Tag: CAN bus
-
Discovery 3 CAN Bus, Part 11: EPB Module Replacement — Longitudinal Sensor & the Real Fix
The Discovery 3 air suspension CAN bus investigation reaches its conclusion. Replacing the EPB module restored the longitudinal acceleration sensor — fixing phantom pitch corrections, brake force data, and the EAS overreaction to road undulations.
-
Discovery 3 Suspension Levelling Solved — Faulty EPB Module Was the Culprit
Months of CAN bus diagnosis revealed why this Discovery 3 kept self-levelling — a cheap aftermarket EPB module was failing to transmit the longitudinal value, blinding the suspension ECU to weight transfer.
-
Discovery 3 CAN Bus, Part 10: The EXML Files and What We’re Still Hunting
SDD stores diagnostic configuration in EXML — JLR’s proprietary encrypted XML format. We cracked the Triple DES encryption, decrypted 2,033 EXML files, and found the RLM’s diagnostic data map. But the real prize — the calibration amplitude vs offset parameters — is still out there.
-
Discovery 3 CAN Bus, Part 7: Cracking the Ford Security Algorithm
Before you can write calibration data to an ECU, you need to pass Security Access. We found the Ford KeyGenMkI algorithm, confirmed the 24-bit LFSR seed in SecAlg.dll, and extracted the RLM’s secret diagnostic keys from SDD’s encrypted Security.exml.
-
Discovery 3 CAN Bus, Part 6: Reverse Engineering JLR SDD for Air Suspension Diagnostics
Going deeper into the Discovery 3 air suspension: we downloaded JLR SDD 130, extracted the dealer diagnostic VM, and found the service action plugins, VERONA CAN protocol layer, and the DLLs that control the Ride Level Control Module.
-
Discovery 3 CAN Bus, Part 9: Building Our Own UDS Diagnostic Tool
Building a Python UDS diagnostic tool for the Discovery 3 air suspension RLM module. Using a LilyGO ESP32 CAN board with full ISO-TP transport, Ford KeyGenMkI security unlock, auto CAN-ID scanning across HS-CAN and MS-CAN, and an interactive UDS shell.
-
Discovery 3 CAN Bus, Part 8: The LilyGO CAN Transceiver TX Saga
We spent weeks trying to transmit CAN frames from the LilyGO ESP32 board. Frames were received perfectly but nothing would transmit. The fix? Two GPIOs we never knew existed: ME2107_EN (GPIO16) and CAN_SPEED_MODE (GPIO23).
-
Discovery 3 CAN Bus Sniffing, Part 3: When OBD-II Frames Stay at Zero
Part 3 of the Discovery 3 CAN bus sniffing series: what to check when USB works, diagnostic requests transmit, but no CAN frames arrive.
-
Discovery 3 CAN Bus Sniffing, Part 2: LilyGO ESP32 CAN Board Setup
Part 2 of the Discovery 3 CAN bus sniffing series: getting the LilyGO CANbus ESP32 detected on Windows and ready for OBD-II testing.
-
Discovery 3 CAN Bus Sniffing, Part 1: OBD Pins and Incorrect Wire Colours
Part 1 of the Discovery 3 CAN bus sniffing series: the vehicle OBD port was fine, but the DIY pigtail colour chart was wrong.