notes.md (6030B)
1 2 3 # Resources 4 5 https://github.com/aeaphichart/HondaECU-1 6 7 - interface with optocouplers 8 - table of "keihin codes" (38770-foo model numbers) 9 - "If you make a bench harness to work with your ECU you will need a 2.5 amp power supply." 10 - fork https://github.com/Roxxas21/HondaEcuTest/tree/Roxxas21-patch-1 11 12 https://github.com/sophienyaa/Honda-Motorcycle-ECU-Tools/blob/master/scan.ino 13 14 - for CRF250, scan all tables 15 - scanning the code it looks like it's mostly 11 and D1 16 17 https://gonzos.net/projects/ctx-obd/ 18 19 - Honda CTX-700 20 - explains checksum algo 21 22 https://github.com/aster94/Keyword-Protocol-2000 23 24 - Suzuki and Kawasaki, untested on Hondas 25 - circuit diagram for L9637 26 - needs 510R resistor, 100n capacitor 27 28 https://github.com/martinhol221/ISO14230-4-KWP 29 30 - Russian 31 - citroen c3 32 - https://github-com.translate.goog/martinhol221/ISO14230-4-KWP/blob/master/README.md?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp 33 34 https://rust-classes.com/chapter_embedded_stmf401 35 36 - Rust for embedded STM32F401CCU6 boards 37 38 https://sigrok.org/wiki/Main_Page 39 40 - software for usb signal analyser 41 42 https://netcult.ch/elmue/HUD%20ECU%20Hacker/ 43 44 - more ecu hacking software, charityware 45 - describes honda init sequence 46 47 https://www.liwebikes.com/pgm_fi-90.html 48 - cbr125rw ecm pinout 49 - this may be an earlier year 50 51 https://www.manualslib.com/manual/1244336/Honda-Cbr125r.html?page=99#manual 52 53 https://themotorbikeforum.co.uk/uploads/monthly_2018_05/7.jpg.e9632588ec1d17c0f74223b06cb81b0f.jpg 54 https://themotorbikeforum.co.uk/topic/30235-cbr125-electrical-fault/ 55 56 - photo of wiring diagram for CBR125R 2012, looks 57 to be the same ecu connection to DLC as whatever year is the 58 carlsalter.com source 59 60 https://www.1000rr.net/threads/k-line-ecu-logging.247922/ 61 62 - 2016 forum thread "Whipped up a simple circuit to interface with 63 the K-Line interface found on that red adapter under the seat. " 64 65 https://www.carlsalter.com/mcpdf/Honda%20-%20cbr125rw-service-manual.pdf 66 - wirig diagram, yay. !Caution: this is 2007 model! 67 pin 1 Bl/W IGP "ignition power" (also seen on DLC) 68 pin 15 SCS 69 pin 30 k-line 70 pin 9 and 10 ground, so maybe that helps us find which way the pins 71 are numbered 72 73 service manual p 17-6 has a diagram of the ecu harness connector 74 (female side) showing blue/yellow and white/yellow wires in the right 75 hand side (CKP sensor) (pins 12, 23). this implies that pin 1 is top right 76 when looking at the female side => top left looking at the ecu itself 77 78 additionally, p5-66 labels pin 1 at top right of "wire side/female 79 connector". It says pins 2, 9, 10 sohuld be ground 80 81 as a side note, there is no permanent power to the ecu, only ignition 82 power 83 84 85 https://publicism.info/engineering/penetration/8.html 86 87 - build an ecu test bench 88 89 https://github.com/AutotronicCommunity/Honda_Keihin_KLine_Protocol 90 91 - has a different init sequence which supposedly sends a response to 92 the first byte sequence 93 94 > Wake Up with send to ECU code = FE 04 72 8C 95 > ECU Response with code = 0E 04 72 7C 96 97 vs gonzo.net which says 98 > Send “Wakeup” message: FE 04 FF FF. No response is expected 99 100 (The second req/resp is the same) 101 102 https://www.m0agx.eu/reading-obd2-data-without-elm327-part-2-k-line.html 103 104 - circuit diagram for K-line -> ttl interface using only discrete 105 components 106 107 108 109 # Data available 110 111 ## CBR125R 112 113 there is data in tables 0 0x11 0x20 0x61 0x70 0xd0 0xd1 114 115 - 0x0 has values [1, 0, c6, 1, 2, 1, 0 ..... ] 116 - 0x11 has values [0 0 6 0 ff a ff a f1 a8 ff ff 7f 0 0 0 80 93 5a 37 8f] 117 and matches the 0x11 table for cb600f pc41 in 118 https://gonzos.net/projects/wp-content/uploads/2015/09/Honda-data-tables.pdf 119 120 [ we've only tested battery voltage but the others are not obviously wrong) 121 122 - 0x20 has values [ff, 80, 0, 0, 0, 0 .....] 123 - 0x61 is [0 0 1a 0 9c 3e a3 3c 93 64 ff ff 3f 0 0 0 80 0 c2 4b 7d] 124 and is _not_ a copy of 0x11 as it was in the cb600f 125 - 0x70 has values [bc, 80, 0 .....] 126 - 0xd0 [87, 12*0, ff, 6*0] 127 - 0xd1 [2, 0, 0, 0, 4, 1, 0 ...] 128 129 0x20 and 0x70 look similar but not the same 130 131 according to https://forum.pgmfi.org/viewtopic.php?p=140964#p140964 132 table 0 is "ecmid" 133 134 135 136 # TODO 137 138 ``` 139 X make a TCP listener 140 X parse tcp messages to extract command/signature/payload 141 - discard signature 142 X implement flashing support : https://docs.rs/esp-hal-ota/latest/esp_hal_ota/ https://github.com/filipton/esp-hal-ota 143 _ add ring crate 144 X create an eddsa keypair with openssl 145 X read the pubkey into the rust binary 146 X sign something with the key using openssl 147 X as PoC, add the signed thing into the rust binary and verify the signature at startup 148 X verify signature before flashing 149 X maintain a hash of session keys for udp listener and expire them eventually 150 X update the subscription request parsing to expect a session key, validate it 151 X udp client needs to send the key 152 O wifi provisioning over ble 153 X restore ble thread 154 X publish the characteristics w/o encryption 155 X write the client side ( https://pypi.org/project/bleak/ hth) 156 X wire up the network list so wifi can publish and ble can read 157 X make it choose a network when psk is provided 158 X reboot after writing to nvs 159 X delete network if it doesn't connect 160 _ add pairing 161 X encrypt the psk 162 - add client side to eculocate.py 163 - android stuffz 164 - switch to _tcp in dns-sd domain 165 - revert to a single crate, or extract some portable code? 166 - update README 167 - add the 12v->5v buck converter, make a cable to plug into diag port 168 - ride 169 - reverse-engineer the mystery values 170 - add an IMU to get lean angles 171 - stop hardcoding BLE address 172 ``` 173 174 how to manage keys? the server is built manually with nix-shell, we 175 haven't even packaged this yet, and the client is built as part of 176 biscuit, on a separate machine 177 178 - a nixos module to write a config file for the client that says 179 where the keys are // https://docs.python.org/3/library/configparser.html 180 - the client to parse the config file and read keys 181 - biscuit config to use the module 182 - biscuit make install to copy the keys from local/secrets/ dir to 183 /etc/secrets/eculocate