Category: Land Rover Discovery 3
-
Discovery 3 CAN Bus, Part 10: The EXML Files and What We’re Still Hunting
SDD stores diagnostic configuration in EXML — JLR’s proprietary encrypted XML format. We cracked the Triple DES encryption, decrypted 2,033 EXML files, and found the RLM’s diagnostic data map. But the real prize — the calibration amplitude vs offset parameters — is still out there.
-
Discovery 3 CAN Bus, Part 7: Cracking the Ford Security Algorithm
Before you can write calibration data to an ECU, you need to pass Security Access. We found the Ford KeyGenMkI algorithm, confirmed the 24-bit LFSR seed in SecAlg.dll, and extracted the RLM’s secret diagnostic keys from SDD’s encrypted Security.exml.
-
Discovery 3 CAN Bus, Part 6: Reverse Engineering JLR SDD for Air Suspension Diagnostics
Going deeper into the Discovery 3 air suspension: we downloaded JLR SDD 130, extracted the dealer diagnostic VM, and found the service action plugins, VERONA CAN protocol layer, and the DLLs that control the Ride Level Control Module.
-
Discovery 3 CAN Bus, Part 9: Building Our Own UDS Diagnostic Tool
Building a Python UDS diagnostic tool for the Discovery 3 air suspension RLM module. Using a LilyGO ESP32 CAN board with full ISO-TP transport, Ford KeyGenMkI security unlock, auto CAN-ID scanning across HS-CAN and MS-CAN, and an interactive UDS shell.
-
Discovery 3 CAN Bus, Part 8: The LilyGO CAN Transceiver TX Saga
We spent weeks trying to transmit CAN frames from the LilyGO ESP32 board. Frames were received perfectly but nothing would transmit. The fix? Two GPIOs we never knew existed: ME2107_EN (GPIO16) and CAN_SPEED_MODE (GPIO23).
-
Land Rover Discovery 3 Intake Manifold Replacement: Alloy vs OEM — What Australian Owners Need to Know
Cast aluminium intake manifolds are emerging as a durable alternative to the OEM plastic part for Land Rover Discovery 3 and 4. We cover install tips, common pitfalls including injector seal failure, the PCV crossover question, and part numbers every Australian owner should know.
-
Discovery 3 CAN Bus Sniffing, Part 5: Finding the Height Values
Part 5 of the Discovery 3 CAN bus sniffing series: using labelled suspension height captures to find the first likely height-related CAN frame.
-
Discovery 3 CAN Bus Sniffing, Part 4: We Have Frames
Discovery 3 CAN bus sniffing series Part 1: OBD pins, incorrect wire colours, and the DIY cable trap Part 2: Bringing up the LilyGO ESP32 CAN board Part 3: Debugging when CAN frames stay at zero Part 4: Corrected wiring and the first real CAN frames Part 5: Finding the first likely suspension height values…
-
Discovery 3 CAN Bus Sniffing, Part 3: When OBD-II Frames Stay at Zero
Part 3 of the Discovery 3 CAN bus sniffing series: what to check when USB works, diagnostic requests transmit, but no CAN frames arrive.
-
Discovery 3 CAN Bus Sniffing, Part 2: LilyGO ESP32 CAN Board Setup
Part 2 of the Discovery 3 CAN bus sniffing series: getting the LilyGO CANbus ESP32 detected on Windows and ready for OBD-II testing.