📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Automotive Computer Based help!

Topic created on: June 24, 2010 17:36 CDT by blckonyxx .


Ok....not tech savvy whatsoever, so please bear with me.

I have an automotive application problem. I have installed a modern transmission installed in a slightly older car and it does not work. I am seeking to create an independent interface module to control an electronically controlled transmission that has its own internal module. Access to a Transmission module is not possible at this time, but can be obtained if necessary.

The nature of the approach to this project is a reverse engineering exercise.

What I know is the follow:

-The Transmission, Engine and Body modules MUST communicate via 2 forms of networks...(A) High Speed LAN and (B) Low Speed LAN.

-The High Speed LAN (A) is a two line parallel architecture having a "lo" and "hi" side. The Engine and Transmission module ONLY communicate with each other on this network.

-The Low Speed LAN (B) uses a 1-wire serial network with varying communication speeds up to approximately 90 kbps. The Engine or Transmission module only communicate with the Bodymodule on this network

-The Body module is the master or "gateway" module between the two LANs.

-The Body module initiates a 'search' or 'wake up' voltage signal along the 1-wire Low Speed LAN (B) to the Transmission, Engine and other modules. Their response confirms their presence and then authorization to proceed operation is given. Without this initial "search/wake up" signal the Transmission module will NOT communicate with the Engine module along the High Speed LAN (A) .

-The Body module maintains a "constant" minimum KBPS communication with the 1-wire Low Speed LAN (B) modules afterwards. Dropping this constant communication will trigger a 'failsafe' response from all modules on this network. The specifics of the failsafe response is unknown and therefore preferred to be avoided in our module's design.

What is needed:

-Isolate the Body module's "initiation" function(s)/program/code/pulse

-Isolate Body module's "maintenance" function(s)/program/code/pulse

-Create an independent module to automatically emulate same functions.

I have more detailed information, including schematics and actual components.

Any ideas????

Jesse

No posts found under this topic.
Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit