You can start experimenting. I bet the command will be mode 4 request. You have to find the ID of module. In the ds file it is defined as $F9.
First send f1 xx 08 message to get the ccm quiet. You can dump the bus until a response is received.
You will likely need to resend that every 2 seconds.
That you can start sending
F9 xx 04 [...] messages.
First figure the length of [...] It can be 6,8,10 or 12 or ?? bytes. If it is shorter than needed it will be a problem. A longer message will be accepted without issues. The extra part will be ignored.
Sending [....] filled with zeroes is also safe. That way you can check if the length is correct and the message is accepted. Than you can start sending random data like 01s, 02s, 04s, 08s, 10s, 20s, 40s, 80s and listen for unusual activity at the solenoids, lamps actuation and so on. Write A map with the discovered info for reference. Mode 4 is used as follow. 2 consecutive bytes. 1st byte sets bit $04 means enable control of XX solenoid, second byte bit $04 means switch on or off the solenoid.
A sample message will be
00 00 04 04 00 00 00 00 00 00
or
04 04 00 00 00 00 00 00 00 00
And so on until you found some actuation.
Be prepared to turn off ignition if something unusual occurs. It will clear the commands and reset the ebcm.
Bookmarks