Hacking this computer on wheels - Chrysler 300C Forum: 300C & SRT8 Forums
2nd Generation Chrysler 300 Discussion This is the area for discussion of the new 2nd generation Chrysler 300.

Reply
 
LinkBack Thread Tools Display Modes
post #1 of 106 (permalink) Old 02-24-2012, 07:34 PM Thread Starter
Member
Points: 8,070, Level: 1 Points: 8,070, Level: 1 Points: 8,070, Level: 1
Level up: 99% Level up: 99% Level up: 99%
Activity: 5% Activity: 5% Activity: 5%
 
Join Date: Apr 2008
Location: Austin, TX
Posts: 47
Thanks: 0
Thanked 18 Times in 5 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 1 Post(s)
Hacking this computer on wheels

Just thought I would start a thread to discuss hacking the software in our cars - what we wish we could hack, technical information, tools, etc.

Here are some things I'd love to hack on my 2011:

- Disable in-motion lockout (I know it can be done with the lock pick, but a direct firmware modification would be better)
- Turn on rear camera any time. An additional button in the "More" tab is a great place for it!
- Add performance pages from SRT8.
- Tweak ACC parameters, such as minimum speed, reaction time, etc. It'd be so cool to set min speed to zero, so the car will come to a complete stop and take off for you in traffic or at a red light.
- Add a close all feature. I would love to be able to push 1 button to have the car roll up all the windows and close the sunroof. Surely the body control module or whatever can already talk to all the power window and sunroof modules to do this. Actually, we already have the ability to roll down the front windows from the key fob (press and release unlock, and then immediately press it again but hold it).

Anyone have anything else to add?

If I could somehow dump the firmware used in the Uconnect unit then I could take a stab at removing the in-motion lockout... Anyone have any insight on this?

-Andrew

Last edited by whisla13; 02-24-2012 at 07:39 PM.
whisla13 is offline  
Sponsored Links
Advertisement
 
post #2 of 106 (permalink) Old 02-24-2012, 09:45 PM
Senior Contributing Member
Points: 33,902, Level: 1 Points: 33,902, Level: 1 Points: 33,902, Level: 1
Level up: 99% Level up: 99% Level up: 99%
Activity: 0% Activity: 0% Activity: 0%
 
zach2011's Avatar
 
Join Date: Dec 2011
Location: USA
Posts: 643
Thanks: 12
Thanked 69 Times in 60 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 0 Post(s)
Well, the rear camera being enabled at any time can also be achieved with a lock pick.

On a more technical note, I know this nav uses .KWI files similar to our 2008 Tahoe and 2010 Escalade. I wanted to hack those as well and discovered that those types of Nav's, and maybe these UConnects, base their settings and config on these .KWI files and you'd have to have a way of reading and editing the .KWI files to manipulate the system, which others have found out it was nearly impossible to do because there isn't any software readily available to do so.

It's been a while since I researched it but that is what I came up with.

Last edited by zach2011; 02-24-2012 at 09:46 PM.
zach2011 is offline  
post #3 of 106 (permalink) Old 02-27-2012, 12:48 PM Thread Starter
Member
Points: 8,070, Level: 1 Points: 8,070, Level: 1 Points: 8,070, Level: 1
Level up: 99% Level up: 99% Level up: 99%
Activity: 5% Activity: 5% Activity: 5%
 
Join Date: Apr 2008
Location: Austin, TX
Posts: 47
Thanks: 0
Thanked 18 Times in 5 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 1 Post(s)
Quote:
Originally Posted by zach2011 View Post
Well, the rear camera being enabled at any time can also be achieved with a lock pick.

On a more technical note, I know this nav uses .KWI files similar to our 2008 Tahoe and 2010 Escalade. I wanted to hack those as well and discovered that those types of Nav's, and maybe these UConnects, base their settings and config on these .KWI files and you'd have to have a way of reading and editing the .KWI files to manipulate the system, which others have found out it was nearly impossible to do because there isn't any software readily available to do so.

It's been a while since I researched it but that is what I came up with.
The iPod update they released for the 8.4 is a file with a KWI extension (CTPMY11.KWI), leading me to believe it was in KIWI format. When I tried to read the file according to the KIWI specification, it is clearly not in the standard KIWI format. Chrysler must be using a variation or compressing/obfuscating the file... if I could figure out the format it'd bring me one step closer...
whisla13 is offline  
post #4 of 106 (permalink) Old 02-27-2012, 01:01 PM
Senior Contributing Member
Points: 33,902, Level: 1 Points: 33,902, Level: 1 Points: 33,902, Level: 1
Level up: 99% Level up: 99% Level up: 99%
Activity: 0% Activity: 0% Activity: 0%
 
zach2011's Avatar
 
Join Date: Dec 2011
Location: USA
Posts: 643
Thanks: 12
Thanked 69 Times in 60 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 0 Post(s)
Good find, I guess they are using a combo because I think the GM Nav's ran only on KIWI format files. A wild guess here but maybe an OBD II tool can help with the nav, they're expensive but I know they programmed my Tahoe's nav with one over at Chevrolet.
zach2011 is offline  
post #5 of 106 (permalink) Old 08-07-2014, 04:22 AM Thread Starter
Member
Points: 8,070, Level: 1 Points: 8,070, Level: 1 Points: 8,070, Level: 1
Level up: 99% Level up: 99% Level up: 99%
Activity: 5% Activity: 5% Activity: 5%
 
Join Date: Apr 2008
Location: Austin, TX
Posts: 47
Thanks: 0
Thanked 18 Times in 5 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 1 Post(s)
I know its against the rules to resurrect an old thread, but as the OP I decided it was time to share the amazing progress I've achieved on Powernet (even CUSW) vehicles.

I have managed to successfully reverse engineer the Powernet and CUSW vehicle message matrix (VMM). I know the format of EVERY message that is going through the CAN-C, CAN-IHS, and CAN-AT buses on Powernet and CUSW architectures (except for CAN-AT on CUSW as it doesn't exist). I did this using a combination of isolating each module (disconnecting each one, and bridging communication to the rest of the car, reverse engineering, among getting much more advanced such as dumping the modules memory and reading the disassembly to determine the VMM).

So using this on my Chrysler 300S 2012 with Powernet, I have been able to completely replace my ACC module with my *own* implementation (using code I wrote which talks to a CAN transceiver on a Raspberry Pi) to enable features such as Stop-And-Go (really AWESOME in bumper to bumper traffic) and even remote control gas and brake via Xbox controller (which is not practical and for fun only). I am working on using GPS data combined with computer vision to stop at stop signs, stop lights, etc.

I have made some videos and will post them on YouTube soon and will provide a link.

But basically I have successfully "hacked" my computer on wheels. I can do anything from change the climate control, to controlling exterior and interior lights (every single one, something as mundane as the license plate light). I can even detonate the AIRBAGS (which I've of course never tried but from the information I have no reason to believe it will not work). It has taken me years in my spare time to pull this off but I have succeeded.

I have also enabled SRT pages on my non-SRT vehicle in both the UConnect and the EVIC. It is really neat to have those screens. This was accomplished by determining which UDS (unified diagnostic services) data identifier used to write to the CBC (Common Body Controller) which changes the "Performance Pages Present" to 1 (enables in Uconnect) and "Is Vehicle SRT" to 1 (enables in EVIC). I can even change "Vehicle Model" to think its Jeep, so when the Uconnect and Evic boots, its shows the Jeep logo. That's just scratching the surface. I can modify the entire vehicle configuration. Add ParkAssist to your car? No problem, I know what the data identifier to set that Present = 1. In addition I have changed the Vehicle Max Speed to remove the speed limiter.

I pretty much have the car's CAN bus and modules at my fingertips. Have been using my stop-and-go ACC for about a year now and it has been flawless. I've also added a few gimmick features such as auto blinker when approaching a turn (as long as your route is in GPS), to enabling "Police Car Mode", so when you put the light knob all the way down to the last detent, ALL interior lights go off, and much more.

Quick background, I am a software and hardware engineer for a company in downtown Austin. In my spare time this is what I did, day and night - a kind of obsession if you will.

Another thing to mention, my younger brother has a 2014 Jeep (CUSW architecture). As those are equipped with EPS (electric power steering, full), I was actually able to plug into his diagnostic port and activate the steering torque overlay interface, and was able to turn his steering wheel left or right straight from my code. It was AWESOME! The possibilities of self controlling one's own steering wheel via TWO CAN bus wires is amazing. I already have computer vision algorithms ready to go to enable "full lane keep assist" (albeit illegal if you have yours hands off the wheel, but the coolness factor is outstanding).

So if anyone else is interested in my breakthrough, just reply in this thread - especially with any ideas you may have. I should have YouTube videos up soon.

Take care everyone,
-Andrew

Last edited by whisla13; 08-07-2014 at 04:33 AM.
whisla13 is offline  
The Following 10 Users Say Thank You to whisla13 For This Useful Post:
BigIronRam (08-07-2014), DReffects (08-18-2014), Patdow1 (08-07-2014), Piggy. (08-07-2014), SUPERJAM68 (09-27-2014), tanbam (08-08-2014), TheKrell (08-07-2014), thrifty (08-12-2014), TurboDoug84 (08-12-2014), zach2011 (08-07-2014)
post #6 of 106 (permalink) Old 08-07-2014, 04:48 AM
Lifetime Premium Member
Points: 7,731, Level: 1 Points: 7,731, Level: 1 Points: 7,731, Level: 1
Level up: 99% Level up: 99% Level up: 99%
Activity: 100% Activity: 100% Activity: 100%
 
Piggy.'s Avatar
 
Join Date: Feb 2009
Location: Sydney, Australia
Posts: 2,252
Thanks: 56
Thanked 223 Times in 203 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 20 Post(s)
Can you fix the voice recognition in Australian cars which has been disabled by Chrysler Australia?
Piggy. is online now  
post #7 of 106 (permalink) Old 08-07-2014, 05:24 AM
Join our cruise to Darwin
Points: 32,042, Level: 1 Points: 32,042, Level: 1 Points: 32,042, Level: 1
Level up: 99% Level up: 99% Level up: 99%
Activity: 100% Activity: 100% Activity: 100%
 
Moparlife's Avatar
 
Join Date: Sep 2007
Location: Canberra
Posts: 4,762
Thanks: 156
Thanked 389 Times in 352 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 52 Post(s)
Quote:
Originally Posted by Piggy. View Post
Can you fix the voice recognition in Australian cars which has been disabled by Chrysler Australia?
Thats the first thing I thought if when I read that. You took the words right out of my mind.
Considering we already know what the solution is but just can't implement it.



I want to die peacefully in my sleep, like my grandfather.. Not screaming and yelling like the passengers in his car.
Moparlife is online now  
post #8 of 106 (permalink) Old 08-07-2014, 05:27 AM
Lifetime Premium Member
Points: 7,731, Level: 1 Points: 7,731, Level: 1 Points: 7,731, Level: 1
Level up: 99% Level up: 99% Level up: 99%
Activity: 100% Activity: 100% Activity: 100%
 
Piggy.'s Avatar
 
Join Date: Feb 2009
Location: Sydney, Australia
Posts: 2,252
Thanks: 56
Thanked 223 Times in 203 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 20 Post(s)
I also would really like the 'stop and go' ACC
Piggy. is online now  
post #9 of 106 (permalink) Old 08-07-2014, 05:54 AM
Senior Member
Points: 445, Level: 1 Points: 445, Level: 1 Points: 445, Level: 1
Level up: 99% Level up: 99% Level up: 99%
Activity: 6% Activity: 6% Activity: 6%
 
Yellow Toy's Avatar
 
Join Date: Dec 2013
Posts: 163
Thanks: 103
Thanked 9 Times in 8 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 0 Post(s)
Can I have the SRT pages.
Yellow Toy is offline  
post #10 of 106 (permalink) Old 08-07-2014, 06:32 AM
Premium Member
Points: 13,128, Level: 1 Points: 13,128, Level: 1 Points: 13,128, Level: 1
Level up: 99% Level up: 99% Level up: 99%
Activity: 43% Activity: 43% Activity: 43%
 
TheKrell's Avatar
 
Join Date: Jun 2013
Location: Fairfax, VA
Posts: 886
Thanks: 565
Thanked 130 Times in 120 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 22 Post(s)
Can you increase the sensitivity of the dang sun sensor?
TheKrell is offline  
Sponsored Links
Advertisement
 
Reply

Bookmarks

Quick Reply
Message:
Options

Register Now

In order to be able to post messages on the Chrysler 300C Forum: 300C & SRT8 Forums forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.
User Name:
If you do not want to register, fill this field only and the name will be used as user name for your post.
Password
Please enter a password for your user account. Note that passwords are case-sensitive.
Password:
Confirm Password:
Email Address
Please enter a valid email address for yourself.
Email Address:

Log-in

Human Verification

In order to verify that you are a human and not a spam bot, please enter the answer into the following box below based on the instructions contained in the graphic.



User Tag List

Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page
Display Modes
Linear Mode Linear Mode



  LinkBacks (?)
LinkBack to this Thread: http://www.300cforums.com/forums/2nd-generation-chrysler-300-discussion/96777-hacking-computer-wheels.html
Posted By For Type Date
I know this is a ps3 hacking community but..... This thread Refback 08-11-2014 01:34 PM
I know this is a ps3 hacking community but..... This thread Refback 08-11-2014 01:11 PM
I know this is a ps3 hacking community but..... This thread Refback 08-11-2014 12:33 PM

Similar Threads
Thread Thread Starter Forum Replies Last Post
Computer Question Agroal Off-Topic Discussion 6 03-04-2009 05:23 AM
In car PC computer ricardo Car Audio/Alarms/UConnect/Navigation 10 05-27-2008 09:42 PM
CANBUS hacking? 345CID Car Audio/Alarms/UConnect/Navigation 7 06-26-2007 05:37 PM
In car computer AF300C Car Audio/Alarms/UConnect/Navigation 5 09-20-2005 02:14 PM

Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

 
For the best viewing experience please update your browser to Google Chrome
Inactive Reminders By Icora Web Design