WEBVTT 00:00.000 --> 00:18.480 So let's maybe start with the boring bits first, so I think thanks for coming to my talk 00:18.480 --> 00:22.440 about my office chair, obviously everyone knows that let's say with remote work now it's 00:22.440 --> 00:26.400 becoming important to be comfortable at home and so I'm glad to see that all of you guys 00:26.400 --> 00:33.360 are also interested in similar antics. So we started the boring bits, so who am I? So I'm a 00:33.360 --> 00:38.440 software engineer working for BMW CARE-T in Oom. I don't really work anywhere near 00:38.440 --> 00:44.560 car seats, obviously it's more like, I don't know, big ethernet ECUs and most of my 00:44.560 --> 00:49.200 motivation was that I wanted to understand how this can stuff was working and I mean we 00:49.200 --> 00:53.440 talk about a lot but I was never really involved so I thought okay, maybe it's time to do 00:53.440 --> 00:58.120 bit of hacking my personal time and play around. And obviously just as a detail this has 00:58.120 --> 01:02.280 nothing to do with a real attack on a vehicle, this is just basically hacking in the sense 01:02.280 --> 01:08.520 of using an object in an unconventional way. I mean we are simply just wiring up a car 01:08.520 --> 01:13.960 seat in a different non-standard way. At least I'm not aware of a particular security 01:13.960 --> 01:21.080 attack on this particular object. So what do we talk about? So a BMW comfort seat, it's 01:21.080 --> 01:27.800 like an optional extra and some big cars like 7 series X5, this kind of stuff and it's 01:27.800 --> 01:31.940 sometimes referred to as a multi-functional seat. You can tell when you have a comfort 01:31.940 --> 01:35.760 seat because the headrest is electrically adjustable which is clearly very important in 01:35.760 --> 01:41.440 your office chair. There's a different generation that's very complicated as typical with 01:41.440 --> 01:46.160 car parts but here we are talking about the G series seats which seems to first appear 01:46.160 --> 01:52.120 in the G11 which is like the big 7 series. My car seat actually comes from G05 which 01:52.120 --> 01:58.640 is an X5 but I mean you find them all over the place and I mean eBay as your friend. 01:58.640 --> 02:01.840 And it's mostly an interesting seat unit because the control logic is entirely in the 02:01.840 --> 02:06.320 seat. So basically like different manufacturers of different ways of wiring the seats but 02:06.320 --> 02:10.600 here the entire logic of the seat including the control buttons or directly in the seat. 02:10.600 --> 02:13.880 It would be even better if there were physical buttons for other things but at least 02:13.880 --> 02:18.880 the seat doesn't have this but generally it's quite good because it's also quite comfortable 02:18.880 --> 02:22.960 and quite wide. Car seats are quite narrow. I don't understand this fashion of people using 02:22.960 --> 02:27.560 like race car seats as office chairs. Very strange. I don't know what you would want this but 02:27.560 --> 02:31.360 it's still actually quite narrow. Car seats are weirdy narrow when you take the 02:31.360 --> 02:39.880 matter of car. I mean the main reason of why is that why not it's pretty cool. The seat 02:39.920 --> 02:44.480 looks kind of like this so you can see basically it's like super adjustable. We're 02:44.480 --> 02:48.040 noting there are different models when you're like going to find one or if you want it 02:48.040 --> 02:53.240 also find one. Most of the comfort seats are they're all electrically adjustable. They 02:53.240 --> 02:57.400 are all heating. Some of them have ventilation but not all of them and some of them have 02:57.400 --> 03:01.960 massaging. Essentially there's two units, talk about it later. If you have the pneumatic units 03:01.960 --> 03:06.880 then you get all the fun function. And I think there's other units with like crazy stuff 03:06.880 --> 03:09.920 from the back you can get like a screen and you can get like a foot rest. Which would 03:09.920 --> 03:12.840 be cool to have but I don't know what you would do with the foot rest behind your office 03:12.840 --> 03:17.960 chair. Could still be cool. There's like a little light by whatever. Anyways, lots of them. 03:17.960 --> 03:22.840 And obviously you like everything what color you want. So obviously the first thing to look 03:22.840 --> 03:27.320 up at the seat is how to connect it. So you find out that there's something called an X14 03:27.320 --> 03:31.800 connector which again something I didn't know but it turns out this connector has been 03:31.800 --> 03:37.440 called X14 since like 2000. It just means it'd be in W. It's a car seat front car seat 03:37.440 --> 03:43.520 connector. I think X15 or 16 is the passenger one. So the wiring differs completely between 03:43.520 --> 03:47.600 models and generations and your car seat may not look exactly like this. But at least what I 03:47.600 --> 03:52.760 worked out is that the guys are quite organized and so they've organized the pins in a nice 03:52.760 --> 03:57.560 logical order. So there are basically the two main power pins which obviously the big ones. 03:57.560 --> 04:03.000 And then a bunch of that say smaller pins which are mostly the I.O. in a bit of voltage. 04:03.000 --> 04:06.200 And the interesting ones are the slightly thicker pins at the bottom which are essentially 04:06.200 --> 04:12.160 what I call the danger zone. Now the wiring looks something like this. So basically you 04:12.160 --> 04:16.400 have a 12 volts which is used for the seat ECUs, 12 volts which is used for the heating 04:16.400 --> 04:24.280 elements. Two can buses. Which is a bit strange. But talk about that in a second. And 04:24.320 --> 04:30.440 a passenger coating pin which is interesting. Basically if this is powered the seat will behave 04:30.440 --> 04:34.720 as a passenger seat. If it's unpowered the seat will behave as a driver seat. So it doesn't 04:34.720 --> 04:38.720 actually matter which one you get. You can tell that you did it wrong because if you start 04:38.720 --> 04:42.660 touching the buttons it will go in the reverse way that you expected if you do it the 04:42.660 --> 04:48.960 wrong way around. Very strange. But this is the where it is. A little bit of safety and here 04:48.960 --> 04:55.280 I don't mean like automotive safety or ISO 262. I mean like actual safety. These seats 04:55.280 --> 05:00.720 do have explosives and number or airbags. And I mean like recent news makes you think maybe 05:00.720 --> 05:05.120 that's not a great idea. So there's basically two devices in this seat and they're quite 05:05.120 --> 05:09.760 easy to remove. The head breast basically has this thing called an active safety protection 05:09.760 --> 05:13.040 whatever. But anyways that's the one I was most worried about because I thought that's like 05:13.040 --> 05:16.760 a little bit uncomfortable if you're sitting at your desk and suddenly you're heads for 05:16.760 --> 05:21.600 S pops two centimeters or whatever. It could be a funny part of your trip. It's like 05:21.600 --> 05:25.160 a one time used device and basically you're like there's like a nice YouTube video 05:25.160 --> 05:29.680 some guy like replacing it. It's like 10 seconds. And then a bit more annoyingly there's 05:29.680 --> 05:34.160 a side airbag which I think could also be quite interesting but this will I think Rick 05:34.160 --> 05:39.440 your seat. So you probably shouldn't like remove this and yeah you just got to like rip 05:39.440 --> 05:43.520 out the back a little bit and there's like one rivet to drill out and then you can remove 05:43.520 --> 05:47.800 it. So after this your seat is mostly in it. There's also like a seat belt thing that 05:47.800 --> 05:52.720 you can remove but I think this is not problematic. Yeah and obviously you should just 05:52.720 --> 05:59.720 post it the minute safeway and not use the 12 volts to blow them up. So yeah obviously don't 05:59.720 --> 06:09.960 do this at home. It's probably dangerous. So a little bit of can basics. So I mean basically 06:09.960 --> 06:15.520 if you're in this generation or this buses use actually relatively basic can. So it's 06:15.520 --> 06:22.800 basically the really standard can of leave 2.0A and basically that's the like speed. The 06:22.800 --> 06:26.080 best is basically really short. At least the really the standard length so it's not 06:26.080 --> 06:30.520 this can extended frames. There's no like encryption or anything so you can just lift 06:30.520 --> 06:36.160 the messages and send them back. There's nothing that's a no particular security here. 06:36.160 --> 06:41.400 Yeah socket count on Linux was really well for this. I mean basically any kind of like cheap 06:41.400 --> 06:45.320 USB counter depth will do the job and you can basically get in this way or have a look 06:45.320 --> 06:51.680 of what's happening. I used a yeah this cheap like no DMC U boards or whatever because it's 06:51.680 --> 06:55.920 powered by 12 volts. So it was like kind of handy because you'll need a lot of 12 volts 06:55.920 --> 07:01.760 as we see later and then a can shield with an MCP25 on 5 or whatever but the cheap ones 07:01.760 --> 07:07.640 work as well. So to see why I get up it's like a normal canvas it's like pretty easy. 07:07.640 --> 07:10.960 You have to wire both and this I don't really understand to be honest because they're 07:10.960 --> 07:14.880 on the same bus internally so why didn't they just make them together internally don't 07:14.880 --> 07:18.880 know but you need to do both. But anyway something like this it's pretty tolerant you don't 07:18.880 --> 07:24.360 have to be like the effect or whatever. A short that would diverge in because I think it's 07:24.360 --> 07:28.240 important to understand basically how a simpler device works before we talk about let's 07:28.240 --> 07:33.520 say a more complicated device. This little ZB controllers like at least I saw this on 07:33.520 --> 07:37.600 hack news like well back people are doing like like do controlling them with like a gear 07:37.600 --> 07:42.320 stick or whatever or like with a ZB it's like actually this is really easy. So basically 07:42.320 --> 07:47.840 once you have it wired up and powered by 12 volts you can use these devices the really nice 07:47.840 --> 07:52.000 thing is that they they wake up on action. So actually they're pretty good because they're 07:52.000 --> 07:55.280 really low part when they're like powered and not used and then they wake up basically 07:55.280 --> 07:59.760 on the first button press. Sometimes it misses the first one but it's like pretty good. So you 07:59.760 --> 08:03.760 can actually use this as a really simple actuator and you can see that it's like really simple. 08:03.760 --> 08:07.840 I mean you look at the can frame you see what's happening and then you just basically guess what 08:07.840 --> 08:14.080 the actions are. So this is like my rough mapping of what this meant and it's like I have a little 08:14.080 --> 08:19.440 bit covered and rusted like basically handles this and then you can just send MGT events to your 08:19.440 --> 08:24.880 broker and then do whatever you want with it. So obviously I was like super happy of myself and put 08:24.960 --> 08:32.080 in my sofa and yeah life's good. But unfortunately the seats a little bit more complicated than this 08:32.720 --> 08:36.320 that was kind of my next thing. So basically I did this a D or I was like that's pretty cool like 08:36.320 --> 08:42.000 it's really easy let's do something fun here. So the seat is more complicated basically because 08:42.000 --> 08:48.560 it's actually multiple ECUs within basically a seat. So it's actually let's say I don't know 08:48.560 --> 08:54.240 complex board in itself compared to one ECU. So my understanding is it looks something like this 08:54.240 --> 08:59.520 I didn't take it fully apart so maybe I made some mistake but essentially after this X14 connector 08:59.520 --> 09:07.760 you have two modules you have the SNFA and the SPNN VR basically one is controlling the seat functions 09:07.760 --> 09:12.400 and the movements of the monitors and everything and the heat of elements the other one is the 09:12.400 --> 09:17.440 additional module which is controlling all of the massage functions and all the pneumatics and these are 09:17.440 --> 09:24.080 two different ECUs which switch IDs if you do this passenger coating. So that's quite interesting 09:24.560 --> 09:28.880 and as you can see from the name it's kind of funny because one is called Thaher so 09:28.880 --> 09:34.320 driver and one is called Fright which is maybe the driver or maybe not. I don't really know how 09:34.320 --> 09:41.920 this works in Japan but uh okay but I thought it was funny and also what you can see the seat buttons 09:41.920 --> 09:46.800 is actually a separate ECU that's on lid and this is actually why you might be slightly disappointed 09:46.800 --> 09:53.120 because when you plug in your seat it actually will only work for somewhere between two and five seconds 09:53.200 --> 09:58.320 and then it will power down to this lower life cycle state and go into power saving and because 09:58.320 --> 10:03.600 the link controller is an external box it doesn't actually wake up the seat so it wakes up itself 10:03.600 --> 10:08.560 but it doesn't wake up the rest of the ECUs so your seat is basically immobile which is quite sad 10:09.280 --> 10:13.920 so you need to basically do a little bit more to actually have the seat uh working at all 10:13.920 --> 10:18.080 and actually it's interesting because there's a bunch of guys on like I found like some videos 10:18.080 --> 10:22.880 or whatever on YouTube or some forums and I plug in the sim and they have it working for i5 seconds 10:22.960 --> 10:27.680 and then it stops and they seem to be using this as a chair anyway so I don't know if you're 10:27.680 --> 10:33.760 happy with this it's probably good enough here but obviously let's say for our case we want to 10:33.760 --> 10:39.920 wire it up directly so you need to basically simulate this gateway component and on the W systems 10:39.920 --> 10:45.360 this seat is connected to either the body one the body two or sometimes referred to as the K-Candles 10:45.360 --> 10:51.360 and this is just the canline that's coming from the gateway nothing more um little bit of power 10:51.440 --> 10:55.840 stuff so basically the seat uses for volts and anywhere between 9 to 16 will work 10:56.400 --> 11:01.040 it's 30 amps used in a car so it's actually like pretty high power drill back 11:01.040 --> 11:06.720 these work great uh don't bother with anything else and the motor in the heater is exclusive so 11:06.720 --> 11:10.240 you don't really have to worry too much just like 15 amps max and then it's it's you're good 11:11.600 --> 11:16.160 and obviously my great wiring with something like this when I was playing with it um yeah don't copy 11:16.240 --> 11:22.880 um so essentially let's say the pattern of figuring out what the seat does is relatively simple 11:24.160 --> 11:27.920 when the seat is powered on it starts basically sending out some messages and frames 11:28.720 --> 11:32.160 obviously you don't really know what's happening it's just like spamming the busker random stuff 11:33.440 --> 11:38.000 so it's quite hard to figure out what's happening so really what you need to do is use like 11:38.000 --> 11:44.880 all the best e-boc tool which is a car alternatively if you don't have a car there is an alternative 11:44.960 --> 11:51.200 and you get a gateway um now it's worth knowing you need one with a key otherwise it's the useless 11:51.760 --> 11:57.680 but basically once you hook up to one of these you can either figure out basically how the 11:57.680 --> 12:02.240 what messages it's being sent um and how to basically power the various canlines 12:03.440 --> 12:07.520 or you can also basically go on forums and try and figure out basically what's happening 12:08.240 --> 12:13.200 essentially the main messages that you're looking for are and must have a bit bad 12:13.840 --> 12:19.360 um basically you need to find the repeating pans so essentially there's a bunch of messages that tell you 12:20.400 --> 12:25.440 so there's zero x5 10 is basically a semi standardised can and end message that basically tells 12:25.440 --> 12:30.800 it's used to stay on so this is the technical management message um you also have to say a bunch 12:30.800 --> 12:36.320 of other say steps which seem mostly important um mostly I think there's pvf state which is 12:36.320 --> 12:42.080 parking one and faren basically you need to send this over can continuously and you need to set the 12:42.720 --> 12:48.400 at least you need to capture something which tells the car that is in the living state otherwise 12:48.400 --> 12:53.680 the car will basically not function I'm not entirely sure it's possible to see accepts different 12:53.680 --> 13:00.720 states I mean I just found a combination that worked and then was happy um and it's web noting 13:01.280 --> 13:05.520 the sea is pretty tolerant I guess there's like problems with wiring harness and all of this so 13:05.520 --> 13:09.840 actually if you capture a short trace and you just send it over and over again it will actually work 13:10.400 --> 13:14.880 you don't actually have to send a correct trace but it probably better to do so 13:17.440 --> 13:22.880 so yeah obviously it's a kind of explain so you send the messages of the frequency that you 13:22.880 --> 13:27.520 kind of spots so usually it seems to be around 500 to 100 milliseconds um for each message 13:29.280 --> 13:33.040 all of a sudden has a really nice specifications about the CRCs which you can read whether or 13:33.040 --> 13:39.840 not but basically the CRCs being used for the frame calculation are these SAEJ 1850s 13:40.880 --> 13:46.800 we have different XOR values so you need to figure out the polynomial in some of those calculations 13:46.800 --> 13:51.280 that basically have a correct CRC obviously in a trace that you capture and you send back 13:51.280 --> 13:56.080 the frames will be correct so this will work perfectly and it doesn't seem to basically 13:56.080 --> 14:01.520 they have an index which is incrementing all over and then this is like there's a CRC block at the 14:01.840 --> 14:08.320 start like this and the let's say you need to increment but it seems that if you basically 14:08.320 --> 14:11.920 have like two or three in a row that are correct the C basically accept this and keeps going and 14:11.920 --> 14:18.320 it doesn't really mind big skips um obviously it's yeah again nicer if you do it correctly the 14:18.320 --> 14:23.520 example is like the 12f message which basically says what like clamp state the car is in so 14:23.520 --> 14:27.440 this is like what power mode obviously is completely pointless because the C is always powered because 14:27.520 --> 14:33.120 you just wire it up to 12 volts but you need to send something so we never actually send a different 14:33.120 --> 14:37.440 message here but you need to basically increment the sequence and have the CRC that's kind of 14:37.440 --> 14:41.600 correct and the great thing is if you capture like a few frames then you can quickly just figure out 14:41.600 --> 14:49.360 what the XOR value is of the CRC and then insert it in this case it's yeah 044 so using a new found 14:49.360 --> 14:53.680 knowledge we can basically figure out roughly what we need to send and it's a mixture of these so 14:53.680 --> 14:58.160 basically we have like uh bit of let's say Googling and figuring out there's a lot of people 14:58.160 --> 15:02.800 with like I ran and can frames and logs that basically publish this on incidents kind of interesting 15:03.680 --> 15:08.560 that you can kind of figure out roughly what these are for and with all of this I don't even 15:08.560 --> 15:13.120 know if you need really all of them but at least this seems to work um you can basically get your 15:13.120 --> 15:18.640 seat working um the fun one is the vint at the bottom it seems the seat likes having a vint otherwise 15:18.720 --> 15:26.320 unhappy um so you should do that um the more difficult part comes from obviously you have a seat 15:26.320 --> 15:30.240 and there are functions which only work let's say from the UI right because this is a total 15:30.240 --> 15:36.320 of modern cars like from 2015 is plus so obviously there's buttons for the main physical functions 15:36.320 --> 15:41.040 but for things like the massage, the heating and the cooling um you need to send the correct frames 15:42.000 --> 15:49.280 and um this is actually like really quite simple um and I wasn't entirely sure basically 15:50.240 --> 15:56.880 what the right let's say um speed that you need to send these frames at but I kind of worked out 15:56.880 --> 16:02.560 that if you send the right message around 100 milliseconds and for heating at 50 milliseconds 16:02.560 --> 16:08.160 it will basically constantly heat um and for the massage you can figure out essentially there's like 16:08.240 --> 16:13.360 eight different massage types and four different intensities um what I'm not actually sure about 16:13.360 --> 16:20.240 is there seems to be no like stop massage function so like it's kind of strange like I think you 16:20.240 --> 16:25.520 just set the intensity to zero but it keeps like a massage type in memory um and when it starts 16:25.520 --> 16:32.400 again that's the one it picks it's really weird um and the other thing is the the message is basically 16:32.480 --> 16:38.800 different for the driver and passenger but it's the same frame ID um so and I think the rest of the 16:38.800 --> 16:44.240 frames the rest of the frame is basically used when you have like this four seat heaters so I think 16:44.240 --> 16:48.000 when you have like the rear seats which also are heating and cooling then you I think it's all part 16:48.000 --> 16:52.960 of the same frame so in one frame if you wire seats up together you can get that say heating and cooling 16:54.160 --> 16:59.280 so that's let's say yeah relatively simple you need to repeat it otherwise it basically 16:59.280 --> 17:03.600 becomes off which is a nice public safety feature um I mean you probably don't want the seat 17:03.600 --> 17:10.320 consuming like 15 amps or too long so if you stop sending the frames it stops as well um so 17:11.920 --> 17:18.160 once you put all this together it's relatively simple look something like this uh uh some people 17:18.160 --> 17:26.640 pointed out um it's not my best work but um it's fine um the um obviously I hooked it all up with basically 17:27.600 --> 17:33.200 yeah small USB 32 I don't want to show you the code but but the thing there um obviously the 17:33.200 --> 17:38.400 nice thing to do is to use like auto minim HA or something to make an MQT device and then you can 17:38.400 --> 17:44.400 have it in your home assistant and then change the settings um so that's yeah essentially how it works 17:44.400 --> 17:49.680 um the I didn't want to wire so I put a battery I mean you can wire up to 12 volts if you want 17:49.680 --> 17:54.400 but yeah just note you actually like a really powerful power supply like even 5 amps at 12 volts 17:54.480 --> 17:59.280 is not enough to get the seat moving especially if you sit on it so it might work like a tiny bit 17:59.280 --> 18:04.240 but you yeah you need probably about 10 amps to really have it moving correctly and 15 for the heating 18:04.960 --> 18:11.040 um and there's a few other things to like my seat had like a nice light at the back that I thought 18:11.040 --> 18:15.760 would be quite cool I couldn't work out how you turned this on so I thought I'll cheat and just like 18:15.760 --> 18:21.040 wire it up to 12 volts but it turns out I've broken it when dismantling it so I replaced it with 18:21.040 --> 18:28.480 an RGB strip so if you're confused how it's working it's literally a GPIO right yeah sometimes things 18:28.480 --> 18:36.720 are easy that way um so then um interestingly after I did this I found this blog post which is 18:36.720 --> 18:41.200 quite interesting from some guy who did something for the gear stick of like a series cars 18:41.200 --> 18:45.360 and uh it's interesting because he took a different approach to how to make it work which is also 18:45.440 --> 18:51.520 like fully valid so I'll point to his his blog and he basically does his control of the 18:51.520 --> 18:56.320 gear stick via diagnostic messages which basically it's a UDS diagnostic messages I've 18:56.320 --> 19:00.800 had can and I think it's a bit more difficult I don't really know why he took this approach 19:02.240 --> 19:08.000 I think he didn't manage to basically make it work with the normal approach but I actually tried 19:08.000 --> 19:14.000 this as well because of some let's say reasons and I basically it's a bit easier to find diagnostic 19:14.000 --> 19:19.920 I think messages online like uh so you can find things maybe a little bit simpler um the problem 19:19.920 --> 19:24.320 that I found with the car seat in this case is that the UDS messages are mostly for like 19:24.320 --> 19:28.960 I guess dealership and workshop technicians so you can get the seat to basically like turn on 19:28.960 --> 19:33.360 you can get it to like uh turn on the heating for example with the massage but it will only work 19:33.360 --> 19:37.440 for like a few seconds and then it will stop and if you just repeatedly spam this message the seat 19:37.440 --> 19:41.680 seems to have some kind of protection and just disables itself after a while so you can get like heating 19:41.680 --> 19:49.680 for 30 seconds and then it's gone um so that that was a bit sad um other thing that you discover 19:49.680 --> 19:55.680 basically um like there's a bunch of let's say other things on the seats so I mentioned the 19:55.680 --> 20:01.680 LED light bar but there's also things like the seatbelt presence detection sensor so there's 20:01.680 --> 20:06.720 a seatbelt sensor which is like a whole effect sensor but useless but there also should be a present 20:06.720 --> 20:11.280 sensor as far as I understand which says if someone is set in the seat or not I can't work out how 20:11.360 --> 20:17.760 this works but if someone can it could be kind of cool um yeah and there's obviously let's say 20:18.640 --> 20:22.160 versions with a display with a footrest that all the stuff I mentioned but I mean I think it's 20:22.160 --> 20:27.440 pretty pointless um yeah and then I thought I mean it's interesting so on kind of curious what other 20:27.440 --> 20:32.160 you see use we can find on a car and reuse and if you guys have some funny ideas I think we could 20:32.160 --> 20:37.520 try and make a work I think it'll be fun um and the code has linked here so I mean it 20:37.520 --> 20:42.160 honestly the code is nothing special it's random or the meaner hack it's nothing crazy but you find