Unlocking doors with CAN?

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.

kevinleaf

Well-known member
Joined
Jun 3, 2013
Messages
178
Does anyone know if it might be possible to unlock the doors by putting a message on the CAN bus? I have an idea to unlock the car over the OBD-II connector with a smartphone with a bluetooth ELM327.

Thanks!
 
Oh!
I have a cooler idea!
If you can control shifter, steering and brakes via CAN you can Build remote-controlled Leaf! Big boy RC car!
 
Yes, I have codes for Unlock All Doors and Lock All Doors.

I have not tested them to see if they work with the Leaf off. I think not.

I can fire up my iTouch test app and see what happens.

But if it does work with the Leaf off (again not very likely) I would not release them.

Don't want you unlocking my Leaf ;-)
 
It does bring up an interesting security concern but for the idea I have in mind it isn't a big issue. Let me know what you find.

Thanks!
 
I found the "skeleton key" that fits any car.

1936417-527298-old-red-brick-in-hand-isolated-on-white-background.jpg


I'm pretty sure this is the preferred one for most thieves. Why go to all the trouble to learn can codes for all these cars and then try to get inside the car to gain access to the CAN. Heck, it would probably be far easier to just capture the signal from the RFID in the key itself and build a copy of the key. Just walk close to the person with the key in their pocket and have your laptop have a little conversation with the key in their pocket such that the key thinks its talking to the car.
 
palmermd said:
I found the "skeleton key" that fits any car.

1936417-527298-old-red-brick-in-hand-isolated-on-white-background.jpg


I'm pretty sure this is the preferred one for most thieves. Why go to all the trouble to learn can codes for all these cars and then try to get inside the car to gain access to the CAN. Heck, it would probably be far easier to just capture the signal from the RFID in the key itself and build a copy of the key. Just walk close to the person with the key in their pocket and have your laptop have a little conversation with the key in their pocket such that the key thinks its talking to the car.
I am pretty sure that today that link is encrypted with a code that changes on each access. So if you capture the code it will not work a second time. You need to use one that is valid and for that you need the encryption key.
 
Turbo3 said:
palmermd said:
I am pretty sure that today that link is encrypted with a code that changes on each access. So if you capture the code it will not work a second time. You need to use one that is valid and for that you need the encryption key.


ok, well the brick will still work much faster and cheaper, and it is universal. My point was that people keep getting all worked up about securing the door locks on these cars from hackers and the concern is unwarranted since hacking these is more for fun for programming folks; not a security risk. If a thief wants your car or something in it, it can be done without technology.
 
The ECU that controls the doors does not respond to the CAN when the Leaf is off.
Well that is disappointing. Something in the car is "listening" for the unlock from the key so there must be a way but perhaps not over CAN.

I'll post my idea for this functionality in another thread.
 
Do you think it is possible to reprogram the headlights? I would like to have them (only them) ON when switching car ON...
is this possible with sending the right message to CAN ?
 
Could there perhaps be something on the EV bus or another bus? Something is listening for the key press from the key fob to open the doors, and it is probably on the CAN bus somewhere.
 
Update on this:
During the Leaf / EV Hackathon we investigated this a bit more. There is a company out there http://www.getlocalmotion.com" onclick="window.open(this.href);return false; that has a device that will remotely enable a LEAF (and other cars) to unlock and start but it hooks to more than the OBD-II port. They somehow tap into the immobilizer and probably the lock wires. Seems with OBD-II alone it won't be doable.
 
kevinleaf said:
... to unlock and start but it hooks to more than the OBD-II port. They somehow tap into the immobilizer and probably the lock wires. Seems with OBD-II alone it won't be doable.
Thank goodness and Nissan for at least a slightly secure locking system.
 
I do remote starters for a few Nissan dealers and work with 2 of the companies here in Montreal that make the canbus bypass units. Needless to say I have not put one in my Leaf but on other nissan models some (normal key) cars you can cntrol lock unlock through can but not arm disarm. On early intellikey cars (with the ignition switch) can does locks and alarm control.

On the newer PTS cars can does lock amd arm but not disarm. We need to use transponder and ignition to disarm.


Short version is unlock by can without disarm is useless.

But like I said I have not done anything on my Leaf.
 
kevinleaf said:
Update on this:
During the Leaf / EV Hackathon we investigated this a bit more. There is a company out there http://www.getlocalmotion.com" onclick="window.open(this.href);return false; that has a device that will remotely enable a LEAF (and other cars) to unlock and start but it hooks to more than the OBD-II port. They somehow tap into the immobilizer and probably the lock wires. Seems with OBD-II alone it won't be doable.


For The new nissan PTS cars when we do remote start we control almost everything with canbus and 2 wires at the PTS switch.
 
Short version is unlock by can without disarm is useless.
Not necessarily: I am willing to lock my car without arming if this is possible, so I can also unlock without disarming. In cases where I am actively charging I'd just lock my car in this remote way without setting the alarm. If possible...
 
I have a test app I put together a few weeks ago that locks and unlocks the doors through the CAN bus.

However, as has been stated above the CAN door lock function also enables the alarm. But the CAN unlock function only unlocks the doors and leaves the alarm active. So when I open the door the alarm goes off.

Another short coming is that the CAR-CAN must be active before the lock/unlock CAN messages are sent for the messages to be seen. There is a short window after the Leaf is turned off and when you plug the charge cord in when the CAN is active. So in most cases the Leaf is not in a position to even hear the command.

Having wires go to the PTS (Push to Start) button would allow you to wake up the CAN. Not sure if that disables the alarm too.
 
Interesting. So pushing the PTS button wakes up the CAN bus even if no keys are in the car? This would be interesting to experiment with.
 
kevinleaf said:
Interesting. So pushing the PTS button wakes up the CAN bus even if no keys are in the car? This would be interesting to experiment with.
Yes, one PTS push wakes up the CAR-CAN for a little over 40 seconds.

Actually, just pressing the outside door lock/unlock button also wakes up the CAR-CAN too for a short period.
 
Back
Top