Volkswagen T5 bus CAN bus hacking

These are my notes. I'm sampling the drivetrain CAN (500kbps) with a n MPC2515 and an Arduino Pro Mini.

• J623 ECU
• Cluster
• J104 ABS Control Unit (SD4 30A, SD6 30A)
• J234 Airbag Control Unit (SB13 5A)

Ignition on, vehicle not running
ID 00000050 found 128 times
ID 000001A0 found 213 times
ID 00000280 found 126 times
ID 00000288 found 147 times
ID 00000320 found 182 times
ID 00000380 found 30 times
ID 0000038A found 148 times
ID 00000390 found 46 times
ID 00000420 found 43 times
ID 00000480 found 130 times
ID 00000488 found 34 times
ID 000004A0 found 31 times
ID 00000520 found 9 times
ID 00000570 found 41 times
ID 00000580 found 6 times
ID 00000588 found 123 times
ID 000005A0 found 116 times
ID 000005D0 found 13 times
ID 000005D1 found 30 times
ID 000005D8 found 14 times
20 unique IDs in a 32.71 second sample period

Pulled SD4, SD6, SB13 -- no ABS or airbags

ID 00000010 found 1 times
ID 00000011 found 1 times
ID 00000280 found 105 times
ID 00000288 found 114 times
ID 00000320 found 187 times
ID 00000380 found 226 times
ID 0000038A found 68 times
ID 00000390 found 212 times
ID 00000420 found 124 times
ID 00000480 found 149 times
ID 00000488 found 203 times
ID 00000520 found 21 times
ID 00000570 found 113 times
ID 00000580 found 22 times
ID 00000588 found 117 times
ID 000005D0 found 41 times
ID 000005D1 found 56 times
ID 000005D8 found 48 times
18 unique IDs in a 47.21 second sample period

Replaced SB13 -- no Airbags

ID 00000010 found 1 times
ID 00000050 found 232 times
ID 00000280 found 1 times
ID 00000288 found 91 times
ID 00000320 found 186 times
ID 00000380 found 143 times
ID 0000038A found 245 times
ID 00000390 found 166 times
ID 00000420 found 102 times
ID 00000480 found 15 times
ID 00000488 found 84 times
ID 00000520 found 13 times
ID 00000570 found 89 times
ID 00000580 found 25 times
ID 00000588 found 54 times
ID 000005D0 found 31 times
ID 000005D1 found 39 times
ID 000005D8 found 35 times
18 unique IDs in a 46.36 second sample period

No 0x1A0, 0x4A0, 0x5A0. So I'm guessing 0x50 is an airbag controller message and that 0x1A0, 0x4A0 and 0x5A0 comes from the ABS. This checks out against https://github.com/v-ivanyshyn.

I am also guessing that 0x10 and 0x11 are error messages generated when the cluster (ECU?) doesn't see the airbags or ABS.