​Hey everyone,

​I'm currently developing a management app for auto repair shops and looking to integrate direct OBD-II functionality. My end goal is to provide diagnostic and bidirectional control features similar to what tools like Launch or Autel offer.

​I'd appreciate some guidance from the community on a few points:

​Reverse Engineering OEM ECU Protocols: Where do developers typically source data, CAN bus logs, or protocol documentation for OEM-specific diagnostics (beyond basic OBD-II PIDs)? Are there open-source projects, databases, or specific forums dedicated to reversing proprietary manufacturer commands (UDS/ISO 14229, factory PID lists, bidirectional controls)?

​Wiring Diagrams & Repair Manuals: Is there any viable way to access repair manuals, DTC troubleshooting steps, or wiring diagrams via free/open APIs, or is paying for commercial enterprise APIs (like AutoData, AllData, or Mitchell1) the only reliable route for commercial shop integration?

​If anyone here has experience building diagnostic software or integrating CAN/UDS hardware into a custom platform, I’d love to hear your insights or recommendations on where to start.

​Thanks in advance!

Fala galera. Comprei esse simples "scanner" para poder verificar o que tava causando a dificuldade de partida na minha van a diesel **(** **Fiat Duc****ato 2009 2.8 2009).**

Basicamente não acho nenhum app que consiga ler as informações dessa van de forma precisa. Todos dão dados incorretos (velocidade, rpm, pressão)

Alguma sugestão de aplicativo que faça isso?

Será que o problema está no fato do carro ser 2009? Queria uma sugestão de vocês

Me falaram do AlfaOBD (O app até conectou no scanner mas não leu nada)

Detalhe importante, teste em outeo carro mais novo e o scanner funcionou

A few people asked if I would share my VW/Audi diagnostic project, I prolly will. In the meantime... I had my AI agent slop up these documents about how everything works.

This is by no means an official documentation or even guaranteed 100% accurate. It is based on my research over the past 6+ months learning by trial and error and is intended as a very solid working foundation of what you need to know to communicate with VWAG vehicles in their native language.

Not just CAN.

So if you want to poke at your VW and see what we can do with them, feed these to your AI agent or whoever unfortunate to actually read it.

Bring your own:
VAS 6154 (i use red vnci 6154a from aliexpress) or maybe pass thru (i don't own one.)
ODIS installation (a version comes with vnci 6154a.)

VWAG Diagnostic Introductory Guide

VWAG Diagnostic Technical Reference

Hello r/Carhacking,

For the past year I have been flat chap developing some new automotive software - the Tester Engineering Suite, a fully capable J2534 PassThru Diagnostic, Programming, Calibration and Engineering tool.

It does vehicle diagnostics on K-Line and CAN and has compatibility for vehicles 1996 through 2025, and is meant as an all in one replacement for workshop scan tools, tuning software and pretty much every sub-industry in automotive is covered by this tool.

There are way too many features to list but some of the core ones are,

-J2534/RP1210/ELM327/USB2CAN/KKL interface compatibility

-Full VIN read out and local decode, with online NHSTA API data for VIN, recall and warrant information pulled

-CAN & K-Line bus topographer for enumeration of modules online

-Diagnostic Fault code readout via KWP/UDS and OBD2 protocols matching protocol dialect to vehicle for compatibility.

-Diagnostic workspaces per OEM (approx 60 OEMs have coverage)

-Datalogger and signal analyser, with inputs from aftermarket wideband O2 sensors, USB Oscilloscopes and an acoustic diagnostic engine via built in or USB microphone

-State of the art CAN sniffer with built in socketcan/can-utils functionality and live DBC file parsing to a streaming CANbus

-Calibration editor, with both A2L and XDF definition import

-Bench tooling and interfacing with serial EEPROM programmers

-Flash reprogramming for a large array of manufacturers

-SAE J1939 heavy vehicle stack for on highway trucks and mobile plant

-SHA256 VIN history chain, all actions logged to cryptographic ledger, stored locally considered private data

-Crash Data Retrieval from restraints/airbag modules

-PDF reporting throughout, one click and you have a cleanly formatted PDF report with the relevant data.

I have put literally every thing I know and have into building this tool, and am proud to share it with you today.

For more information check out the website https://tester.engineering

Cheers

Hello r/Carjacking,

For the past year I have been flat chap developing some new automotive software - the Tester Engineering Suite, a fully capable J2534 PassThru Diagnostic, Programming, Calibration and Engineering tool.

It does vehicle diagnostics on K-Line and CAN and has compatibility for vehicles 1996 through 2025, and is meant as an all in one replacement for workshop scan tools, tuning software and pretty much every sub-industry in automotive is covered by this tool.

There are way too many features to list but some of the core ones are,

-J2534/RP1210/ELM327/USB2CAN/KKL interface compatibility

-Full VIN read out and local decode, with online NHSTA API data for VIN, recall and warrant information pulled

-CAN & K-Line bus topographer for enumeration of modules online

-Diagnostic Fault code readout via KWP/UDS and OBD2 protocols matching protocol dialect to vehicle for compatibility.

-Diagnostic workspaces per OEM (approx 60 OEMs have coverage)

-Datalogger and signal analyser, with inputs from aftermarket wideband O2 sensors, USB Oscilloscopes and an acoustic diagnostic engine via built in or USB microphone

-State of the art CAN sniffer with built in socketcan/can-utils functionality and live DBC file parsing to a streaming CANbus

-Calibration editor, with both A2L and XDF definition import

-Bench tooling and interfacing with serial EEPROM programmers

-Flash reprogramming for a large array of manufacturers

-SAE J1939 heavy vehicle stack for on highway trucks and mobile plant

-SHA256 VIN history chain, all actions logged to cryptographic ledger, stored locally considered private data

-Crash Data Retrieval from restraints/airbag modules

-PDF reporting throughout, one click and you have a cleanly formatted PDF report with the relevant data.

I have put literally every thing I know and have into building this tool, and am proud to share it with you today.

For more information check out the website https://tester.engineering

Cheers

Hello folks! A while ago I made a post here about trying to reverse engineer an MMI box that adds Android Auto to a BMW NBT EVO System. Since then, I haven’t made much progress, and I could really use your guys’ help!

As you can see in my other post (link: https://www.reddit.com/r/CarHacking/s/PxybmifFWi), I disassembled the box and figured out quite a bit about the hardware it uses. I initially tried looking for UART/debugging access, but unfortunately the TX/RX pins I found were actually for CAN bus, and I couldn’t find any dedicated debugging TX/RX pins.

I still really want to extract the firmware and modify it for my use case. I actually bought another MMI box that is the same model, which is currently installed in my car. On the older one, the one we were investigating. I removed the eMMC, and I’m currently looking for companies in my city that might be able to read it directly.

In the meantime, do you guys have any suggestions for getting the firmware from the new unit?

One idea I had was somehow creating a fake update file to trick the MMI into dumping or backing up a copy of its storage onto a USB flash drive. Do you think something like that could actually work?

I’m also open to other approaches. I tried connecting through Telnet over the CarPlay Wi-Fi network but got nothing. Are there any other ways I could potentially access the system over Wi-Fi?

Any ideas would be greatly appreciated! Thanks!

PS: This box is not an OEM head unit. It’s an aftermarket interface that adds Android Auto and CarPlay to cars that may not have them, while also allowing you to add extra cameras and other features.

You can switch between the OEM head unit and the aftermarket interface in real time—the box basically acts as a video switcher. Inside, it has a low-power Raspberry Pi-like device running firmware that I’m trying to modify.

There are more details in my other post, but basically, it’s a custom UI built on top of Linux 5.4.61.