[{"data":1,"prerenderedAt":1041},["Reactive",2],{"kb-nav":3,"kb-doc":96},[4,10,15,20,25,30,35,40,45,50,55,60,65,70,75,81,86,91],{"_path":5,"title":6,"description":7,"part":8,"chapterNumber":9},"/knowledge-base/networks/introduction","Introduction","Overview of the communication networks used in modern vehicles, from LIN to Automotive Ethernet.","Vehicle Networks & Protocols",1,{"_path":11,"title":12,"description":13,"part":8,"chapterNumber":14},"/knowledge-base/networks/vehicle-documentation","Vehicle Documentation","Where to find manufacturer wiring diagrams, J2534 passthrough devices, and the different types of diagrams that are useful when researching a vehicle.",2,{"_path":16,"title":17,"description":18,"part":8,"chapterNumber":19},"/knowledge-base/networks/lin-bus","Local Interconnect Network (LIN)","Local Interconnect Network — a single-wire low-speed bus used as a low-cost alternative to CAN for non-critical body electronics.",3,{"_path":21,"title":22,"description":23,"part":8,"chapterNumber":24},"/knowledge-base/networks/controller-area-network","Controller Area Network (CAN)","ISO 11898 — the differential bus that became the backbone of automotive networking. Frames, bit timing, errors, CAN FD, message contents, and practical attacks.",4,{"_path":26,"title":27,"description":28,"part":8,"chapterNumber":29},"/knowledge-base/networks/flexray","FlexRay","Time-triggered, deterministic automotive bus standardized as ISO 17458, designed for higher speeds and drive-by-wire systems.",5,{"_path":31,"title":32,"description":33,"part":8,"chapterNumber":34},"/knowledge-base/networks/automotive-ethernet","Automotive Ethernet","Automotive variants of Ethernet — 100BASE-T1, 1000BASE-T1, and 10BASE-T1S — built around single twisted-pair cabling and strict EMC requirements.",6,{"_path":36,"title":37,"description":38,"part":8,"chapterNumber":39},"/knowledge-base/networks/secure-onboard-communication","Secure Onboard Communication (SecOC)","AUTOSAR's standard for cryptographic message authentication on in-vehicle networks — freshness values, MAC computation and key management.",7,{"_path":41,"title":6,"description":42,"part":43,"chapterNumber":44},"/knowledge-base/diagnostics/introduction","Overview of automotive diagnostic protocols — ISO-TP, OBD-II, UDS, CCP and XCP — and how they layer on top of CAN.","Diagnostic Protocols",8,{"_path":46,"title":47,"description":48,"part":43,"chapterNumber":49},"/knowledge-base/diagnostics/iso-tp","ISO 15765-2 (ISO-TP)","ISO 15765-2 transport layer for sending diagnostic payloads larger than 8 bytes over CAN — single, first, consecutive and flow-control frames.",9,{"_path":51,"title":52,"description":53,"part":43,"chapterNumber":54},"/knowledge-base/diagnostics/vw-tp20","VW Transport Protocol 2.0 (TP 2.0)","Volkswagen's pre-ISO-TP transport layer for KWP2000 over CAN — channel setup, parameter negotiation, and the data exchange counter scheme.",10,{"_path":56,"title":57,"description":58,"part":43,"chapterNumber":59},"/knowledge-base/diagnostics/obd-ii","On-board diagnostics (OBD-II)","On-Board Diagnostics II — the J1962 connector, signal protocols, service IDs, parameter IDs, and DTC encoding.",11,{"_path":61,"title":62,"description":63,"part":43,"chapterNumber":64},"/knowledge-base/diagnostics/uds","Unified Diagnostic Services (UDS)","ISO 14229-1 — the modern diagnostic protocol for sessions, Read/Write DID, Security Access, Routine Control and firmware Request Download / Upload.",12,{"_path":66,"title":67,"description":68,"part":43,"chapterNumber":69},"/knowledge-base/diagnostics/ccp","CAN Calibration Protocol (CCP)","A low-level debug/calibration protocol over CAN — Command Receive Object, Data Transfer Object, and the commands used to read and write ECU memory.",13,{"_path":71,"title":72,"description":73,"part":43,"chapterNumber":74},"/knowledge-base/diagnostics/xcp","Universal Measurement and Calibration Protocol (XCP)","ASAM XCP — successor to CCP supporting CAN, CAN FD, FlexRay, and Ethernet, with synchronous data acquisition, stimulation, and calibration.",14,{"_path":76,"title":77,"description":78,"part":79,"chapterNumber":80},"/knowledge-base/tools/can-adapters","CAN Adapters","USB-to-CAN adapters — comma.ai red panda and PEAK-System PCAN — and the standard DB-9 pinout for CAN.","Tools",15,{"_path":82,"title":83,"description":84,"part":79,"chapterNumber":85},"/knowledge-base/tools/can-analysis","CAN Analysis","Tools for analysing and reverse-engineering CAN traffic — comma.ai cabana, SavyCAN, VehicleSpy, and Wireshark.",16,{"_path":87,"title":88,"description":89,"part":79,"chapterNumber":90},"/knowledge-base/tools/scripting","Scripting","Python libraries and CLI tools for talking to a CAN bus — comma.ai panda, SocketCAN can-utils, python-can, and Scapy with ISO-TP and UDS examples.",17,{"_path":92,"title":93,"description":94,"part":79,"chapterNumber":95},"/knowledge-base/tools/dbc-files","DBC Files","The DBC file format used to describe the contents of CAN messages — nodes, messages, signals, comments, and value tables.",18,{"_path":66,"_dir":97,"_draft":98,"_partial":98,"_locale":99,"title":67,"description":68,"part":43,"chapterNumber":69,"body":100,"_type":1036,"_id":1037,"_source":1038,"_file":1039,"_extension":1040},"diagnostics",false,"",{"type":101,"children":102,"toc":1013},"root",[103,111,117,124,170,176,181,188,193,200,206,211,283,289,294,300,305,323,342,363,370,387,458,464,480,498,504,520,539,545,561,572,578,595,621,627,633,635,966,972],{"type":104,"tag":105,"props":106,"children":108},"element","h1",{"id":107},"can-calibration-protocol-ccp",[109],{"type":110,"value":67},"text",{"type":104,"tag":112,"props":113,"children":114},"p",{},[115],{"type":110,"value":116},"CCP is another diagnostic protocol on CAN. It's used during debugging and final tuning or calibration of an ECU. Therefore, it mostly contains commands to read and write memory on the ECU. Even though it's not supposed to be used post-production, it's sometimes left enabled on production cars, or can be enabled using UDS. CCP is therefore a very useful protocol to know about.",{"type":104,"tag":118,"props":119,"children":121},"h2",{"id":120},"history",[122],{"type":110,"value":123},"History",{"type":104,"tag":125,"props":126,"children":127},"ul",{},[128,140,150,160],{"type":104,"tag":129,"props":130,"children":131},"li",{},[132,138],{"type":104,"tag":133,"props":134,"children":135},"strong",{},[136],{"type":110,"value":137},"1992",{"type":110,"value":139}," — CCP 1.0 initial release",{"type":104,"tag":129,"props":141,"children":142},{},[143,148],{"type":104,"tag":133,"props":144,"children":145},{},[146],{"type":110,"value":147},"1995",{"type":110,"value":149}," — CCP 1.01 standardized",{"type":104,"tag":129,"props":151,"children":152},{},[153,158],{"type":104,"tag":133,"props":154,"children":155},{},[156],{"type":110,"value":157},"1996",{"type":110,"value":159}," — CCP 2.0 standardized",{"type":104,"tag":129,"props":161,"children":162},{},[163,168],{"type":104,"tag":133,"props":164,"children":165},{},[166],{"type":110,"value":167},"1999",{"type":110,"value":169}," — CCP 2.1 standardized",{"type":104,"tag":118,"props":171,"children":173},{"id":172},"protocol",[174],{"type":110,"value":175},"Protocol",{"type":104,"tag":112,"props":177,"children":178},{},[179],{"type":110,"value":180},"The CCP protocol defines two types of messages, one for each direction between the tester and the ECU. Messages from tester to ECU are called CRO (Command Receive Object). Messages from ECU to tester are called DTO (Data Transfer Object).",{"type":104,"tag":182,"props":183,"children":185},"h3",{"id":184},"command-receive-object-cro",[186],{"type":110,"value":187},"Command Receive Object (CRO)",{"type":104,"tag":112,"props":189,"children":190},{},[191],{"type":110,"value":192},"The CRO is used to send commands from the Tester to the ECU. It's an 8-byte message. The first byte is the command. The command is followed by a one-byte counter. The counter increases by one after each command and wraps after reaching 255. The counter is used to match the CRO with the DTO. The rest of the message is command-specific data.",{"type":104,"tag":194,"props":195,"children":199},"uds-packet",{":fields":196,"direction":197,"title":198},"[{\"name\":\"Command Code\",\"mnemonic\":\"CMD\",\"placeholder\":\"command\",\"description\":\"Identifies the requested command (e.g. 0x01 CONNECT, 0x03 DNLOAD).\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"placeholder\":\"counter\",\"description\":\"Increments per command, wraps at 0xFF → 0x00. The DTO echoes this value.\"},{\"name\":\"Parameters & data\",\"mnemonic\":\"DATA\",\"placeholder\":\"6 bytes, command-specific\",\"description\":\"Layout depends on the command. Unused bytes are \\\"don't care\\\".\"}]","request","CRO frame layout",[],{"type":104,"tag":182,"props":201,"children":203},{"id":202},"data-transfer-object-dto",[204],{"type":110,"value":205},"Data Transfer Object (DTO)",{"type":104,"tag":112,"props":207,"children":208},{},[209],{"type":110,"value":210},"There are three different options for the DTO. All types of DTO start with a PID indicating the type of DTO.",{"type":104,"tag":125,"props":212,"children":213},{},[214,241,258],{"type":104,"tag":129,"props":215,"children":216},{},[217,222,224,231,233,239],{"type":104,"tag":133,"props":218,"children":219},{},[220],{"type":110,"value":221},"Command Return Message",{"type":110,"value":223}," (PID = ",{"type":104,"tag":225,"props":226,"children":228},"code",{"className":227},[],[229],{"type":110,"value":230},"0xFF",{"type":110,"value":232},") — Response to a CRO from the tester. The second byte of the message is the Command Return Code, which is ",{"type":104,"tag":225,"props":234,"children":236},{"className":235},[],[237],{"type":110,"value":238},"0x0",{"type":110,"value":240}," for a successful command, or non-zero in case of an error. The rest of the message is command-specific data. The DTO is always 8 bytes in size, padded if needed.",{"type":104,"tag":129,"props":242,"children":243},{},[244,249,250,256],{"type":104,"tag":133,"props":245,"children":246},{},[247],{"type":110,"value":248},"Event Message",{"type":110,"value":223},{"type":104,"tag":225,"props":251,"children":253},{"className":252},[],[254],{"type":110,"value":255},"0xFE",{"type":110,"value":257},") — Sent based on a status change in the ECU. The second byte is the event code, and the rest of the message is event-specific data. Since the DTO is not sent as a response to a CRO, the CTR value is not defined. Always 8 bytes, padded if needed.",{"type":104,"tag":129,"props":259,"children":260},{},[261,266,268,273,275,281],{"type":104,"tag":133,"props":262,"children":263},{},[264],{"type":110,"value":265},"Data Acquisition Message",{"type":110,"value":267}," (",{"type":104,"tag":225,"props":269,"children":271},{"className":270},[],[272],{"type":110,"value":238},{"type":110,"value":274}," ≤ PID ≤ ",{"type":104,"tag":225,"props":276,"children":278},{"className":277},[],[279],{"type":110,"value":280},"0xFD",{"type":110,"value":282},") — Frame containing data as a response to a (periodic) Data Acquisition Request. The PID is used to identify the data and matches the entry in the ODT. The message can have a variable length and should not be padded.",{"type":104,"tag":194,"props":284,"children":288},{":fields":285,"direction":286,"title":287},"[{\"name\":\"Packet ID\",\"mnemonic\":\"PID\",\"placeholder\":\"0xFF / 0xFE\",\"description\":\"0xFF = Command Return. 0xFE = Event Message.\"},{\"name\":\"Return / Event code\",\"mnemonic\":\"ERR\",\"placeholder\":\"code\",\"description\":\"0x00 = acknowledge for Command Returns. Non-zero values are error or event codes.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"placeholder\":\"counter\",\"description\":\"For Command Returns, echoes the CTR from the matching CRO. Don't-care for Event Messages.\"},{\"name\":\"Parameters & data\",\"mnemonic\":\"DATA\",\"placeholder\":\"5 bytes, command-specific\",\"description\":\"Layout depends on the command or event. Always padded to 8 bytes total.\"}]","response","DTO — Command Return / Event Message",[],{"type":104,"tag":194,"props":290,"children":293},{":fields":291,"direction":286,"title":292},"[{\"name\":\"Packet ID\",\"mnemonic\":\"PID\",\"placeholder\":\"0x00 – 0xFD\",\"description\":\"Identifies the Object Descriptor Table (ODT) within the DAQ list.\"},{\"name\":\"DAQ data\",\"mnemonic\":\"DATA\",\"placeholder\":\"up to 7 bytes\",\"description\":\"Periodic data from the ECU. Variable length, not padded.\"}]","DTO — Data Acquisition Message",[],{"type":104,"tag":118,"props":295,"children":297},{"id":296},"commands",[298],{"type":110,"value":299},"Commands",{"type":104,"tag":112,"props":301,"children":302},{},[303],{"type":110,"value":304},"A few interesting commands are described below. For the full list see the CCP standard.",{"type":104,"tag":182,"props":306,"children":308},{"id":307},"_0x01-connect",[309,315,317],{"type":104,"tag":225,"props":310,"children":312},{"className":311},[],[313],{"type":110,"value":314},"0x01",{"type":110,"value":316}," — ",{"type":104,"tag":225,"props":318,"children":320},{"className":319},[],[321],{"type":110,"value":322},"CONNECT",{"type":104,"tag":112,"props":324,"children":325},{},[326,328,333,335,340],{"type":110,"value":327},"The ",{"type":104,"tag":225,"props":329,"children":331},{"className":330},[],[332],{"type":110,"value":322},{"type":110,"value":334}," command is the first step in establishing a connection with the ECU. The ",{"type":104,"tag":225,"props":336,"children":338},{"className":337},[],[339],{"type":110,"value":322},{"type":110,"value":341}," command has a single two-byte parameter (little-endian), the Station Address. By adding a Station Address to the connect step, it's possible to have multiple ECUs listen for CCP on the same Arbitration ID. The Station Address parameter might also be ignored by the ECU, in which case it will respond to any Station Address.",{"type":104,"tag":112,"props":343,"children":344},{},[345,347,353,355,361],{"type":110,"value":346},"Example of connecting to an ECU with Station Address ",{"type":104,"tag":225,"props":348,"children":350},{"className":349},[],[351],{"type":110,"value":352},"0x0040",{"type":110,"value":354},". The command counter is ",{"type":104,"tag":225,"props":356,"children":358},{"className":357},[],[359],{"type":110,"value":360},"0x00",{"type":110,"value":362},":",{"type":104,"tag":364,"props":365,"children":369},"uds-exchange",{":request":366,":response":367,"title":368},"{\"fields\":[{\"name\":\"Command Code\",\"mnemonic\":\"CMD\",\"bytes\":\"01\",\"description\":\"0x01 = CONNECT.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"00\",\"description\":\"First command in the session.\"},{\"name\":\"Station address\",\"mnemonic\":\"STA\",\"bytes\":\"40 00\",\"description\":\"Little-endian station address (0x0040).\"},{\"name\":\"Don't care\",\"mnemonic\":\"—\",\"bytes\":\"00 00 00 00\",\"description\":\"Unused. Padded to 8 bytes.\"}]}","{\"fields\":[{\"name\":\"Packet ID\",\"mnemonic\":\"PID\",\"bytes\":\"FF\",\"description\":\"0xFF = Command Return Message.\"},{\"name\":\"Return Code\",\"mnemonic\":\"ERR\",\"bytes\":\"00\",\"description\":\"0x00 = acknowledge.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"00\",\"description\":\"Echoed CTR from the CRO.\"},{\"name\":\"Don't care\",\"mnemonic\":\"—\",\"bytes\":\"00 00 00 00 00\",\"description\":\"Padded to 8 bytes.\"}]}","CONNECT — open a session with station 0x0040",[],{"type":104,"tag":182,"props":371,"children":373},{"id":372},"_0x02-set_mta",[374,380,381],{"type":104,"tag":225,"props":375,"children":377},{"className":376},[],[378],{"type":110,"value":379},"0x02",{"type":110,"value":316},{"type":104,"tag":225,"props":382,"children":384},{"className":383},[],[385],{"type":110,"value":386},"SET_MTA",{"type":104,"tag":112,"props":388,"children":389},{},[390,391,396,398,404,406,412,413,419,420,426,427,433,434,440,442,448,450,456],{"type":110,"value":327},{"type":104,"tag":225,"props":392,"children":394},{"className":393},[],[395],{"type":110,"value":386},{"type":110,"value":397}," command sets the Memory Transfer Address (MTA) pointer to a user-specified address. This data pointer is then used in subsequent commands. There are two data pointers, MTA0 and MTA1. The MTA number is specified in the CRO. MTA0 is used for ",{"type":104,"tag":225,"props":399,"children":401},{"className":400},[],[402],{"type":110,"value":403},"DNLOAD",{"type":110,"value":405},", ",{"type":104,"tag":225,"props":407,"children":409},{"className":408},[],[410],{"type":110,"value":411},"UPLOAD",{"type":110,"value":405},{"type":104,"tag":225,"props":414,"children":416},{"className":415},[],[417],{"type":110,"value":418},"DNLOAD_6",{"type":110,"value":405},{"type":104,"tag":225,"props":421,"children":423},{"className":422},[],[424],{"type":110,"value":425},"SELECT_CAL_PAGE",{"type":110,"value":405},{"type":104,"tag":225,"props":428,"children":430},{"className":429},[],[431],{"type":110,"value":432},"CLEAR_MEMORY",{"type":110,"value":405},{"type":104,"tag":225,"props":435,"children":437},{"className":436},[],[438],{"type":110,"value":439},"PROGRAM",{"type":110,"value":441},", and ",{"type":104,"tag":225,"props":443,"children":445},{"className":444},[],[446],{"type":110,"value":447},"PROGRAM_6",{"type":110,"value":449}," commands. MTA1 is used as the destination pointer for the ",{"type":104,"tag":225,"props":451,"children":453},{"className":452},[],[454],{"type":110,"value":455},"MOVE",{"type":110,"value":457}," command.",{"type":104,"tag":364,"props":459,"children":463},{":request":460,":response":461,"title":462},"{\"fields\":[{\"name\":\"Command Code\",\"mnemonic\":\"CMD\",\"bytes\":\"02\",\"description\":\"0x02 = SET_MTA.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"23\",\"description\":\"Per-command counter.\"},{\"name\":\"MTA number\",\"mnemonic\":\"MTA#\",\"bytes\":\"00\",\"description\":\"0x00 = MTA0 (used for downloads/uploads). 0x01 = MTA1 (MOVE destination).\"},{\"name\":\"Address extension\",\"mnemonic\":\"EXT\",\"bytes\":\"02\",\"description\":\"Memory device / page selector. Implementation-specific.\"},{\"name\":\"Address\",\"mnemonic\":\"ADDR\",\"bytes\":\"34 00 20 00\",\"description\":\"32-bit big-endian address. 0x34002000 here.\"}]}","{\"fields\":[{\"name\":\"Packet ID\",\"mnemonic\":\"PID\",\"bytes\":\"FF\",\"description\":\"0xFF = Command Return Message.\"},{\"name\":\"Return Code\",\"mnemonic\":\"ERR\",\"bytes\":\"00\",\"description\":\"0x00 = acknowledge.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"23\",\"description\":\"Echoed CTR.\"},{\"name\":\"Don't care\",\"mnemonic\":\"—\",\"bytes\":\"00 00 00 00 00\",\"description\":\"Padded to 8 bytes.\"}]}","SET_MTA — point MTA0 at 0x34002000 (extension 0x02)",[],{"type":104,"tag":182,"props":465,"children":467},{"id":466},"_0x03-dnload",[468,474,475],{"type":104,"tag":225,"props":469,"children":471},{"className":470},[],[472],{"type":110,"value":473},"0x03",{"type":110,"value":316},{"type":104,"tag":225,"props":476,"children":478},{"className":477},[],[479],{"type":110,"value":403},{"type":104,"tag":112,"props":481,"children":482},{},[483,484,489,491,496],{"type":110,"value":327},{"type":104,"tag":225,"props":485,"children":487},{"className":486},[],[488],{"type":110,"value":403},{"type":110,"value":490}," command is used to write data to the ECU. The data is written to the address specified by the MTA0 pointer. The length of the data is specified in the CRO. The CRO can contain up to 5 bytes of data. The MTA0 pointer is automatically increased by the amount of data written, so multiple ",{"type":104,"tag":225,"props":492,"children":494},{"className":493},[],[495],{"type":110,"value":403},{"type":110,"value":497}," commands can be issued in a row to write a large amount of data. The acknowledgment response from the ECU contains the value of the new MTA0 pointer.",{"type":104,"tag":364,"props":499,"children":503},{":request":500,":response":501,"title":502},"{\"fields\":[{\"name\":\"Command Code\",\"mnemonic\":\"CMD\",\"bytes\":\"03\",\"description\":\"0x03 = DNLOAD.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"23\",\"description\":\"Per-command counter.\"},{\"name\":\"Size\",\"mnemonic\":\"SIZE\",\"bytes\":\"05\",\"description\":\"Number of data bytes that follow (1–5).\"},{\"name\":\"Data\",\"mnemonic\":\"DATA\",\"bytes\":\"10 11 12 13 14\",\"description\":\"Up to 5 bytes to write at MTA0. MTA0 is post-incremented by `size`.\"}]}","{\"fields\":[{\"name\":\"Packet ID\",\"mnemonic\":\"PID\",\"bytes\":\"FF\",\"description\":\"0xFF = Command Return Message.\"},{\"name\":\"Return Code\",\"mnemonic\":\"ERR\",\"bytes\":\"00\",\"description\":\"0x00 = acknowledge.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"23\",\"description\":\"Echoed CTR.\"},{\"name\":\"New MTA0 ext.\",\"mnemonic\":\"EXT\",\"bytes\":\"02\",\"description\":\"MTA0 address extension after post-increment.\"},{\"name\":\"New MTA0 address\",\"mnemonic\":\"ADDR\",\"bytes\":\"34 00 20 05\",\"description\":\"MTA0 after post-increment by `size` (0x34002000 + 5).\"}]}","DNLOAD — write 5 bytes at MTA0",[],{"type":104,"tag":182,"props":505,"children":507},{"id":506},"_0x23-dnload_6",[508,514,515],{"type":104,"tag":225,"props":509,"children":511},{"className":510},[],[512],{"type":110,"value":513},"0x23",{"type":110,"value":316},{"type":104,"tag":225,"props":516,"children":518},{"className":517},[],[519],{"type":110,"value":418},{"type":104,"tag":112,"props":521,"children":522},{},[523,525,530,532,537],{"type":110,"value":524},"Using the ",{"type":104,"tag":225,"props":526,"children":528},{"className":527},[],[529],{"type":110,"value":403},{"type":110,"value":531}," command, one byte of payload is lost to the length byte. If large batches of data need to be written, the ",{"type":104,"tag":225,"props":533,"children":535},{"className":534},[],[536],{"type":110,"value":418},{"type":110,"value":538}," command can be used to download data in fixed chunks of 6 bytes.",{"type":104,"tag":364,"props":540,"children":544},{":request":541,":response":542,"title":543},"{\"fields\":[{\"name\":\"Command Code\",\"mnemonic\":\"CMD\",\"bytes\":\"23\",\"description\":\"0x23 = DNLOAD_6.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"25\",\"description\":\"Per-command counter.\"},{\"name\":\"Data\",\"mnemonic\":\"DATA\",\"bytes\":\"10 11 12 13 14 15\",\"description\":\"Always exactly 6 bytes. MTA0 is post-incremented by 6.\"}]}","{\"fields\":[{\"name\":\"Packet ID\",\"mnemonic\":\"PID\",\"bytes\":\"FF\",\"description\":\"0xFF = Command Return Message.\"},{\"name\":\"Return Code\",\"mnemonic\":\"ERR\",\"bytes\":\"00\",\"description\":\"0x00 = acknowledge.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"25\",\"description\":\"Echoed CTR.\"},{\"name\":\"New MTA0 ext.\",\"mnemonic\":\"EXT\",\"bytes\":\"02\",\"description\":\"MTA0 address extension after post-increment.\"},{\"name\":\"New MTA0 address\",\"mnemonic\":\"ADDR\",\"bytes\":\"34 00 20 06\",\"description\":\"MTA0 after post-increment by 6.\"}]}","DNLOAD_6 — write a fixed 6-byte block",[],{"type":104,"tag":182,"props":546,"children":548},{"id":547},"_0x04-upload",[549,555,556],{"type":104,"tag":225,"props":550,"children":552},{"className":551},[],[553],{"type":110,"value":554},"0x04",{"type":110,"value":316},{"type":104,"tag":225,"props":557,"children":559},{"className":558},[],[560],{"type":110,"value":411},{"type":104,"tag":112,"props":562,"children":563},{},[564,565,570],{"type":110,"value":327},{"type":104,"tag":225,"props":566,"children":568},{"className":567},[],[569],{"type":110,"value":411},{"type":110,"value":571}," command can be used to read data from the ECU. This can be useful to dump the flash or RAM contents of the ECU for reverse engineering. The ECU will reply with the requested size of data. The MTA0 pointer is incremented automatically.",{"type":104,"tag":364,"props":573,"children":577},{":request":574,":response":575,"title":576},"{\"fields\":[{\"name\":\"Command Code\",\"mnemonic\":\"CMD\",\"bytes\":\"04\",\"description\":\"0x04 = UPLOAD.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"23\",\"description\":\"Per-command counter.\"},{\"name\":\"Size\",\"mnemonic\":\"SIZE\",\"bytes\":\"04\",\"description\":\"Number of bytes to read (1–5). MTA0 is post-incremented by `size`.\"},{\"name\":\"Don't care\",\"mnemonic\":\"—\",\"bytes\":\"00 00 00 00 00\",\"description\":\"Unused.\"}]}","{\"fields\":[{\"name\":\"Packet ID\",\"mnemonic\":\"PID\",\"bytes\":\"FF\",\"description\":\"0xFF = Command Return Message.\"},{\"name\":\"Return Code\",\"mnemonic\":\"ERR\",\"bytes\":\"00\",\"description\":\"0x00 = acknowledge.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"23\",\"description\":\"Echoed CTR.\"},{\"name\":\"Data\",\"mnemonic\":\"DATA\",\"bytes\":\"10 11 12 13\",\"description\":\"Requested bytes from MTA0.\"},{\"name\":\"Don't care\",\"mnemonic\":\"—\",\"bytes\":\"00\",\"description\":\"Padded to 8 bytes.\"}]}","UPLOAD — read 4 bytes from MTA0",[],{"type":104,"tag":182,"props":579,"children":581},{"id":580},"_0x0f-short_up",[582,588,589],{"type":104,"tag":225,"props":583,"children":585},{"className":584},[],[586],{"type":110,"value":587},"0x0F",{"type":110,"value":316},{"type":104,"tag":225,"props":590,"children":592},{"className":591},[],[593],{"type":110,"value":594},"SHORT_UP",{"type":104,"tag":112,"props":596,"children":597},{},[598,600,605,607,612,614,619],{"type":110,"value":599},"While the ",{"type":104,"tag":225,"props":601,"children":603},{"className":602},[],[604],{"type":110,"value":411},{"type":110,"value":606}," command can be used to read data from the ECU, it first requires setting the MTA0 pointer using the ",{"type":104,"tag":225,"props":608,"children":610},{"className":609},[],[611],{"type":110,"value":386},{"type":110,"value":613}," command. If you only want to read data from the ECU and want to keep track of the current pointer on the tester side, the ",{"type":104,"tag":225,"props":615,"children":617},{"className":616},[],[618],{"type":110,"value":594},{"type":110,"value":620}," command can be used. This command requests up to 5 bytes from an address specified in the CRO. The MTA0 pointer is not changed by this command.",{"type":104,"tag":364,"props":622,"children":626},{":request":623,":response":624,"title":625},"{\"fields\":[{\"name\":\"Command Code\",\"mnemonic\":\"CMD\",\"bytes\":\"0F\",\"description\":\"0x0F = SHORT_UP.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"23\",\"description\":\"Per-command counter.\"},{\"name\":\"Size\",\"mnemonic\":\"SIZE\",\"bytes\":\"04\",\"description\":\"Number of bytes to read (1–5).\"},{\"name\":\"Address extension\",\"mnemonic\":\"EXT\",\"bytes\":\"00\",\"description\":\"Memory device / page selector.\"},{\"name\":\"Address\",\"mnemonic\":\"ADDR\",\"bytes\":\"12 34 56 78\",\"description\":\"32-bit big-endian source address.\"}]}","{\"fields\":[{\"name\":\"Packet ID\",\"mnemonic\":\"PID\",\"bytes\":\"FF\",\"description\":\"0xFF = Command Return Message.\"},{\"name\":\"Return Code\",\"mnemonic\":\"ERR\",\"bytes\":\"00\",\"description\":\"0x00 = acknowledge.\"},{\"name\":\"Command Counter\",\"mnemonic\":\"CTR\",\"bytes\":\"23\",\"description\":\"Echoed CTR.\"},{\"name\":\"Data\",\"mnemonic\":\"DATA\",\"bytes\":\"10 11 12 13\",\"description\":\"Requested bytes. MTA0 is unchanged.\"},{\"name\":\"Don't care\",\"mnemonic\":\"—\",\"bytes\":\"00\",\"description\":\"Padded to 8 bytes.\"}]}","SHORT_UP — read 4 bytes from 0x12345678",[],{"type":104,"tag":118,"props":628,"children":630},{"id":629},"error-codes",[631],{"type":110,"value":632},"Error Codes",{"type":110,"value":634},"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",{"type":104,"tag":636,"props":637,"children":638},"table",{},[639,658],{"type":104,"tag":640,"props":641,"children":642},"thead",{},[643],{"type":104,"tag":644,"props":645,"children":646},"tr",{},[647,653],{"type":104,"tag":648,"props":649,"children":650},"th",{},[651],{"type":110,"value":652},"Code",{"type":104,"tag":648,"props":654,"children":655},{},[656],{"type":110,"value":657},"Description",{"type":104,"tag":659,"props":660,"children":661},"tbody",{},[662,679,695,712,729,746,763,780,797,814,831,847,864,881,898,915,932,949],{"type":104,"tag":644,"props":663,"children":664},{},[665,674],{"type":104,"tag":666,"props":667,"children":668},"td",{},[669],{"type":104,"tag":225,"props":670,"children":672},{"className":671},[],[673],{"type":110,"value":360},{"type":104,"tag":666,"props":675,"children":676},{},[677],{"type":110,"value":678},"Acknowledge / no error",{"type":104,"tag":644,"props":680,"children":681},{},[682,690],{"type":104,"tag":666,"props":683,"children":684},{},[685],{"type":104,"tag":225,"props":686,"children":688},{"className":687},[],[689],{"type":110,"value":314},{"type":104,"tag":666,"props":691,"children":692},{},[693],{"type":110,"value":694},"DAQ processor overload",{"type":104,"tag":644,"props":696,"children":697},{},[698,707],{"type":104,"tag":666,"props":699,"children":700},{},[701],{"type":104,"tag":225,"props":702,"children":704},{"className":703},[],[705],{"type":110,"value":706},"0x10",{"type":104,"tag":666,"props":708,"children":709},{},[710],{"type":110,"value":711},"Command processor busy",{"type":104,"tag":644,"props":713,"children":714},{},[715,724],{"type":104,"tag":666,"props":716,"children":717},{},[718],{"type":104,"tag":225,"props":719,"children":721},{"className":720},[],[722],{"type":110,"value":723},"0x11",{"type":104,"tag":666,"props":725,"children":726},{},[727],{"type":110,"value":728},"DAQ processor busy",{"type":104,"tag":644,"props":730,"children":731},{},[732,741],{"type":104,"tag":666,"props":733,"children":734},{},[735],{"type":104,"tag":225,"props":736,"children":738},{"className":737},[],[739],{"type":110,"value":740},"0x12",{"type":104,"tag":666,"props":742,"children":743},{},[744],{"type":110,"value":745},"Internal timeout",{"type":104,"tag":644,"props":747,"children":748},{},[749,758],{"type":104,"tag":666,"props":750,"children":751},{},[752],{"type":104,"tag":225,"props":753,"children":755},{"className":754},[],[756],{"type":110,"value":757},"0x18",{"type":104,"tag":666,"props":759,"children":760},{},[761],{"type":110,"value":762},"Key request",{"type":104,"tag":644,"props":764,"children":765},{},[766,775],{"type":104,"tag":666,"props":767,"children":768},{},[769],{"type":104,"tag":225,"props":770,"children":772},{"className":771},[],[773],{"type":110,"value":774},"0x19",{"type":104,"tag":666,"props":776,"children":777},{},[778],{"type":110,"value":779},"Session status request",{"type":104,"tag":644,"props":781,"children":782},{},[783,792],{"type":104,"tag":666,"props":784,"children":785},{},[786],{"type":104,"tag":225,"props":787,"children":789},{"className":788},[],[790],{"type":110,"value":791},"0x20",{"type":104,"tag":666,"props":793,"children":794},{},[795],{"type":110,"value":796},"Cold start request",{"type":104,"tag":644,"props":798,"children":799},{},[800,809],{"type":104,"tag":666,"props":801,"children":802},{},[803],{"type":104,"tag":225,"props":804,"children":806},{"className":805},[],[807],{"type":110,"value":808},"0x21",{"type":104,"tag":666,"props":810,"children":811},{},[812],{"type":110,"value":813},"Cal. data init. request",{"type":104,"tag":644,"props":815,"children":816},{},[817,826],{"type":104,"tag":666,"props":818,"children":819},{},[820],{"type":104,"tag":225,"props":821,"children":823},{"className":822},[],[824],{"type":110,"value":825},"0x22",{"type":104,"tag":666,"props":827,"children":828},{},[829],{"type":110,"value":830},"DAQ list init. request",{"type":104,"tag":644,"props":832,"children":833},{},[834,842],{"type":104,"tag":666,"props":835,"children":836},{},[837],{"type":104,"tag":225,"props":838,"children":840},{"className":839},[],[841],{"type":110,"value":513},{"type":104,"tag":666,"props":843,"children":844},{},[845],{"type":110,"value":846},"Code update request",{"type":104,"tag":644,"props":848,"children":849},{},[850,859],{"type":104,"tag":666,"props":851,"children":852},{},[853],{"type":104,"tag":225,"props":854,"children":856},{"className":855},[],[857],{"type":110,"value":858},"0x30",{"type":104,"tag":666,"props":860,"children":861},{},[862],{"type":110,"value":863},"Unknown command",{"type":104,"tag":644,"props":865,"children":866},{},[867,876],{"type":104,"tag":666,"props":868,"children":869},{},[870],{"type":104,"tag":225,"props":871,"children":873},{"className":872},[],[874],{"type":110,"value":875},"0x31",{"type":104,"tag":666,"props":877,"children":878},{},[879],{"type":110,"value":880},"Command syntax",{"type":104,"tag":644,"props":882,"children":883},{},[884,893],{"type":104,"tag":666,"props":885,"children":886},{},[887],{"type":104,"tag":225,"props":888,"children":890},{"className":889},[],[891],{"type":110,"value":892},"0x32",{"type":104,"tag":666,"props":894,"children":895},{},[896],{"type":110,"value":897},"Parameter(s) out of range",{"type":104,"tag":644,"props":899,"children":900},{},[901,910],{"type":104,"tag":666,"props":902,"children":903},{},[904],{"type":104,"tag":225,"props":905,"children":907},{"className":906},[],[908],{"type":110,"value":909},"0x33",{"type":104,"tag":666,"props":911,"children":912},{},[913],{"type":110,"value":914},"Access denied",{"type":104,"tag":644,"props":916,"children":917},{},[918,927],{"type":104,"tag":666,"props":919,"children":920},{},[921],{"type":104,"tag":225,"props":922,"children":924},{"className":923},[],[925],{"type":110,"value":926},"0x34",{"type":104,"tag":666,"props":928,"children":929},{},[930],{"type":110,"value":931},"Overload",{"type":104,"tag":644,"props":933,"children":934},{},[935,944],{"type":104,"tag":666,"props":936,"children":937},{},[938],{"type":104,"tag":225,"props":939,"children":941},{"className":940},[],[942],{"type":110,"value":943},"0x35",{"type":104,"tag":666,"props":945,"children":946},{},[947],{"type":110,"value":948},"Access locked",{"type":104,"tag":644,"props":950,"children":951},{},[952,961],{"type":104,"tag":666,"props":953,"children":954},{},[955],{"type":104,"tag":225,"props":956,"children":958},{"className":957},[],[959],{"type":110,"value":960},"0x36",{"type":104,"tag":666,"props":962,"children":963},{},[964],{"type":110,"value":965},"Resource / function not available",{"type":104,"tag":118,"props":967,"children":969},{"id":968},"scanning-for-ccp",[970],{"type":110,"value":971},"Scanning for CCP",{"type":104,"tag":112,"props":973,"children":974},{},[975,976,981,983,989,991,997,999,1004,1005,1011],{"type":110,"value":327},{"type":104,"tag":225,"props":977,"children":979},{"className":978},[],[980],{"type":110,"value":322},{"type":110,"value":982}," command is a great way to scan for ECUs that accept CCP connections. You have to iterate over all possible Arbitration IDs and Station Addresses, which is quite a large space to search. However, most of the time the Arbitration ID will be between ",{"type":104,"tag":225,"props":984,"children":986},{"className":985},[],[987],{"type":110,"value":988},"0x600",{"type":110,"value":990}," and ",{"type":104,"tag":225,"props":992,"children":994},{"className":993},[],[995],{"type":110,"value":996},"0x7FF",{"type":110,"value":998},", and the Station Address will be between ",{"type":104,"tag":225,"props":1000,"children":1002},{"className":1001},[],[1003],{"type":110,"value":238},{"type":110,"value":990},{"type":104,"tag":225,"props":1006,"children":1008},{"className":1007},[],[1009],{"type":110,"value":1010},"0x40",{"type":110,"value":1012},". Sometimes the Station Address is ignored by the ECU.",{"title":99,"searchDepth":14,"depth":14,"links":1014},[1015,1016,1020,1034,1035],{"id":120,"depth":14,"text":123},{"id":172,"depth":14,"text":175,"children":1017},[1018,1019],{"id":184,"depth":19,"text":187},{"id":202,"depth":19,"text":205},{"id":296,"depth":14,"text":299,"children":1021},[1022,1024,1026,1028,1030,1032],{"id":307,"depth":19,"text":1023},"0x01 — CONNECT",{"id":372,"depth":19,"text":1025},"0x02 — SET_MTA",{"id":466,"depth":19,"text":1027},"0x03 — DNLOAD",{"id":506,"depth":19,"text":1029},"0x23 — DNLOAD_6",{"id":547,"depth":19,"text":1031},"0x04 — UPLOAD",{"id":580,"depth":19,"text":1033},"0x0F — SHORT_UP",{"id":629,"depth":14,"text":632},{"id":968,"depth":14,"text":971},"markdown","content:7.knowledge-base:2.diagnostics:7.ccp.md","content","7.knowledge-base/2.diagnostics/7.ccp.md","md",1778093002010]