1. Attachments are working again! Check out this thread for more details and to report any other bugs.

Door lock code via CAN

Discussion in 'Gen 3 Prius Accessories and Modifications' started by kanec, Dec 1, 2016.

  1. kanec

    kanec New Member

    Joined:
    Dec 1, 2016
    2
    0
    0
    Location:
    zealand
    Vehicle:
    2010 Prius
    Model:
    N/A
    Does anyone know the code to lock/unlock doors via CAN in Prius 2010?

    My friend has Prius 2010, Body Style: Saloon (ZVW30), Country of Origin: Japan, Model Code: DAA-ZVW30; Variant: 2

    I turned off engine and dashboard lights and I was listening to can bus on 500Kbps. Then I hit LOCK button inside car and got Following messages. However, I'm not able to figure out what's the locking code. Any idea guys?
    Thank your any help!

    First is ID, then 8 bytes of data:
    1088,64,0,128,0,0,0,0,0,
    1116,92,0,128,0,0,0,0,0,
    1101,77,0,128,0,0,0,0,0,
    1090,66,0,128,0,0,0,0,0,
    1116,92,1,128,32,7,0,0,0,
    1088,64,1,128,21,5,0,0,0,
    1569,17,128,3,0,0,0,0,0,
    1101,77,1,128,8,2,0,0,0,
    1592,19,128,30,0,218,0,0,0,
    1574,28,128,0,0,0,0,0,0,
    1090,66,1,128,16,5,0,0,0,
    1553,33,128,0,18,0,1,181,123,
    1116,64,2,0,32,7,0,0,0,
    1592,19,128,0,0,218,0,0,0,
    1088,66,2,0,21,5,0,0,0,
    1090,92,2,0,16,5,0,0,0,
    1101,92,1,0,8,2,0,0,0,
    1116,64,2,0,32,7,0,0,0,
    1568,16,0,0,32,128,0,0,128,
    1728,228,0,0,128,0,0,0,0,
    1584,23,0,0,0,0,0,0,0,
    1570,18,0,0,0,0,0,0,0,
    1586,128,0,0,0,0,0,0,0,
    1572,26,0,0,73,73,0,255,0,
    1587,129,0,0,0,0,0,0,0,
    1593,20,0,0,0,0,0,0,0,
    1589,131,0,0,0,0,0,0,0,
    1595,22,0,55,120,0,0,70,196,
    1664,216,0,1,0,0,0,0,0,
    1552,32,0,0,100,192,0,0,22,
    1088,66,2,0,21,5,0,0,0,
    1090,77,2,0,16,5,0,0,0,
    1101,92,18,0,8,2,0,0,0,
    1568,16,0,0,32,128,0,0,128,

    Unlocking is attached.
     

    Attached Files:

  2. RobH

    RobH Senior Member

    Joined:
    Sep 18, 2006
    2,369
    978
    70
    Location:
    Sunnyvale, California
    Vehicle:
    2006 Prius
    There are 3 device ids that occur in both the lock and unlock sequences. They are 1569, 1592, and 1595. 1592 smells like the active message.

    So first WAG for unlock:

    1592,19,128,31,0,218,0,0,0
    1592,19,0,31,0,218,0,0,0​

    And for lock:

    1592,19,128,30,0,218,0,0,0
    1592,19,128,0,0,218,0,0,0​

    Seems to be a two step process, so you'll probably have to send both messages for each function.
     
  3. kanec

    kanec New Member

    Joined:
    Dec 1, 2016
    2
    0
    0
    Location:
    zealand
    Vehicle:
    2010 Prius
    Model:
    N/A
    Interesting. Is there any way how can I find out more about these messages? I'd like to understand what's going on while locking/unlocking car.
    Last time when I sent a few first messages from log above hazard light turned on and I couldn't get rid of the light.

    RobH, thank you very much for your help!
     
  4. RobH

    RobH Senior Member

    Joined:
    Sep 18, 2006
    2,369
    978
    70
    Location:
    Sunnyvale, California
    Vehicle:
    2006 Prius
    My approach would be to replay an entire sequence and see what happens. If something happens, then try the other entire sequence and see if the happening reverses. Next try sending half of the first sequence, then the other half of the first sequence. Keep narrowing down the sequences until you identify the important ones. You know that it's safe to send everything in the recorded sequences, as the car has already survived them.

    Once you have long sequences that include your desired action, try deleting device ids from the set.

    You'll probably identify a very limited number (1?) of required messages to achieve an action. If there are multiple messages for the same id, try issuing them one at a time. There's frequently a lot of noise, such as querying a state before setting it, setting it multiple times, or querying the condition after it has been set. The interior light is not a lock, but it toggles based on the lock/unlock command.

    There are multiple ways of doing lock/unlock. Try recording pressing the overall switch, then the individual door switches, then the keyfob buttons, then the mechanical key in the lock. There are probably different sequences used. I don't know if there are 4 (5 with the trunk), or just 1 (+trunk) that controls all of the locks. The driver's door lock is certainly isolated from the rest.

    If a message sets an error condition that doesn't clear with one of the full sequences, try using Techstream to reset any DTCs. Several other reset functions are to disconnect the 12V battery and/or cycle power on/off several times.

    I did a lot of experimenting with the messages that Techstream sends to my 2006 Gen2. I don't know much about Gen3 messages, and CAN in particular. But my car survived all of the experiments. Turned on the triangle of death several times, but Techstream turned it back off.

    The messages are a lot more legible in hexadecimal than decimal. You can see bit patterns that are just obscured by using decimal. For example, x'80' is clearly one bit on, while 128 takes a lot more thought.

    Some people do crossword puzzles. I reverse engineer things just for the fun of it. As the T-Shirt from the Maker's Faire says, "I void warranties". It's fun.
     
  5. Landon51

    Landon51 Member

    Joined:
    Apr 18, 2018
    190
    63
    0
    Location:
    US
    Vehicle:
    2007 Prius
    Model:
    Two