LeoDJ<p>I spent many dozens of hours losing track of time in <a href="https://chaos.social/tags/Ghidra" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ghidra</span></a> (I swear, it's worse than <a href="https://chaos.social/tags/Factorio" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Factorio</span></a>)</p><p>Until I had figured out the <a href="https://chaos.social/tags/CAN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CAN</span></a> message handling, signal parsing and where and when which <a href="https://chaos.social/tags/DTC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DTC</span></a> codes get set.<br>With that knowledge I could figure out, slowly but surely, what the <a href="https://chaos.social/tags/startergenerator" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>startergenerator</span></a> needs to run.<br>Even <a href="https://chaos.social/tags/FBS4" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FBS4</span></a> was pretty trivial to circumvent (a single 1 written to the right memory location via <a href="https://chaos.social/tags/XCP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>XCP</span></a>)</p><p>And after implementing the ~25 CAN messages in my STM32 code I finally got this today:</p>