Using an OBD2 Breakout to Sniff, Re-route, and More

It can be remarkably difficult to get in the middle of a vehicle and an OBD2 device, with the typical solution being to flay apart 2-3 OBD2 cables in order to build a rats-nest of wires that allow you access to every signal line and allow you to re-route any signal to any pin. Unfortunately they are also hard to reconfigure, and look like a robot threw up his spaghetti dinner on your workbench.

Macchina is developing an OBD2 breakout board (as of this writing it is yet untitled), which dramatically cleans up the connections while making it extremely fast and easy to route signals in any way you see fit. Want to sniff bus traffic? Get in the middle! Want to develop OBD2 devices without running to your car every five minutes? Plug in the optional power adapter and work where you want to (like inside where it is warm). Want to re-route CAN1 down to CAN0? Easy! This board is a real Swiss Army knife of functionality, and we look forward to seeing what users do with it.

Here is a quick introduction of the hardware features:

Components

The OBD2 test board has several components as shown below:

INPUT OBD2 Connector: 1 input OBD2 connector (MALE pins). This connector would plug into an OBD2 extension cable and eventually into a car's OBD2 port.

OUTPUT OBD2 Connectors: 2 output connectors. (FEMALE pins). These connectors are the same as found in any modern car.

12V Input power source: Use in external 12V power adapter when doing desktop OBD2 development. If OBD2 extension cable is used, you'll get power from the car and won't need the external power source.

Power jumpers: Control power to each output by installing Jumpers. GREEN LED confirms power is ON.

Junction blocks: Route OBD2 signals to the connectors as needed. All signals are broken out and available. More about Junction block functionality below.

CAN termination resistors: 2 sets of termination resistors are available. These are typically used when using an emulator.

Junction blocks

The junction blocks near both OUTPUT OBD2 connector gives you the flexibility to change how signals move between connectors. Install a jumper wire between rows to make "through" connections, or jump over to other pins to rearrange signals.

Warning - be careful when rearranging signals between OBD2 connectors.

Not all pins have same voltage levels.

The row closest to the OBD2 connector goes directly to the connector. The row farthest from the OBD2 connector goes directly to the INPUT OBD2 connector.

Note: Ground is already connected between the 3 OBD2 connects, but also available on junction blocks for convenience.

Step 1: Example Modes of Operation

The OBD2 test board can function in several "modes" by rearranging how the signals route throughout the board. For example:

1. Sniffer:

This mode allows you to use external test equipment to watch traffic. In the example below, the CAN0 channel is being "Sniffed".

2. Man in the middle:

Put an OBD2 device (i.e. M2) in between the host and another OBD2 device (i.e. OEM scanner, etc). This mode gets its name from the computer security term.

Learn more here: Man-in-the-middle attack

In our case, if we wanted to intercept, change or better understand a CAN conversation, we'd use the connections shown below. The CAN traffic to and from "Scanner" would need to go though our device (shown in the middle as "man" below).

3. Emulator:

Connect 2 OBD2 dongles together for desktop development purposes. Typically, one of the devices would be set up to be an Emulator and the other a scanner, etc. In many cases, you'd need to ensure the CAN bus is terminated as shown below

4. Other:

The OBD2 test board has several modes and many configurations - all of which can be made using standard jumper wires. For example, breakout or splitter modes are easy to do with the OBD2 test board.