Toyota GR86, 86, FR-S and Subaru BRZ Forum & Owners Community - FT86CLUB - View Single Post

ojuniour · 12-25-2023, 01:19 AM

Alright..
Upon further diagnosis I am able to FULLY start the vehicle with just two commands.

First command that put the car into FULL ACC Mode - ACC + IGN1 + IGN2 (kinda like pressing the brake (or clutch for MT) and pushing the start/stop but without cranking) - There is a canbus msg that would trigger all three states at same time.

The Second command that I send basically cranks the engine.

Now here is the caveat, you have to continue sending the the initial FULL ACC Mode canbus message at least once every 5 second else the car would automatically shut off completely.
This ACTUALLY works superb for my use case since I'll be remote starting anyway and i don't have to send a separate shut off command.

I've yet to find a message that can shut off the ACC/IGN1/IGN2 if the car was started by a normal procedure, unfortunately.
The closest I can do is being able to cut fuel to the engine..But car won't completely shut off and would just cut power to engine but not the electrical part which means the ACC and all the lights would remain active. I believe i might be able to eventually figure out the command if i continue to brute force but at this moment I have sorta reached my goal for remote start via my Arduino.

Another thing I discovered that's very crucial to my remote start quest would be the hand-over method when you are ready to start driving the car after the car was started originally from a remote start.
I kind of already thought about just stop sending command to the ecu as soon as the door state changed (from Closed to Opened) or if the brake pedal was pressed. So No biggie!
But then the question would be, well the engine doesn't exactly shut off RIGHT after I stopped sending the command as it takes about 5 seconds to be exact for the engine to shut off. Anyone can just quickly get in, put in gear and start driving , right? -with or without key.
Well apparently the ECU DOES NOT CARE! It still shuts off even if you are in drive. LOL.
Less thing to worry about it. Almost perfect for remote start and quite frankly good enough.

Now there is a caveat though (yea I know), you can actually override that by doing something interesting as soon as you get into the car and the car would switch to the normal state and the engine won't shut off. At this point I can't override the ACC MODE. Doing this override basically switches the car into the normal start that assumed a normal starting operation. I won't mention it here but you can PM me or email me if you are interested.
I am probably going to add that in my code that would basically kill the engine if you try to override but no key is detected - Yes I have the Canbus command that detects if the chip key is nearby or not. Easy fix for that.

Oh before I forgot I also tried sending the remote starting command without eh key presented. Interestingly enough (to my surprise) it actually started but shuts off like a second later indicating to me (in the lcd display) that I need to depress and have the key near the ignition).

Perhaps in the future I'll look into finding the command that would bypass they key and tricking the ecu that the key is presented but not a priority at the moment since i already bought a immobilizer transponder bypass.

So in retrospect after many trials and brute forces, I have the canbus commands that can do this follow while the car is completely off:
unlock/lock doors
unlock trunk
Roll up/down windows
headlight/Tailight on/off
Various (or practically all icons) in the gauge,
Drive Mode (sport/snow for AT)

ACC mode on/off
IGN1 on/off
IGN2 on/off
Crank
Cut Fuel to Engine
HVAC (all functionalities - only applies to the one with dual zones - not the manual ones. Car would also need to be running else it's pointless)

There are other miscellaneous stuff too that i can control remotely but not that important like horn, hazard light, interior buzzer sound, courtesy lights, dome light.
There are also read only status messages to get info like tire pressure/temperature, etc...
---------------------
I am still debating on whether to post all the canbus codes here or not.

Anyway, Now I am ready to finish up the code for my remote start.

I'm using arduino MKR 1500 (with built in 4g cat/nbIoT simcard) with the canbus shield which makes it SUPER portable compared to a conventional remote start kit which would require wire cutting and stuff. Infact the only thing that require some cutting might just be the immobilizer.

Also anyone that want to find a message that control particular function or rather a status message. Feel free to ask and in that case it's just preferable to start a whoile new topic.

Cheer!

12-25-2023, 01:19 AM	#27
ojuniour Senior Member Join Date: Nov 2018 Drives: Subaru BRZ 2017 Location: New Jersey Posts: 176 Thanks: 3 Thanked 32 Times in 23 Posts Mentioned: 5 Post(s) Tagged: 0 Thread(s)	Alright.. Upon further diagnosis I am able to FULLY start the vehicle with just two commands. First command that put the car into FULL ACC Mode - ACC + IGN1 + IGN2 (kinda like pressing the brake (or clutch for MT) and pushing the start/stop but without cranking) - There is a canbus msg that would trigger all three states at same time. The Second command that I send basically cranks the engine. Now here is the caveat, you have to continue sending the the initial FULL ACC Mode canbus message at least once every 5 second else the car would automatically shut off completely. This ACTUALLY works superb for my use case since I'll be remote starting anyway and i don't have to send a separate shut off command. I've yet to find a message that can shut off the ACC/IGN1/IGN2 if the car was started by a normal procedure, unfortunately. The closest I can do is being able to cut fuel to the engine..But car won't completely shut off and would just cut power to engine but not the electrical part which means the ACC and all the lights would remain active. I believe i might be able to eventually figure out the command if i continue to brute force but at this moment I have sorta reached my goal for remote start via my Arduino. Another thing I discovered that's very crucial to my remote start quest would be the hand-over method when you are ready to start driving the car after the car was started originally from a remote start. I kind of already thought about just stop sending command to the ecu as soon as the door state changed (from Closed to Opened) or if the brake pedal was pressed. So No biggie! But then the question would be, well the engine doesn't exactly shut off RIGHT after I stopped sending the command as it takes about 5 seconds to be exact for the engine to shut off. Anyone can just quickly get in, put in gear and start driving , right? -with or without key. Well apparently the ECU DOES NOT CARE! It still shuts off even if you are in drive. LOL. Less thing to worry about it. Almost perfect for remote start and quite frankly good enough. Now there is a caveat though (yea I know), you can actually override that by doing something interesting as soon as you get into the car and the car would switch to the normal state and the engine won't shut off. At this point I can't override the ACC MODE. Doing this override basically switches the car into the normal start that assumed a normal starting operation. I won't mention it here but you can PM me or email me if you are interested. I am probably going to add that in my code that would basically kill the engine if you try to override but no key is detected - Yes I have the Canbus command that detects if the chip key is nearby or not. Easy fix for that. Oh before I forgot I also tried sending the remote starting command without eh key presented. Interestingly enough (to my surprise) it actually started but shuts off like a second later indicating to me (in the lcd display) that I need to depress and have the key near the ignition). Perhaps in the future I'll look into finding the command that would bypass they key and tricking the ecu that the key is presented but not a priority at the moment since i already bought a immobilizer transponder bypass. So in retrospect after many trials and brute forces, I have the canbus commands that can do this follow while the car is completely off: unlock/lock doors unlock trunk Roll up/down windows headlight/Tailight on/off Various (or practically all icons) in the gauge, Drive Mode (sport/snow for AT) ACC mode on/off IGN1 on/off IGN2 on/off Crank Cut Fuel to Engine HVAC (all functionalities - only applies to the one with dual zones - not the manual ones. Car would also need to be running else it's pointless) There are other miscellaneous stuff too that i can control remotely but not that important like horn, hazard light, interior buzzer sound, courtesy lights, dome light. There are also read only status messages to get info like tire pressure/temperature, etc... --------------------- I am still debating on whether to post all the canbus codes here or not. Anyway, Now I am ready to finish up the code for my remote start. I'm using arduino MKR 1500 (with built in 4g cat/nbIoT simcard) with the canbus shield which makes it SUPER portable compared to a conventional remote start kit which would require wire cutting and stuff. Infact the only thing that require some cutting might just be the immobilizer. Also anyone that want to find a message that control particular function or rather a status message. Feel free to ask and in that case it's just preferable to start a whoile new topic. Cheer!