CAN Sniffing For Steering Wheel Button Presses

You can make those buttons on your steering wheel much more functional if you have a way of monitoring them. Don’t even think of cracking open the factory finish to get to the solder points, just tap into the CAN bus and monitor the data traffic.

The small board seen above is the result of a project [Peter Shabino] calls the CAN sniffer. The connector on the left will plug into the Control Area Network system on your car, giving the chips on board something to do. There’s an MCP2551 CAN transceiver (hidden under that linear regulator) and an SPI controlled MCP2515 CAN controller which take care of the particulars of the CAN protocol. The big chip in the middle is a PIC 16F876, responsible for making sense out of the data. From there a MAX232 chip is used to provide a serial interface to connect the device to a computer.

This really isn’t tied down to one particular function. Once you have access to the bus for a microcontroller you’ll only be limited by your firmware writing skills. [Peter] has posted an archive with all of the open source files, as well as an illustrated step-by-step board assembly. We’ve embedded the schematic from that archive after the break.

32 thoughts on “CAN Sniffing For Steering Wheel Button Presses

    1. I’ve been going through the archives — so this might not get to you. But! I imagine that the car radio watches the buttons in the same way, after all, you should be able to switch radios out if you buy a new one. You might have to pry it out and unplug the connector.

  1. There are ready to go solutions for that purpuse available: for instance an Atmel STK600 has a CAN-transceiver on-board (no need to use those lame Microcheap products).

    However, I wouldn’t dare to do more than packet sniffing on an automotive bus. It may get nasty if you mess arround with brake systems etc

  2. Or just buy one of the OTS interface boxes for the stock steering control buttons. Those have been available for a decade now.

    crutchfield.com for more info.

    Also you scardey cat whimps thinking you will disable brakes or deploy air bags dont know anything at all about canbus and automotive electronics.

    I suggest you LEARN ABOUT IT before being scared little girls. There is this secret thing called the internet that has all that info out there. you have to use the secret Google to search it.

    h3po: yes…. remove the stock stereo and it will not interpet the keypresses.

  3. @ donov4n

    there are plenty of pics with can transceivers

    there is really no reason to insult a home made solution and point out how they should be using some over priced, over sized development board

  4. @dcroy – show me one PIC with a built in CAN transceiver.

    There are plenty of PICs with built in CAN controllers. But built in transceiver? I have never seen such a beast. Heck – I’ve never seen an MCU with a built in CAN transceiver.

    I truly wish they existed.

  5. I have a separate button that controls the on/off for my cruise control. I wonder if I could use my cruise control lever with this thing while the main switch is “off”… Any thoughts? Will this pick up on all sorts of button presses in the car?

  6. So if you sniff a packet of data, say when you press the door lock button, are you able to transmit that same packet back in from the uC used? Or is the OBDII port read only?

  7. @ donov4n

    yeah, your STK6000 is a 200$ dev board to program Atmel chip.

    Also, you can not control the primary function of your car by sniffing CAN packets! There is two separate CAN networks, they are separate by a electric firewall.

  8. Not all manufacturers use CAN to control button presses on the steering wheel controls of late model vehicles. The ones I know that do use CAN extensively are most German makes VW/Audi/Porsche/Mercedes and Dodge/Chrysler (which still raids the Mercedes electronics bins for their new vehicles). Later model GMs don’t exactly use a CAN network. Theirs is either an 11 bit or 29 bit system which they started using around 2000 or so. Japanese and Korean makes simply use differing resistance values or voltage values to distinguish button functions to the factory radio. How do I know this? 13 years doing car audio and security and being that guy that “figures sh#t out” armed only with bosch relays, 1 amp diodes, and a multi-meter. Also using some good deductive reasoning with SW control information from pac-audio.com. I’ll still see about putting this CAN sniffer together since I know where I can tag the can signals in most car and it would be great just to see what I can do with that info.

  9. Messing with the CAN bus can be fatal, every commercial product for CAN intercept and decoding sourcing will warn you not to use in a moving vehicle. Make sure you have defined the CAN based protocols for your application. J1939 is common but allows for proprietary code. The entire bus can be used for every thing from RPM’s to throttle position. As a hardware developer for the auto industry, I have a plethora of stories about development vehicles gone haywire. So proceed with caution.

  10. @flapjack: Fatal schmatal, caution to the wind, devil-may-care research. Ain’t nobody’s business if you do.

    I’m sick of all the risk-adversity, especially when it comes to automotive data busses. Oh, the DMCA. Oh, the brakes. Oh, the airbags. Use your head, by all means, but go explore. Whatever happened to, “if you can’t open it, you don’t own it?”

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.