Category: Cars
-
Discovery 3 CAN Bus, Part 11: EPB Module Replacement — Longitudinal Sensor & the Real Fix
The Discovery 3 air suspension CAN bus investigation reaches its conclusion. Replacing the EPB module restored the longitudinal acceleration sensor — fixing phantom pitch corrections, brake force data, and the EAS overreaction to road undulations.
-
Discovery 3 Suspension Levelling Solved — Faulty EPB Module Was the Culprit
Months of CAN bus diagnosis revealed why this Discovery 3 kept self-levelling — a cheap aftermarket EPB module was failing to transmit the longitudinal value, blinding the suspension ECU to weight transfer.
-
Discovery 3 CAN Bus, Part 10: The EXML Files and What We’re Still Hunting
SDD stores diagnostic configuration in EXML — JLR’s proprietary encrypted XML format. We cracked the Triple DES encryption, decrypted 2,033 EXML files, and found the RLM’s diagnostic data map. But the real prize — the calibration amplitude vs offset parameters — is still out there.
-
Discovery 3 CAN Bus, Part 7: Cracking the Ford Security Algorithm
Before you can write calibration data to an ECU, you need to pass Security Access. We found the Ford KeyGenMkI algorithm, confirmed the 24-bit LFSR seed in SecAlg.dll, and extracted the RLM’s secret diagnostic keys from SDD’s encrypted Security.exml.
-
Discovery 3 CAN Bus, Part 6: Reverse Engineering JLR SDD for Air Suspension Diagnostics
Going deeper into the Discovery 3 air suspension: we downloaded JLR SDD 130, extracted the dealer diagnostic VM, and found the service action plugins, VERONA CAN protocol layer, and the DLLs that control the Ride Level Control Module.
-
Discovery 3 CAN Bus, Part 9: Building Our Own UDS Diagnostic Tool
Building a Python UDS diagnostic tool for the Discovery 3 air suspension RLM module. Using a LilyGO ESP32 CAN board with full ISO-TP transport, Ford KeyGenMkI security unlock, auto CAN-ID scanning across HS-CAN and MS-CAN, and an interactive UDS shell.
-
Discovery 3 CAN Bus, Part 8: The LilyGO CAN Transceiver TX Saga
We spent weeks trying to transmit CAN frames from the LilyGO ESP32 board. Frames were received perfectly but nothing would transmit. The fix? Two GPIOs we never knew existed: ME2107_EN (GPIO16) and CAN_SPEED_MODE (GPIO23).
-
Land Rover Discovery 3 Intake Manifold Replacement: Alloy vs OEM — What Australian Owners Need to Know
Cast aluminium intake manifolds are emerging as a durable alternative to the OEM plastic part for Land Rover Discovery 3 and 4. We cover install tips, common pitfalls including injector seal failure, the PCV crossover question, and part numbers every Australian owner should know.
-
Discovery 3 CAN Bus Sniffing, Part 5: Finding the Height Values
Part 5 of the Discovery 3 CAN bus sniffing series: using labelled suspension height captures to find the first likely height-related CAN frame.
-
Discovery 3 CAN Bus Sniffing, Part 4: We Have Frames
Discovery 3 CAN bus sniffing series Part 1: OBD pins, incorrect wire colours, and the DIY cable trap Part 2: Bringing up the LilyGO ESP32 CAN board Part 3: Debugging when CAN frames stay at zero Part 4: Corrected wiring and the first real CAN frames Part 5: Finding the first likely suspension height values…