Read Part Number

Reverse engineer CAN-Bus communications of automotive modules
Post Reply
oscarboiro
Active member
Posts: 107
Joined: 19 Feb 2019, 21:50

Read Part Number

Post by oscarboiro » 15 Mar 2020, 11:12

Hello, i try to read the part number of my Instrument cluster (I have a kuga MK1) an i have problems to decode last digits.

to read i send and received next sequences:

Send-----> 720 03 22 E2 1A 00 00 00 00
Receive-> 728 07 62 E2 1A 38 56 34 54 from this sequence i read next digits: 38 56 34 54 from hex to ASCII is next: 8 V 4 T

Send-----> 720 03 22 E2 17 00 00 00 00
Receive-> 728 07 62 E2 17 01 00 08 49 from this sequence i read next digits: 01 00 08 49 and take next red digits: 01 00 08 49

Now i have next number 8v41-10849- But i need decode last digits. to read last digits i send next sequence:
Send-----> 720 03 22 E2 19 00 00 00 00
Receive-> 728 05 62 E2 19 0C 09 00 00 from here i need read 0C 09 i read the instrument cluster with elmconfig and 0C is G and 09 is K

but i dont know the logic to read another codes, i have another instrument cluster and the can bus returned 14 09, and 14 is L and 09 is K
Any idea to decode all letters?

i put numbers to all letters example:
A-0 B-1 C-2 D-3 E-4 F-5 G-6 but G is 0C..... :?: :roll: :? :shock:

any sugestions or infromation from this

PD: after read PCM serial returned number 49, and this number are two letters "AM"
Kuga MK1 owner

Go4IT
Pro
Posts: 557
Joined: 08 Feb 2019, 12:25

Re: Read Part Number

Post by Go4IT » 15 Mar 2020, 22:15

Hm, are you shure about the data you request?
You request 0x22 (=SID for "Read Data By Identifier") with data identifier 0xE21A, which is unknown to me. Also the number of bytes in the answer (7) does not fit the ECU HW number length. What you request are some "other" data and so it does not make any sense to you (and not to me, either ;-)

If you want to have the serial number, it think it should be 0xF191 ("Vehicle Manufacturer ECU Hardware Number Data Identifier"), so your request should be like: 720 8 03 22 F1 91 00 00 00 00
This should return something like "728 8 10 1B 62 F1 91 37 4D 32", which is the first frame of a multiframe transmition, so you must answer
"720 8 30 00 00 00 00 00 00 00" and in return get three further frames where the first byte is the frame-number (counting up from 0x21) and the remaining bytes are pute ASCII data.

Post Reply