I ultimately gave up on this because I found out from Gerald that he's sending UDS commands and that opened a new can of worms. My RaceCapture can't send UDS commands so that means that I would have to build something that does. There are devices out there and ChatGPT made some recommendations but I felt like it would be more trouble than it was worth to me. However, here's the response from ChatGPT for how it believes this is to be done.
In the end, the amount of money to buy the necessary hardware combined with the brain power investment to do this is getting so close to GJP's solution that I may as well pay for the device and not mess with this anymore. I've never heard anything bad about what he sells.
Code:
🧠 Key Insight: TPMS Reset/Override in Gen1 BRZ Is UDS-Based
UDS = Unified Diagnostic Services, part of ISO 14229
It's a high-level communication protocol layered on top of CAN — used for diagnostics, ECU programming, TPMS relearning, etc.
❌ Why Raw CAN Spoofing Fails
Messages like:
lua
Copy
Edit
txCAN(0, 0x6E2, 8, {0x10, 0x10, ...}, 0)
…are basic broadcast messages, and while useful for sensor simulation, they don’t trigger ECU-level actions like:
TPMS resets
Sensor ID registration
Status clearing
Because those require UDS request/response sessions, like:
css
Copy
Edit
0x7DF → request diagnostic session
0x7E0 → TPMS ECU address
Service 0x10, 0x2E, 0x2F, 0x31, etc.
✅ What Gerald Just Projects Likely Does
Gerald’s project (like this one) likely:
Opens a UDS diagnostic session with the TPMS ECU (e.g., 0x7E0)
Sends a routine control command (UDS service 0x31) to disable TPMS monitoring
Might even clear DTCs afterward
These commands are structured like:
plaintext
Copy
Edit
CAN ID: 0x7E0
Data: [0x31, 0x01, 0xFF, 0x00, ...] ← Routine Control: Disable TPMS
🛠 Why This Is Hard to Do With RaceCapture
RaceCapture’s Lua scripting environment:
❌ Does not support UDS protocol out-of-the-box
❌ Cannot handle multi-frame ISO-TP (required for UDS sessions)
❌ Cannot parse or respond to flow control messages (0x30)
So you won’t be able to replicate Gerald Just’s method directly using just RaceCapture.
✅ What You Can Do If You Want to Pursue UDS
Use a proper UDS tool, like:
PCAN-USB + PCAN-View or PCAN-UDS API
Kvaser + CANoe/CANalyzer
SavvyCAN + SocketCAN hardware
Even Python + python-udsoncan with a CAN interface
Target the TPMS ECU address (usually 0x7E0 or similar)
Send a UDS RoutineControl request to disable TPMS logic
This is exactly how Gerald Just Projects does it — often permanently writing a disable flag to NVM on the TPMS module.
✅ Summary
❌ RaceCapture alone cannot do this, because UDS requires ISO-TP and more protocol than RaceCapture supports.
✅ You were right to dig further — spoofing raw CAN messages like 0x6E2 won’t fully disable TPMS in the Gen1 BRZ.
✅ You’d need a UDS-capable CAN tool to do what Gerald’s device does.