- 153
- 247 618
TheBionicbone
เข้าร่วมเมื่อ 7 ต.ค. 2009
WARNING: Autel TPMS Hot Function Errors on Freelander 2
In this video I attempt to use the OBD2 device Autel AP200 Hot Function for the TPMS (Tyre Pressure Monitoring System) calibration. It does some weird stuff, throws fault errors on the dash board and starts the windscreen washers, wipers and locks the car !!
I will reach out to Autel to see if they are aware of the issue and to see if it can be fixed and report back here and hopefully record a new video of it working correctly.
I will reach out to Autel to see if they are aware of the issue and to see if it can be fixed and report back here and hopefully record a new video of it working correctly.
มุมมอง: 103
วีดีโอ
MCP2515 Arduino CAN BUS Library Performance Testing
มุมมอง 9412 หลายเดือนก่อน
In this video I test the following MCP2515 CAN Bus Libraries on the bench and connected to a Land Rover Freelander 2 car to see which ones have the best proformance. We also use an Oscilloscope connected to the Freelander 2 to understand the amount of CAN Data we should be expecting. MCP2515 CAN Bus Arduino Libraries: Acan2515 by pierremolinaro AA_MCP2515 by codeljo Arduino_MCP2515 by autowp mc...
Fusion360 - Concaved Soap Dish Design
มุมมอง 462 หลายเดือนก่อน
Fusion360 - Concaved Soap Dish Design Step by Step walkthrough of how to design something like this. In this design we use the following Fusion 360 features: Canvas Insert Canvas Resize Canvas Visibility Sketch Create Sketch Line Sketch Dimensions Sketch Arc Sketch Fit Point Splines Sketch Spline Add Point Sketch Pattern Sketch Formula Sketch Offset Sketch Visibility Extrude Part Extrude Cut Sh...
Fusion 360 - Cutting Holes
มุมมอง 413 หลายเดือนก่อน
Fusion 360 - Cutting holes at different angles or following a path through a part
Bosch UBH 2 20SE Hammer Drill Oil Seal Replacement
มุมมอง 3274 หลายเดือนก่อน
Bosch UBH 2 20SE Hammer Drill Oil Seal Replacement Total strip down and rebuild looking at how every part goes back together
Airwolf Nacelle and Guns Deployment
มุมมอง 738 หลายเดือนก่อน
The full project is building an AirWolf RC Helicopter like the hit 80's series called Aurwolf. This video is taking a look at the working machanics for the nacelle, and extending guns. An ESP32 is used to control the flow, the code was specially written and available on my github page along with wiring diagram: github.com/bionicbone/AirWolf_Cell_Guns_Rockets
Freelander 2 Service Reset using Autel AP200
มุมมอง 3048 หลายเดือนก่อน
In this video I show the process of reseting the "Service Required" warning using the popular Autel AP200 OBDII module. I do this on my MY2014 Land Rover Freelander 2, we look at the live data before and after to see that its updated the next service due indicator in the PCM unit.
Repair Air Compressor ( Coopers 8749 )
มุมมอง 1418 หลายเดือนก่อน
Coopers 8749 Air Compressor Repair, strip down and reassemble diconnected pump mechanism
Radiomaster TX16S Vibration Motor Repair
มุมมอง 1188 หลายเดือนก่อน
Quick video covering the repair of a Radiomaster TX16S RC radio that has a very noisy vibration motor, it was more of a rattle than a vibration.
Fusion360 Assemble Bodies to check tollerences
มุมมอง 1079 หลายเดือนก่อน
Quick video using Fusion360 Assemble feature to join two bodies and then checking tollerences using Section Analysis
3 Phase Rectifier Tests and Gasser Charging Circuit
มุมมอง 909 หลายเดือนก่อน
In this video we look at the test results of 4 different three phase rectifiers for rectifying voltages from BLDC motors to create a generator / charging circuit for a flight battery on RC Gasser (petrol) Engine Helicopter. The video mainly focuses on testing what happens if a flat flight battery is connected and the generator has to maintain power for the helicopter and additional flight batte...
Repair SBEC charger on a Petrol RC Helicopter
มุมมอง 2109 หลายเดือนก่อน
Here we demonstrate that sometimes an oscilloscope is required to find a problem and show that a cheap oscilloscope will often be enough. We look at what is wrong and how I am using the BEC to charge a LiFe battery and power servos on an petrol RC helicopter using a BLDC motor as a genorator and 3 phase rectifier to power the BEC.
FNIRSI 138Pro Oscilloscope
มุมมอง 5039 หลายเดือนก่อน
Very happy with this for the price, defo get with battery and probe as for the extra cost these are really good. Easy getting 5 hours of usage, the probe is 100mhz and seems as good as the one supplied with my Siglent Osc. Values have been validated using a calibrated Siglent SDS1104X-E and I was very pleased. A little fiddly at times, one button to cycle around all settings but you kind of get...
Practical Example: Designing & 3D Printing a Part
มุมมอง 1049 หลายเดือนก่อน
Practical Example: Designing & 3D Printing a Part I this video I use Fusion360 to design a part for an RC Scale Model of an Airwolf Helicopter. The part is required as a guide for a zip tie which pushes the guns out. The purpose of the video is actually a tutorial video for a friend to be able to measure and create the part himself. The thoughts behind uploading was to help others and possibly ...
QiaChip Signal Decoding - 433Mhz You can't hack this !!
มุมมอง 44911 หลายเดือนก่อน
In this video we decode / reverse engineer the QiaChip signals in some detail and review what would be necessary to create a successful rollJam attack on my project. My Project is open source and the code available in my GitHub account, feel free to use it and check back to see further updates coming soon. It is very much a developing project, please submit any ideas / like to have's on the Git...
Arduino Processing Speed - Bit Banging Registers vs digitalWrite, not what you think!!!
มุมมอง 38611 หลายเดือนก่อน
Arduino Processing Speed - Bit Banging Registers vs digitalWrite, not what you think!!!
RollJam on 433Mhz You can't hack this !!
มุมมอง 36011 หลายเดือนก่อน
RollJam on 433Mhz You can't hack this !!
Multi-Tx on 433Mhz You can't hack this !!
มุมมอง 43611 หลายเดือนก่อน
Multi-Tx on 433Mhz You can't hack this !!
LHT00SU1 - A practical application of the Logic Analyzer
มุมมอง 455ปีที่แล้ว
LHT00SU1 - A practical application of the Logic Analyzer
Siglent SDS1104X-E SPI Bus Decoding (2 Channels)
มุมมอง 730ปีที่แล้ว
Siglent SDS1104X-E SPI Bus Decoding (2 Channels)
Siglent SDS1104X-E SPI Bus Decoding (4 Channels)
มุมมอง 2.3Kปีที่แล้ว
Siglent SDS1104X-E SPI Bus Decoding (4 Channels)
Siglent SDS1000X-E License Key Recovery and Activate WiFi AWG MSO 200MHz
มุมมอง 1.9Kปีที่แล้ว
Siglent SDS1000X-E License Key Recovery and Activate WiFi AWG MSO 200MHz
SDR Fine Tuning 433mhz Signals in SDRSharp SDR# SDR Sharp
มุมมอง 865ปีที่แล้ว
SDR Fine Tuning 433mhz Signals in SDRSharp SDR# SDR Sharp
Installing SDRSharp and 433mhz Plugin for V4 dongle
มุมมอง 3.6Kปีที่แล้ว
Installing SDRSharp and 433mhz Plugin for V4 dongle
Siglent SDS1104X-E - Trigger on Exact Pulse Width
มุมมอง 822ปีที่แล้ว
Siglent SDS1104X-E - Trigger on Exact Pulse Width
Optimizing Code Efficiency: Mastering Conditional Debugging with #define in Arduino Programming
มุมมอง 252ปีที่แล้ว
Optimizing Code Efficiency: Mastering Conditional Debugging with #define in Arduino Programming
Arduino Code Speed Showdown: Serial.printf vs Serial.println at 2,000,000 Baud | Visual Performance
มุมมอง 352ปีที่แล้ว
Arduino Code Speed Showdown: Serial.printf vs Serial.println at 2,000,000 Baud | Visual Performance
Hi, would you mind sharing details of the hardware and software you used? That's very interesting.
Hopefully in the next week or so I'll be copying this over to a github master so I can share the firmware because it does everything needed for recording and analysing the data now. Of course they'll always be a need to add user code for things like requesting data or other tasks to see if what you found is what you think it is. For hardware, I used ESP32-S3, two MCP2515 (HW-184), and an ILI9341 display (with touch). Look for bionicbone on github.
I forgot to mention the F411 Openlager (not to be confused with an OpenLogger) for recording, kind of a must really for this so you can use SavvyCAN (or similar) to help find the data while sat comfortable indoors :).
Can you share the driver to make it work with USBee AX? For me it only worked with Pulseview, under USB device (installin WinUSB with Zadig), it never appeared under usb controller
It looks like the original provider of USBee has removed the software from their website, I didn't keep a copy of the install files either. In Zadig dont forget to use the menu to see "all".
I managed to download USBee AX Pro software from another source, but cant make it find the device. Installed the WinUSB driver, but still it does not recognize. When I tried with sigrok PulseView it worked perfectly though, wonder how you managed to get it working with USBee software
Did you see the part where you have to dedicate a USB port for USBee and a different one to Pulseview? Its essential because the two drivers are not compatible.
@TheBionicbone I did. The thing is that I can't find where to download the driver for USBee. Can you share?
I cant reach the website you mention to download usbee
Looks like you managed to find it somewhere else. Thanks for watching
💌🤟
It looked like you are using esp32, that has an inbuilt CAN controller and only needs a 3.3v transceiver SN65HVD230. More info on my other GitHub repositories. Feel free to message me as I have numerous PCBs for CAN on different MCUs, ranging from attiny1514, atmega328p (nano), esp32
Hello. What kind of batteries they are? Li ion?
Lithium "polymer" batteries, used in the remote control vehicles world a lot. This was 15 years ago and we still use them today. They can discharge at very high current, well over 100amps, even 160amps is possible. I use them in RC helicopters and less powerful LiPo batteries in RC drones, but they still pull 70 to 80amps during acceleration.
10:10 I suspect you got the sporadic errors due to the high bandwidth, and switching to x1 reduced the bw considerably. Almost every modern scope has a 'limit BW' feature which would help as well. Regardless, great video.
Thanks, it's great getting feedback and now them errors make sense to me.
Autel Ticket Number: 2794689 (6th Nov 2024) - Subject "TPMS Hot Function Faults" After working with Autel and testing several different scenarios it appears to be something Autel Software Engineers need to fix I emailed them again on the 10th November 2024 to see if they would confirm if a fix would be possible for them to do I will keep you guys updated...
Hi. I'm interested to calculate RPM from the sensor. But should we need "IRAM_ATTR" for interrupt? just found it, IRAM_ATTR is only for ESP family. Thank you sir.
I just reinstalled Oct 2024. I found the following differences which you need to take account of: 1) SDR Sharp is now revision 1920 2) When inside the Plugin-Rtl433 install folder you now have to Unzip 1.5.7.0 to get the 3 files you need 3) Other than that it worked as per this video
Thanks, this kinda cool to see. The other video where you show to download it, is a little different now. The install folder has text document where to download the master, but figured it out finally. Now I just need to find out where my temp sensor is, still transmitting after losing it a few years back.
fabulous vid ! Can this rpm sensor output to iBus sensor port, say iA6B ?
Sorry I've never used iA6B so I don't know the specs
@@TheBionicbone thanks all the same!
usefull video thank you
I've managed to get all warking as you do. Except the protocol windows poping out. Is this another plugin?
So far you gave the best explanation. Thank you
Really helpful! thank you
Are the decoded CAN/Serial messages able to be saved to internal or external memory? When I logged a CAN bus to CSV on mine, it just seemed to record the raw values 🤔
I dont think you can save the decoded values at all, only a waveform as a CSV file
@TheBionicbone I was able to figure out how to save a long string of decoded CAN messages to USB. A little clunky but it worked well.
@@tanner3801 you mean using the oscilloscope? Or did you use a logic analyser or something else?
@TheBionicbone yes, using the siglent sds1104x. It does seem limited in the size of continuous log it can record, but I was able to record a few seconds of 500kbaud CAN, which was enough for my needs this time.
Interesting, I'll have another play. Thank you, great info.
Hello to you I would like to do the same thing with my sds802x hd oscilloscope if possible. THANKS
Sorry, I'd need a test scope to work on.
Any reason why I have no plugins folder?
It's awhile since I did this, maybe I had to make that folder
This was useful, thanks. I hope you get a few more views.
is it possible to continuously monitor/stream/see live the LHT00SU1's analog and digital signals?
No buddy, just record and review from memory
I have been looking at these units, wondering if they would pick up engine pulses from an ignition coil on a motorcycle and give a clean square wave. They are cheap and small. Do you know whats inside them and how they work?
I'm not sure they would handle the voltage. Personally if you have access to mount a magnet somewhere I'd use an hall effect sensor A3144 with a 100k resistor across output and Vcc pins. The output will then go negative when the magnet passes, and you'll have a beautiful square wave.
Good Job As always, I didnt want to read the manual Subscribed
You are great, thank you so much for making this video, I was too scared to do this and got lost on the eevblog didnt know how to start. But after seeing your video with great and simple instructions, I will follow this tutorial :) One question, instead of the SD card do you think we can use 64 gb USB?
Thanks, I am glad it helped you. You could try the 64gb USB but sometimes these things only recognise SD / USB flash simulating devices that are 32gb or less. It's a technical limitation. I cant remember honestly if this does or doesn't. But try, it will or it wont and no harm should come from trying.
Thanks a lot, sir. Great and easy fix which helped me. 😊
Many thanks for posting the video, it's been about 9 months since I've used my AP200 to reset my oil and service intervals, but I seem to remember I used the prompt ignition 2 has engine running also for live data . Once again thanks for the video
I think you are correct, although Position 2 (engine started) is not normally recommended when resetting any ECU value (as far as I understand), certainly when resetting error codes its advised not to have the engine running so it kind of unexpectely caught me out by requesting it. Either way it has worked with no issues
At 20:55, after you press "Date/Time", you got the "NTP" selection. However, I don't have this "NTP" option, and the screen just have "Date/Time" and "Display off" selection. The middle 2 selections, "NTP" and "Time Zone", are misssing. Do you know how to add them? I am using a SDS1104X-E, with Software Version=6.1.37R10, Uboot-OS Version=8.1, FPGA Version=2021-11-08, Hardware Version=01-05. Thx !
How
Informative video. I know a little more about my analyser than I did 30 minutes ago, but bro, you gotta work on that teeth sucking tick.
I never noticed that, but listened to a video I did today and I see what you mean. Spent 20 mins editing and cutting them out lol, there was quite a few. I hate it when people have the meter bleeping for continuity testing, so I'm fully with you. Thanks for letting me know.
@@TheBionicbone Thanks a bunch! I subscribed to your channel to track your progress (smiles) Question: Do you experience Pulseview freezing up on you regularly running it on Winblows? I've run it on several flavours of linux (Mint, Manjaro, Arch) and Pulseview will always freeze on me having to close it down and restart.
Occasionally but I'm normally messing with lots of stuff, plugging things in and out the USB hubs. One thing I noticed is the driver doesn't like the USB being interrupted while the program is running, so I give it a priority port direct the the laptop and a good shielded USB cable. It seems to help.
Thank you for the experiment. I have the same device. I use it with sigrok. I tried to download the usbee software, but it is not available anymore. Have you tried using a 10x oscilloscope probe to be able to test voltages higher than the 10 volt max this device can handle?
Thank you for watching and commenting. I'll check the usbee software, I was not aware they had removed it. The x10 probe is an interesting one, I've not tried that but I just found a good cheap <£30 oscilloscope FNIRSI 138pro that comes with an x10 probe. Check my recent videos.
Very useful thx - I'm just starting to play with some CANbus home automation gear.
Is it possible too just make a single esp -32 rolling code module
I am not quite sure what you mean? Maybe remove the Tx Rx, maybe use the one ESP32 and have both Tx and Rx attached to it although not sure why. Maybe you can explain more.
Cheers, it worked perfect just as you laid it out. my SDS1204X-E is updated for MSO,WIFI, AWG.... 😀 thank you
I am really pleased this helped you. Thank you for taking the time to comment, it means a lot.
How can i get a copy to test?
Sorry it not ready for release, it needs a lot more documentation and I moved onto other stuff because the interest was not very high for the freelander 2. I still have a freelander 2 though and planning to have more time this year to continue as I have a personal interest.
@TheBionicbone myself. Im looking for sniffer or can scope. I have issues on some module not talking or kind of delays.
It will be a software emulated ev1527 or a Princeton Technology chip; viewing the waveform will tell you which one. Usually available between a receiver chip and decoder IC on the receiver pcb. Reminds me of my decoding sessions as a young teen, using a receiver (from a junked car alarm), tape recorder, and data slicer into an 8 bit home computer. Really bodgy, but it worked. For ASK now, I'd simply interface a bare receiver to the input of a sound card and record the result in Audacity for analysis. I'd be using a bare 433MHz transmitter module connected to an arduino to generate the signal rather than the sledgehammer esp and cc1101 combination. Soundcard is fine on the demodulated signal from a receiver for these things as the data rate is so low.
This is how i'd try, just from your description (not looked at the code). Capture 1, then send random guess to move along, send captured and repeat. If the random guess is right, door opens otherwise you'll only need to send as many attempts as you have in the numbers list. Trying to roll your own rolling code without knowledge of cryptography is usually a disaster. You should see how complex the original keeloq was, but it still was broken after the method used was leaked.
Thank you so much for this video i bought the V4 myself and its been difficult to find videos for the new version of this dongle
I was playing with this.. (I set a wide bandwidth) of 200,000 to grab a wack of devices.. (BaseBand Noise Blanker) not used.. RF Gain 32.8 (But.. I say This Plugin Needs work also 😊) Fidle Fidle
Yeah I agree. I found is it was difficult for the plug in to work put what the signal was. My car TPMS is detected but the values are incorrect. Thus the same header but different calculations used for that signal. I did find it all very interesting though. I'll come back to this one day. So many projects at the moment.
This didn’t make sense the first time I viewed it. When I realized you were working with an ARM Teensy, I started to understand. You’re not saying anything untrue, but it would be more accurate if you replaced most of the places you say “Arduino” with “Teensy 3”. The original Arduinos and original Teensys were AVR MCUs. AVRs use DDRX, PINX and PORTX registers at a low level for port manipulation. Starting with v3, the Teensys became ARM MCUs. ARMs use a completely different register system to control IO bits in a completely different process than AVRs. When the Teensy 3s came out, Paul Stoffregen (the Teensy creator) extended the digitalWrite function to work for his ARM setup. He also extended the Arduino direct port calls (DDRA = 0x0F) to generate ARM register code when the board is set to Teensy 3 (and now 4). So when you write direct port register code in Arduino, for an ARM Teensy, it’s not really direct code anymore. This and the fact that ARM register bit manipulation works very differently, gives you the non-predicted results for your tests. Compile and run your test code on an AVR Arduino (UNO, Nano, Leonardo, etc), or a Teensy 2.0, and you should get very different results.
Should be possible to get same result by telling the compiler to unroll loops, however im not comfortable enough with compiler optimization to trust the compiler to actually unroll the loops i want to unroll, so either code it ugly or look at the dissasembly to make sure. :)
Hi again. I did finally get the code to compile, but the serial monitor did not show the text, only a bunch of questions marks.
Make sure you have the serial monitor band rate (speed) set to the same as the program on the Serial.begin(xxxx) line
Serial port set to same baud rate. Still same garbage.
Thanks for the great video. I tried your Code and I can’t get it to compile. What am I missing?
"dumps the flash and cackles* ez hack
You could add an RTC to the electronics and have the code be dependent on the time it receives the message. It solves the problem of desync.
Thanks for watching. Desync has been resolved on the latest updates. Check the channel for the latest videos or github which also links to the videos.
"unrolling the loop" :)
@elmegil I shall use loops with caution in future lol
The waveform of the last one looks extremely distorted, so it still seems like the bitwise is faster without sacrificing the waveform?
@AbyssalArray I'm sure what you are seeing on the last test is the oscilloscope not sampling quick enough cos I'm trying to collect too much data. If I ran that as a single test so I could capture just a small window, and just used Ch1 and Ch3 on my scope so I could get the full 1GSa/s rather than the 100kSa/s on the test then that would look perfect. I know, its difficult to accept, my guess is compilers have just got so good they compile the base arduino code extremely well and fully optimised.
So you jam one of the signals and you store the rolling code which remains valid cuz it hasn't been used and then you're in....
They call this Rolljam, see latest videos for Rolljam I'm working on.
If an incorrect code is repeated, Rx wont progress.. Hacker records 2 valid sequences and plays them back alternately. Rx progresses and looks ahead so it only takes once round the sequence and I'm in.
After x (set by user) incorrect receives the rx starts a lock down, again set by user, ever increasing time outs. Its not perfect and can create a long lock out. But at least the criminal is also locked out.
@@TheBionicbone there is a solution... Use encryption... Encrypted information is salt (key word that must be present) and a counter. Tx encrypts a sentence comprised of salt, count and RSA signature(that's overkill, but hey..) then increments count. Because count is never the same, RSA signature will never be the same. Encrypted, doubly so. Rx only has to decode a valid packet (correct encryption was used), check salt and RSA signature (double protection), and check that count is greater than any recieved so far (pre recorded packets won't work).
It's true and the normal way, but I like to find different things and while what you mention and RSA is industry standard the industry is already preparing for the future. Search quantum resistant algorithms, and look for US government or banking
Maybe I misunderstood, the entire project only offers one function for a fully 4 button sender. If this is the case, I would suggest that instead of binary, we use fibonacci number base, 1 2 3 6, if you use this base 1 = 0001, 2 = 0010, 3 = 0100, 4 = 0101, 5 = 0110, 6 = 1000, 7 = 1001, 8= 1010, 9 = 1100, 10 = 1101, 11 = 1110, 12 = 1111 and the last button could be encoded into the last code sent, so you have 12,13,14,15 based on binary coding. If any transmitter sends any numbers above 12 in a sequence, you can lock it up.
I think you understood well. Any changes could be made and that one could easily be added, to make a unique implementation and I encourage people to make changes to keep their own unique setup. I'm not sure you know but you can config to lock up after x unsuccessful attempts so you could tap into that, and repeated last code etc is handled. Tx number is already hashed into the first number sent, eventually I'll hash the button probably into the first number too.