Autor |
Nachricht |
DatafoxChris
CAN Hacker seit: 03.05.2018 Beiträge: 32 Karma: +9 / -0
Premium Support
CAN-Diagnose gefällt das. |
14-07-2018, 8:19 Titel: Ateca Windows |
|
|
These codes do not work when the car is parked and off. They only work at moments when the window-buttons would work.
Window Right-Front:
185#8000000000000000 Full Open
185#4000000000000000 Down
185#1000000000000000 Up
185#2000000000000000 Full Close
Window Left-Front:
185#0800000000000000 Full Open
185#0400000000000000 Down
185#0100000000000000 Up
185#0200000000000000 Full Close
Window Right-Back:
185#0080000000000000 Full Open
185#0040000000000000 Down
185#0010000000000000 Up
185#0020000000000000 Full Close
Window Left-Back:
185#0008000000000000 Full Open
185#0004000000000000 Down
185#0001000000000000 Up
185#0002000000000000 Full Close
Does anyone know why the front-left window (the door with the four window-buttons) doesn't respond to these codes, but all other windows do ?
Regards,
Chris
Zuletzt bearbeitet am 14-07-2018, 9:15, insgesamt 3-mal bearbeitet.
|
|
Nach oben |
|
 |
CAN-Diagnose Administrator


CAN Hacker seit: 07.06.2011 Beiträge: 553 Karma: +27 / -0 Wohnort: Ländle
|
14-07-2018, 9:19 Titel: Ateca Windows |
|
|
Hi
Zitat: | Does anyone know why the front-left window (the door with the four window-buttons) doesn't respond to these codes, but all other windows do ? |
my guess is, beacuse it steers the other window positions. But I am quite sure there is a way via CAN to let it go up and down: When you press the close/open button on the key's remote control, you can open/close all 4 windows.
Best regards, Rainer
|
|
Nach oben |
|
 |
DatafoxChris
CAN Hacker seit: 03.05.2018 Beiträge: 32 Karma: +9 / -0
Premium Support
|
14-07-2018, 9:22 Titel: Controlling Windows |
|
|
Yes, i am trying to find these codes now, but the log i recorded while closing the windows using the remote key, i get a log with a size of 211 kb
Any idea on which code (like 185 for the windows) i should look at? The 185 code doesn't show in this log.
MessageID Message-Count
17334600 1
17FC0114 2
17FE0114 2
17FE010E 3
16A95493 4
17331101 4
17331901 5
17331A01 5
17331B01 5
17332101 5
66E 6
671 6
386 7
5F5 7
5F7 7
52A 8
58C 8
643 8
64E 8
658 8
6A6 8
6AE 8
6B2 8
6B6 8
6B7 8
6B8 8
6B9 8
16A95497 8
16A95499 8
17331210 8
585 9
17330310 9
17330910 9
17330C10 9
17330D10 9
17330E10 9
17331310 9
17330110 11
17332710 12
3D4 13
65A 13
17332310 13
569 15
588 15
5BB 15
5E0 15
5EA 15
5EB 15
5F4 15
65E 15
6B0 15
6B5 15
16A95498 15
17330810 15
17F0000C 15
17F0000E 15
17F00014 15
17F00023 15
17F00031 15
17F00032 15
17F00046 15
17F00047 15
17F0004A 15
17F0004B 15
17F00084 15
17F000A9 15
1A55552B 15
16A9540A 18
1B000014 20
1B000023 20
1B000031 20
1B000032 20
1B000046 20
1B000047 20
1B00000C 21
1B000010 21
1B0000A9 21
593 22
1B00004B 24
1B00004A 25
1B00000E 26
17331110 30
366 33
17330F10 34
1B000084 34
3EA 36
551 36
5A0 36
6B4 36
530 37
584 37
5E1 37
5E9 37
5F0 37
668 37
12DD546F 37
582 38
5F2 42
395 72
3DA 72
3EB 72
48B 72
504 72
5AC 72
661 72
663 72
3B5 73
3C0 73
3D5 73
3D6 73
3E5 73
3E9 73
3CF 74
3D0 74
3D1 74
3CE 76
1FA 80
583 111
592 133
30B 144
3DC 144
656 144
12B 237
184 362
12DD5471 362
Regards,
Chris
Zuletzt bearbeitet am 14-07-2018, 9:32, insgesamt 1-mal bearbeitet.
|
|
Nach oben |
|
 |
CAN-Diagnose Administrator


CAN Hacker seit: 07.06.2011 Beiträge: 553 Karma: +27 / -0 Wohnort: Ländle
|
14-07-2018, 9:31 Titel: Ateca Windows |
|
|
Do not use the logging function, use the "Message Changes" view of KCANMonitor to find what changes when you press the remote control.
Best regards, Rainer
Zuletzt bearbeitet am 14-07-2018, 9:32, insgesamt 1-mal bearbeitet.
|
|
Nach oben |
|
 |
DatafoxChris
CAN Hacker seit: 03.05.2018 Beiträge: 32 Karma: +9 / -0
Premium Support
|
14-07-2018, 9:40 Titel: Windows |
|
|
Using two PuTTY windows I can replay the log file on virtual can-bus on a Raspberry Pi " canplayer vcan0=can0 -I Close-Windows-by-Remote-2.log", and use "cansniffer -c vcan0" to see the message-changes.
But as there is SO much messages, i am not able to find the right one...
Regards,
Chris
Zuletzt bearbeitet am 14-07-2018, 9:53, insgesamt 2-mal bearbeitet.
|
|
Nach oben |
|
 |
CAN-Diagnose Administrator


CAN Hacker seit: 07.06.2011 Beiträge: 553 Karma: +27 / -0 Wohnort: Ländle
|
14-07-2018, 11:27 Titel: Ateca Windows |
|
|
Zitat: | Thanks for your help !
I have a Raspberry Pi connected to the Comfort Canbus in my boot, with it's own LiFePo4 battery which is charged only while the motor is running.
How can i use the log-file to feed KCanMonitor with data ? |
Hi Chris,
sorry, support is for the RKS+CAN CAN-Bus Kit and the KCANMonitor software, not some other tools. I do not know your other tools nor is it my task to support them.
Just use the bought product if you expect to get help, thanks.
Best regards, Rainer
Zuletzt bearbeitet am 14-07-2018, 11:29, insgesamt 1-mal bearbeitet.
|
|
Nach oben |
|
 |
DatafoxChris
CAN Hacker seit: 03.05.2018 Beiträge: 32 Karma: +9 / -0
Premium Support
|
14-07-2018, 11:30 Titel: Ateca Windows |
|
|
OK i have the hardware you mentioned, i will make a connection to the Comfort Can Bus and report back here.
Regards,
Chris |
|
Nach oben |
|
 |
DatafoxChris
CAN Hacker seit: 03.05.2018 Beiträge: 32 Karma: +9 / -0
Premium Support
|
14-07-2018, 13:58 Titel: Ateca Windows |
|
|
This is what KCanMOnitor shows, i don't understand how to find the MessageID used by the Remote Key Receiver...
Could you help to find it ?
When the car is running, there are more than three pages of messages constantly changing values and colors. It is way too much to understand.
Do you know the MQB excel file called vw_mqb_2010.xlsx ?
As i don't understand technical German language very much, i am not able to find any clues as to which message ID's could be the interesting ones.
Regards,
Chris
Zuletzt bearbeitet am 14-07-2018, 14:17, insgesamt 4-mal bearbeitet.
|
|
Nach oben |
|
 |
CAN-Diagnose Administrator


CAN Hacker seit: 07.06.2011 Beiträge: 553 Karma: +27 / -0 Wohnort: Ländle
|
14-07-2018, 14:46 Titel: Ateca Windows |
|
|
Hi,
you could use the CAN hardware filters (program options) to reduce the showed messages to a reasonable amount.
When you press the remote control first "window down" and then "window up", the corresponding bytes are marked in "toggled" color (orange). Now subtract all marked bytes which are changed when you do nothing, then only these regarding remote control and window up/down should be left.
To "subtract", you can print out the screens and lay it above each other. Would be a nice feature for future to add a "Subtract this" button in KCANMonitor.
Of course you should watch only that bytes that change when you press the remote control for windows up/down and not all changing messages.
Best regards, Rainer
Zuletzt bearbeitet am 14-07-2018, 14:50, insgesamt 2-mal bearbeitet.
|
|
Nach oben |
|
 |
DatafoxChris
CAN Hacker seit: 03.05.2018 Beiträge: 32 Karma: +9 / -0
Premium Support
|
15-07-2018, 11:04 Titel: Ateca Windows |
|
|
I am absolutly not able to find it using kcanmonitor.
Eventually i have used my brute force attack: record a log and replay. If the windows respond in any way then halve the log and replay again. If the windows still respond then halve again and replay... and so forth.
Now i have cleaned the log up to 12 remaining commands:
1531641028.749384) can0 66E#E0783800FE000000
(1531641028.749702) can0 671#0007801500000000
(1531641028.749933) can0 1FA#0000002800000000
(1531641028.750531) can0 6B5#FD83FD03FD00FD07
(1531641028.754089) can0 3CE#0000000085400000
(1531641028.758577) can0 3D1#0200041881040000
(1531641028.759753) can0 6B2#2A400F20B997E40D
(1531641028.760864) can0 656#8D80090000000000
(1531641028.764774) can0 663#6028000E00910004
(1531641028.770602) can0 592#0000000000020000
(1531641028.774262) can0 583#00300A80200B5414
Only the sunroof closes a bit occasionally when replaying these commands.
When I remove any of these codes, nothing seems to happen anymore when replaying them.
Does anyone recognize this situation?
Please  any help would be greatly appreciated.
Regards,
Chris |
|
Nach oben |
|
 |
CAN-Diagnose Administrator


CAN Hacker seit: 07.06.2011 Beiträge: 553 Karma: +27 / -0 Wohnort: Ländle
|
15-07-2018, 12:27 Titel: Ateca Windows |
|
|
DatafoxChris hat folgendes geschrieben: |
Only the sunroof closes a bit occasionally when replaying these commands.
When I remove any of these codes, nothing seems to happen anymore when replaying them.
Does anyone recognize this situation?
Please any help would be greatly appreciated. |
Hi,
my guess is, that when you "write" the messages above, still the original messages exist on the bus and the corresponding control units do not know what to: Still "do nothing" as the normal CAN messages say or "to do something" what your CAN replay says.
I would get the wiring plan for your car and try to find out, which messages come from which control unit and how the window-switch positions are signaled to the corresponding control unit/motor driver.
As in most VAG cars a function exists to close the windows/roof when it rains, it must be possible to signal what to do to the windows/roof even when the ignition is off. I do not know if your car supports this function but I would wonder if not.
Best regards, Rainer
|
|
Nach oben |
|
 |
DatafoxChris
CAN Hacker seit: 03.05.2018 Beiträge: 32 Karma: +9 / -0
Premium Support
|
16-07-2018, 10:38 Titel: Windows |
|
|
Do you have these VAG codes ?
I could always try...
It seems you are right: Whenever I send messages on a quiet line when the car is off, then all modules start to send messages for a short period of time. It seems these modules send 'do nothing' messages to the control-units which interferes with my 'do something' messages. This is also my problem when trying to flash the headlights (find my car function).
My goal is to make an App which has buttons to control some parts of the car while parked. There is a Raspberry in my car which is connected to a Mifi router, and uses OpenVPN to connect to my home router. I will use SocketCanD (binding to VPN only) to be able to send can commands from within the mobile app.
At this moment i can control and read the Auxiliary Heater, and the direction-indicator lights.
Would like to be able to close the windows and the roof remotely, and control the headlights.
Not much luck until now... again any help would be greatly appreciated !
Regards,
Chris |
|
Nach oben |
|
 |
CAN-Diagnose Administrator


CAN Hacker seit: 07.06.2011 Beiträge: 553 Karma: +27 / -0 Wohnort: Ländle
|
16-07-2018, 10:43 Titel: Re: Windows |
|
|
DatafoxChris hat folgendes geschrieben: | Do you have these VAG codes ?
I could always try... |
Should be functionality fo the central electrics module, rain sensor is needed and control module must support the corresponding coding.
DatafoxChris hat folgendes geschrieben: |
It seems you are right: Whenever I send messages on a quiet line when the car is off, then all modules start to send messages for a short period of time. It seems these modules send 'do nothing' messages to the control-units which interferes with my 'do something' messages. This is also my problem when trying to flash the headlights (find my car function).
My goal is to make an App which has buttons to control some parts of the car while parked. There is a Raspberry in my car which is connected to a Mifi router, and uses OpenVPN to connect to my home router. I will use SocketCanD (binding to VPN only) to be able to send can commands from within the mobile app.
At this moment i can control and read the Auxiliary Heater, and the direction-indicator lights.
Would like to be able to close the windows and the roof remotely, and control the headlights.
Not much luck until now... again any help would be greatly appreciated ! |
Your Raspberry module should act as a gateway: in normal mode just route all the corresponding messages on the bus from one side to the other. When you want to do your special function, replace the "normal" message with your special one which triggers the corresponding action.
Best regards, Rainer
|
|
Nach oben |
|
 |
DatafoxChris
CAN Hacker seit: 03.05.2018 Beiträge: 32 Karma: +9 / -0
Premium Support
|
16-07-2018, 10:49 Titel: Windows |
|
|
Thanks for your help
I have VCDS Ross-Tech module, and i can log the special OBD messages when i control parts of the car form within the VCDS software. Unfortunately i have not been able to enable the headlights from vcds.
I will see if my dealer is able to connect to the car and enable headlights and close windows from the configuration console in their shop. I will enable the log and filter-out the special messages.
I don't want to use Raspberry-Pi's as gateways in order to change messages going into the headlight modules. This will use additional power from the secondary battery which will be drained too fast. I could use Atmel chip with two CAN-Bus interfaces, and use serial interface to communicate with my Raspberry. I can wrote program in C++ for the Atmel chip, but it would take some time and i do not have very much hobby time available now.
Regards,
Chris |
|
Nach oben |
|
 |
DatafoxChris
CAN Hacker seit: 03.05.2018 Beiträge: 32 Karma: +9 / -0
Premium Support
CAN-Diagnose gefällt das. |
21-07-2018, 18:48 Titel: Ateca Windows |
|
|
By enabling the rain-sensor to close the windows (I think the sunroof cannot be auto-closed) when it rains, I have been able to log that, and play it back and find the window-closing code.
Close the front left and right windows when car is parked:
5A0#0C04826E78
I have not been able to find the code for closing the rear windows or the sunroof.
Bonus finds:
Lock all doors:
184#965245010A000600
Unlock front left and front right doors:
184#60A20A0009000600
Does anyone recognize these? If so, do you have additional information on how to interpret the individual bits inside the payload of these codes?
Regards,
Chris |
|
Nach oben |
|
 |