CAN sniffing for steering wheel button presses

You can make those buttons on your steering wheel much more functional if you have a way of monitoring them. Don’t even think of cracking open the factory finish to get to the solder points, just tap into the CAN bus and monitor the data traffic.

The small board seen above is the result of a project [Peter Shabino] calls the CAN sniffer. The connector on the left will plug into the Control Area Network¬†system on your car, giving the chips on board something to do. There’s an MCP2551 CAN transceiver (hidden under that linear regulator) and an SPI controlled MCP2515 CAN controller which take care of the particulars of the CAN protocol. The big chip in the middle is a PIC 16F876, responsible for making sense out of the data. From there a MAX232 chip is used to provide a serial interface to connect the device to a computer.

This really isn’t tied down to one particular function. Once you have access to the bus for a microcontroller you’ll only be limited by your firmware writing skills. [Peter] has posted an archive with all of the open source files, as well as an illustrated step-by-step board assembly. We’ve embedded the schematic from that archive after the break.

30 thoughts on “CAN sniffing for steering wheel button presses

  1. is there a way to then prevent the other car electronics (the stereo at least) to interpret these button presses?

    1. I’ve been going through the archives — so this might not get to you. But! I imagine that the car radio watches the buttons in the same way, after all, you should be able to switch radios out if you buy a new one. You might have to pry it out and unplug the connector.

  2. AFAIK a CAN bus is not something universal to every car, the way OBDII is right? Where is the connector located inside the car?

  3. There are ready to go solutions for that purpuse available: for instance an Atmel STK600 has a CAN-transceiver on-board (no need to use those lame Microcheap products).

    However, I wouldn’t dare to do more than packet sniffing on an automotive bus. It may get nasty if you mess arround with brake systems etc

  4. Or just buy one of the OTS interface boxes for the stock steering control buttons. Those have been available for a decade now.

    crutchfield.com for more info.

    Also you scardey cat whimps thinking you will disable brakes or deploy air bags dont know anything at all about canbus and automotive electronics.

    I suggest you LEARN ABOUT IT before being scared little girls. There is this secret thing called the internet that has all that info out there. you have to use the secret Google to search it.

    h3po: yes…. remove the stock stereo and it will not interpet the keypresses.

  5. @ donov4n

    there are plenty of pics with can transceivers

    there is really no reason to insult a home made solution and point out how they should be using some over priced, over sized development board

  6. @dcroy – show me one PIC with a built in CAN transceiver.

    There are plenty of PICs with built in CAN controllers. But built in transceiver? I have never seen such a beast. Heck – I’ve never seen an MCU with a built in CAN transceiver.

    I truly wish they existed.

  7. I have a separate button that controls the on/off for my cruise control. I wonder if I could use my cruise control lever with this thing while the main switch is “off”… Any thoughts? Will this pick up on all sorts of button presses in the car?

  8. The CAN bus that connects to the steering wheel is not the same bus that is available via the OBD connector, there is a CAN gateway in between.

    1. yes but the OBDII is connected to the gateway, which hides most of the communication and gives you access only to limited portion of the communication prepared for diagnostics

  9. So if you sniff a packet of data, say when you press the door lock button, are you able to transmit that same packet back in from the uC used? Or is the OBDII port read only?

  10. @ donov4n

    yeah, your STK6000 is a 200$ dev board to program Atmel chip.

    Also, you can not control the primary function of your car by sniffing CAN packets! There is two separate CAN networks, they are separate by a electric firewall.

  11. Not all manufacturers use CAN to control button presses on the steering wheel controls of late model vehicles. The ones I know that do use CAN extensively are most German makes VW/Audi/Porsche/Mercedes and Dodge/Chrysler (which still raids the Mercedes electronics bins for their new vehicles). Later model GMs don’t exactly use a CAN network. Theirs is either an 11 bit or 29 bit system which they started using around 2000 or so. Japanese and Korean makes simply use differing resistance values or voltage values to distinguish button functions to the factory radio. How do I know this? 13 years doing car audio and security and being that guy that “figures sh#t out” armed only with bosch relays, 1 amp diodes, and a multi-meter. Also using some good deductive reasoning with SW control information from pac-audio.com. I’ll still see about putting this CAN sniffer together since I know where I can tag the can signals in most car and it would be great just to see what I can do with that info.

  12. Messing with the CAN bus can be fatal, every commercial product for CAN intercept and decoding sourcing will warn you not to use in a moving vehicle. Make sure you have defined the CAN based protocols for your application. J1939 is common but allows for proprietary code. The entire bus can be used for every thing from RPM’s to throttle position. As a hardware developer for the auto industry, I have a plethora of stories about development vehicles gone haywire. So proceed with caution.

  13. @flapjack: Fatal schmatal, caution to the wind, devil-may-care research. Ain’t nobody’s business if you do.

    I’m sick of all the risk-adversity, especially when it comes to automotive data busses. Oh, the DMCA. Oh, the brakes. Oh, the airbags. Use your head, by all means, but go explore. Whatever happened to, “if you can’t open it, you don’t own it?”

  14. hello
    i am doing the same project..just clear me one thing how i compose message in standard data frame..i am very much confuse in it..

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s