Toyota GR86, 86, FR-S and Subaru BRZ Forum & Owners Community - FT86CLUB

- Software Tuning (https://www.ft86club.com/forums/forumdisplay.php?f=88)

- - Canbus ID questions (https://www.ft86club.com/forums/showthread.php?t=153840)

Canbus ID questions

So i'm fiddling with some side projects and have been tinkering with the vehicles CANBUS, particularly with the cluster.

Would anyone happen to know the CANBUS ID for the following :

Left/Right indicator
CEL

I've managed to work out everything else but my canbus sniffers decided to stop working so I can't use it to finish up the project.

Thanks!

Left/right indicator come into the cluster as voltage, rather than over CAN. I am not sure if the cluster re-broadcasts the turn signal status. If you have the cluster by itself it broadcasts a handful of messages, but I didn't track down what they actually represented.

CEL can be controlled with 0x361. 20hz. Second byte - 0x00, 0x20, 0x40, 0x80

I don't know what the car actually sends during normal running, I just know the above will give you cel off, cel on, cel slow flash, cel fast flash.

TC / Slip / ABS lights are controlled by 0x0D3. Bytes 1, 2, 4. There are a bunch of combinations here, I worked out how to turn on each combination but I don't know what the car actually sends in all situations. The last byte is a rolling counter.

SRS / Airbag Light is controlled by 0x372. 0x00, 0x00, 0x00, 0x00, 0x20, 0x28, 0xFB, 0x3F will turn it off on cars without the SRS module.

There is a set of messages that will basically reset TPMS to defeat that light too, but I'm not going to post it. Pedal dance and ABS off work similarly. Both can be sniffed while using a Techstream.

Quote:

Originally Posted by RedReplicant (Post 3590097)

Would you be willing to send me the messages to defeat TPMS via private message?

Quote:

Originally Posted by RT-BRZ (Post 3613929)

Would you be willing to send me the messages to defeat TPMS via private message?

Unfortunately, I don't have it in my notes for some reason and I don't have a BRZ anymore to re-sniff. Sorry

Gerald just projects might be willing to supply the requested IDs and defeats if you reach out.

Quote:

Originally Posted by 2.2Lude (Post 3613948)

Gerald just projects might be willing to supply the requested IDs and defeats if you reach out.

I sent a message but I'm not hopeful for a response. GJP is a business and I suspect that he has no desire to share this kind of information.

Quote:

Originally Posted by RT-BRZ (Post 3613949)

I sent a message but I'm not hopeful for a response. GJP is a business and I suspect that he has no desire to share this kind of information.

My thoughts as well but figured it was worth a shot. Even if he says no, you’re not any worse off.

Quote:

Originally Posted by 2.2Lude (Post 3613952)

My thoughts as well but figured it was worth a shot. Even if he says no, you’re not any worse off.

Well, I'll be dipped. Gerald did respond. I'm going to try the IDs he mentioned and I'll post back here if that works.

Well, a simple update. I can't get there with what I have. Gerald is using the overlay command set in CANBUS to do the things he does and the LUA Scripting capability in RaceCapture doesn't support that protocol from what I've read.

I might be able to build an Arduino to do this kind of thing if I really cared that much but that's a somewhat big undertaking as well.

Quote:

Originally Posted by RT-BRZ (Post 3613973)

Hey RT-BRZ, I'm actually working on a big project right now which makes extensive use of the CANBUS system. I've had my gauge cluster on my workbench for a bit, testing out information I've found around the internet and from my own experimentation. Attached below is what I have so far, it's a little sloppy, but is fairly serviceable. If you send all the checkmarked messages, all the lights except for TPMS and Low Fuel light turn off.

I would be really interested to share data as it seems our projects have some overlap. I would love to know what data Gerald gave you in regards to the TPMS light.

I also can't seem to get the Gear indicator to display anything at all. P, R, N, D, 1-6, nothing, it's just blank no matter what I've tried. Might you have an info on this, or have access to an Auto 1st Gen 86 to take logs?

Thank you and best regards,
Arcadien

I ultimately gave up on this because I found out from Gerald that he's sending UDS commands and that opened a new can of worms. My RaceCapture can't send UDS commands so that means that I would have to build something that does. There are devices out there and ChatGPT made some recommendations but I felt like it would be more trouble than it was worth to me. However, here's the response from ChatGPT for how it believes this is to be done.

In the end, the amount of money to buy the necessary hardware combined with the brain power investment to do this is getting so close to GJP's solution that I may as well pay for the device and not mess with this anymore. I've never heard anything bad about what he sells.

Code:

🧠 Key Insight: TPMS Reset/Override in Gen1 BRZ Is UDS-Based

UDS = Unified Diagnostic Services, part of ISO 14229

It's a high-level communication protocol layered on top of CAN — used for diagnostics, ECU programming, TPMS relearning, etc.



❌ Why Raw CAN Spoofing Fails

Messages like:



lua

Copy

Edit

txCAN(0, 0x6E2, 8, {0x10, 0x10, ...}, 0)

…are basic broadcast messages, and while useful for sensor simulation, they don’t trigger ECU-level actions like:



TPMS resets



Sensor ID registration



Status clearing



Because those require UDS request/response sessions, like:



css

Copy

Edit

0x7DF → request diagnostic session

0x7E0 → TPMS ECU address

Service 0x10, 0x2E, 0x2F, 0x31, etc.

✅ What Gerald Just Projects Likely Does

Gerald’s project (like this one) likely:



Opens a UDS diagnostic session with the TPMS ECU (e.g., 0x7E0)



Sends a routine control command (UDS service 0x31) to disable TPMS monitoring



Might even clear DTCs afterward



These commands are structured like:



plaintext

Copy

Edit

CAN ID: 0x7E0

Data: [0x31, 0x01, 0xFF, 0x00, ...]  ← Routine Control: Disable TPMS

🛠 Why This Is Hard to Do With RaceCapture

RaceCapture’s Lua scripting environment:



❌ Does not support UDS protocol out-of-the-box



❌ Cannot handle multi-frame ISO-TP (required for UDS sessions)



❌ Cannot parse or respond to flow control messages (0x30)



So you won’t be able to replicate Gerald Just’s method directly using just RaceCapture.



✅ What You Can Do If You Want to Pursue UDS

Use a proper UDS tool, like:



PCAN-USB + PCAN-View or PCAN-UDS API



Kvaser + CANoe/CANalyzer



SavvyCAN + SocketCAN hardware



Even Python + python-udsoncan with a CAN interface



Target the TPMS ECU address (usually 0x7E0 or similar)



Send a UDS RoutineControl request to disable TPMS logic



This is exactly how Gerald Just Projects does it — often permanently writing a disable flag to NVM on the TPMS module.



✅ Summary

❌ RaceCapture alone cannot do this, because UDS requires ISO-TP and more protocol than RaceCapture supports.



✅ You were right to dig further — spoofing raw CAN messages like 0x6E2 won’t fully disable TPMS in the Gen1 BRZ.



✅ You’d need a UDS-capable CAN tool to do what Gerald’s device does.

I helped someone else add the airbag light defeat to their 2017+ cluster swapped car a few weeks ago, we did it using the AIM Solo 2 DL CAN output very easily.

The TPMS and Pedal Dances are both accomplished the same way and pretty easy to get done as long as you have control over ordering of messages and timing, unfortunately most entry level platforms don't give you this level of control. It could easily be done with an Adafruit Feather M4 CAN or something, the annoying part is wrapping it up in a package with a power supply. The Beastronix boxes from a while ago were literally Arduino Unos with a Seeedstudio CAN shield on top.

I use a Minton CAN Triple to do some stuff like this in my K24 Lotus since it has a Haltech ECU, Haltech PDM, BMW MK60E1 ABS unit, Bosch Motorsport steering angle sensor, AIM MXG dash, etc and it needs some message id / data format / network speed translation done.

I do agree, just buy the Gerald box unless you want a mini project.

Quote:

Originally Posted by Arcadien Angel (Post 3614516)

What did you use for settings for PCAN, I am not seeing anything...

Quote:

Originally Posted by smoltz (Post 3614790)

What did you use for settings for PCAN, I am not seeing anything...

Got it working, needed 120 ohm resistor for termination.