Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BMW F Series Gear Selector, Part Two: Breakthrough

projectgus.com

Post reply on HN
Print view View original

31–40 of 118 posts

Re: BMW F Series Gear Selector, Part Two: Breakthrough

#31

Post by systemvoltage »

themitigating wrote: post #27
Cthulhu_ wrote: post #16

Earlier quoted context omitted.

I kinda wish, as it stands it feels like decades of different protocols and technologies awkwardly stitched together. In theory everything would be connected on a central bus to a centralized RTOS computer able to read every sensor and adjust everything that needs it 1000x a second (or more), so that anyone could easily hook up a new device or software and subscribe to an event bus, but alas.

Mostly every component on modern cars uses the CAN bus for communication https://en.wikipedia.org/wiki/CAN_bus Many third party companies have made accessories to read information or control devices using it. Cars also have a standard diagnostic port called the OBD2 which you can purchase $10 readers that use bluetooth with your phone. Cars may have much more electronics but with all the sensors it's very easy to kno…

A lot of things in the interior uses LIN bus.

Re: BMW F Series Gear Selector, Part Two: Breakthrough

#32

Post by londons_explore »

Hooking it up to a real car and sniffing the message bus where it connects would be by far the easiest approach to this...

Then you don't even need to understand all the messages - just replay what the car sends and figure out which byte in the response is the current gear.

You probably wouldn't even need to figure out the checksums!

Re: BMW F Series Gear Selector, Part Two: Breakthrough

#33

Post by paywallasinbeer »

themitigating wrote: post #27
Cthulhu_ wrote: post #16

Earlier quoted context omitted.

I kinda wish, as it stands it feels like decades of different protocols and technologies awkwardly stitched together. In theory everything would be connected on a central bus to a centralized RTOS computer able to read every sensor and adjust everything that needs it 1000x a second (or more), so that anyone could easily hook up a new device or software and subscribe to an event bus, but alas.

Mostly every component on modern cars uses the CAN bus for communication https://en.wikipedia.org/wiki/CAN_bus Many third party companies have made accessories to read information or control devices using it. Cars also have a standard diagnostic port called the OBD2 which you can purchase $10 readers that use bluetooth with your phone. Cars may have much more electronics but with all the sensors it's very easy to kno…

It's important to note that just because a CEL is on for a sensor, it doesn't mean that sensor is bad and needs to be replaced. For example, it's possible for a camshaft position sensor to be on for a timing system that is out of sync. It would be a mistake to replace the cam sensor in that scenario. Shotgunning parts isn't always the answer...

Re: BMW F Series Gear Selector, Part Two: Breakthrough

#34

Post by tmh88j »

foobarian wrote: post #12
CraigJPerry wrote: post #10

Earlier quoted context omitted.

>> A good manual transmission is a core part of the driving experience. Which cars have those today or in the time-frame of the F-series BMWs from TFA? Every fiat/chrysler gearbox is sloppy gooey junk thing, even their performance models have horrific manual gear shifts. I'll cut to the chase instead of listing Ford, Peugeot, etc. etc. The Porsche Cayman 982 manual shift feels awesome to use, it's a delight but that…

I'm not a car nerd by far, and I never drove a manual shift before my Focus ST, but I am completely in love with it. I'm heartbroken that Ford stopped manufacturing those models. Edit: Reflecting more on what I like about it. I saw a number of articles or videos, like that 80s Porsche, where the shifter is wiggly or won't go into gear because of long linkages, or falls out of gear. The Ford shifter is nothing like it…

> The Ford shifter is nothing like it. My favorite thing about it is that there seems to be (maybe) some torque-induced flex between the gearbox and shifter that makes it naturally slide and "fall" into the correct next gear

I also have an ST. I highly suggest replacing the shifter with an aftermarket short throw shifter or the shifter bracket. I think you'll like it even more. I've owned several cars with manual transmissions, and one of my biggest complaints about the ST was the stock shifter. It doesn't struggle to get into gear, but it felt light, soft and mushy compared to my other cars. I replaced mine with a short throw from Steeda and it helped a lot, but still lacks the solid bolt-action rifle feeling I was used to.

The ST is a killer deal with serious performance for its price, but if you want a taste for what else is affordable out there and a step up try out a car with a Tremec TR6060 transmission[1]. They are one of the best manual transmissions on the market today and can take a beating. You should easily be able to find one on Turo if you live near any major city.

[1] https://en.wikipedia.org/wiki/Tremec_TR-6060_transmission#Ap...

Re: BMW F Series Gear Selector, Part Two: Breakthrough

#35

Post by potatochup »

spaceywilly wrote: post #30

This makes me realize how easy it would be to hack a car like this. All you would need to do is sneak into the car and plug in a low profile OBD reader-like device with a cellular modem, and you could send these messages from anywhere. Just with the information in these articles we now know how to spoof the shifter mechanism, I’m sure similar processes could be used to determine steering and throttle controls. All th…

Usually there is a whitelisted set of messages available through the OBD port, it doesn't give you unfettered access to the CAN bus.

Re: BMW F Series Gear Selector, Part Two: Breakthrough

#36

Post by ry4nolson »

CraigJPerry wrote: post #10
Nullabillity wrote: post #7

Earlier quoted context omitted.

In what deluded world are items that cost tens of thousands of dollars consumables?! > I appreciate where you’re coming from but experiencing the joy of dual clutch automatics and their shifts in BMWs and Audis that I had the joy to diving might change your mind. Yeah, no thanks. A good manual transmission is a core part of the driving experience.

>> A good manual transmission is a core part of the driving experience. Which cars have those today or in the time-frame of the F-series BMWs from TFA? Every fiat/chrysler gearbox is sloppy gooey junk thing, even their performance models have horrific manual gear shifts. I'll cut to the chase instead of listing Ford, Peugeot, etc. etc. The Porsche Cayman 982 manual shift feels awesome to use, it's a delight but that…

the BMW F-series M3/4 of the same time-frame have a manual gear shift option.

Re: BMW F Series Gear Selector, Part Two: Breakthrough

#37

Post by tjoff »

potatochup wrote: post #35
spaceywilly wrote: post #30

This makes me realize how easy it would be to hack a car like this. All you would need to do is sneak into the car and plug in a low profile OBD reader-like device with a cellular modem, and you could send these messages from anywhere. Just with the information in these articles we now know how to spoof the shifter mechanism, I’m sure similar processes could be used to determine steering and throttle controls. All th…

Usually there is a whitelisted set of messages available through the OBD port, it doesn't give you unfettered access to the CAN bus.

Enough for https://comma.ai/ to work so can't be that restricted?

Edit: thanks to responders, I misremembered how it worked.

Re: BMW F Series Gear Selector, Part Two: Breakthrough

#38

Post by BoorishBears »

spaceywilly wrote: post #30

This makes me realize how easy it would be to hack a car like this. All you would need to do is sneak into the car and plug in a low profile OBD reader-like device with a cellular modem, and you could send these messages from anywhere. Just with the information in these articles we now know how to spoof the shifter mechanism, I’m sure similar processes could be used to determine steering and throttle controls. All th…

This is wrong on more than a few levels.

First off, you learned how to send messages to a gear indicator (after it's been ripped out of the car)

That's not the same as being able to spoof messages from the gear indicator to other components in a real vehicle, and then getting them to affect the transmission.

Realistically even if you could somehow send the transmission an instruction to shift in a way that would cause an issue (like telling the transmission to go in Park at highway speeds), there are multiple layers that would stop you in your tracks. At the lowest level the ZF8 most of these GWS shifters came with would never follow that instruction to start with.

-

I hate fear mongering around vehicle security because it leads to things like Mazda locking down their infotainment Linux box because news reports saying "Mazdas can be easily hacked", when the component in question had no tie in at all to anything safety critical.

The reality is physical access to the car is game over. I feel like your comment is intentionally worded to retort "oh well you just need quick access to the inside, vs getting under to cut the brake lines", but if you stick some random custom OBD II device with remote C&C you're making a much larger target for attention.

People are stealing entire catalytic converters off cars with noisy angle grinders, getting more intimate access to a vehicle is really not that hard.

Re: BMW F Series Gear Selector, Part Two: Breakthrough

#39

Post by bri3d »

spaceywilly wrote: post #30

This makes me realize how easy it would be to hack a car like this. All you would need to do is sneak into the car and plug in a low profile OBD reader-like device with a cellular modem, and you could send these messages from anywhere. Just with the information in these articles we now know how to spoof the shifter mechanism, I’m sure similar processes could be used to determine steering and throttle controls. All th…

This was true in the mid 2000s, but isn't true on most modern cars. Most modern cars have a Gateway module which sits between the OBD port and the Powertrain CAN busses which the OP is reverse engineering.

These Gateway modules only allow specific diagnostics-related messages through to the various backing buses.

Now, generally the security on the Gateway module itself isn't great, and diagnostic protocols also aren't very well secured, so there's certainly havoc to wreak. But it's not as simple as "plug in a dongle and send commands" - to do what OP is doing, you need to tap into a wiring harness that's usually buried a bit higher up in the dashboard, at least :)

Usually either the Gateway or the control module itself will disallow sensitive UDS commands like the Hard Reset from the article, as well as adaptation / basic settings and output testing commands which are not safe given the current parameters, as well - for example, I doubt you could send UDS Hard Reset to the gear selector module while the car is moving.

Re: BMW F Series Gear Selector, Part Two: Breakthrough

#40

Post by bri3d »

tjoff wrote: post #37
potatochup wrote: post #35

Earlier quoted context omitted.

Usually there is a whitelisted set of messages available through the OBD port, it doesn't give you unfettered access to the CAN bus.

Enough for https://comma.ai/ to work so can't be that restricted? Edit: thanks to responders, I misremembered how it worked.

Comma.ai plugs into the vehicle's "backing" CAN busses (Powertrain, Sensors, infotainment, etc.) behind the Gateway, not the OBD port. This requires the removal of at least a few trim pieces and connectors. For example, the Giraffe module taps in at the high-mounted camera module on many cars, requiring the removal of ceiling trim and the installation of a custom connector / tap onto the CAN bus.
Post reply on HN