Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: Hacking ECU Honda Keihin


Newbie

Status: Offline
Posts: 2
Date:
Hacking ECU Honda Keihin


Hello everyone!!

I am from Spain and I have a Honda CB600F (Hornet). I am an Electronic Engineer and I am trying to study the protocol for this ECU.

I have made an sniffer so I can see the comunication between the ECU and my GiPro DS Gear indicator.

I compare the message format with differents standards (ISO 9141, ISO 14230 and SAE J1979) and it does not match with anyone.

I write here some of the messages and some of my conclusions:

72 05 00 F0 99 (Gear indicator request)

02 04 00 FA (ECU response)

72 07 72 11 00 14 F0 (Gear indicator request)

02 1A 72 11 00 00 00 18 00 62 57 EF 10 91 63 FF FF 77 00 00 00 80 63 1A 51 DA (ECU response)

72 07 72 D1 00 06 3E (Gear indicator request)

02 0C 72 D1 00 03 00 00 00 00 00 AC (ECU response)

I think that first and third byte are address.

The second byte always match with the total lenght of the message.

Last byte is some kind of checksum or CRC but I do not know exactly.

Could anybodyexplain me the protocol used?

Thanks in advance.

Javier



__________________


Guru

Status: Offline
Posts: 964
Date:

What model year is your bike?

What is the physical interface? Is it differential (CAN) or single ended serial? 5V or 12V?

__________________


Newbie

Status: Offline
Posts: 2
Date:

Hello RidgeRacer,

Thank you for your answer.

The bike is from 2007. The interface is only one bidirectional line, K-Line, 12V. and 10.400 bauds.

Is the same as ISO 9141-2 and ISO 14230 but the message structure is different.

The first message from Gear indicator is something similar to init comunication, the second is to know the rpm's and the third the speed.

I think that the Gear indicator is using functional addressing but not sure.



__________________


Member

Status: Offline
Posts: 14
Date:

Any progress ?

Just found that on the web: http://www.vfrdiscussion.com/forum/index.php/topic/69424-heal-tech-is-making-a-diagnostic-computer-for-pgm-fi/



-- Edited by mobyfab on Tuesday 6th of December 2011 04:09:59 PM

__________________


Senior Member

Status: Offline
Posts: 350
Date:

Check this one out, http://probike.co.uk/it080002.htm

Tool in the link works on honda, kawasaki, suzuki etc so there should be some similarities.

SDS is some type of KWP2000 protocol, maybe honda use some alike OBD protocol?

Maybe a test with EE2 interface and software and wire up to Honda K-Line and see what happens...



__________________


Member

Status: Offline
Posts: 14
Date:

600, way too expensive...

As already said Honda uses some special message protocol, but the physical layer is OBD (ISO 9141-2 / ISO 14230).

__________________


Newbie

Status: Offline
Posts: 1
Date:

Hi

Any progress ?
Do you have information about the protocol ?



-- Edited by qfade on Wednesday 21st of December 2011 08:13:24 PM

__________________


Member

Status: Offline
Posts: 14
Date:

Found how the checksum works.

It is actually subtracted from 256 (0x100 in hexadecimal).

so for: 72 05 00 F0 99

0x72+0x05+0x00+0xF0 = 0x67
0x100-0x67 = 0x99

for 02 04 00 FA:

0x02+0x04+0x00 = 0x6
0x100-0x06 = 0xFA

I'll try to look into it when I get my logic analyser. I got the same bike (08' hornet) and a 07' 600 CBR which uses the same protocol.



-- Edited by mobyfab on Tuesday 17th of January 2012 09:42:40 AM

__________________


Member

Status: Offline
Posts: 14
Date:

Also found this: http://forum.pgmfi.org/viewtopic.php?f=57&t=5871

It's for Honda cars but the protocol is probably similar

I guess it might work since it is the protocol used by Honda diagnostic systems (HDS) that works on both car and bikes.

I'll get my hands on a 3pin to OBD connector since I already have an OBD to USB adapter.



-- Edited by mobyfab on Tuesday 17th of January 2012 09:42:31 AM

__________________


Newbie

Status: Offline
Posts: 1
Date:

Both the honda and the 2007 Triumph 675 has a Keihinsmile and triumph uses ISO 9141 for all its rangebiggrin

also my 1050..that also uses Keihin and .ISO 9141, so I imagine Honda do too. but its a guess....hmm

I have been using an elm327 obd2 bluetooth interface that uses ISO 9141 because I asked it !!smile

by using hyperterminal.

Here's a pic because they liven up the forums...

DSC_0386.jpg



__________________
My other triumph has 4 wheels and a V8 motor.


Newbie

Status: Offline
Posts: 3
Date:

Can anyone help me in understanding maps of the honda civic type r 2.0l keihin ecu?

__________________


Senior Member

Status: Offline
Posts: 149
Date:

@poxxy

I can provide you tools and info on that ECU. I am working on KEIHIN ecus this period!
Send me an email and i will help you!

Regards

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Member

Status: Offline
Posts: 18
Date:

mobyfab wrote:

Found how the checksum works.

It is actually subtracted from 256 (0x100 in hexadecimal).

so for: 72 05 00 F0 99

0x72+0x05+0x00+0xF0 = 0x67
0x100-0x67 = 0x99

for 02 04 00 FA:

0x02+0x04+0x00 = 0x6
0x100-0x06 = 0xFA


This is a well known checksum algorithm : ([sum of bytes] xor 0xFF) + 1

which is same as your 0x100 - [sum of bytes] but XOR+1 computation is preferable as it allows you to work with 8 bits/char sum variable only.

PS: Does someone have the official software tools and can share them ? ;)

PS2 : @psyche: Is your share proposition valid for me too ? :) Do you have the official software tools ?



-- Edited by cranor on Saturday 26th of January 2013 11:55:20 AM

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard