Data Sources[]
This network features two broad types of commands: call and response, and module-to-module. Call and response commands are triggered by events, such as button presses. Module-to-module commands are the traffic between networked devices, and typically relay sensor data.
Call-and-Response[]
| 数据 | Header | Arbitration ID | Network | Byte 0 | Byte 1 | Byte 2 | Byte 3 | Byte 4 | Byte 5 | Byte 6 | Byte 7 | Formula | Units | Notes | More Information | Verified on... |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Radio Volume Up | 10438040 | SW-CAN | N/A | 0x01 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | Byte 0 identifies command | N/A | After pressing, button must be canceled by changing B0 to 0x00 | No Link | 2011 Buick Regal |
| Radio Volume Down | 10438040 | SW-CAN | N/A | 0x02 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | Byte 0 identifies command | N/A | After pressing, button must be canceled by changing B0 to 0x00 | No Link | 2011 Buick Regal |
| Radio Voice Recognition | 10438040 | SW-CAN | N/A | 0x06 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | Byte 0 identifies command | N/A | After pressing, button must be canceled by changing B0 to 0x00 | No Link | 2011 Buick Regal |
| Radio Mute Toggle | 10438040 | SW-CAN | N/A | 0x07 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | Byte 0 identifies command | N/A | After pressing, button must be canceled by changing B0 to 0x00 | No Link | 2011 Buick Regal |
Module-to-Module[]
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Mode $22 PIDs[]
General Motors has enhanced PIDs for their vehicles. A list of "enhanced" PIDs will appear below.
Actuators[]
Some devices may be controlled by diagnostic tools or test equipment. These are usually operated by "services," and some require a seed/key to unlock. Examples appear below.
| Actuator | Function | Network | Header | Byte 7 | Byte 1 | Byte 2 | Byte 3 | Byte 4 | Byte 5 | Byte 6 | Byte 7 | Seed/Key? | Notes | More Information | Verified on... |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Headunit | Eject Disk | SW-CAN | 0x244 | 0x07 | 0xAE | 0x05 | 0x01 | 0x00 | 0x00 | 0x00 | 0x00 | No | Ejects disk | No Link | 2011 Buick Regal |
Notes[]
GM vehicles have, at minimum, a high-speed (HS) and single-wire (SW) Controller Area Network. HS-CAN typically operates as 11bit, 500kbps, while SW-CAN operates at 33.3kbps with 29 bit headers. Most GM commands have an "arbitration ID" that is invariant for a given instruction, so while the exact header may vary from vehicle to vehicle, the arbitration ID will not. Additionally, nodes on HS-CAN have well-defined IDs that are invariant, e.g. the functional address for all Body Control Modules (BCMs) is 0x241 with a reply on 0x641. Nodes on SW-CAN may be identified quickly based on the last four characters, which correspond to a two-digit code for the sending and target node.
Links[]
Foxdie's mBed GMLan-Sniffer Repo