Toyota GR Yaris Forum banner

Reverse engineering PIDs

1 reading
73K views 149 replies 36 participants last post by  Helmut Eder  
#1 · (Edited)
Thanks to https://gr-yaris.co.uk/forum/threads/oil-pressure-and-other-info-over-obd.4379/ we now know that selecting Toyota Camry 2020 in OBDLink Android app gives us access to additional sensors.

It is relatively easy to snoop Bluetooth traffic on Android devices from bugreports or even live. So I selected a couple of sensors in OBDLink on continuous monitoring and looked into the BT traffic using Wireshark. Here is a little snippet from the quite verbose conversation:

Capture.PNG


These are ELM327 microcontroler, that runs inside OBDLink, AT protocol commands. Interesting ones here are:
* ATSH 0007D0 - sets OBD header for all subsequent OBD commands
* 2162 - queries OBD Mode 21 PID 62 and gets 7D8 05 61 62 03 00 00 0 as a response

First three hex digits in the response (7D8) is the ID of the ECU that has sent the response. Next three bytes (05 61 62) I am not sure what they are. And next three bytes (03 00 00) is the actual data that could be interesting.

So here is the short list of OBD Headers, Modes and PIDs that I was able to figure out from the first initial look and from subsequent help of other forum members below:

SensorCategoryModePIDHeaderFormulaDiag Command
This item indicates that the parking brake is "ON/OFF"Navigation System21627D0BIT(A:1)
Accelerator PositionEngine221059700(A-41) / 1.42
Engine Oil PressureEngine221074700(((A*256)+B) * 10) / 128
M/T Oil TemperatureEngine221638700A + B/256 - 40
+B VoltageCombination Meter2210217C0A/10
Fuel InputCombination Meter2210227C0???
Sub FuelCombination Meter2210237C0???
Fuel Pressure (High)Engine221F6D700???
Fuel Pressure (Low) / Fuel Pressure 2Engine221F6D700???
Intake Manifold Absolute PressureEngine221F87700???
Low Fuel Pressure SensorEngine2210CD700???
ExDID_1BE1Engine221BE1700???
ExDID_15F7Engine2215F7700???
ExDID_1F07Engine221F07700???
Tire ID 1 PressureTPM221005750B * 0.01373atcea2A
atta2A
Tire ID 2 PressureTPM221005750D * 0.01373atcea2A
atta2A
Tire ID 3 PressureTPM221005750F * 0.01373atcea2A
atta2A
Tire ID 4 PressureTPM221005750H * 0.01373atcea2A
atta2A
Tire ID 1 TemperatureTPM221004750A - 40atcea2A
atta2A
Tire ID 2 TemperatureTPM221004750B - 40atcea2A
atta2A
Tire ID 3 TemperatureTPM221004750C - 40atcea2A
atta2A
Tire ID 4 TemperatureTPM221004750D - 40atcea2A
atta2A
Tire ID 1 PositionTPM222021750LOOKUP(A::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Tire ID 2 PositionTPM222021750LOOKUP(B::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Tire ID 3 PositionTPM222021750LOOKUP(C::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Tire ID 4 PositionTPM222021750LOOKUP(D::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Steering Angle2210047B3((SIGNED(A)*256)+B)*1.5
Master Cylinder Sensor TemperatureBrake2210067B0A-80
Temperature Sensor Value in CouplingFour Wheel Drive2210267B1(A*256+B)/128
??? formulas are the tricky part

So this is not much yet, but at least I hope this is enough information for anyone of you to join into this reverse engineering party. :)

CSV file that can be imported into Torque app for the custom PIDs can be found here: https://github.com/2m/gry/blob/main/exportedPIDs.csv
 
#133 ·
reading most of this thread seems to suggest there is no Android application that works "out of the box" for the GR. ive played with ToroquePro but been unable to get the data like intake air temp to display correctly. it appears to be grabbing the wrong data or have the wrong equation. has anyone found a workable Android based solution to get most/all of the GR CANBUS data??
 
#135 ·
dears,
asking this.
(hope it is in topic)

is there a way to log a data?
just to say, rpm in a track session?
in order to check later on how many gear shift up and down near rpm limiter ?

may be used an obd app like a log ?
which <pp and in which way ?

thx so much to anyone
 
#137 ·
dears....

i am having an issue
and ask to this community looking for help
i have used all the PIDS here with torque pro, super
then i have bought canchecked and i am having same info, MAINLY CLUTCH DIFF TEMP
the named "Temperature Sensor Value in Coupling"

now i have added to the car the Syvecs AWD controller (simply remove cables under rear seat from oem awd controller and connect this syvecs)


but unfortunately the "Temperature Sensor Value in Coupling" is disappeared both from canchecked than from torque pro

syvecs says that this info come not from CANBUS but from OBD
they tried several times but they do not understand how fix it, they do not find "the channel, the signal"

do someone may help me
or give me suggestions ?

shall i open a dedicated topic?
and if yes, where ??
thx u all so much for support

here syvecs awd controller
 
#138 ·
dears....

i am having an issue
and ask to this community looking for help
i have used all the PIDS here with torque pro, super
then i have bought canchecked and i am having same info, MAINLY CLUTCH DIFF TEMP
the named "Temperature Sensor Value in Coupling"

now i have added to the car the Syvecs AWD controller (simply remove cables under rear seat from oem awd controller and connect this syvecs)


but unfortunately the "Temperature Sensor Value in Coupling" is disappeared both from canchecked than from torque pro

syvecs says that this info come not from CANBUS but from OBD
they tried several times but they do not understand how fix it, they do not find "the channel, the signal"

do someone may help me
or give me suggestions ?

shall i open a dedicated topic?
and if yes, where ??
thx u all so much for support

here syvecs awd controller
Hi, have you found the solution for this issue with Syvecs AWD? I use OBD fusion to see rear diff temperatures and am purchasing the syvecs awd ad don’t want to lose that feature…
 
#144 ·
I'm trying to use obdlink mx+ with racechrono to display the custom pids from the first post. I'm having issues getting racechrono to see any data. The standard pids work fine. What's the trick for pids like the m/T temperature? I've tried to add them as custom pid. With w
Pid and header.

Update:
I had to add 0x to the header value.
how are you adding these to race chrono? are you using values from torque pro? or obdlink?