4d ago

hacking a chevy bolt EV

I'm fed up with onstar. It's slow. The app is annoying. I'm paying for it now and it's hardly worth it. Additionally I really need a distraction right now and a technical project could be just the thing. I want to build my own board and software that will use LoRa instead of cellular and I have prototype parts ready but I stumbled across a concerning problem. I read somewhere that the Bolt EV just turns off the OBD 2 port after a while. It also ignores commands to wake, unlock doors, start the climate controls, etc unless they occur on a different wire somewhere else in the car, something seperate from the OBD port.

I know nothing about this wire. How can I communicate with this bus? Can I plug in somewhere or do I have to tap an existing wire? Is there any documentation regarding the commands sent? Is this just another can bus or is it something different?

3 comments

I work in automotive, and have done a bunch of work on the Bolt.
Unfortunately, vehicles made in the last 5 years or so are protecting CAN bus traffic from exactly the kind of thing you're looking to do. You'd need to know exactly how to calculate certain values on your messages to be able to replicate them, plus you'd need to block out the messages from the actual OnStar ECU. This isn't really feasible, unfortunately.
You can probably still read traffic from the OBDII port, but I don't recommend trying to send traffic (those busses are often pretty loaded up anyways) unless you have an existing tool that you could replicate exactly.
- Well there’s a lot of documentation out there online about this and other vehicles CAN bus messages. People much smarter than me have already got the bulk of this figured out. I’m just putting the pieces together in a different way. My bolt is a 2017. It’s outside the date range you described.
  
  I also work in automotive, all of the messages related to starting the car (which is required for climate control) or unlocking the vehicle will be encrypted with keys you will not be able to extract. Many have MAC authentication and counters for invalid attempts. Too many wrong hits and you'll trigger a DTC which may need a visit to the mechanic to clear. Furthermore, a lot of the behaviours you want to trigger that are done via the app normally use a telematics unit in the car that will authenticate with the OEM server. You will not be able to get this authentication. Sorry to be the bearer of bad news, but what you're trying to do is exactly what car thieves wish they could do, which is why we put in every effort to make it extremely hard.