Toyota BEANs, Multiplex etc

[gte]

Thank you.

I'll post my matlab script's output as an example for you
PRI|ML 64
DID 98
MID CC
DATA1 02
DATA2 A8
CRC 35
check crc: 35
CRC OK
EOM 7E

p/s one more file
------Original packets count:5 --------
PRI|ML 64
DID FE
MID 40
DATA1 00
DATA2 00
CRC 3E
check crc: 3E
CRC OK
EOM 7E
--------
PRI|ML 64
DID D2
MID 26
DATA1 00
DATA2 00
CRC B1
check crc: B1
CRC OK
EOM 7E
--------
PRI|ML 53
DID D2
MID C8
DATA1 00
CRC E9
check crc: E9
CRC OK
EOM 7E
--------
PRI|ML 63
DID D2
MID 2C
DATA1 00
CRC B5
check crc: B5
CRC OK
EOM 7E
--------
PRI|ML 64
DID 98
MID CC
DATA1 02
DATA2 A7
CRC D4
check crc: D4
CRC OK
EOM 7E
--------

[gte]

One more hint please

I've been writing code all day and figuring out the challenges on cryptopals, I'm only on number 6 of set 1 though. Based on that site, are the MID and DID used for encryption of DATA or DATA + CRC? Maybe repeating key XOR or single byte cipher XOR?

Which specific lesson/set should I concentrate on that is most applicable to BEAN?

gte
you should concatenate all the fields rather than summing them. Ant then run a variety of 8-bit polynomials against them
Also note that bit stuffing is applied on informational fields

Try to check out this challenge
http://cryptopals.com/

It will improve your programming skills in performing activities like bus decoding, etc

dumbass
Apparently gte already has one

[George]

They are not that much applicable. They rather make you familiar with automated parsing, analysis etc etc. So you know exactly what to do rather than have some theoretical thoughts
The data in my examples isn't encoded. All the values needed to calculate CRC are shown.

The set1 contains an example of fixed 8bit key XOR, when you have to brute force attack it. It's somewhat similar to finding unknown CRC8 polynomial.

[gte]

Hi George,

With a lot of reading and some help, I have built a piece of software that can decode/validate the hex string/crc and brute force the poly. I had no idea this would be as difficult as it was, but I sure know a ton more about CRC's then I did 2 weeks ago!

So the question is, how did you gather the hex strings? Did you use a scope with matlab? I was going to power up an ecu I have on the bench and put a scope on the mux+ and mux- pins and see what would show up on it. If this failed, I was going to try to build my own capture system and stream the bits to a console or to a log file. What do you think?

[George]

I used their system
https://www.saleae.com/

There's cheap chinese clone that's only $10 worth at dx.
However as with any chinese thing it will not work out of box. I needed to reprogram it, clean the PCB from flux spots, replace the quartz rezonator with a more stable one. Additionally, I had to build a number of boards to properly interface the stuff to 5v and 12v signals.

Overall, you may like the original solution more than its clone )

[gte]

$200 bucks is not that expensive, I'll get the real thing.

I used their system
https://www.saleae.com/

There's cheap chinese clone that's only $10 worth at dx.
However as with any chinese thing it will not work out of box. I needed to reprogram it, clean the PCB from flux spots, replace the quartz rezonator with a more stable one. Additionally, I had to build a number of boards to properly interface the stuff to 5v and 12v signals.

Overall, you may like the original solution more than its clone )

[gte]

Hi George,

Do you have any data examples that has bit stuffing in it and then the same example with bit stuffing decoded (not in it) after so I can see how Toyota does that. I have not had a chance to build a test rig for the ECU I have.

They are not that much applicable. They rather make you familiar with automated parsing, analysis etc etc. So you know exactly what to do rather than have some theoretical thoughts
The data in my examples isn't encoded. All the values needed to calculate CRC are shown.

The set1 contains an example of fixed 8bit key XOR, when you have to brute force attack it. It's somewhat similar to finding unknown CRC8 polynomial.

[George]

I do have some records of raw data in Saleae's proprietary format. Their software is free. PM me your email

[cresslux]

Hi Guys just doing a little grave digging, but did anyone ever figure out how to replicate functions and events across this connection?

mainly the a/c idle up, i have done a jzs160 aristo 2jz-ge swap in an mx32 and would like the a/c to work some day. havnt got the lines done yet but thats happening soon. no other functiions are required as its manual

i know triptek have got it working using the aristo a/c unit but i would rather avoid it if possible.

also, do all toyotas from a similar time "speak" the same language?, as in could a jzx110 ecu talk to an IS200, becuase that would make life most excellent if it did.

[dumbass]

Cressida air is very basic
just don't run it thru the new ecu
and if your worried about turning comp off at hi revs just run an rpm switch
most of the time having no idle up doesn't cause problems on late toyota motors
but if u want idle up just fit an idle up silenoid from old corolla
easy fixes and u don't need to touch new ecu

[cresslux]

id didnt think it would be much of an issue. not fussed about cut in and out. just be nice to have car idle a little highter.
if i cant idle up ill just cut the clutch in direct from the ac wire in the bay.

any idea on my other question though? looking at doing a jzx110 engine conversion into an IS200, and im wanting to know if i need to leave the stock ecu or will the 1jz ecu communicate with the IS200 system?
im going to find out either way, but i have someone interested in the 1g-fe as a complete running engine, so i would like to tell them if they can take the ecu or not.

[dumbass]

u need to leave is200 ecu in there if u want some of dash to work
u will also need to wire in extra water temp sensor and maybe stuff for the ac

is200 are worst cars for wiring conversions in and making it look factory

takes three times as long as a 1j into cressida
I wired an ls1 into is200 and customer sold the orig engine loom and ecu
so he didn't have air con working or water temp In dash working
tacho and soeedo can be solved using converter boxes

[George]

Hi Guys just doing a little grave digging, but did anyone ever figure out how to replicate functions and events across this connection?

mainly the a/c idle up, i have done a jzs160 aristo 2jz-ge swap in an mx32 and would like the a/c to work some day. havnt got the lines done yet but thats happening soon. no other functiions are required as its manual

i know triptek have got it working using the aristo a/c unit but i would rather avoid it if possible.

also, do all toyotas from a similar time "speak" the same language?, as in could a jzx110 ecu talk to an IS200, becuase that would make life most excellent if it did.

Physical level is the same, but the data stream is totally different. Even across cars with the same engine. For example UCF21 cluster will not talk to UZS171 ECU though both cars came with 1uz vvti from factory.

Running a/c is complicated. First, you need to bypass fail-safe features built in ECU. These include monitoring 3-way pressure switch, a/c compressor's rotation speed and ambient temp sensor.

Only when all these sensors are ok, ECU will rase idle speed, when not in P or N, and when correct command is issued via MPX pin.

I got some success with simulating idle up command in UCF21 and UZS171 ECUs. Tested on my own car.

[cresslux]

Thanks George. typical, though i guess.

spose its worth a try, its only 2 wires to hook the network up anyway.

might even try jumping my mates jzx110 converted cressida signal wires to the IS200 and see what it thinks of it. no harm in trying i guess.

anyway thanks for the info guys.

[George]

1 wire
all MPX wires are just connected together