15
17F0000C 15
17F0000E 15
17F00014 15
17F00023 15
17F00031 15
17F00032 15
17F00046 15
17F00047 15
17F0004A 15
17F0004B 15
17F00084 15
17F000A9 15
1A55552B 15
16A9540A 18
1B000014 20
1B000023 20
1B000031 20
1B000032 20
1B000046 20
1B000047 20
1B00000C 21
1B000010 21
1B0000A9 21
593 22
1B00004B 24
1B00004A 25
1B00000E 26
17331110 30
366 33
17330F10 34
1B000084 34
3EA 36
551 36
5A0 36
6B4 36
530 37
584 37
5E1 37
5E9 37
5F0 37
668 37
12DD546F 37
582 38
5F2 42
395 72
3DA 72
3EB 72
48B 72
504 72
5AC 72
661 72
663 72
3B5 73
3C0 73
3D5 73
3D6 73
3E5 73
3E9 73
3CF 74
3D0 74
3D1 74
3CE 76
1FA 80
583 111
592 133
30B 144
3DC 144
656 144
12B 237
184 362
12DD5471 362
Regards,
Chris


Zuletzt bearbeitet am 14-07-2018, 9:32, insgesamt 1-mal bearbeitet.
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Skype  
CAN-Diagnose
Administrator
Administrator
Avatar-CAN-Diagnose

CAN Hacker seit: 07.06.2011
Beiträge: 538
Karma: +27 / -0   Danke, gefällt mir!
Wohnort: Ländle



Beitrag14-07-2018, 9:31    Titel: Ateca Windows Antworten mit Zitat

Do not use the logging function, use the "Message Changes" view of KCANMonitor to find what changes when you press the remote control.

Best regards, Rainer



Du bist nicht berechtigt diese Datei(en) zu sehen, logge Dich ein bzw. registriere Dich für erweiterte Rechte oder Status-Updates.

Dipl.-Ing. (FH) Rainer Kaufmann - Kaufmann Automotive GmbH
CANhack.de CAN-Bus Interface RKS+CAN: CAN-Bus Interface


Zuletzt bearbeitet am 14-07-2018, 9:32, insgesamt 1-mal bearbeitet.
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Website dieses Benutzers besuchen
DatafoxChris



CAN Hacker seit: 03.05.2018
Beiträge: 32
Karma: +9 / -0   Danke, gefällt mir!


Premium Support

Beitrag14-07-2018, 9:40    Titel: Windows Antworten mit Zitat

Using two PuTTY windows I can replay the log file on virtual can-bus on a Raspberry Pi " canplayer vcan0=can0 -I Close-Windows-by-Remote-2.log", and use "cansniffer -c vcan0" to see the message-changes.

But as there is SO much messages, i am not able to find the right one...



Du bist nicht berechtigt diese Datei(en) zu sehen, logge Dich ein bzw. registriere Dich für erweiterte Rechte oder Status-Updates.

Regards,
Chris


Zuletzt bearbeitet am 14-07-2018, 9:53, insgesamt 2-mal bearbeitet.
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Skype  
CAN-Diagnose
Administrator
Administrator
Avatar-CAN-Diagnose

CAN Hacker seit: 07.06.2011
Beiträge: 538
Karma: +27 / -0   Danke, gefällt mir!
Wohnort: Ländle



Beitrag14-07-2018, 11:27    Titel: Ateca Windows Antworten mit Zitat

Zitat:
Thanks for your help !

I have a Raspberry Pi connected to the Comfort Canbus in my boot, with it's own LiFePo4 battery which is charged only while the motor is running.

How can i use the log-file to feed KCanMonitor with data ?

Hi Chris,

sorry, support is for the RKS+CAN CAN-Bus Kit and the KCANMonitor software, not some other tools. I do not know your other tools nor is it my task to support them.

Just use the bought product if you expect to get help, thanks.

Best regards, Rainer
Dipl.-Ing. (FH) Rainer Kaufmann - Kaufmann Automotive GmbH
CANhack.de CAN-Bus Interface RKS+CAN: CAN-Bus Interface


Zuletzt bearbeitet am 14-07-2018, 11:29, insgesamt 1-mal bearbeitet.
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Website dieses Benutzers besuchen
DatafoxChris



CAN Hacker seit: 03.05.2018
Beiträge: 32
Karma: +9 / -0   Danke, gefällt mir!


Premium Support

Beitrag14-07-2018, 11:30    Titel: Ateca Windows Antworten mit Zitat

OK i have the hardware you mentioned, i will make a connection to the Comfort Can Bus and report back here.
Regards,
Chris
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Skype  
DatafoxChris



CAN Hacker seit: 03.05.2018
Beiträge: 32
Karma: +9 / -0   Danke, gefällt mir!


Premium Support

Beitrag14-07-2018, 13:58    Titel: Ateca Windows Antworten mit Zitat

This is what KCanMOnitor shows, i don't understand how to find the MessageID used by the Remote Key Receiver...

Could you help to find it ?

When the car is running, there are more than three pages of messages constantly changing values and colors. It is way too much to understand.

Do you know the MQB excel file called vw_mqb_2010.xlsx ?

As i don't understand technical German language very much, i am not able to find any clues as to which message ID's could be the interesting ones.



Du bist nicht berechtigt diese Datei(en) zu sehen, logge Dich ein bzw. registriere Dich für erweiterte Rechte oder Status-Updates.

Regards,
Chris


Zuletzt bearbeitet am 14-07-2018, 14:17, insgesamt 4-mal bearbeitet.
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Skype  
CAN-Diagnose
Administrator
Administrator
Avatar-CAN-Diagnose

CAN Hacker seit: 07.06.2011
Beiträge: 538
Karma: +27 / -0   Danke, gefällt mir!
Wohnort: Ländle



Beitrag14-07-2018, 14:46    Titel: Ateca Windows Antworten mit Zitat

Hi,

you could use the CAN hardware filters (program options) to reduce the showed messages to a reasonable amount.

When you press the remote control first "window down" and then "window up", the corresponding bytes are marked in "toggled" color (orange). Now subtract all marked bytes which are changed when you do nothing, then only these regarding remote control and window up/down should be left.
To "subtract", you can print out the screens and lay it above each other. Would be a nice feature for future to add a "Subtract this" button in KCANMonitor.

Of course you should watch only that bytes that change when you press the remote control for windows up/down and not all changing messages.

Best regards, Rainer
Dipl.-Ing. (FH) Rainer Kaufmann - Kaufmann Automotive GmbH
CANhack.de CAN-Bus Interface RKS+CAN: CAN-Bus Interface


Zuletzt bearbeitet am 14-07-2018, 14:50, insgesamt 2-mal bearbeitet.
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Website dieses Benutzers besuchen
DatafoxChris



CAN Hacker seit: 03.05.2018
Beiträge: 32
Karma: +9 / -0   Danke, gefällt mir!


Premium Support

Beitrag15-07-2018, 11:04    Titel: Ateca Windows Antworten mit Zitat

I am absolutly not able to find it using kcanmonitor.

Eventually i have used my brute force attack: record a log and replay. If the windows respond in any way then halve the log and replay again. If the windows still respond then halve again and replay... and so forth.

Now i have cleaned the log up to 12 remaining commands:

1531641028.749384) can0 66E#E0783800FE000000
(1531641028.749702) can0 671#0007801500000000
(1531641028.749933) can0 1FA#0000002800000000
(1531641028.750531) can0 6B5#FD83FD03FD00FD07
(1531641028.754089) can0 3CE#0000000085400000
(1531641028.758577) can0 3D1#0200041881040000
(1531641028.759753) can0 6B2#2A400F20B997E40D
(1531641028.760864) can0 656#8D80090000000000
(1531641028.764774) can0 663#6028000E00910004
(1531641028.770602) can0 592#0000000000020000
(1531641028.774262) can0 583#00300A80200B5414

Only the sunroof closes a bit occasionally when replaying these commands.

When I remove any of these codes, nothing seems to happen anymore when replaying them.

Does anyone recognize this situation?

Please icon_smile.gif any help would be greatly appreciated.
Regards,
Chris
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Skype  
CAN-Diagnose
Administrator
Administrator
Avatar-CAN-Diagnose

CAN Hacker seit: 07.06.2011
Beiträge: 538
Karma: +27 / -0   Danke, gefällt mir!
Wohnort: Ländle



Beitrag15-07-2018, 12:27    Titel: Ateca Windows Antworten mit Zitat

DatafoxChris hat folgendes geschrieben:


Only the sunroof closes a bit occasionally when replaying these commands.

When I remove any of these codes, nothing seems to happen anymore when replaying them.

Does anyone recognize this situation?

Please icon_smile.gif any help would be greatly appreciated.

Hi,

my guess is, that when you "write" the messages above, still the original messages exist on the bus and the corresponding control units do not know what to: Still "do nothing" as the normal CAN messages say or "to do something" what your CAN replay says.

I would get the wiring plan for your car and try to find out, which messages come from which control unit and how the window-switch positions are signaled to the corresponding control unit/motor driver.

As in most VAG cars a function exists to close the windows/roof when it rains, it must be possible to signal what to do to the windows/roof even when the ignition is off. I do not know if your car supports this function but I would wonder if not.

Best regards, Rainer
Dipl.-Ing. (FH) Rainer Kaufmann - Kaufmann Automotive GmbH
CANhack.de CAN-Bus Interface RKS+CAN: CAN-Bus Interface
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Website dieses Benutzers besuchen
DatafoxChris



CAN Hacker seit: 03.05.2018
Beiträge: 32
Karma: +9 / -0   Danke, gefällt mir!


Premium Support

Beitrag16-07-2018, 10:38    Titel: Windows Antworten mit Zitat

Do you have these VAG codes ?
I could always try...

It seems you are right: Whenever I send messages on a quiet line when the car is off, then all modules start to send messages for a short period of time. It seems these modules send 'do nothing' messages to the control-units which interferes with my 'do something' messages. This is also my problem when trying to flash the headlights (find my car function).

My goal is to make an App which has buttons to control some parts of the car while parked. There is a Raspberry in my car which is connected to a Mifi router, and uses OpenVPN to connect to my home router. I will use SocketCanD (binding to VPN only) to be able to send can commands from within the mobile app.

At this moment i can control and read the Auxiliary Heater, and the direction-indicator lights.

Would like to be able to close the windows and the roof remotely, and control the headlights.

Not much luck until now... again any help would be greatly appreciated !
Regards,
Chris
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Skype  
CAN-Diagnose
Administrator
Administrator
Avatar-CAN-Diagnose

CAN Hacker seit: 07.06.2011
Beiträge: 538
Karma: +27 / -0   Danke, gefällt mir!
Wohnort: Ländle



Beitrag16-07-2018, 10:43    Titel: Re: Windows Antworten mit Zitat

DatafoxChris hat folgendes geschrieben:
Do you have these VAG codes ?
I could always try...

Should be functionality fo the central electrics module, rain sensor is needed and control module must support the corresponding coding.

DatafoxChris hat folgendes geschrieben:

It seems you are right: Whenever I send messages on a quiet line when the car is off, then all modules start to send messages for a short period of time. It seems these modules send 'do nothing' messages to the control-units which interferes with my 'do something' messages. This is also my problem when trying to flash the headlights (find my car function).

My goal is to make an App which has buttons to control some parts of the car while parked. There is a Raspberry in my car which is connected to a Mifi router, and uses OpenVPN to connect to my home router. I will use SocketCanD (binding to VPN only) to be able to send can commands from within the mobile app.

At this moment i can control and read the Auxiliary Heater, and the direction-indicator lights.

Would like to be able to close the windows and the roof remotely, and control the headlights.

Not much luck until now... again any help would be greatly appreciated !

Your Raspberry module should act as a gateway: in normal mode just route all the corresponding messages on the bus from one side to the other. When you want to do your special function, replace the "normal" message with your special one which triggers the corresponding action.

Best regards, Rainer
Dipl.-Ing. (FH) Rainer Kaufmann - Kaufmann Automotive GmbH
CANhack.de CAN-Bus Interface RKS+CAN: CAN-Bus Interface
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Website dieses Benutzers besuchen
DatafoxChris



CAN Hacker seit: 03.05.2018
Beiträge: 32
Karma: +9 / -0   Danke, gefällt mir!


Premium Support

Beitrag16-07-2018, 10:49    Titel: Windows Antworten mit Zitat

Thanks for your help icon_smile.gif

I have VCDS Ross-Tech module, and i can log the special OBD messages when i control parts of the car form within the VCDS software. Unfortunately i have not been able to enable the headlights from vcds.

I will see if my dealer is able to connect to the car and enable headlights and close windows from the configuration console in their shop. I will enable the log and filter-out the special messages.

I don't want to use Raspberry-Pi's as gateways in order to change messages going into the headlight modules. This will use additional power from the secondary battery which will be drained too fast. I could use Atmel chip with two CAN-Bus interfaces, and use serial interface to communicate with my Raspberry. I can wrote program in C++ for the Atmel chip, but it would take some time and i do not have very much hobby time available now.
Regards,
Chris
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Skype  
DatafoxChris



CAN Hacker seit: 03.05.2018
Beiträge: 32
Karma: +9 / -0   Danke, gefällt mir!


Premium Support

CAN-Diagnose gefällt das.
Beitrag21-07-2018, 18:48    Titel: Ateca Windows Antworten mit Zitat

By enabling the rain-sensor to close the windows (I think the sunroof cannot be auto-closed) when it rains, I have been able to log that, and play it back and find the window-closing code.

Close the front left and right windows when car is parked:
5A0#0C04826E78

I have not been able to find the code for closing the rear windows or the sunroof.

Bonus finds:

Lock all doors:
184#965245010A000600

Unlock front left and front right doors:
184#60A20A0009000600


Does anyone recognize these? If so, do you have additional information on how to interpret the individual bits inside the payload of these codes?
Regards,
Chris
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Skype  
Neues Thema beginnen Auf Beitrag antworten Weitergeben, Thema teilen Lesezeichen setzen Druckansicht CANhack.de - Übersicht » Innenraum- / Komfort CAN
Ähnliche Fachartikel und Themen
Thema Community Bereich
Keine neuen Beiträge Sniffing Seat Ateca 2018 CAN-Bus Allgemein
Keine neuen Beiträge Seat Ateca 2018 - Auxiliary Heater Innenraum- / Komfort CAN
Gehe zu:  
Du kannst keine Beiträge in dieses Forum schreiben.