Toyota GR Yaris Forum banner

Reverse engineering PIDs

2 reading
73K views 149 replies 36 participants last post by  Helmut Eder  
#1 · (Edited)
Thanks to https://gr-yaris.co.uk/forum/threads/oil-pressure-and-other-info-over-obd.4379/ we now know that selecting Toyota Camry 2020 in OBDLink Android app gives us access to additional sensors.

It is relatively easy to snoop Bluetooth traffic on Android devices from bugreports or even live. So I selected a couple of sensors in OBDLink on continuous monitoring and looked into the BT traffic using Wireshark. Here is a little snippet from the quite verbose conversation:

Capture.PNG


These are ELM327 microcontroler, that runs inside OBDLink, AT protocol commands. Interesting ones here are:
* ATSH 0007D0 - sets OBD header for all subsequent OBD commands
* 2162 - queries OBD Mode 21 PID 62 and gets 7D8 05 61 62 03 00 00 0 as a response

First three hex digits in the response (7D8) is the ID of the ECU that has sent the response. Next three bytes (05 61 62) I am not sure what they are. And next three bytes (03 00 00) is the actual data that could be interesting.

So here is the short list of OBD Headers, Modes and PIDs that I was able to figure out from the first initial look and from subsequent help of other forum members below:

SensorCategoryModePIDHeaderFormulaDiag Command
This item indicates that the parking brake is "ON/OFF"Navigation System21627D0BIT(A:1)
Accelerator PositionEngine221059700(A-41) / 1.42
Engine Oil PressureEngine221074700(((A*256)+B) * 10) / 128
M/T Oil TemperatureEngine221638700A + B/256 - 40
+B VoltageCombination Meter2210217C0A/10
Fuel InputCombination Meter2210227C0???
Sub FuelCombination Meter2210237C0???
Fuel Pressure (High)Engine221F6D700???
Fuel Pressure (Low) / Fuel Pressure 2Engine221F6D700???
Intake Manifold Absolute PressureEngine221F87700???
Low Fuel Pressure SensorEngine2210CD700???
ExDID_1BE1Engine221BE1700???
ExDID_15F7Engine2215F7700???
ExDID_1F07Engine221F07700???
Tire ID 1 PressureTPM221005750B * 0.01373atcea2A
atta2A
Tire ID 2 PressureTPM221005750D * 0.01373atcea2A
atta2A
Tire ID 3 PressureTPM221005750F * 0.01373atcea2A
atta2A
Tire ID 4 PressureTPM221005750H * 0.01373atcea2A
atta2A
Tire ID 1 TemperatureTPM221004750A - 40atcea2A
atta2A
Tire ID 2 TemperatureTPM221004750B - 40atcea2A
atta2A
Tire ID 3 TemperatureTPM221004750C - 40atcea2A
atta2A
Tire ID 4 TemperatureTPM221004750D - 40atcea2A
atta2A
Tire ID 1 PositionTPM222021750LOOKUP(A::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Tire ID 2 PositionTPM222021750LOOKUP(B::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Tire ID 3 PositionTPM222021750LOOKUP(C::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Tire ID 4 PositionTPM222021750LOOKUP(D::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Steering Angle2210047B3((SIGNED(A)*256)+B)*1.5
Master Cylinder Sensor TemperatureBrake2210067B0A-80
Temperature Sensor Value in CouplingFour Wheel Drive2210267B1(A*256+B)/128
??? formulas are the tricky part

So this is not much yet, but at least I hope this is enough information for anyone of you to join into this reverse engineering party. :)

CSV file that can be imported into Torque app for the custom PIDs can be found here: https://github.com/2m/gry/blob/main/exportedPIDs.csv
 
#79 · (Edited)
There is a new program called AAEase.apk available to overcome the Google restrictions (stopping Screen2Auto from working). For more info please visit https://inceptive.ru/projects/aaease/
I'm now off to test. Update will follow (hopefully soon)

Bye for now Fred

Update 1: No function right now, doesn't download the modified Screen2Auto. Now I'm VIP for Screen2Auto paying $4.- for that privilege :)
Update 2: It's working now. (Dec. 9th 10:30h)
 
#82 ·
Maybe it's time to change your setup... ;).

Have a look at AAAD and Screen2auto (for non-rooted devices). I can't test it - have got only rooted Android devices - but my rooted setup works without problems.

View attachment 30253

Bye for now Fred
Can you run something on the car screen different to the phone screen. I want my lap timer on the phone
 
#83 ·
Found no way to run two different programs on head unit and smart phone :( ,

Solution might be to use additional hardware like Carbotics Carplay2droid or CarDongle (klick on the names to visit web sites), both are "complete Android PCs" connected to USB (will report when I get my hands on one of these and can test them).

Bye for now Fred
 
#84 ·
Oddly I appear to have lost my Boost/Vacuum guage in TorquePro last few days, all othe guages display fine but the Boost one appears to receive no data. I've not altered anything on the car or phone so I'm assuming it's something to do with the recent TorquePro updates? Anyone else having issues?
 
#86 ·
You're not the only one. Something changed within Torque and it lost contact to MAF/MAP sensors. Solution: Enter Torque Settings -> OBD2 Adapter Settings -> Boost Calculation Method and change to Prefer ALT. Worked for me (seems to show the boost value the ECU sees, bu
 
#87 ·
Thanks to https://gr-yaris.co.uk/forum/threads/oil-pressure-and-other-info-over-obd.4379/ we now know that selecting Toyota Camry 2020 in OBDLink Android app gives us access to additional sensors.

It is relatively easy to snoop Bluetooth traffic on Android devices from bugreports or even live. So I selected a couple of sensors in OBDLink on continuous monitoring and looked into the BT traffic using Wireshark. Here is a little snippet from the quite verbose conversation:

View attachment 21254

These are ELM327 microcontroler, that runs inside OBDLink, AT protocol commands. Interesting ones here are:
* ATSH 0007D0 - sets OBD header for all subsequent OBD commands
* 2162 - queries OBD Mode 21 PID 62 and gets 7D8 05 61 62 03 00 00 0 as a response

First three hex digits in the response (7D8) is the ID of the ECU that has sent the response. Next three bytes (05 61 62) I am not sure what they are. And next three bytes (03 00 00) is the actual data that could be interesting.

So here is the short list of OBD Headers, Modes and PIDs that I was able to figure out from the first initial look and from subsequent help of other forum members below:

SensorCategoryModePIDHeaderFormula
This item indicates that the parking brake is "ON/OFF"Navigation System21627D0BIT(A:1)
Accelerator PositionEngine221059700(A-41) / 1.42
Engine Oil PressureEngine221074700(((A*256)+B) * 10) / 128
M/T Oil TemperatureEngine221638700A + B/256 - 40
+B VoltageCombination Meter2210217C0A/10
Fuel InputCombination Meter2210227C0???
Sub FuelCombination Meter2210237C0???
Fuel Pressure (High)Engine221F6D700???
Fuel Pressure (Low) / Fuel Pressure 2Engine221F6D700???
Intake Manifold Absolute PressureEngine221F87700???
Low Fuel Pressure SensorEngine2210CD700???
ExDID_1BE1Engine221BE1700???
ExDID_15F7Engine2215F7700???
ExDID_1F07Engine221F07700???
??? formulas are the tricky part

So this is not much yet, but at least I hope this is enough information for anyone of you to join into this reverse engineering party. :)

CSV file that can be imported into Torque app for the custom PIDs can be found here: https://github.com/2m/gry-obd-pids
Hi dvim,
i see your post and try to give my knowledge to help in the effort of translating PIDs. I'm translating also some others and doing other interesting things ;)
Regarding the response received on 7D8 after querying 7D0 (usually 8 byte more then querying addr: Sent [7D0] Rcv (7D0+8)[7D8], the reply is in a standard format when receiving replies via OBD/CAN and it is made like this:
if you sent 7D0 2162 you receive a response made by 7D0+8; the total length of hex bytes received; the first hex byte sent + 40, the second hex byte sent and the rest of bytes are the value returned (the number of hex bytes of the values are: total length of hex bytes less the first 2).
Example:
Sent
HDR Mode Pid
7D0 21 62
Rcv
HDR Len Mode Pid Value
7D0+8 5 21+40 62 03 00 00
Final
HDR Len h1 h2 h3 h4 h5 (5 hex bytes so Len is 5)
7D8 5 61 62 03 00 00

The h1 and h2 made this way help to intercept the right reply from a request: you ask 21 so you must find 61 in h1 for access the right mode and then you test the h2 to get just what you want from pids. If you don't do this you could intercept wrong values.

Hope to made a sort of good explanation :D and if you already know this.. just ignore the post ;) Let me know if i must tell more.
Ciaooo
 
#88 ·
Eddy, should be possible, if...
...you got a valid PID
...the ECU "understands" this PID
...you get the formula to extract the correct information for each sensor
...you know which OBD header has to be used
then it should be possible. Do you got a PID to test?

Bye for now Fred
dears,
wonderful topic

i had carista app beta
they implemented TPMS management
i have now in carista my 4 tpms sensors id and pressures

i have tried with other apps (torquepro, cascanner, obdlink) no chance now to find the value.....
here carista APP
may be useful to someone to finf the PID ?

Image
 
#89 ·
they implemented TPMS management
Thanks for the hint. Indeed, Carista Beta now has support for TPMS in GR Yaris.

I have updated the first post with the PIDs and formulas for all four tire pressure sensors. To get the values from those PIDs, a multi-line "Diagnositics start command" needs to be used in Torque Pro. You need to use the latest beta version of the app for that to work (more context here).

Image
Image
 
#90 · (Edited)
Thanks for the hint. Indeed, Carista Beta now has support for TPMS in GR Yaris.

I have updated the first post with the PIDs and formulas for all four tire pressure sensors. To get the values from those PIDs, a multi-line "Diagnositics start command" needs to be used in Torque Pro. You need to use the latest beta version of the app for that to work (more context here).

View attachment 34121 View attachment 34123
@dvim
you are simply special
thx a lot

in a few weeks canchecked will arrive with a OBD+CAN diplay
or also


in their plans they have also temperature from tpms in addition to temp
do you think temperatre will be possible ??
i have read the tpms sensor on the wheel woth autec tool in a garage and it gives both pressure than temp and probabily transit them both.
so maybe the ecu read it somewhere but do not use it
what do you think about ?
thx a lot for you effort in these data !!!
 
#99 · (Edited)
Motivated by completing my OBD2AA dashboard with transmission oil temperature, I tried formula from other Toyota vehicle forums. "M/T Oil Temperature" sensor returns correct values with the "A + B/256 - 40" formula. I have updated the table in the first post. Here is how my OBD2AA dashboard looks now:

View attachment 21692

Torque and OBD2AA app configs can be found here: https://github.com/2m/gry-obd-pids
Is this gearbox temperature or rear clutchpack temperature? I've tried some settings on OBD fusion, with OBD mode 22 and PDI number 1638 and seem to be getting around 50 degrees with the car fully warmed up…does that make sense?

Thanks a lot for the magic done on here. This is phenomenal.
 
#102 ·
I got my hands on Techstream application which is able to read all of the sensors from GRY. So now we are able to sniff the CAN requests and responses which Techstream is sending and receiving when querying a certain sensor. Figuring out the formulas still takes a bit of time, but we will get there at least for the most interesting values. :)

I have updated the first post with the formula for the Steering Angle sensor.
 
#104 ·
First post updated with some more temperature sensors. :)

1. Tire air temperature. At least the OEM TPMS sensors report not only tire pressure, but also air temperature inside the tire. Now we can get these values via OBDII. Note that the sensor list in the first post changed how it identifies which sensor belongs to which tire. I've added PIDs like Tire ID x Position which return the name of the tire (Front Left, Front Right, Rear Left, Rear Right) that the TPMS sensor with ID x belongs to.

2. Master Cylinder Sensor Temperature. Found this sensor under the Brake section in Techstream. Will be interesting to see how this value changes under some extensive hard braking. I've got around 50°C while idling.

3. Temperature Sensor Value in Coupling. Found this one under the Four Wheel Drive section in Techstream. My guess is that this sensor is in the hydraulic coupling that controls Front/Rear torque distribution. Unfortunately I was not able to figure out the exact formula just yet. I see that the interesting values were in A and B bytes. Here is what I saw while idling:
ABValue in Techstream
11B835.56
11D735.67
11E735.80

I was not able to find any more temperature sensors in Techstream. I was not even able to locate some of the sensors that we already know from other sources, like Engine Oil and Transmission Oil temperature. That gives me hope that there are some more hidden goodies in Techstream yet to be found out. :)
 
#105 ·
First post updated with some more temperature sensors. :)

1. Tire air temperature. At least the OEM TPMS sensors report not only tire pressure, but also air temperature inside the tire. Now we can get these values via OBDII. Note that the sensor list in the first post changed how it identifies which sensor belongs to which tire. I've added PIDs like Tire ID x Position which return the name of the tire (Front Left, Front Right, Rear Left, Rear Right) that the TPMS sensor with ID x belongs to.

2. Master Cylinder Sensor Temperature. Found this sensor under the Brake section in Techstream. Will be interesting to see how this value changes under some extensive hard braking. I've got around 50°C while idling.

3. Temperature Sensor Value in Coupling. Found this one under the Four Wheel Drive section in Techstream. My guess is that this sensor is in the hydraulic coupling that controls Front/Rear torque distribution. Unfortunately I was not able to figure out the exact formula just yet. I see that the interesting values were in A and B bytes. Here is what I saw while idling:
ABValue in Techstream
11B835.56
11D735.67
11E735.80

I was not able to find any more temperature sensors in Techstream. I was not even able to locate some of the sensors that we already know from other sources, like Engine Oil and Transmission Oil temperature. That gives me hope that there are some more hidden goodies in Techstream yet to be found out. :)
Good stuff, worked out the formula for the coupling.
=((A*256)+B)/128
 
#114 ·
I am trying new pid in carscanner Pro too.
Everything works with tire pressure and temp.
I have no display for tire position
Do you have tricks?

And also
My one built in oil temp in carscanner works over 100 C Degrees. Maybe scale?
 
#116 ·
I cannot get tire temp to work.
Which connection profile are you using?
if u mean carscanner pro
i am using normal bt connection with obdlink mx+
nothing different from other pid

but it seems that "lookup" is present only in torquepro, so no chance
 
#124 ·
Torque can show CACT, it's implemented. Unfortunately there is no easy way to just read out the PID number and settings, these are "internal" factors. Someone with some spare time will be able to extract...

Bye for now Fred
 
  • Like
Reactions: 883
#131 ·
Hey

Has anyone found the PID´s for Knock Retard and Wastegate Dutycycle.

My car has a remap with full inlet and exhaust mods. Sometimes it feels like there is some knock retard and the car is also not doing consistent boost. Sometimes it does 1,8bar till 6k falling to 1,5bar....and some minutes later just doing 1,4bar falling to 1,2bar.