I'm considering setting up a Raspberry Pi or something similar on the CAN bus of my Fit to log the packets sent back and forth. Before I do that, I figured it'd be worthwhile to see if anyone else has done something like this or otherwise knows the answers to some of my questions.

First off, how many busses does a Fit use in addition to the CAN bus?
Next, do any of the busses use encryption or other methods to prevent unauthorized devices issuing commands?


The whole idea of doing this stemmed from me learning that some Hondas, but not the Fit, will roll down the windows and open the sun roof if you hold down the unlock button on the remote (to let the hotter inside air out of the car before you get in). Now it seems to me that if those devices are on the bus (which they well might not be in the Fit - a valid reason why that functionality would be absent) I could put another device on the bus, learn what command is sent to operate each window, and then teach it that when it sees a long-press, or maybe a double-press of the unlock button on a remote, to send the commands that open the windows.

Similarly, I'm annoyed that the hatch unlock button on the remote is basically useless. I can't really think of a use-case where I want to unlock the hatch, but not without actually reaching out and touching it myself. The whole point of a smart key (in my opinion) is that it never leaves your pocket because the car simply detects proximity and opens whatever you touch. Unless I need to open the hatch for someone from 40 feet away without actually approaching the car myself, AND I really don't want to unlock any of the doors, that button serves no purpose. Now what I wish it did would be to actually operate the release, perhaps on a long-press. My guess is that the lift hydraulics don't have enough to push the hatch open, but it probably wouldn't be too difficult to fix that. I can definitely see a few cases where I'd like the hatch to swing open for me as I'm walking towards the car. Again, something that I might be able to do if the devices are on one of the busses.


Last bit: the cameras. There's the rear camera, the side mirror camera, and if I'm not mistaken, a camera that looks forward and contributes to the ACC and LKAS functionality. I'd like to be able to tap into the feeds from any/all of them to record to a hard drive as part of a dashcam/black box system. If a passive device can listen to the video stream from the front camera/sensors, great. As long as it tapping into the stream doesn't introduce latency or otherwise burden the ACC/LKAS processing (I don't see how it would) that could theoretically work as front, rear, and side dash cams without the need to buy and mount additional hardware.


My first step will obviously be to try resending packets I capture while sniffing the network. Plug in, get the system running and logging the chatter, then roll down a window. Do that a few times to see if any packet repeats each time. Then roll the window up and manually send an identical packet from from the R-Pi. If the window rolls down, boom, we're in business. Repeat the process for other inputs to test for the same thing. I also want to look into tying it into the entertainment system. When the car is sitting in the garage it can connect to the house WiFi, so a Pi in the car could sync to a network drive and update its music files to match.

That would solve a long-standing problem with car audio that I've been trying to fix - the wife loves to skip songs she doesn't like, isn't in the mood for, or remembers having listened to in the last week. I'm the kind of person who would rather listen to a song I'm not enthusiastic about than listen to small parts of several songs as someone else fidgets with the radio. A while back I installed stereos in our other cars that take SD cards so that she could build her own playlists and stop skipping song all the damn time. Hell, I'll listen to Hanson if it means every song has a beginning, middle, and end. But then she didn't like loading all the songs herself, and would ask me to do it. So being me, I go and get every single song by whatever artist she requests, which invariably includes a few songs she doesn't like, so we're back to skipping. I tell her she can just pull the card, put it in an adapter that I put in the car for this very reason and delete the song using her phone. No dice, won't even try it. Same deal with the USB drive in the Fit - I got one with a USB A, USB C and micro USB port on it so there's no reason it can't be plugged into anything for song deletion. Still won't happen.

And don't even get me started on SiriusXM - someone starts talking and we're off on a tour of half a dozen channels looking for one that is playing music she's in the mood for.

So the theory now is that if I can set it up so the car automagically syncs the music from a network drive, and I put a link to that drive on my wife's computer desktop and tell her "put car music here" I might actually get to drive without excess frustration.

/rant.off

But yeah... mostly I want to remote-control all the things in the car.

 

There are already CAN bus kits/DIY instructions out there, easiest thing would be to jack one in and see what is/isn't on the bus

I highly doubt the bus in encrypted

Very well could be that fit windows are old school, a DPDT switch to a motor and nothing else. If that's the case, easy to add a couple of relays to do what you want

You've got way too many things in your rant to address, but if anyone has accessed the CAN bus on a fit before, I'm interested
I don't know what I would do with it, but im interested

 

Good point, I hadn't thought about relays. They'd run pretty nicely off the GPIO pins of a Raspberry Pi, or I could just use an Arduino for it. I'd probably want to look into getting spare male and female connectors for anything I wired up that way just so I can revert to bone-stock by just removing the intermediate hardware.

I'd agree that the CAN bus isn't likely to be encrypted, but I do know that some cars use a type of "signature" method to sign commands for the higher-level stuff, which is usually not on the CAN bus. You might remember the articles about how hackers were able to essentially remote drive a Jeep because there was no local security systems to ensure commands were sent by an authorized device. If the infotainment system can send steering instructions just as easily as the steering wheel or ECU, that's not a good thing (especially considering how few people understand the risks of connecting an "ordinary" USB drive).

It's been a while since I dug into vehicle bus information, but I know that modern cars usually have more than one bus because (iirc) the CAN bus doesn't have the bandwidth for all the yakking modern hardware does. It's like the joke: why do they put wheels on their cars? To keep the computer from dragging on the ground. CAN was mainly for diagnostics, quite a while ago. And naturally every manufacturer has their own protocols and proprietary stuff for how they handle everything - particularly the higher level busses.

So while I kind of hope that nothing is encrypted, I also really hope that the important stuff is. As cool as it would be to be able to mount a few sensors and teach this thing to drive itself, I wouldn't be at all upset if it's nearly impossible to do that without proprietary knowledge of how Honda does their device authentication.

 

Not sure if this helps, but here is a pic of my Fit in front of my bus. It's a 1986 Gillig Phantom...


As we are converting it into a Skoolie, the CAN on our bus will be a . Just a personal choice for us as we do not wish to carry a black water tank. Again, hope this helps...

 

Hahaha! Love it!

 

So I'm guessing there's very little interest, and even less knowledge on this?

 

I would think you would have better luck on tuner specific forums for other newer Hondas. The Fit itself is not very popular for high end tuners and tweakers. From what I have seen anyway.