OBDII Wi-Fi Hacking
There are plenty of these OBDII WiFi modules advertised for sale on eBay. I’ve recently bought a RenaultSport Clio which has an OBDII port, so I picked up one to experiment with.
This little gadget plugs into the OBDII port in the Clio (which is hidden behind a removable panel just below the ignition card key slot). It creates an ad-hoc WiFi network and listens on a TCP port for client connections.
The chip that does all the hard work of connecting to the car’s onboard computer(s) is an ELM327-compatible, which means it speaks a simple ASCII protocol. Control messages are sent to the chip using old-school AT commands (like old-school modems), and OBD comms use simple hex strings.
Here’s a quick example:
> ATZ ELM327 v1.4 0100 41 00 9E 3E B8 11 0120 41 20 80 00 00 00 0105 41 05 48
ATZ command resets the interface chip (and displays its ID). The rest of
the commands all request data from the ECU using OBD mode 1.
0120 enumerate the OBD PIDS supported by my car. The data
returned is a header (
41 00 /
41 20) followed by the actual data as a
bit-encoded set of flags.
0105 queries the ECU for the current engine temperature (which, in this case,
returns a temperature of 32°C).
I’m going to carry on hacking with this module, and I’m hoping to build a natty little iOS telemetry app to use with it. Stay tuned for further blog posts as I learn more!