5/25/2015

Madox.NETMazdaCANBus

Madox.NET
PerversionsofanEngineer

Home
AboutMe
Gallery
Projects
MazdaCANBus
ScratchPad
mFCMadoxFloatingCamera
HPProBook5310mUbuntuReference
InternetShopping
TPLinkTLWR703N
Loightscythe
Shapeways

MazdaCANBus

Introduction
Readthemultipartblogposts:
1. ReverseEngineeringtheMazdaCANBusPart1
2. ReverseEngineeringtheMazdaCANBusPart2
Notes:
1. Ivestillgotsomedatafromanotherpersononasimilarquesttocombineintothisdataifyouhaveany
info/dataaswell.LetmeknowandIlladdittoo.
2. Ignoremysillycolourschemes Ithinkblueisconfirmed,andallothersmeansomething.Illclean
ituplater.

HSCANData
ThisistheHSCANdata.500kbps/500kHz.
Can
Message
Identifier
00000040
00000046
00000190

Byte(s)

Bit

Bitmask Description

00000200

0,1

Unknown

00000200

2,3

Unknown

00000200

4,5

Unknown

00000200
00000201

6
0,1

Comment
Onlylastswhenkeyisfirston
Onlylastswhenkeyisfirston

6 0x40

7 0x80

http://www.madox.net/blog/projects/mazdacanbus/

BrakeActive

Unknown
RPM

Correlateswithwith00000200(4,5)&
Acceleration
Correlateswithwith00000200(0,1)&
Acceleration
Scale=Xrpm.
1/7

5/25/2015

Madox.NETMazdaCANBus

00000201

2,3

Unknown

00000201
00000201
00000205

4,5
6
2

VehicleSpeed
AcceleratorPedal
BrakeActive

6 0x40

0000020F

2,3

0000020F
00000211
00000211
00000212
00000212
00000212

4
2
4
0
2
3

6 0x40
7 0x80
6 0x40
7 0x80
5 0x20
7 0x80

00000212

4 0x10

00000212

6 0x40

00000228
00000228
00000228
00000228
00000228
00000228
00000228
00000228

0
0
0
0
0
0
0
0

0 0x1
1 0x2
2 0x4
3
4 0x10
5 0x20
6 0x40
7 0x80

Off(Park)
Reverse
Forward(Drive)

00000228

3 0x8

GearShift

00000228
00000228
00000228

1
1
1

4 0x10
6 0x40
7 0x80

Unknown

00000231

0 0x1

Unknown

00000231
00000231
00000231
00000231
00000231
00000231
00000231
00000231

0
0
0
0
0
0
0
1,2

1 0x2
2 0x4
3 0x8
4 0x10
5 0x20
6 0x40
7 0x80

Unknown
Unknown
Unknown
1stGear
2ndGear
3rdGear
4thGear
Unknown

00000240

Unknown

00000250
00000250
00000250

0
1
2

Unknown
Unknown
Unknown

00000250

00000250

VehicleSpeed
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown

Offsetby0x4000.Appearstobethedelta
inenginetorque?Derivativeofrpm?
Cumulativereturnstozero.
Scale=X/100km/h.Unsigned.
AcceleratorPosition.200isfullydepressed.
Scale=(X10000)/100km/h,unsigned
(Refertohandleposition).Correlateswith
0000004B0wheelspeeds.
Appearsalwayson
Appearsalwayson
Appearsalwayson
Appearsalwayson
Appearsalwayson
Appearsalwayson
SomeDashWarningLightOffwhen
ignitionisoff
SomeDashWarningLightOffwhen
ignitionisoff
0x03appearstobeneutral
0x03appearstobeneutral

1stGear
2ndGear
3rdGear
4thGear
Activeforseveralmessagesoneachgear
change.
Occurredonceonagearchange
Somethingtodowithbrakepedal

Manual/Triptronic

Unknown

NotBrake,butveryclosechangesnotfar
frombrake
Alwaysappearsoff
Alwaysappearsoff
Alwaysappearsoff
Reverse=0xE?
Reverse=0xE?
Reverse=0xE?
Reverse=0xE?
Torque?RPMdemandx10?
Varies,notcorrelatedwithspeed/accel.
Around10/11/12whenstationary.

AcceleratorPosition.225seemsfully
depressed,butbiasof32Seeotheraccel
pos.Thismightbetherawvalue,some
noise.

0 0x1

http://www.madox.net/blog/projects/mazdacanbus/

2/7

5/25/2015

Madox.NETMazdaCANBus

00000250
00000250
00000250
00000250
00000250
00000250
000002A0
00000420
00000420
00000420
00000430
00000433
00000433
00000433
00000433
00000433
00000433
00000433
00000433
00000433
00000433
00000433
00000433
00000433
00000433
00000433
00000433

5
5
5
5
5
5

000004B0

0,1

000004B0

2,3

000004B0

4,5

000004B0

6,7

1 0x2
2 0x4
3 0x8
4 0x10
5 0x20
6 0x40

0,1
1
2
1
2
2
2
2
2
3
3
3
3
5
6
6
6
6
6

000004DA 0,1
000004DA 2
000004DA 2
000004EA
000004EC

0 0x1
0 0x1
1 0x2
2 0x4
3 0x8
6 0x40
0 0x1
1 0x2
2 0x4
3 0x8
0 0x1
0 0x1
1 0x2
2 0x4
3 0x8
6 0x40

Appearstobeallzeroes(4byteframe)

Unknown
Unknown

Counter(AlwaysIncrements)
Notsureif2bytesorbytepair.

Unknown
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown

Notseentochange(0)
Changes
Changes
Notseentochange(1)
Notseentochange(1)

Notseentochange(1)

CheckOrder.Scale=(X10000)/100km/h,
unsigned(Refertohandleposition).
Correlateswith00000020Fvehiclespeeds.
CheckOrder.Scale=(X10000)/100km/h,
RightFrontWheelSpeed unsigned(Refertohandleposition).
Correlateswith00000020Fvehiclespeeds.
CheckOrder.Scale=(X10000)/100km/h,
LeftRearWheelSpeed
unsigned(Refertohandleposition).
Correlateswith00000020Fvehiclespeeds.
CheckOrder.Scale=(X10000)/100km/h,
RightRearWheelSpeed unsigned(Refertohandleposition).
Correlateswith00000020Fvehiclespeeds.
SteeringColumnAngle
(X32768)/10Degrees,Clockwise+ve.
Unknown
Notseentochange(1)
Unknown
Notseentochange(1)
Unknown
1ByteFramealways00
Unknown
8ByteFramealways00
UnchangingUnknown
142412FFFF7F
Every5s
UnchangingUnknown
4A019FFFFF645E5E
Every5s
Odometer(Total)
Mightbefirstbytetootogettherange
UnchangingUnknown
3230333030383131
Every5s
UnchangingUnknown
424B313046323030
LeftFrontWheelSpeed

6 0x40
7 0x80

000004F0
000004F1
000004F2

Unknown
Unknown

1,2

000004F3
000004F4
http://www.madox.net/blog/projects/mazdacanbus/

3/7

5/25/2015

Madox.NETMazdaCANBus

Every5s

MSCANData
ThisistheMSCANdata.125kbps/125kHz.
Can
Message
Identifier
00000023
00000201

Byte(s)

00000201

2,3

Unknown

00000201

4,5

VehicleSpeed

00000201

Unknown

00000265

5 0x20

Unknown

00000265

6 0x40

Unknown

00000285
00000285
0000028F
0000028F
0000028F

0
0
0
0
0

5 0x20
6 0x40
4 0x10
6 0x40
7 0x80

00000290

1,2,3,4,5,6,7

00000291

1,2,3,4,5,6,7

00000400

0,1

00000400

2,3

00000400

3,4

00000400
00000401
00000420
00000420
00000420
00000420

5,6
0
0
1,2
4
4

00000433

00000433
00000433
00000433
00000433
00000460
00000501
00000511

3
3
3
4

Unknown
Unknown
Unknown
Unknown
Unknown
HULCDAlphanumeric
ASCIIByteCodes
Display1/2
HULCDAlphanumeric
ASCIIByteCodes
Display2/2
AverageSpeedinKm/h.Mightbesingle
AverageSpeed
byteonly
InstantaneousFuelConsumptionL/100km.
FuelConsumption
ScaleX/10.
AverageFuel
FuelConsumption(L)per100km.Scale
Consumption
X/10.Mightbesinglebyteonly.
DistanceRemaining
DistanceinKMremaining
Unknown
Notseentochange(0)
Unknown
RisesthenlevelsoffTemperature?
Unknown
Increasingcounter?
Unknown
Unknown
Guessonly,temperatureinCX/4(0.25deg
Cincs)
KeyOn?
AirConrunning?
Highbeam(IndicatorLight)
Headlight&Wiper
Keyposition?
Key?
Key?

1
0,1

Bit

Bitmask Description
7 0x80

1 0x2
6 0x40

0 0x1
3 0x8
6 0x40

http://www.madox.net/blog/projects/mazdacanbus/

Unknown
RPM

Comment
Notseentochange(1)
Offsetby0x8000.Appearstobethedelta
inenginetorque?Cumulativereturnsto
zero.
Scale=X/100km/h.Unsigned.
AcceleratorPosition?Verycloselylinked
withaccelerations(notdecel).
LeftBlinkerIndicateslighton.(Itpulses
too!)Checkhazard
RightBlinkerIndicateslighton.(Itpulses
too!)Checkhazard
keypos?
keypos?
volume?
volume?
volume?

4/7

5/25/2015

Madox.NETMazdaCANBus

Genuine Mazda Car Parts

Genuine OEM Japanese Car Parts. Buy online

and save! Fast delivery

103ResponsestoMazdaCANBus
1.
Tw33dlersays:
August23,2013at14:16
Re:Rx8instrumentCluster
anyoneknowhowtofooltheclusterintothinkingtheparkinglight/headlightsareon?
gotitworkingonmydesktopsimulatorbutiwanttheclustersredlightstoturnwheniturnthelightson.
itsaCANsignalbutdunnowhichid.
Reply
2.
ReverseengineeringtheRX8sinstrumentcluster,partoneCantankosays:
January15,2014at00:04
[]amessagetype,alengthfieldandoneormorebytesofdata.FrominformationIdfoundonthissite,
CANmessageidentifier0201lookedinteresting,soIsetallthebitsinthe8bytedata[]
Reply
3.
spirossays:
May1,2014at03:33
canypuhelpmeihaveanrx8andimade1jzengoneswamphowtomakeguagework?
Reply
4.
Andrew22says:
July23,2014at07:21
AnychanceyouhaverawdatafilefromtheCanBustohaveadetailedlookat?
Reply
5.
Zangdar64says:
August23,2014at07:54
Nice!
ImactuallydumpingthetwocanbusofmyMazda3(2ndGEN).SomePIDaresame.
Reply
6.
IKERsays:
August29,2014at01:24
Iownamazdacx5.Wipers/rainsensitivityandlights/doorscanbesetupfromheadunit.Couldbethey
adjustedviacanbuscommands?IamgoingtoreplaceHUbyanaftermarketoneandinjectbus
commandsfromandroidkerneltocanbus(viaUSB)
Couldthisbedone?CanIusethestockheadunittoidentifycanbuspidthatHUsendswhensetting
options?Anytipforachievingthis?
Manythanksinadvance
http://www.madox.net/blog/projects/mazdacanbus/

5/7

5/25/2015

Madox.NETMazdaCANBus

Reply
7.
IntroducingtheCANBusTriple!Page8MazdaspeedForumssays:
September2,2014at06:43
[][]
Reply
8.
IndieGameDeveloper|WTF!ItShouldNotBeIllegaltoHackYourOwnCarsComputersays:
January23,2015at22:18
[]toreverseengineertheircarscommunicationnetworkandraiditfordata.Thereareevenpeople
reverseengineeringMazdasincaseIshouldevergetcuriousabouttheonesandzeroeszoomingaround
inthesecret,[]
Reply
9.
WTF!ItShouldNotBeIllegaltoHackYourOwnCarsComputer|Naggsays:
January23,2015at22:30
[]toreverseengineertheircarscommunicationnetworkandraiditfordata.Thereareevenpeople
reverseengineeringMazdas[7]incaseIshouldevergetcuriousabouttheonesandzeroeszooming
aroundinthesecret,[]
Reply
10.
ItShouldNotBeIllegaltoHackYourOwnCarsComputer|iFixitsays:
January24,2015at05:25
[]toreverseengineertheircarscommunicationnetworkandraiditfordata.Thereareevenpeople
reverseengineeringMazdasincaseIshouldevergetcuriousabouttheonesandzeroeszoomingaround
inthesecret,[]
Reply
11.
Michasays:
January30,2015at09:55
DidyoutrysendingsomethingoverCAN?IwouldbeinterestedinsendingtexttoLCD?IwonderifI
sendmessagesameasthatcomingfromradiowillitgetreplaced?
Reply
OlderComments
LeaveaReply
Name(required)
Email(willnotbepublished)(required)
Website

http://www.madox.net/blog/projects/mazdacanbus/

6/7

5/25/2015

Madox.NETMazdaCANBus

SubmitComment

PoweredbyWordPress,Mandigothemebytom.
Entries(RSS)and Comments(RSS).
Cancel

http://www.madox.net/blog/projects/mazdacanbus/

7/7