Actually I have some automotive evidence that government mandated Right to Repair is not likely to work in the average user's favor. Better than what we have but not what we want.

nostr:nevent1qvzqqqqqqypzqqm9x092su3hd9rdfe8aafxp5pzpak3cegkem9qhhvmqqm96406cqythwumn8ghj7un9d3shjtnwdaehgu3wvfskuep0qythwumn8ghj7un9d3shjtnswf5k6ctv9ehx2ap0qqs8gp0yvy4pmhm9z5whmyd8q8n68stmgdppt663ruyp6clgacksexqwn5lwd

How it started:

In 1996 the US government required auto manufacturers to use the open, OBD II communications protocol so users (or average repair shops) could diagnose and repair their vehicles easier with computers become more sophisticated and black-box. It was mostly for emissions control and "saftey" purposes, but it still allowed the average user to go to their nearest auto-parts store and purchase a $20 tool that told them what was wrong with their car when a check-engine light appeared.

The majority of my hands on experience is with 1994-2003 Ford 7.3L diesel pickup trucks, however it expands across most light duty domestic brands. Ive done repair on many newer vehicles and some newer Asian brands as well.

How it's going:

OBD II only requires a very small set of reports and values which the manufacturer is not required to publicly release lookup codes for outside of the well-known versions and can even vary their multiplers so the data reads wrong anyway. OEMs aren't required to expose any additional coms protocols or extra features of the firmware/hardware. So they keep all of that locked behind custom protocols or mfg-known memory addresses and conversion values, and you STILL need special/expensive equipment to access usable data, where OBD II basically just tells you "hey there's a problem" which the bloody light on the dash already did.

Why:

Beyond that OEMs employ their own communications protocols for THEIR tools which they hide behind complicated dealer networks and high priced commercial subscription fees or vin-locked credit systems after a multi $1000 purchase of "validated coms equipment"

Generally "generic" off-the-shelf OBD II readers will leave you in a worse place throwing parts at your car instead of just taking it to a shop with more expensive tools.

Why are more expensive tools better? Well companies like Opus, Drewtech (another fun story if you want to hear my talk about it) and other hacker-founded companies spend time reverse engineering the proprietary communications protocols which cost metric ass-loads of R&D, ask me how I know, we couldn't afford it. Sometimes they use techniques offered by the processors like Direct Memory access to fetch values from SRAM or registers. Which then requires reverse engineering the ROM to make sense of the values pulled back.

You can see how this works using devices like STC sell, and off-the-shelf products like ScanGauge which you can manually configure it to fetch memory values then convert them on the fly to human-readable values. It's all a huge guessing game because its not uncommon for the memory map to change slightly or a multiplier be changed because were working with real-time processors, so every instruction and optimization counts. It's rare to see massive changes but its common to see SOME values change between firmware updates which occur ALL the time. So when you write firmware for these devices you usually need to create a profile for EVERY firmware identifier. (also legally required to publish firmware revision numbers btw)

For Ford diesel pickups I came across something like 500 (off the production line) revisions of ROMs. Nearly every truck drives slightly different, and for a while they were STILL modifying the firmware.

Reply to this note

Please Login to reply.

Discussion

why the fuck is DMA enabled on a diagnostics port

Well you have to ask for it, read-only. It's a firmware feature. Its called Data Memory Read I believe, DMR was the acronym. You can ask the processor to fetch values from running memory once or twice per second. I think most CAN systems will only allow 4 DMR per second but I could be outdated on that.

Only the processor can write to memory and in my experience there are no routines to write to RAM. There are routines to overwrite ROM in special conditions, flashing obviously. We sold devices that attached to the bus directly which had the ability to do whatever you wanted :)

The deeper I look into automotive it feels like piles and piles of bloat that no one understands

Welcome to automotive! How can we piss you off today?

The existence of it is enough.

I became aware of the automotive hellhole primarily because the SE company I work with is primarily focused on automotive and industrial systems. They do have a bunch of automotive focused SE's of course, I think some of their demos included measuring passenger motion with UWB (what's the benefit?!), their low-latency end-to-end encryption stuff, and I don't remember the rest.

Tell me if it feels like they couldn't seem to care any less about consumer rights like this, Im not judging, the motivation just isn't there. I assume there is a high focus on convenience, but the red-tape surrounding repair and consumer education/information is just an expense no one wants to deal with.

They make semiconductors and therefore couldn't care if it happened or not

Ah.

But still yeah, when I ask for 01000h it reads me whatever was stored in the register address 01000h. On my roms, this address is usually start of the SRAM register file for the static data segment. Anything above that address is reserved or used for cpu working memory although there isn't much of that. Generally there is enough register file to use every register for a dedicated purpose XD