comma ai Live car hacking with panda this time or bust!

Key Takeaways

okay I know they're working I know I can't see the chat oh maybe it's working now okay cool see you guys joining can someone try to chat and we are back okay cool right now for me the stream looks frozen is that true for you too I hope we're good so I'm trying to actually broadcast my not frozen okay cool excellent alright so we can close that out you don't need that so what we're gonna be playing with today is I'm sitting here in my rav4 and if I want to see myself I gotta look over here alright so I'm streaming for my Mac this time you can see that I've added something to the Panda examples repo called query VIN you can see right here this is the VIN number of my car what we're going to be playing with today is it turns out that a lot of cars don't actually have messages being sent on the canvas you're gonna have to send commands to it in order to get the car to tell you things if you look at these obd2 pigs so you know when I talk about every other car dongle this is what they can get these standard PIDs close up the window standard PID so to show you PID supported engine load fuel pressure rpm vehicle speed that kind of stuff so we're gonna try to make some of those queries today so I've written a script called query VIN I committed it to panda examples this morning we take a look at what it is it sends some stuff it's really kind of terribly written code um so we should do a little bit of refactoring so can you guys we'll see if I make them that big ice OTP is a standard on top of can that let's it kind of packet eyes can because can has only a eight byte limit per message so if you want to send things that are more than eight bytes you got to packetize them so first let's try something so I'm actually setting the safety mode on the panda remember pandas can't transmit by default setting the safety mode to wall output so let's see if we can instead set the safety mode to elm isn't documented here so we're gonna add this we can find this in the board go get a safety cage yeah e3 to 7 is Elm let's just add this here also we have safety toyotas board here better way yes make sure my panda repose update everything origin that's very cool already okay cool so let's see what happens if I set the safety mode so first of all I'll show you guys what happens if I set the safety mode to no out shouldn't work yeah so it sends but it doesn't actually send it sounds nothing so if I set the safety mode instead to elm327 I'll try to look up every once in a while to see you guys on the chat still doesn't work works if I set it to all output but only all output when I was working I set it out interest maybe LM isn't actually triggering a reinitialize ation of can read the code so if I look in main here this is set safety mode should trigger a cannon at all why doesn't work so it's weird if I toggle from no outputs or it doesn't work then I changed elm327 it still doesn't I don't know it works the second time okay so the first time I just must be clogged up with crap cool so that's good to know so now let's see if we can make some of these other queries to the car the request that I'm making for the VIN is own I know to equals gab move in and then I'm doing a iso TP receive so I believe if I recall correctly 7d F is a broadcast address and 78 is the address I expect to hear back from the ECU on let's see what other queries I can make here I hope this is still visible to you guys yeah I still read the Wikipedia I'm just on the obd2 bids Wikipedia yeah this will be in the Panda repo I'm gonna push whenever I'm done um that wasn't the can bus that was finicky I find the campus is actually super reliable so you see right now I'm sending a PID 9 yeah text is hard to read okay I can try to zoom in a little bit more mode 9 PID 2 is the vehicle identification number it's really unreadable shouldn't be it's pretty readable here oh yeah okay I can see why that's kind of hard to read let me zoom in a little more I'll keep it at 100 I'll make it fullscreen if I have to it is 4 bytes what's 4 bytes so I want to send a mode 9 that can request the VIN message count in pit usually value will be 5 calibration ID what's a calibration ID so I found that cars call things I need to start live streaming on YouTube you have people tell me this I'm a Twitter fanboy you know you know I love the Twitter let's see what the ECU name is let's see if we can request that Oh ECM engine control cool so I'm gonna break out my ISO teepee library a little bit I think we can actually eventually just make this part of Panda so this is a 2017 rav4 so up here is kind of the ISO TV library so let me just break that out to ISO GP dot so much worse at using computers when people are watching me even anonymous people on the Internet oh yeah cool so now I can say from ISO TP in porch I said TP send this computer see you pass in the Panda as the first argument so won't push this little library here on so you guys will be able to do this stuff in your car so that's got a broadcast let's see if we can find any other ECU's in this car let's also just text up that red because I don't actually think I think I'm getting more information than what's there yeah look I'm getting this well that's just part of the response interesting just what I have in response to interesting luring it thank you yeah it's part of the VIN response oh I'm not you unpacking that cool I'm so 4902 Lotus and that's like a response to my to my command ECM probably engine control model and this is engine control so let's see if we can get any father easy-to-use to respond and ask them their names like looping through some stuff almost longer for stop signs and traffic lights so it looks like if I send it doesn't matter if I son to which is broadcast or I think 750 is actually the ECM ECU itself my thoughts on supercruise I haven't got to try it if anyone has it and we wants to let me try I'll be happy to give you my thoughts mama no we can just set the safes I know what I'm doing my garage it's a neighbor's garage yeah cool so I can actually send it to that one as well I can send it to three so let's look up Toyota like clear my history your history comes up still enough and uh incognito load um how much long until you've run out of money we're not running out of money man oh my guy is coming is we are gonna be more serious about sales of our products though why do I need to see inside what box am i looking inside boxes I just got a chrome preferences here and clear my history person one edit person why do I have to look inside OBD is it part of advanced when I look at all this chrome stuff clear since the beginning of time you can say those those are fine browsing history download history yeah it sounds good bye bye cool how may i I see oh yeah funny any upcoming open pilot updates well that is coming very very soon zero point three point seven and it comes with silky smooth lateral control so I hope you guys appreciate it it was a web service use a prediction surface some do not shout Wow chromis all the stuff man well formed it we definitely only - hosted app date I don't know dad cool no vision only you guys with that I've never actually met someone in your life who has a Subaru I'm looking at my phone I'm not looking at you that's you over there cool yeah so silky silky lateral not not longitudinal yeah that is uh people are working on that right now um so let's check out Charlie noise thing actually has some good information Toyota car hacking media cracking porous and by panel you know we hope like like I said we ordered we ordered ten thousand pandas I hope to sell these all next year come to Australia 50% of sugru guess your showroom you're out think you're our ACCC is too bad the vision is only if the lateral only uses vision so that might be what you want so oh manufacturing no no we're shipping out okay so this is the anti-lock brake ECU it should be on 760 so let's try to send 760 see if we can get a name that looks like something reasonable so we would expect a response on seven six eight No so I think you want to all-out but what in their work they got the he doesn't respond to a name query so maybe they're all the seven continents this is probably something I should do more googling for sending things to my car never turns out now I should know like Python one-liners for time outs nice just like the one I know it works yeah that works no that one's responded to me Oh D responds to me as well that's interesting D responds with an invalid cool so to see so it was big age is not okay so there's something at B C and D they just seem like they don't have names look I could write like I've given you guys the deal with the vision only ACC before if somebody shows me that they have a car that they can control then I will happily spend some time and fix it for you it already kind of works too I don't know if anyone's actually tried it yeah if you comment up the other radar it'll work okay cool so it looks like I'm actually getting responses from these ECU's what's ever on B 0 C 0 and D 0 they're just not so what I'm trying to do right now is two things first off I have to add Elm support to a not male but like ad standard PID support to shiver um the other thing I have to do is figure out how to knock out the driving support ECU in the Toyotas so the driving support ECU is what's responsible for the onboard fairly low quality adaptive cruise control we want to knock it out and we wanna replace it with comet adaptive cruise control because it's way better so for the lateral we can actually just unplug the the camera module the driving support ECU is hidden much deeper in the car and we want to keep our brand-new rav4 as pristine as possible so we're gonna try to do it with software now realistically probably the right idea here is for me to get the Toyota text stream software hey do I want Japanese food that's kind of tempting but then I gotta switch off periscope um yes oppa violet can already do vision uh yeah yeah I could go for some Japanese yeah she ball sounds good I don't know if you're watching I don't have slack I can't get to slack it's on my phone if I switch off of periscope periscope man Josh Andy I got your Aussie ball alright I give that up 50% heads working so you can't just comment out radar D it's gonna take a bit more effort than that no no no we have an internal slack but we need more computers no we need that we walk the talkies right I need more phone so have another phone right here let me you know what I'll send him an email I know his email I'll send him an email from this phone okay I got a phone yeah sure she ball please okay so now I think my odds are getting across your bowl get up to 70% that is good well yo good all right I sent you an email from the test phone okay cool so let's go back to obd2 Pitts we're gonna want to send the request we're just gonna deal with the main ECU for now but it's interesting that those things do respond Jessie the contractor who wrote the panda elm software for us had some pretty good comments about this stuff let's see what you wrote so our stuff is here that's actually the co knowledge was in the safety it tells you what the spec is it's actually being implemented here yeah so this so the Honda uses these really high up addresses check or someone said if an address is 7 TF or address and okay that's good to know this is the Honda one no open bottle does not have emergency safety features it's not really to be viewed at as a safety device we do think that it makes driving safer but now it doesn't oh oh it's been it's been it's been updated by this one oh how much do I have to pay for this okay so first off it's a hundred thirty-eight I do believe that Swiss francs okay let's get this for free well let's preview man ISO standards a pricey an Apple lock meow lock me out of watch you rich paying how many chips look like I'm paying them any chips mommy figures Oh perform Broadway Val I'll have to buy if I want that okay who knows how I get free ISO things oh did the Swedish make it available free Swedish my girls like that PewDiePie Swedish he's the most famous youtuber ever oh yeah oh no it's a it's a it's a Provo sings like example our yeah Pirate Bay yeah for some reason I don't think there's gonna be up on the Pirate Bay okay alright let's just see what we can find that's not I self and so this is like yeah how to request you game this is how I figured out how to do that VIN request you know what we'll just figure it off a little Kapiti pay just can't be that hard so these pigs are like the standard ones they're used by like emissions people see mode five just modify redo they come in with the different modes of arson where this motor mold want the exceptions are PID one which is only available in mode one and PID two which is only available in mode tool oh here we go show current data all right so that's mode once let me just try sending a100 and seeing what happens so we're sending engine ECU we're receiving it from the engine ECU I just read that it's supposed to be +8 let's see what this does well cool gives me some stuff okay so this is allegedly the PIDs supported and I believe it's bit encoded yeah it's been encoded okay so let me just start writing this standard quickly um very poor dead PIDs then it looks like the cons responds from MSB to LSB he's our first aw I guess it starts with 1 because 0 pit is always supported and that's what I'm sending ok so just make a get PID D I should name the thing correctly the mode 1 what didn't want where did they use get get current now I just say red equal get data for PID 0 that's the works I remove this extra debug crap from here yeah you know I don't really write in a Python 3 compatible way Python 3 is a disaster so we can find out this getting bin doing any more cool so those are my supported pets now it's MSB for so what's the easiest way to do this support it equals that I wanna do this too strong and I should see anything page 132 was the max you see below X 20 is the max 20 yeah y equals 1 to infinity I mean you can do that if your language is lazy I think your Friday equals 1 to infinity I mean just wow I plus 1 box if supported and 1 2 3 watch it watch oh I support it if left equals y guy should standardize something I shouldn't call one of them query and one of them yeah let's did I take that word query from somewhere I try to make things as standard as possible unsupported types for tuple and Aunty add extract okay cool so those are the supported pads for the car so we can get calculated engine load we can get long term fuel trims we can get intake manifold pressure wait I can't get engine rpm now that's weak I just made a mistake trihex thumping get current-day - my flat for PID 168 I'm just data for PID let's try okay so 12 should be the engine rpm seem like it says it's not supported and yet stepper motor designed to control car all question the safety of those things uh but if you have one I mean I'm not sure we can really review it I mean I can look at it like you posted on everything really the way to do it is like posted on github and yeah so you got you got to make sure you do it safely so if you're gonna build a external steering control you need two things to be enforced by the hardware practically you need a torque limit and you need a disengagement fuckin side so yeah I mean posted on the Internet we have a community going our slack and see what you love to say okay so I understand oh that's the PID wait mode 1 PID zero our quest for this PID doesn't make sense like I'm sure this car can fetch the RPM between monitor idea supported okay let's look at this mode thing happens if Neo CPU fails um also they'll stop sending messages to the car so the dashboard will turn orange you'll get the lights you'll get beeps well I can request trouble codes with mode three wow that's actually really easy updo that only other easy use as well by the way I'm watching the stream and it's really laggy is it lagging for you too well you're actually seeing up to the minute what I'm doing like when I talk I'm like I ran query van I ran query van does that work no like okay it just likes for me weird um that's why I thought it was broken before silky-smooth that's what I like to hear okay so that's the engine rpm um let's see community according to this can we request the throttle position position is 17 which isn't here either yeah I know it works weird did I write this code wrong all maybe things aren't sent as MSB you each bit from MSB to LSB I did that right seven eight nine oh oh oh cuz this is that after after the big endian here actually let me actually do proper big endian like that ah much better okay that's a lot more sensible now can I get things like the wattle position in rpm yes I can 17 and 12 so let's make a little loop here want extract the current data for the pin so I know that that's two bytes untaek so this is your RPM and let's also get what else can I guess throttle position that's what I was gonna get and the level three autonomous a know fully fake news so you have to realize how a lot of auto manufacturers view self-driving they don't actually care about it and they actually really don't like it um because you know if you believe all the predictions about mobility as a service yeah yeah yeah they sell less cars so they're doing this the only reason they ship any of this stuff is for press the Audi a8 the l3 Audi a8 is a press stunt GM supercruise is a press stunt right they ship it on one Cadillac they're not actually shipping it on their cars they ship it on one Cadillac that car sells five thousand cars a year it's a PR stunt practically do I think Ilan gta4 what do I think Ilan zga for his drive across the country is realistic maybe chess is about six months to a year ahead of us requires an argument for that number is required this is some like trick okay so this is 100 times 255 can you jailbreak your ps3 with your panda I wouldn't know anything about that would I okay cool let's see if it works let me get over here into the driver's seat and now let's press on the throttle and see if it changes oh yeah look at that kayaking with pandas bro car hacking with pandas that's nice oh you're starting up see if we get some RPMs look at them RPMs I think I did the math wrong I don't think that's the right number of rpms okay 256 times a closed B also I gonna divide by four it says oh that was so easy you guys bro so easy show you Oh show you me stepping on the throttle like that well you can see like the ref count on a car and it matches what's on the screen process called car hacking all right it's turns off it's loud boom boom okay cool um who knows what boost is we were having a debate last night about what boo sticks none of us really knew and but none of us I mean I was talking with our designer who's made shiver look awesome by the way and he didn't know a boost wasn't like really Oh boosters either but I think no not Boost Mobile no way yeah I mean boost okay so let's see what else we can get from these things oh we can get the PID supported 20 as well 20 gets you more pids for to get you more PIDs okay so we'll have those two might get supported pids function all right let's write this in a not crappy way but you knowing me I will write in a crappy way pit equals one rangy pit boss head cast is through 21 plus pig pig pig and range zero see how many goes work Pig supported air oh sweet it works all the way up let's see easier although so we won't send a zero alright alright does not work you make typos oh it's on the car accessory boats what we're all four here not the normal mode data yeah so this is just normal mode data yeah when I'm not getting past any gateways right now okay so it looks like it doesn't even support the last request hey it says that standard scam Oh unless that not right no scam like time out okay so these are all my supported pits see what this Bwana Juanes woggs iller en put and out push yeah I know I am Toyota socks with standard peds that's too bad well it says it supports 96 how does that how is that possible that must mean I made a mistake oh I know oh that's clever okay alright I understand now wild one kid plus equals twenty if did not and supported break variable pitter four side Oh rats alright yeah that makes us all right let's do the trench sweet so that returns all your supportive pits and we'll add this code to pant I'll kind of clean it up totally off stream some lights on yeah Toyota lights oh yo ice cream light this up Joe that's a real life not like just nothing at all John Dylan alright so those are our supportive pads what do you think what do you guys think the coolest pads to display will be like by default on shiver as I'm writing this stuff now well I get the temperature of the engine that's kind of cool use your phone flash on your flappy mirror thing wow that's bright it's too bright can't do it what's the coolest one of these fuel pressure see how do you know how torque is getting yeah can we get that so I don't see it here I'd love to see fuel usage but yes a house torque doing that I've seen that in torque does that actually work or is it just estimated because I don't see anything here that would let you actually get that rpm speed gear consumption torque a transmission battery voltage we're gonna get you guys so that's actually I don't think on here either huh okay well that's interesting but no go back to that later um non-standard PIDs oh very limited information Oh should reverse engineer them and make it available for free cuz I love free I love free yeah I think it does math current current of what I can get you current from the Panda pandas have current and voltage sensors in them um but okay yeah so that's the speeds a good one to get vehicle speed km/h he tells me the vehicle speed accurate to literally one kilometer per hour week I like accuracy you know you don't have another bite your phone's GPS you don't know but you yes because that's you could they couldn't afford another bite they couldn't give me the speed two to two bits of precision all right well this is where we have open dvc [Music] so we'll move the query all ECU's things somewhere else Kevin's kind of cool shouldn't really send the PID if it's not supported seven is fine let's rename it MV queries in which we name it very very thin stats that's cool this is a code that's gonna go into Schiffer obviously not the pipe shiver is no longer written in Python it wasn't one point but it's not anymore so what else do we want speed revs throttle battery voltage anymore see no it's written in JavaScript huh the futures JavaScript runtime since engine start well that's interesting because we should be able to query at least if the engine is started with that and watching we send this so in cars with more it's in cars like the Honda we're gonna have to use that one try to comment there oh did open pilot zero point three point seven just got pushed it might have it might have been pushed into Val I'm pretty cool stuff in there no I'm not logged into anything here let's check it out open pal zero point three point seven release check it out guys this one's exciting yeah we have we have lots of improved stuff yeah go to get up coming I open pilot checks out but let's go back to what I was doing haha should work it's gonna update your panda to the latest panda firmware - let me just name this thing properly what's happening right now so I'm setting some standard queries to the car you can see that I'm getting the speed the rpm and the throttle right now and I've managed to clear the supported pids I'm also getting the VIN number from the car actually want to be better about this oops I should really write a parser for this and I'll just do two : but hey you know so what happens if I Google this then that's good idea Toyota rav4 and I'm gonna find out all the terrible stuff that happened to my car did I get a good price let's check let's check to history melody Twitter's plus I bought it from mmm look at this oh yeah I think that's the price they're asking I got a good price 34 you know I think car dealers is one of those industries that like makes all their money off like a few suckers alright cool that's what happens when you query then that's a little crazy though that you can just like query the van you like no so where someone bought the car and stuff oh mode 21 for Toyota the voltage of the traction battery and a hybrid electric vehicle that's exciting I should probably ask for store DTC's as well Java's car has any make that Turkish effort as well what does a dtc that's not a did you say cool yeah extended warranties i probably tell scammy business all right control model module voltage job exciting no so oven pilot won't update on reboot we've only pushed to devel we haven't pushed to release yet so if you are a developer you can check it out if you're not a developer you probably want to wait till a few people check it out first i'm still visible it's good oxygen sensors engine coolant temperature well definitely check that one no it's called temperature call him okay so I'll just subtract 40 from this one PID 5 it's one bite okay no now you're looking at this no charge why you're a terrible code okay well to clean up I did write a really terrible code truly atrocious well 39 degrees Celsius it's that warm or cold I don't know how Celsius has worked sounds kind of warm though can't blow water though are you cool mom one more stat I need one more stat engine load yeah it's probably pretty cool I support that load yeah load no it's one of those percent once does that really what took away from that point zero to where you want it I don't even have that many degrees of significant figures cool cool guys I'm pretty happy with that so we'll add ice OTP will add craving stats what I do doing that I think I need that get the gif well unless it's vicinage change yeah yeah oh I did change this yeah I added I added those okay that's a cool probably refactor eyes OTP to be somewhere else but yeah we can be that later can I make it honk well we'll do that on the next session what do you all think about that we'll try to do some crazy stuff we're even and stats ok guys I think that is live let me go to OBS let's what my food is here I'd be real happy if my food is here a shell cool I just pick myself full screen here all that's so pixelated let me just make it less pixelated oh but now it did that come on OBS why would anybody want to do that wrong choice broski all right thanks everyone for joining this periscope and it's a little dark and you'll try some white so let's turn some lights on any last questions wait it's hunk actually a code I really don't think hunk is a code but if I'm wrong and we can make the code hunk very easily a car honk very easily I am sold oh no I don't think that works what's your question I'll try it next up I'll tell you next time we learn for next time next time I got a point to the right place how's vim but you gotta ask man just me tonight I hope my foods inside who thinks patrasche was inside uh yeah you should have got an email you sure got an email if your Panda has shipped um which should be almost all the pandas now are you sure got an email what's the goal of what of the goal of this the goal of this was just to get some cool stats so those five stats that I just wrote that Python to do we're gonna hand off to the app team and they're gonna add them to shiver what is sync up and drive well know what that is sync up and dry let's go thank you thing sync up and drive oh it's like some t-mobile oh they make like crappy dongle so I say why they all make dongles this is like a new pivot for the broski's the the phone carriers phone Appetit alright alright cool guys see y'all later thanks for joining wait wait wait post that again send 750 I'll do that I'll do that what do we got I'm counting on you 750 oh for okay next time next time