Disable the TPMS in JEEP JK 2010

[OBDRipper]

For a while now ive been messing around with my Jeep's CAN-BUS and OBD2 port.
Ive been trying to find a way to disable the TPMS (Tyre pressure monitoring system) on my Jeep JK 2010
I changed bigger tyres , Bigger than the rims can handle but never kept the TPMS sensors.

I couldn't find away, So I took the plunge and bought a well know OBD2 programmer device that can do it and, and now ive become totally & beyond obsessed!!!!!
I have to be able to do it!, I just have to!

This is what i have done so far to intercept the data.
I'm using a CAN-BUS + Arduino Shield made by SeeedStudio. I modified the OBD2 Programmer Device and attached the CAN-H from the Arduino Shield to OBD pin 6 and CAN-L to OBD Pin 14
and using Pin 16 and 4 for power (Pin16 = Positive 12V and Pin 4 = Negative)
I programmed the Arduino to deliver all messages found line by line separating each bit with a "," to the Arduino's Serial Monitor.
So when connecting to it from my laptop using Putty it dumps all text to screen so that i'm able to save it.

When connecting the setup to the OBD2 port the programmer starts to send messages to disable the TPMS, and returns about 50 messages, of which most of them are responses from the Jeep and the others are messages being sent to the Jeep.
When connecting the programmer to the Jeep after it programmed it, it honks the hooter twice.

I ran the disable the TPMS twice and saved the log using putty via serial.
When comparing the 2 there are a few differences,

I also ran it a 3rd time but i let the programmer set the TPMS to 22 PSI before the "Flat Tyre" indicator comes on.
Comparing the data to one another there are quite a few commonalities.



all of the below data is in number format and should be converted to HEX, But if you convert each bit in between the ","s to ASCII the first few responses are the
VIN number of my Jeep.

I analyzed the data and used some common logic to figure out which comes from the Jeep and which comes from the programmer,
I then used all of the messages which i think comes from the frogrammer and fed it back into the Jeep!

Something worked because instead of the Jeep honking twice, the hooter when crazy by giving one long hoot and i couldn't stop it, i had to shut ot off by taking the key out and only after a few seconds it Stopped.
For a moment i went a bit pale

Dont know if the below helps anyone, bu here is the data.

Fisrt Run

Code: Select all

Enter setting mode success
set rate success!!
Enter Normal Mode Success!!
CAN BUS Shield init ok!
<1536,2,26,136,0,0,0,0,0,>
<1280,16,19,90,136,49,74,52,66,>
<1536,48,0,0,0,0,0,0,0,>
<1280,33,69,54,68,49,52,65,76,>
<1280,34,50,48,54,48,52,52,0,>
<1568,2,33,10,0,0,0,0,0,>
<1284,16,18,97,10,240,2,17,2,>
<1568,48,0,0,0,0,0,0,0,>
<1284,33,10,4,0,3,0,0,34,>
<1284,34,0,0,0,2,3,15,0,>
<1568,2,33,176,0,0,0,0,0,>
<1284,16,20,97,176,2,0,0,0,>
<1568,48,0,0,0,0,0,0,0,>
<1284,33,0,0,0,0,71,194,236,>
<1284,34,0,225,0,255,255,15,0,>
<1568,2,33,178,0,0,0,0,0,>
<1284,16,11,97,178,0,0,0,0,>
<1284,33,0,0,0,0,0,194,236,>
<1568,2,33,18,0,0,0,0,0,>
<2015,2,62,2,0,70,84,87,33,>
<1568,2,16,146,0,0,0,0,0,>
<1284,2,80,146,250,1,192,4,216,>
<1568,2,33,11,0,0,0,0,0,>
<1568,48,0,0,0,0,0,0,0,>
<1284,33,1,2,3,0,255,156,128,>
<1284,34,30,147,97,11,14,0,133,>
<2015,2,62,2,0,70,84,87,33,>
<1568,48,0,0,0,0,0,0,0,>
<1568,2,16,146,0,0,0,0,0,>
<1284,2,80,146,97,11,14,0,133,>
<1696,2,16,146,0,0,0,0,0,>
<1300,2,80,146,7,0,0,0,0,>
<1568,4,48,173,7,1,0,0,0,>
<1284,3,112,173,7,11,14,0,133,>
<1696,4,48,64,7,1,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1568,4,48,173,7,0,0,0,0,>
<1284,3,112,173,7,11,14,0,133,>
<1696,4,48,64,7,0,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1568,4,48,173,7,1,0,0,0,>
<1284,3,112,173,7,11,14,0,133,>
<1696,4,48,64,7,1,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1568,4,48,173,7,0,0,0,0,>
<1284,3,112,173,7,11,14,0,133,>
<1696,4,48,64,7,0,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1924,2,17,130,0,0,0,0,0,>
<1536,2,17,130,0,0,0,0,0,>
<1280,3,127,17,18,48,52,52,0,>
<1925,3,127,17,128,0,0,0,0,>

Second Run

Code: Select all

Enter setting mode success
set rate success!!
Enter Normal Mode Success!!
CAN BUS Shield init ok!
<1536,2,26,136,0,0,0,0,0,>
<1280,16,19,90,136,49,74,52,66,>
<1536,48,0,0,0,0,0,0,0,>
<1280,33,69,54,68,49,52,65,76,>
<1280,34,50,48,54,48,52,52,0,>
<1568,2,33,10,0,0,0,0,0,>
<1284,16,18,97,10,240,2,17,2,>
<1568,48,0,0,0,0,0,0,0,>
<1284,33,10,4,0,3,0,0,34,>
<1284,34,0,0,0,2,3,0,0,>
<1568,2,33,176,0,0,0,0,0,>
<1284,16,20,97,176,2,0,0,0,>
<1568,48,0,0,0,0,0,0,0,>
<1284,33,0,0,0,0,68,194,234,>
<1284,34,0,225,0,255,255,15,0,>
<1568,2,33,178,0,0,0,0,0,>
<1568,48,0,0,0,0,0,0,0,>
<1284,33,0,0,0,0,0,194,234,>
<1568,2,33,18,0,0,0,0,0,>
<2015,2,62,2,0,70,84,87,33,>
<1568,2,16,146,0,0,0,0,0,>
<1284,2,80,146,250,1,192,4,215,>
<1568,2,33,11,0,0,0,0,0,>
<1568,48,0,0,0,0,0,0,0,>
<1284,33,1,2,3,0,255,156,128,>
<1284,34,30,147,97,11,14,0,133,>
<2015,2,62,2,0,70,84,87,33,>
<1284,16,11,97,178,0,0,0,0,>
<1568,2,16,146,0,0,0,0,0,>
<1284,2,80,146,97,11,14,0,133,>
<1696,2,16,146,0,0,0,0,0,>
<1300,2,80,146,7,0,0,0,0,>
<1568,4,48,173,7,1,0,0,0,>
<1284,3,112,173,7,11,14,0,133,>
<1696,4,48,64,7,1,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1568,4,48,173,7,0,0,0,0,>
<1284,3,112,173,7,11,14,0,133,>
<1696,4,48,64,7,0,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1568,4,48,173,7,1,0,0,0,>
<1284,3,112,173,7,11,14,0,133,>
<1696,4,48,64,7,1,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1568,4,48,173,7,0,0,0,0,>
<1284,3,112,173,7,11,14,0,133,>
<1696,4,48,64,7,0,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1924,2,17,130,0,0,0,0,0,>
<1536,2,17,130,0,0,0,0,0,>
<1280,3,127,17,18,48,52,52,0,>
<1925,3,127,17,128,0,0,0,0,>

& the 3rd run is not to disable to the TPMS but set the threshold to 22 PSI

Code: Select all

Enter setting mode success
set rate success!!
Enter Normal Mode Success!!
CAN BUS Shield init ok!
<1536,2,26,136,0,0,0,0,0,>
<1280,16,19,90,136,49,74,52,66,>
<1536,48,0,0,0,0,0,0,0,>
<1280,33,69,54,68,49,52,65,76,>
<1280,34,50,48,54,48,52,52,0,>
<1568,2,33,10,0,0,0,0,0,>
<1284,16,18,97,10,240,2,17,2,>
<1568,48,0,0,0,0,0,0,0,>
<1284,33,10,4,0,3,0,0,34,>
<1284,34,0,0,0,2,3,15,0,>
<1568,2,33,176,0,0,0,0,0,>
<1284,16,20,97,176,2,0,0,0,>
<1568,48,0,0,0,0,0,0,0,>
<1284,33,0,0,0,0,65,194,234,>
<1284,34,0,225,0,255,255,15,0,>
<1568,2,33,178,0,0,0,0,0,>
<1284,16,11,97,178,0,0,0,0,>
<1284,33,0,0,0,0,0,194,234,>
<1568,2,33,18,0,0,0,0,0,>
<1284,7,97,18,250,1,192,4,215,>
<2015,2,62,2,0,70,84,87,33,>
<1568,2,16,146,0,0,0,0,0,>
<1284,2,80,146,250,1,192,4,215,>
<1568,48,0,0,0,0,0,0,0,>
<1284,33,1,2,3,0,255,156,128,>
<1284,34,30,147,97,11,14,0,133,>
<1568,34,30,147,0,0,0,0,0,>
<1284,2,123,11,255,255,255,255,255,>
<1568,48,0,0,0,0,0,0,0,>
<28,2,62,2,0,0,65,69,86,>
<2015,2,62,2,0,70,84,87,33,>
<1536,2,16,146,0,0,0,0,0,>
<1536,2,33,80,0,0,0,0,0,>
<1280,7,97,80,28,28,0,0,5,>
<1536,7,59,80,28,28,22,22,5,>
<1280,2,80,146,54,48,52,52,0,>
<1280,2,123,80,28,28,0,0,5,>
<28,2,62,2,0,0,65,69,86,>
<2015,2,62,2,0,70,84,87,33,>
<1568,2,16,146,0,0,0,0,0,>
<1284,2,80,146,255,255,255,255,255,>
<1696,2,16,146,0,0,0,0,0,>
<1300,2,80,146,0,0,0,0,0,>
<1568,4,48,173,7,1,0,0,0,>
<1284,3,112,173,7,255,255,255,255,>
<1300,3,112,64,7,0,0,0,0,>
<1696,4,48,64,7,1,0,0,0,>
<1568,4,48,173,7,0,0,0,0,>
<1284,3,112,173,7,255,255,255,255,>
<1696,4,48,64,7,0,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1568,4,48,173,7,1,0,0,0,>
<1284,3,112,173,7,255,255,255,255,>
<1696,4,48,64,7,1,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1568,4,48,173,7,0,0,0,0,>
<1284,3,112,173,7,255,255,255,255,>
<1696,4,48,64,7,0,0,0,0,>
<1300,3,112,64,7,0,0,0,0,>
<1924,2,17,130,0,0,0,0,0,>
<1536,2,17,130,0,0,0,0,0,>
<1280,3,127,17,18,28,0,0,5,>
<1925,3,127,17,128,0,0,0,0,>

[nr0x]

Man I would love to play with a programmer like that one of these days.

I had a thought. This may or may not be plausible, and I may or may not be a complete moron...

What if we could split incoming and outgoing traffic on the obd port. What if you could connect to 2 wires that would only show the outgoing traffic? I'm thinking a diode matrix. I have no idea if it would work, but if it does, it would maybe help you dig a little deeper.

So the programmer isn't working right to disable the tpms? Or did I read that wrong?

[OBDRipper]

Sorry my post was a bit long .

No, The programmer works perfectly fine. It can disable the TPMS, Recalibrate tyre sizes, up the Revs to generate more power for a winch and a whole lot more.
So even though i now have a device that can do it for me, I still want to be able to program the Jeep using my own hardware, Dont ask me why, just because

So i intercepted the programmer's data going back and forth, But not knowing exactly which messages comes from the Jeep and which comes from the programmer.
I picked the ones i think should go into the Jeep, But i obviously skipped a few messages, causing minor havoc with the hooter

But the data posted in the first post is all the communication between the programmer and the Jeep.

Regarding your idea with the diode, The Jeep, Programmer and Arduino+CAN Bus shield (interceptor) all gets connected in parallel.
The programmer retrieves information and then decides which message to respond with so, you definitely need 2 way communication.

But to intercept the data I see where you are coming from with the diode idea, how ever if you put a diode it will basically cut either of the lines off, so you might aswell just
connect one wire either CAN-H or CAN-L as far as i understand either one two TX and RX, But its programmed to only listen and not sending data.

But i think the main issue is because its in parallel.

[nr0x]

Ok, I did a piss-poor job of explaining my diode idea. let me see if I can do it on mine, and if it works I will show you what I mean.

[nr0x]

Oh, and "just because" is probably an acceptable answer in these parts. I'm gearing up for a project to interface a picaxe chip with the interior and lin busses. Arduino is kind of Greek to me. Is that what you're going to use?

[biper4x4]

Do you have any other logs for other functions? Change wheel size, transmission adaptation? We are now working on Android app that should be able to Enable/Disable TPMS

[poop713]

Dude I just posted about this on this other thread I'm on but check out "UDSIM" "caringcaribu" & "UDS-server"
Those will help you with scan tools.