Good work!
I'm confident I have the correct command bytes from my analysis of the ACR4 requests. The conversion of data needs calculating.
Whilst I was testing, I put together a list of hex values and their displayed values on the ACR4 in my simulator code (but never got around to committing it):
// ???
{0x00, 20U},
// ECT
{0x01, 2U},
// Oil temperature
{0x02, 2U},
// IAT
// 0x0000 = -273
// 0x000A = -272
// 0x0014 = -271
// 0x0064 = -263
// 0x00C8 = -253
// 0x0AF9 = 7
// 0x0AAA = 0
{0x03, 2U},
// Fuel rail temperature
{0x05, 2U},
{0x06, 10U}, // ???
// MAP Sensor
// 0x00 = 0
// 0x0A = 0.1
// 0x14 = 0.2
// 0x3E8 = 10
// 0X2710 = 100.0
{0x07, 2U},
// Throttle position
// 0x00 = 0
// 0x0A = 0.1
// 0x14 = 0.2
// 0x64 = 1.0
// 0x1C2 = 4.5
// 0x1194 = 45.0
{0x08, 2U},
// RPM
// 0x000A = 10
// 0x0064 = 100
// 0x09C4 = 2500
{0x09, 2U},
// O2 volts bank 1
// 0x00000000 = 0.00
// 0x0000000A = 0.01
// 0x00000064 = 0.10
// 0x000000FF = 0.26
// 0x00000FA0 = 4.00
{0x0A, 4U},
// Coil 1 charge time (Is this also coil 2?)
// 0x00 = 0.00, 0.00
// 0x01 = 0.00, 0.00
// 0x0A = 0.01, 0.00
// 0x64 = 0.10, 0.00
// 0x6464 = 25.7, 0.00
// 0xFFFF = -0.00, 0.00
// 0x7FFF = 32.77, 0.00
{0x0B, 2U},
// Injector 2 pulse width (Is this also injector 4?)
{0x0C, 2U},
// Status (Throttle Switch = Bit 2)
{0x0F, 2U},
// Battery volts
// 0x00 = 0.0
// 0x0A = 0.0
// 0x64 = 0.1
// 0xC8 = 0.2
// 0x3458 = 13.4
{0x10, 2U},
// Status (CAM = Bit 2, Crank Sync = Bit 3, Also ignition switch?? and air con req?)
{0x11, 2U},
// Stepper position
// 0x00 = 0
// 0x0A = 5
// 0x14 = 10
// 0x42 = 33
{0x12, 2U},
// F/Back bank 1
{0x13, 2U},
// Error codes
// 0x00000001 = 06 M.A.P. SENSOR CIRCUIT, LOGGED, SENSOR OUTPUT VOLTAGE TOO LOW.
// 0x00000002 = 07 INLET AIR TEMPERATURE SENSOR CIRCUIT, LOGGED, SENSOR OUTPUT VOLTAGE TOO LOW.
// 0x00000004 = 08 THROTTLE POTENTIOMETER CIRCUIT, LOGGED, SENSOR OUTPUT VOLTAGE TOO LOW.
// 0x00000008 = No errors
// 0x00000010 = 09 O2 SENSOR 1 CIRCUIT, LOGGED, SENSOR OUTPUT VOLTAGE TOO LOW.
// 0x00000020 = No errors
// 0x00000040 = No errors
// 0x00000080 = 11 BATTERY VOLTAGE, LOGGED, SENSOR OUTPUT VOLTAGE TOO LOW.
// 0x00000100 = 01 E.C.M. SUPPLY, CAN BE TRIGGERED BY DISCONNECTING E.C.M, LOGGED, SENSOR OUTPUT VOLTAGE TOO LOW.
// 0x00000200 = No errors
// 0x00000400 = 02 COOLANT TEMPERATURE SENSOR CIRCUIT, LOGGED, SENSOR OUTPUT VOLTAGE TOO LOW.
// 0x00000800 = No errors
// 0x00001000 = No errors
// 0x00002000 = 05 SENSOR SUPPLY CIRCUIT, LOGGED, SENSOR OUTPUT VOLTAGE TOO LOW.
// 0x00004000 = No errors
// 0x00008000 = No errors
// 0x00010000 = No errors
// 0x00020000 = No errors
// 0x00040000 = No errors
// 0x00080000 = No errors
// 0x00100000 = No errors
// 0x00200000 = No errors
// 0x00400000 = No errors
// 0x00800000 = No errors
// 0x01000000 = No errors
// 0x02000000 = No errors
// 0x04000000 = No errors
// 0x08000000 = No errors
// 0x10000000 = No errors
// 0x20000000 = No errors
// 0x40000000 = No errors
// 0x80000000 = No errors
{0x19, 4U},
// REQRD.CAM PER (also MEASD.CAM PER?)
{0x25, 2U}
The first value is the command byte, and the second is the number of bytes returned from the ECU. Comments show the mapping of some byte values to displayed measurements.
What was the seed/key algorithm in the end?
