ioc_scanner.py

#!/usr/bin/python3

from panda import Panda
import time
import binascii


# module names and RE work status
class ECU():
  BCM = 0x18 # Scan completed.
  METER = 0x50 # something
  AUDIO = 0x54 # nothing  =()
  WINDOW = 0x30 # Scan completed.
  CLIMATE = 0x51 # weird response = 0x7f2011
  SOLAR = 0x72
  # IMMO = 0x96 # dangerous?
  SEAT = 0xA2 # weird response = 0x7f2011
  TESTER = 0xF0

MODULE = ECU.BCM

p = Panda('460034000851363038363036')
time.sleep(2)
bus = 1
# p.can_clear(bus)?
p.set_safety_mode(100)
MIN_BYTE = 0x0
MAX_BYTE = 0xff

IDX_MAX = 500

IOC_PREFIX = 0x16F10000

TX_ADDR = IOC_PREFIX | MODULE << 8 | ECU.TESTER
RX_ADDR = IOC_PREFIX | ECU.TESTER << 8 | MODULE
wake = False
TIMEOUT = 0.1

NOT_ALLOWED = (0x26,)

XM = range(0, MAX_BYTE+1)
YM = range(0, MAX_BYTE+1)
print(f'Destination ECU ID: {MODULE}')
print(f'TX address: {TX_ADDR}')
print(f'RX address: {RX_ADDR}')

msgs_accepted = []
msgs_rejected = []
msgs_unknown = []
msgs_noresponse = []

def wakeup():
  print('wakeup')
  for i in range(0,13):
    p.can_send(0x1e12ff18, bytes([0]), bus)
    time.sleep(TIMEOUT)
if wake:
  wakeup()
try:
  for y in YM:
    for x in XM:
        if x in NOT_ALLOWED:
          next
        else:
          print(f'Sending...: {hex(x)}, {hex(y)}', end= ' ')
          # make the data string
          dat = []
          dat += bytes([0x30])
          dat += bytes([x])
          dat += bytes([y])
          dat += bytes([0x0])
          dat += bytes([0x0])
          dat += bytes([0x0])
          dat += bytes([0x0])
          dat += bytes([0x0])

          # send it
          p.can_clear(bus)
          p.can_send(TX_ADDR, bytes(dat) , bus)
          time.sleep(TIMEOUT)
          idx = 0
          rx_good = False
#           input()
          while idx < IDX_MAX:
            frame = p.can_recv()
            if len(frame):
              for f in frame:
                if len(f[2]) > 0 and f[3] == bus:
                  idx += 1
                  if f[0] == RX_ADDR:
                    dn = binascii.hexlify(f[2])
                    d1 = f[2][0]
                    if d1 != 0x60:
                      rx_good = True
                      if dn == b'7f3031':
                        msgs_rejected.append((hex(x), hex(y), dn))
                        print(f'rejected {hex(x)} {hex(y)} {dn}')
                        # idx = IDX_MAX+1
                      elif d1 == 0x70:
                        msgs_accepted.append((hex(x), hex(y), dn))
                        print(f'accepted {hex(x)} {hex(y)} {dn}')
                        time.sleep(1)
                        p.can_send(TX_ADDR, bytes([0x20]) , bus)
                        time.sleep(1)
#                         input("Next?")
                        if wake:
                          wakeup()
                      else:
                        msgs_unknown.append((hex(x), hex(y), dn))
                        print(f'unknown reply {hex(x)} {hex(y)} {dn}')
                        #input("Next?")
                        if wake:
                          wakeup()
                        # idx = IDX_MAX+1
                      if rx_good:
                        idx = IDX_MAX+1
                        break
              # idx += 10
            idx += 1
          if not rx_good:
            msgs_noresponse.append((hex(x), hex(y)))
            print('no response', hex(x), hex(y))
  print(f'Accepted: {msgs_accepted}')
  # print(f'Rejected/Unsupported: {msgs_rejected}')
  if len(msgs_unknown):
    print(f'Unknown reply: {msgs_unknown}')
  if len(msgs_noresponse):
    print(f'No reply: {msgs_noresponse}')
except KeyboardInterrupt:
  print(f'Accepted: {msgs_accepted}')
  # print(f'Rejected/Unsupported: {msgs_rejected}')
  if len(msgs_unknown):
    print(f'Unknown reply: {msgs_unknown}')
  if len(msgs_noresponse):
    print(f'No reply: {msgs_noresponse}')