[roostere4]

Originally Posted by DamonZ28

Break your window, open the door, plug their device into your OBD port, and replicate a key on their tablet that they bought off Amazon for about $400.

The software update is supposed to make it much more difficult to replicate a key. Here's the thread, if you're just hearing about the software update for the first time.
https://www.camaro6.com/forums/showthread.php?t=632684

This is how many are stolen it appears, though technically they don't need a OBD port, just access to the CAN lines. And from some of the posts above it sounds like at least a few are not even using the port and using vampire clips to tap into these lines directly in other spots. Have to guess they developed this technique to deal with all the fake/blocked OBD ports people started using.

I am hopeful for that update to actually do something, but so far haven't seen any information that is really a silver bullet to the issue of programming keys and theft.

[ckeysvt]

For those that have done the dual OBDII… have you had any DTCs as a result? I’ve seen it happen in other vehicles where a splitter can cause issues. Not sure on the Camaro, just curious.

[SS_Don]

Originally Posted by ckeysvt

For those that have done the dual OBDII… have you had any DTCs as a result? I’ve seen it happen in other vehicles where a splitter can cause issues. Not sure on the Camaro, just curious.

I have a splitter connected to a set of Banks gauges (only 1 gets connected to the OBD II port). No issues.

[bishopts]

Here is a simple solution to CAN bus tapping. Tap it yourself.
Use a 5 pin relay that in the off position it shorts can+ to can-, it will completely kill the ability for anything to communicate on that CAN line. Have a kill switch button hidden somewhere that's out of sight but accessible so that you can power on the relay and it will disconnect the short between the wires and allow communication.
I spend a good amount of time tracing out CAN bus failures that are like this but unintentionally there.

[bishopts]

Just have to find the right CAN bus to short together that will keep key programming access locked down and wont cause a U1000 code

[2018 Blue 1LE]

Originally Posted by bishopts

Here is a simple solution to CAN bus tapping. Tap it yourself.
Use a 5 pin relay that in the off position it shorts can+ to can-, it will completely kill the ability for anything to communicate on that CAN line. Have a kill switch button hidden somewhere that's out of sight but accessible so that you can power on the relay and it will disconnect the short between the wires and allow communication.
I spend a good amount of time tracing out CAN bus failures that are like this but unintentionally there.

Got a recommendation/link for the relay?

[bishopts]

Pretty much any generic 5 pin relay.
87 is left empty
87a is can+
30 is can-
86 is switch controlled battery positive
85 is ground

Both can bus connections would be tapped into but not cut. Cut the insulation back and solder the tap wires.
The power wire needs to come from somewhere that is always hot and not coming from a module that will possibly be interrupted from the can tap.
I would probably say the passenger presence system under the passenger seat. But i dont know the circuit wiring for sure what this platform, That's where i usually attach gps trackers on cars.
I dont know if anyone has ever done a kill switch like this but theoretically it will work.
Can bus failures are hard to trace out sometimes and if you know where to tap it you can take down several modules at once.
For instance the equinox around 2014. If you unplug the power steering rack connector by the passenger side wheel. It will not start and you will have no communication to the ECM, TCM, EBCM, PSCM. I learned than one with one that came in and something in the road hit that connector and it quit running.

[Rnovrit]

Does shorting the can bus positive and negative have any long term effects on any of the modules/computer systems? I would think a direct short could potentially damage electronics at some point. I could totally be wrong as I am not an electronics guy. Just curious.

[bishopts]

Its not positive and negative even though the name kinda hints at it. Its more of a pull up and pull down system.
It operates on a 5v range but 0-1v and 4-5v are normally reserved for circuit check. So for the most part it "operates" in 1-4v range.
One wire will pull up and one wire will pull down with the starting point being 2.5v.
For simplicity sake a very very dumbed down example will be, if the circuit sees 2.7v on can+ and 1.8v on can- it could mean something like activate evap vent solenoid.
Its Doing thousands of processes like that a min.
So shorting them to each other will nullify its ability to pull up or down because each command will be sent on both wires at the same time. Kinda like trying to talk on the phone while the other person is talking too.
I see failures like this pretty regularly in cars that were in accidents and body panels have cut into the harness. Or someone modified something and didn't realize a harness was under the panel they ran a screw into.
If you know the can bus line is shorted and tried to use the car it would normally set a U1000 to all the modules on that bus and if it's an important bus it wont let it start. But as soon as the can line is able to communicate it will work pretty normally.
In this instance you wouldn't want to actively try and start it with the can bus shorted, you would want to try and remember to deactivate your trigger before trying to start. And ideally no lights or messages will ever be triggered.
If i can remember i will look up all the can bus circuits at work and see which would be the most ideal for the test. Also taking into consideration buses a thief would try and access too.

[2018 Blue 1LE]

Originally Posted by bishopts

Its not positive and negative even though the name kinda hints at it. Its more of a pull up and pull down system.
It operates on a 5v range but 0-1v and 4-5v are normally reserved for circuit check. So for the most part it "operates" in 1-4v range.
One wire will pull up and one wire will pull down with the starting point being 2.5v.
For simplicity sake a very very dumbed down example will be, if the circuit sees 2.7v on can+ and 1.8v on can- it could mean something like activate evap vent solenoid.
Its Doing thousands of processes like that a min.
So shorting them to each other will nullify its ability to pull up or down because each command will be sent on both wires at the same time. Kinda like trying to talk on the phone while the other person is talking too.
I see failures like this pretty regularly in cars that were in accidents and body panels have cut into the harness. Or someone modified something and didn't realize a harness was under the panel they ran a screw into.
If you know the can bus line is shorted and tried to use the car it would normally set a U1000 to all the modules on that bus and if it's an important bus it wont let it start. But as soon as the can line is able to communicate it will work pretty normally.
In this instance you wouldn't want to actively try and start it with the can bus shorted, you would want to try and remember to deactivate your trigger before trying to start. And ideally no lights or messages will ever be triggered.
If i can remember i will look up all the can bus circuits at work and see which would be the most ideal for the test. Also taking into consideration buses a thief would try and access too.

Thanks for the explanation!!!


If you do come up with a location, or two or three, to tap into I would be interested.


On the relay, you are activating it to open the direct short, correct?
Deenergized/not powered 87a & 30 are n/c and causes the no communication issue on the can bus, activate it an 87 & 30 are now closed(87a & 30 are now open) but with nothing on 87 the normal can bus communication now happens.


This could be another option to use the Mobilistics relay device.

[Rnovrit]

Thank you for the detailed reply. That makes perfect sense now. Assuming the correct section on the can bus is shorted, there would be no trouble codes or issues created until the vehicle attempted to be started? I assume a cleverly hidden/ disguised switch could be used as well in place of the relay. Reason I ask about the codes is I tried something similar interrupting the 5v signal though the clutch position sensor. It did not work because every time I unlocked the door and entered, the computer looked for a reference voltage immediately and threw a code before even attempting to start. No matter what, I would have to reconnect the circuit, exit the vehicle and lock it for a minute or two to let the systems die down and reset. You could not just hop in, reconnect the circuit, pres the clutch pedal and start it. I already have other "layers" of theft deterrent but wanted to add one more.

[2018 Blue 1LE]

Originally Posted by Rnovrit

Thank you for the detailed reply. That makes perfect sense now. Assuming the correct section on the can bus is shorted, there would be no trouble codes or issues created until the vehicle attempted to be started? I assume a cleverly hidden/ disguised switch could be used as well in place of the relay. Reason I ask about the codes is I tried something similar interrupting the 5v signal though the clutch position sensor. It did not work because every time I unlocked the door and entered, the computer looked for a reference voltage immediately and threw a code before even attempting to start. No matter what, I would have to reconnect the circuit, exit the vehicle and lock it for a minute or two to let the systems die down and reset. You could not just hop in, reconnect the circuit, pres the clutch pedal and start it. I already have other "layers" of theft deterrent but wanted to add one more.

I was thinking along the same lines as interrupting the clutch signal to keep the car from starting.


Not a place someone would think to look although I wondered if push starting it would still work.

[Rnovrit]

Originally Posted by 2018 Blue 1LE

I was thinking along the same lines as interrupting the clutch signal to keep the car from starting.


Not a place someone would think to look although I wondered if push starting it would still work.

I will save you the headache, it doesn't work as I would have hoped. I thought the same thing. Basically if you get in the car with the circuit broken you just get the message to push in the clutch. No matter if you reconnected the circuit before or after attempting to start, you continue to get the same message and it wont start. You get a clutch pedal sensor error code. Only way to get it to start was to reconnect the circuit, get out, lock the doors and wait a few minutes. Then you could get in and start it. Only way this would work is if you used a remote relay and you had to have the circuit connected when you unlock the car and wake up the systems. I have a complete 8 volume service manual for the car including all wiring diagrams so I did spend a bit of time combing over connectors and wires. Luckily I made this a bit of a plug and play so removing was easy.

[bishopts]

So with this theory build of a forced can bus short, i don't have a camaro to work with right now but i do have a 2016 malibu in my bay. Its here for no start and can bus failure codes. I found can bus 1 is like most GM, its a linear pair going into and out of the BCM, EBCM, PSCM, ECM, TCM. So if GM wanted to make it more fault tolerant they would connect the input and output inside and outside the modules, but they didn't so you lose the EBCM then you lose all the ones i listed going to the right from there.
That being said, i bridged the can+ to can- on this for testing. It does in fact kill the ability to communicate to any of those modules. If you try and start the car it will say shift to park and never start.
If you remove the bridge it will start up but have a check engine light.
If you bridge it and don't try and start it then, remove the bridge it will start normal and no check engine light.
If you bridge it then close and lock the doors, then unlock them and remove the bridge. (Similar to disengage the kill switch), the car will start but it will also have an engine light.

So yes in theory this can work for a kill switch but you will be dealing with an engine light. Workaround could be use hp tuners and change those codes to "no mil" and the codes will be in the system but not set a light. That way you can still use them for diagnostic reference.

This particular car has 13 can buses.