Car hacking | How I added features by manipulating can bus — and how you can, too!
The goal of this article is to walk you through the approach I took while learning more about modifying my vehicle via can bus.
This project began when I decided to add a front camera to my 2017 Chevrolet Cruze. Because my car already has a factory backup camera, at a high level I determined I had to figure out how to accomplish 2 things -
- A way to feed in the video from the front camera I will be adding
- A way to trigger the backup camera screen on my factory radio at anytime
The video part was easy; through prior experience I knew I could create a video switcher using relays.
Triggering the screen proved to be more tricky and after some investigation, I came to the conclusion that my car must signal the backup camera screen via some sort of data bus.
Chevrolet’s utilize 2 different data bus’. The first is standard CAN which is fast [500kbs], reliable, and used for critical data. The second is what GM refers to as LAN (GMLAN) which is an older, slower [33.3kbs] bus used for non safety critical data.
I needed a way to listen to can traffic — otherwise known as “sniffing” the bus — and this is where the PCAN came in incredibly useful.
Peak Can — or PCAN, is a usb device capable of listening to and transmitting can messages. Along with their software, Pcan View, I was able to get started with minimal learning curve.
Since a backup camera is less safety critical than other components, I assumed the data I was after would likely live on the GMLAN bus.
The easiest point to access was the obd2 connector. I connected the peak can to the gmlan bus via some jumper wires, launched the software, and before I knew it I was listening to the traffic in real time.
The goal was to reverse engineer how to trigger the back up camera screen. To accomplish this, while sniffing the bus I put the car in reverse — to trigger the display — and then back to park multiple times. Throughout this process, I noticed one ID had message data that consistently mimic’d my actions.
At that point, I put the car in park and through Pcan View I attempted to transmit the same message I saw when the display turned on and off. In no time at all I was interacting with the bus.
Although, my objective was not to drive around with a laptop plugged in all the time. I needed a way to automate these functions for me — this is where the Arduino comes in. The ability to receive a 12V input directly combined with the large amount of resources and support that already exist on the internet made this an obvious choice.
In addition to the Arduino, I needed 2 components to complete my project: a can module and a relay module.
Essentially, the Arduino is the brains, running and executing the code.
The can module provides me the ability to interact with the data bus.
And the relay module provides power to the front camera along with acting as a video switcher between the front and rear camera’s.
After adding and customizing the appropriate libraries, I had the Arduino communicating with my car.
Because I already knew I could trigger the display, I began thinking about HOW I should trigger it. My initial idea was to install a dedicated momentary button in the dash and use that, but I began thinking “Wouldn’t it be cool if I used something ELSE on the network for my trigger?”
Through experimentation, I discovered a message id corresponding to the “cruise control cancel” button on my steering wheel was also on the gmlan bus. This was perfect because cruise control would only be in use at speeds above 40mph while I would only be using the front camera to assist with parking at speeds below 10mph so they would never overlap. After writing some code, I was able to have the Arduino recognize when the cruise cancel button was pressed.
However, I didn’t want the camera activated every time I canceled cruise control, so I decided the best approach would be to turn it into (essentially) a multi function button. The front camera would be activated ONLY if the button was ‘double pressed’.
After a long weekend of learning the millis function and troubleshooting code, I had the double press successfully recognized.
And once I tied it to my commands to control the display I had a pretty cool little utility built.
Now at this point, I had the ability to turn on and off the display, but I still had one problem — what about the back up camera? I needed the front camera to function alongside the back up camera (BUC) as if it came installed from the factory that way.
I created this flowchart to help better illustrate what I envisioned.
To achieve this, I quickly realized I needed the state of 3 variables at any given time. Those variables are:
Front Camera Module —does the driver have it turned on or off?
Camera Display —is the camera image on the display on or off?
Reverse — is the car in reverse or not?
Not having a programming background, this was very challenging to accomplish and I spent every spare minute outside work for about a week thinking about different approaches.
Eventually, I had success!
I was now able to implement the operational logic which, in turn controls the relay’s.
Throughout the process, I had been learning more and more about Arduino’s and noticed the Nano version will do everything I needed with both a smaller footprint and cheaper cost. This is ideal for permanent installation in a vehicle. I designed and 3d printed an enclosure to house my components as a compact unit for installation.
Tying it all together
The day finally came when I got to see results . Although I still have some tweaking to do in regards to timing, it was pretty awesome to see the module function as intended.
Overall, this experience taught me a lot and opened my eyes to possibilities of integrating directly with a data bus’. It is pretty amazing what can be accomplished with just a 2 wire connection.
Be on the lookout for my next article — I ‘ll be providing a beginner tutorial focusing on how to get started with can bus reverse engineering — all with <$5 worth of components!
If you have any questions or comments — or if you are in the Bay Area and have interest in collaborating on a project — please reach out to me directly at email@example.com