Peugeot gear selector hacking

[AMP3R]

Hello! I'm trying to hack this gear selector from PSA group cars. The hardware I'm using is an arduino + mcp2515 can board.

Gear selector always sends these ID's. The only thing I've discovered for now is illumination.

I have a couple of thoughts:

- The message 4FE looks encouraging because it only has one constantly changing byte (maybe counter or checksum, although it looks to change semi-randomly which makes me think checksum).

- This gear selector needs one reply ID from gearbox or BSI module and I want to discover it.

So what can you say about all of this? Maybe someone could capture CAN log from modern peugeot 3008/5008? Thanks in advance.

[johu]

Once you have hacked it you can add your findings here: https://openinverter.org/wiki/Peugeot_Gear_Lever

Thanks!

[AMP3R]

I've found ID 0x349, which activates gear lever and illuminates "P" symbol. It has 8 bytes, byte6 is a double counter.

When I'm sending a message from ID 0x349 every 20ms, byte1 of the ID 0x4FE is updating from E1 to 01.
While pressing the parking button and pushing the selector forward and backward, byte2 is changing from 08 to 18. That's all. Nothing is changing anymore. There is no response from pressing "M" and "Unlock" buttons.

There is a lot of work to be done

[AMP3R]

Some progress here. I have found almost all states of that gear lever. Image is playable.

For example to set a "Drive" you need to send this message every 30 ms.
ID 0x349 03 55 00 13 00 00 F4 20
ID 0x349 03 55 00 13 00 00 E5 20
ID 0x349 03 55 00 13 00 00 D6 20
ID 0x349 03 55 00 13 00 00 C7 20
ID 0x349 03 55 00 13 00 00 B8 20
ID 0x349 03 55 00 13 00 00 A9 20
ID 0x349 03 55 00 13 00 00 9A 20
ID 0x349 03 55 00 13 00 00 8B 20
ID 0x349 03 55 00 13 00 00 7C 20
ID 0x349 03 55 00 13 00 00 6D 20
ID 0x349 03 55 00 13 00 00 5E 20
ID 0x349 03 55 00 13 00 00 4F 20
ID 0x349 03 55 00 13 00 00 30 20
ID 0x349 03 55 00 13 00 00 21 20
ID 0x349 03 55 00 13 00 00 12 20
ID 0x349 03 55 00 13 00 00 03 20

The last thing what need to be found is how to unlock the "unlock" button.

[EV_Builder]

Best is to make a DBC file with the correct fields.

[AMP3R]

Finally, this gear selector works properly. The code is adapted to work with M3/Y rear drive units with firmware versions from 2022 and emulates Tesla's right stalk. In principle, it can be easily modified for older versions.

In plans to realize activating cruise control by pulling the handle towards when you in Drive, as well as switching between CHILL and STANDARD modes using the M button.