Using different interface

[danielkucera]

Hi, thanks for the project. I'd like to dump my EPS firmware (Touran 2014). Can I use some other interface than Panda? I've been using ESP32 in the past: https://blog.danman.eu/playing-with-can-bus/

[danielkucera]

Okay, I managed to get it running with ESP32 although the latency is possibly higher. Now I am stuck at following error:

./01_dump.py --output backup.bin
Connecting to 192.168.4.1 : 3333
Connected
Connecting using KWP2000...
TX: 0x200 - 09c00010000301
RX: 0x209 - 00d00003a80701
Got channel setup response 00d00003a80701
TX: 0x7a8 - a00f8aff0aff
RX: 0x300 - a10f8aff4aff
Got timing params a10f8aff4aff
b'\xa1\x0f\x8a\xffJ\xff'
Reading ecu identification & flash status
TX: 0x7a8 - 1000021a9b
RX: 0x300 - b1
RX: 0x300 - 2000305a9b354e31
RX: 0x300 - 2139303931343452
RX: 0x300 - 2220203134303103
RX: 0x300 - 2300010200064016
RX: 0x300 - 24054d4a3530305f
RX: 0x300 - 255f4150412d4253
RX: 0x300 - 26204b4c2e323934
RX: 0x300 - 1720
TX: 0x7a8 - b8
ECU identification b'5N1909144R  1401\x03\x00\x01\x02\x00\x06@\x16\x05MJ500__APA-BS KL.294 '
TX: 0x7a8 - 1100021a9c
RX: 0x300 - b2
RX: 0x300 - 2800145a9c000101
RX: 0x300 - 290000064622052c
RX: 0x300 - 2a30302e31342e30
RX: 0x300 - 1b30
TX: 0x7a8 - bc
Flash status b'\x00\x01\x01\x00\x00\x06F"\x05,00.14.00'

Connecting using CCP...
CAN clear called...
CAN clear called...
Traceback (most recent call last):
  File "/home/danman/storage/Projects/pq-flasher/./01_dump.py", line 42, in <module>
    client.connect(0x0)
  File "/home/danman/.local/lib/python3.9/site-packages/panda/ccp.py", line 142, in connect
    self._recv_dto(3.025)
  File "/home/danman/.local/lib/python3.9/site-packages/panda/ccp.py", line 134, in _recv_dto
    raise CommandTimeoutError("timeout waiting for response")
panda.ccp.CommandTimeoutError: timeout waiting for response

It timeouts when trying to connect with CCP. It is connected to the car and the key is in position II. Do you know what could be the problem?

[pd0wm]

How are you connecting to the EPS? CCP is not available on the OBD-II port, you have to connect to a CAN bus that's directly connected to the EPS, such as tapping the bus at the J533 module.

I also would not recommend attempting a flash if you don't have a stable connection. That's just asking for trouble.

[danielkucera]

I am taped to powertrain CAN bus (pin 6, 16) according to this picture https://user-images.githubusercontent.com/3917213/98302702-00823c00-2011-11eb-88e8-ea326b25f0ec.png

[danielkucera]

The connection is stable - it's TCP, it is only a bit delayed.

[pd0wm]

I'm not exactly sure which CAN bus my harness was connected to, but I would just try both other busses.

[danielkucera]

Can it be because it is a different firmware? 5N1909144R 1401 Which firmwares have been tested? I have found the sgo file but not examined it yet. https://race-tun.com/vag-sgo-frf/audi/5n1909144r1401bp.sgo/5n1909144r-1401-bp.sgoori/

[dkiiv]

"Which firmwares have been tested?" 2501, and 3501 for 1k0 909 144 racks only!

We are connected on the powertrain can at the j533 module

5n1 likely will not work with the scripts due to being more secure (this have been seen in other tiguan racks when people have tried to dump it with a panda)