is it well made? well it works but your mileage may vary

Your description was very close to how it works, Many cars store the mileage in more than one location, this particular module is setup for a mercedes to stop the dashboard getting an updated mileage from another ecu in the vehicle, not necessarily the engine ecu, it could be from the ABS, LCM or even SAM modules(other places store it too but these are the main ones). Many modules have access to the vehicles mileage so that when a fault occurs they can log the fault code, time, date, mileage, etc in the fault log. The car this was removed from probably had the mileage "corrected/cheated" to a lower value before it was sold and this module was to stop the dashboard getting the updated mileage when the key was switched on, the module filters out the data containing the mileage from other ecu's but it cannot correct the data to show 40,000 km less, that had to be reprogrammed into the dashboard itself. A genuine use for these is if you have some modules damaged by water/voltage surge/take your pick and need to replace them with 2nd hand units, if they came from a vehicle with higher mileage than the one your repairing then you would use a module like this to stop the dashboard loading the higher mileage into its memory, the dash will automatically increase the mileage value but wont lower it if you change the module back(BMW cars do this also). Using the vehicles reg to do an online MOT check will usually show issues if the mileage has been tampered with. We work on vehicle electrics here daily and have many problems with canbus systems, mainly due to condensation on the connectors & pcb's, it takes very little damp to bridge the can data wires to power wires and raise the canbus voltage above operating limits, but as the can network covers the whole vehicle it can take a long time to trace where the fault is, eg. landrover immobiliser & engine communications faults are regularly caused at the rear of the vehicle in the electric parking brake pcb, Mercedes canbus problems often are with damp underneath the drivers feet mat or in the boot beside the spare wheel. Its very interesting work but it causes some headaches and makes a weekly pub visit almost essential. P.S. Removing this module most likely didn't do anything to fix the cars warning lights unless the module itself was faulty.

"The more they over think the plumbing, the easier it is to stop up the drain." Montgomery Scott.

I wonder if an increase mileage version exists for those who claim mileage against their tax.

Very interesting. I install remote starters in vehicles and these types of circuits that peel out a signal or useful control for the vehicle are referred to as 't-harnesses'. When I use a t-harness its typically to give me the information I need in order to control the car and running it down to a plug that interfaces with my remote start brain. This is the first Ive seen of something like this, very interesting, thanks for sharing. Edit: also on the pcb itself, S4 would be for an audi W22 and w166 are mercedez bens chassis codes

I think we need a part 2 where you see if the program can be read.

Clive, you really need to read this chip and see what the secret sauce is!

That really restores my faith in buying second hand cars!

The "W" numbers are the Mercedes model numbers.

I used to have a very similar device about 12 years back, they can be used for many things, not just illegal ones. Have you seen the feature on cars to program in two sets of seat/mirror/etc settings for two drivers? Before that was standard, I made my own with a device like this. It intercepted dash controls to watch for a trigger. If I had the accessory on but engine off, pulled forward on the high beam lever twice, I could then hit turn signal up or down, each being a different seat, mirror, ac/heat, etc profile to change to. I suspect that's why the build quality is so high. Whomever programmed it for its illegal function probably just sourced the hardware elsewhere, programmed it for this task, and resold it labeled for this purpose.

For sale: E36 BMW, runs great, cold AC, good tires, lots of extras. LOW MILEAGE! $10k. No lowballers, I kno wut I have!

I fitted one of these kinds of devices some years back for a friend with an imported Subaru Legacy B4 Blitzen. In this case it wasn’t specifically an attempt reduce the mileage but circumvent the speed limiter which came in at around 112 mph. When fitted it converted the speedo so that the km/h section of the dial then became the mph reading.

Here in the states when I was a young child, my father worked as an auto mechanic and I remember him bringing home the “analog” ancestor of such a device he found installed in-line with a cars Speedometer drive cable. About the size of a D cell with a couple on each end. It contained a set of planetary gears that would down-covert the cars speed measurement from “Miles per Hour” to Kilometers per Hour." So if you were going 60 MPH for one hour the Speedometer would only indicate a little over 35 MPH, and likewise, the Odometer would only increment 35 miles, not the 60 miles traveled! What is more by that time most American vehicles had speedometer's that indicated both MPH and kM/h so the driver could just use the kM/h scale to accurately know their true speed in MPH.

With Clive's accent I kept hearing him say "Cannabis" and for a minute my brain kept getting confused...

In South Africa we call that giving the car a haircut

CANbus in vehicles (Beyond the engine and transmission) started with the power windows. Vehicle manufacturers had reached a point around 2000 in shaving weight where all the low hanging fruit was gone. They were shaving weight because of the MPG requirements of the EPA and other regulatory agencies around the world. At some point, I believe it was Chrysler... an engineer said in a meeting, what about the power window system? At the time a power window system had wires looping from door switch to door switch all over the vehicle, wired basically like 3 way switches in a house. This system had well over 200 pounds of wiring, JUST to control the windows!!! Easch door had a thick bundle of wires going into it just to control raising and lowering the windows, since all doors were connected through the main panel on the driver's door. This engineer realized he could reduce the wiring in each door to 12 volt power and ground, and two thin communication CAN wires looping around to each component of the window system within the door - a total of 4 wires passing into the door.... So instead of 12 volts in a heavy wire going from the drivers door to the passenger motor to drive it. The drivers door switch module puts commands on the CANbus to tell the passenger door to roll down. (on some vehicles the modules talk directly, on others it must go through the ECM). Thus, vehicle wide CAN control was quickly adopted throughout the vehicle, on some vehicles to include things as basic as brake lights and turn signals.... All, in the interest of losing weight in the wiring harness for fuel economy as well cost savings reasons. By doing this, they reduced the over 2 miles of wire required in a late 1990's vehicle to less than half that by 2008. But I digress... as for this little gem... No bit banging... with proper construction of the circuit and hardware to meet CANbus communication standards... Well done !!!! except for, wow that's LOW.....

as a professional mechanic & electrical enthusiast this was very interesting. a good example of why I subscribed; all the random electronics you find and show.

This is what it says on the back - a CAN gateway. Messages received on one CAN interface will be blocked or re-transmitted on the other, and vice-versa. (Here odometer messages going in the direction of the instrument cluster will have their payload doctored to represent a lower value before being sent on.) These sort of things are used legitimately by vehicle manufacturers, usually to filter what messages can be read from the diagnostics port and especially to filter what messages can be sent from the diagnostics port onto the vehicle bus - which could be very dangerous. I really like this little board - whoever made it has done a neat job!

The dominant "0" implements an ID priority system. When 2 devices write at the same time, the smaller ID will override the other one. This is sensed by each device and when it recognizes a difference between sent and read data, it stops and lets the other one continue.

16:33 Maybe you can. Mercedes writes any changes on the can-bus to a log every 10 miles. I remember it because one victim of airbag/radio theft decided to drive his car to a shop and practically strip the interior before reporting it. The shop then saw that the seats, radio, dash etc etc were disconnected after the car had been driven and pieced one and eleven together: insurance fraud.

This is a classic "Man-in-the-middle Attack"

The dominant state in CAN bus is a 0, so the lower node or message ID gets higher priority, so message or node 0 has the biggest priority and will 'win' any collision if two nodes start transmitting at the same time. Technically the dominant state could be a 1, but the the highest priority ID would depend on implemented specification (CAN 2.0A vs CAN 2.0B).

Those prints just continue to impress me every time.

I remember a case where a used car dealer was brought up on charges for "rolling back" a speedometer..(that is how the law was written)..in the days when cars used mechanical speedometers. At the trial, they had him cold with all their evidence. But he threw them for a loop. He rolled the speedometer "forward" until it 99,999 miles and then it all went to 000,000 and then he went a bit further and shaved off 40k. He walked and they had to reword the law.

The W166 refers to the 3rd generation of Mercedes M-class, W222 are the short wheel based saloons in the s-class. S-4 might be for the Audi S-4

That's fascinating that the mileage suddenly changed when it was removed. That means the ECU is accumulating the mileage and storing it locally in a non-volatile flash or eeprom to make the vehicles mileage inaccessible to most modifications. Reminds me of the "black box" functionality I found while reverse engineering some GM OBD-II ECU software. The ECU keeps a rolling buffer of vehicle telemetry data (speed, braking, engine parameters, pitch/roll/yaw data if available, etc.). In the event you crash the car, the entire buffer is dumped to the flash memory to tattle on you and investigators can then tell exactly what you were doing in the moments leading up to the crash.

they're actually used after changing the mileage in the cluster via an eeprom dump, it blocks CAN signals to stop the dash synchronizing with the EZS module and putting the mileage back to what it was before (info is stored in both and it will "correct" itself to whichever number is higher)

Its so nice to see they went to the effort to color code it for us

years ago I had a boss who had me and another co-worker install a switch into his leased car. The switch replaced a fuse that powered the dashboard and the odometer. What he would do is get out on the highway, engage the cruise control and then disable the dash and odometer, presumably saving money on his lease.

Memories of Danny DeVito in 'Matilda'...though he took a little different of an approach :P Cheers for sending this, Dave. Very interesting!

It is a naughty little part. BTW, I really enjoy your channel and along with helping me understand some of the "useless (or useful depending on your bent), I too have had a parent with dementia and your sharing has helped me quite a bit. Keep up the good work. :O)

It makes totally sense. The jumper in the lower right say "W222" (Mercedes S-Class) and "W166" (Mercedes M-Class). It makes sense to manipulate the mileage of these models, as they are the biggest factors for resale. That moves (with us) in the area of ​​a clear imprisonment because of "heavy fraud".

These are somewhat common in Central Europe (basically every car has had the miles clocked). Although the drawback I’ve heard from a few people is that the dash (even on a modern car with a fully digital dash) will display the speed wrong, presumably lower than reality so the dash doesn’t think you’ve travelled so far.

Its similar to a device that Taxi drivers use to display the journey to charge their customers.

Thanks for explaining what a can bus wiring system is for. Had to install an aftermarket stereo in a 2000 Chevy several years ago and the install kit came with a similar device and a new buzzer for when the keys are in the ignition and the doors are open. Guess the old radio had the buzzer and can bus wiring. Now I know. Thanks

The speed/distance data for the instruments comes from the ABS unit, but is also sent to the engine ECU, and the auto gearbox if fitted.

Videos from two of my favorite creators (Great Scott is the other) making content on CANBus?! YAY!

Back in the day, ‘clocking’ was rampant amongst the back street car traders...the Arfur Daley’s. The U.K. introduced a mileage statement on each MOT. so I’m not sure if it can still be fiddled or not?

The bus termination resistor is also to stop the signal wave bouncing off the end of the transmission line and echoing back and forth. Like a rope tied to a fixed point and pulled a bit tight, twitch one end of the rope and watch a wave travel -- then bounce off the tie point and return. The resistor absorbs the signal instead. Slope control allows reduction of EMI and power supply peak draw in CAN bus networks with lower data rates (slower edges = doesn't transmit as much, takes less current to slew the bus voltage) and high speed operation for e.g. 1MBPS networks.

I need to learn more about can bus always hearing about it. So thanks for the canbus introduction.

This generation was in need of replacement due to power drain issues.

"I had to do a lot of test driving to find the issue, if you don't believe me, check the odometer."

this should absolutely be forwarded to Ben Heck! I have no idea what he could do but you know it's going to be epic!

very big thanks BigClive for the autopsy of that delinquent device 😀✔

A 👍and a subscription for that "If your getting illegal electronics, you ot to make sure that they are made to a good standards" lol too funny 🤣🤣🤣

Ahh yes, it's the "Ferris Bueller" mileage fluffing unit.

I believe the slope control is enabled to meet more stringent EMC levels, it softens the edge of the signal making it easier to filter it from the outside world.

Looks fairly well made, The messages are sent periodically, this is intercepting the odometer message and modifying the reading, the other messages will be relayed. The jumpers in the bottom right are to change the vehicle it's configured for W222 and W166 are Mercedes chassis generation numbers and there is BMW support. The CAN chips are Transceivers, the controllers are in the MCU itself. They'll have used Microchip as they are the cheapest in low volume. A CAN gateway is a device that bridges 2 CAN bus networks, bit like a router in Ethernet.

Nice coincidence this comes up after me diving into the STM32 microcontroller family in the last few months. Yes it *could* be programmed in the Arduino environment, but I suspect the makers used the ST Microsystems development tools which are free and provide fairly easy access to all the powerful features of these chips, including software libraries that make using the CAN ports easy. The STM32 chips seem to be a favorite of the Chinese advanced gadget makers, probably because of their really good cost/feature ratio. And your guess is going to be right about the read-protect feature being enabled - it's so easy to do that it would be a huge error NOT to enable it. BTW and as I'm sure you know, the magic sauce is not in the circuit but in the code. What's happening in software on the chip is not very difficult itself, but the knowledge behind it might very well represent untold hours of reverse engineering the dashboard/ECU communications in various cars. There's a lot of value in that. The board itself could probably be sold for $15 to $20 US while still making a small profit on the hardware, but I bet it costs at least 10x more for a scumbag used car dealer to acquire. Edit: Unless they know where to buy it firsthand. I saw some of the links in here and they're going for $40. Still a tidy profit for the Chinese maker(s).

the CAN bus has 0 being active due to how the CAN bus handles Arbitration; i.e. what happens when two devices go to talk at once. Each CAN message has a priority code which works as follows; lets say we have three nodes that want to transmit at practically the same time, one of 3 (0011) one of 1 (0001) and one of 5 (0101) rather than messing with baud rates lets just say call each step a Tick; first tick; All send the first bit, this is 0 for all of them So they all go high, and the bus is high They all check the bus value and all see it is high So they all transmit the next bit, this is 0 for all but the last one for which it is 1 so the first two go high, and the last one goes low as such the bus goes low! they all check the bus value and the last one sees the bus is not the right level and goes into receive mode finally the first two transmit again the bus goes low and the first one drops out to going into receive the remaining node transmits it's remaining bit, sees no conflict (which as its the last bit would otherwise produce an error) and transmits its data onto the bus

"If you're getting illegal electronics you want to make sure they're made to good standards" 😂😂 Brilliant Clive. Interestingly, I had a BMW Motorcyle and due to their particular take on CANBUS you couldn't just plug your battery maintainer (e.g Optimate) straight into the 12v accessory output socket as it goes dead a few seconds after the ignition is turned off. So you actually need a special (expensive) version of battery maintainer. What I did instead is to unplug the wiring from the back of the pillion seat accessory socket, insulate and tie these back carefully (for easy reversal of my mod). Then I simply connected the battery (with a suitable in-line fuse) directly to the accessory socket terminals. Voilà! A simple way to use my standard Optimate device with this particular bike 👍

Well you certainly can't argue against their quality of work - impressive.

Wow I'm not even a driver and I learned so much from this video. I have very basic knowledge about circuits and the explanations here filled in so many little questions I had. Thanks for that.

8:44 - "It's actually quite well designed." Probably so that it minimizes any technical issues it might cause. You wouldn't want this causing problems on the network thus causing a technician to find it.

Some vehicles will store the mileage in both the cluster and ecu, and in some cases other modules. ABS units will provide speed data and this is usually passed on to ECU, Instrument cluster and any other modules that need it via CAN.

Doing a quick search on CAN gateway and CAN gateway module brought up some interesting results.

Would really like to see you revisit this when you have the facilities or access to facilities to read the programing on the chip, hopefully they haven't locked it. Keep the great videos coming I really enjoy them all. Best wishes to you Big Clive.

The keyword for this on aliexpress is "can filter universal odometer adjust", only 12$ or something....

The bottom contacts are certainly for the SWD to program the mcu with pogo pins. Also, some STM32F1's can be read out even when the lock bit is set.

The STM32F1 chip was used on a lot of earlier quadcopter flight controllers like the NAZE32.

Very interesting, I may have to check this out as my car lost 40k miles when I disconnected the battery. 63 plate audi. As you said in the video, very had to prove when it was done if this was installed.

The old way of fudging miles was to disable the cluster, you would loose all output information on the IC. guys would install a external programmer into the DLC and use that as there cluster. things have changed now due to the fact that most ICs contain the vehicle security module. very smart little gadget if you ignore its intended use. I actually have a module that us used to provide feed back information for the new electronic power steering systems. if your interested in taking a look at it let me know, i can also get you all the relevant OEM wiring diagrams CHEERS!!

Love the video! It reminds me that some car manufacturers “hard burn” the mileage from the canbus into other modules like anti lock break control modules. That way if the car is in an accident you can get a 30 second last condition of the car sensors. It records actual mileage. It should also prevent modules like what you have in lease cars. They check the ABS system mileage to the dash board. Thanks Clive!

It's a node broadcast on the CAN if they adhere to standard protocols, a dominant controller will be allowed a specific number of Ms per second to broadcast it's information, some are 1Hz some are 5 or 10Hz depending on the data priority. A dominant controller can pull voltage to 12V on some systems to tell others controllers a fault has occured, some use 5V on CAN HI for this signalling. It can be 100 meters long with hundreds of nodes on the same bus. 2 120Ohm resistors, usually "active" termination are installed along the way.

I see many of these on ebay at the moment - one title "Yanhua MB CAN Filter 18 in 1 For Benz/BMW Odometer Adjustment Universal Filter"

"Keep in mind that their function is to reduce the apparent mileage of a vehicle, and this may be a criminal offence in some countries." It definately is in the Isle of Man, and in fact the UK :-)

CANbus explained in a way that thick people understand..even though your " not very organised ' as you say. thanks buddy. Learned a lot 😀 Squiggz 👍

The polarity of the dominant and recessive bits is selected this way so that logically lower IDs have higher priority on the bus. That is, the message with the lowest ID will determine the state of the bus in case of a collision between two or more messages. Any tranceiver transmitting a higher ID will detect that the bus state doesn't match what they are trying to send, and will yield. This provides a mechanism of arbitration, which always allows the message with highest priority to get through.

Looks like a classic Man In The Middle ( MITM) hardware attack. Very slick.

Wow that's f'd up, good catch to the guy who found it!

Somebody may have already said this, but the four pads on the bottom of the board (and that are present in many devices that use microcontrollers, generally directly adjacent to the mocrocontroller itself and traceable to either a serial interface or serial programming pins. They are intended for programming the chip during manufacture. The chips are almost always soldered to the board directly from a tape reel or whatever, and programmed after they are installed with a clip or a jig specific for the purpose. If it's four pins that look like this board It is almost certainly RS232, and if the chip isn't an OTP model (or a model with a one-time program option for which the fuse has been tripped by the manufacturer) you should be able to connect to it with a device as simple as a RS232-USB converter. It's easiest to just remove the DB9 connector and solder a couple of wires to the 4 serial IO lands on the board, then of course attach them to the corresponding pins on the target board. Depending on the software the microcontroller is running and/or the configuration of the internal flash rom (and how the physical pins on the board are hooked up) one can almost always get by using the program flashrom in linux (available in nearly every distribution's repository), or in more usual commercial products (wireless routers being an example about which there is much information and a great many guides/tutorials online) which were built with diagnostics/rebuild-ability/refurbishment in mind there is often even a telnet server running on the microcontroller that can be accessed how one might expect.

In over 40 years of buying cars I cannot recall ever paying much attention to the recorded mileage. But then most of my cars come from a period when body condition was much more important and the greasy bits could be fixed relatively easily. Having said that, I did once go as far as replacing the luminous paint on the dials of a 1954 Pathfinder. On that model the instruments were lit via UV filters which gave a rather pleasing glow to them.

Hmmmm, I think I see how it works (7:00) but Merc have got wise to the 'mileage correction' game for a while now, the mileage is stored in 3/4 different places, the ECM (engine ecu), EIS (electronic ignition/key (yes the mileage is stored in the key)) and the IC (instrument cluster). If the mileage is significantly higher in any of these 3/4 places the rest of the modules will adopt the higher mileage. This has happened to a customer of a garage I used to work for where they used one of their spare keys and the mileage jumped up by 50,000 miles

Would love a in-depth, loooong video with scope, DMM, PC, datasheet orgy. =) Please Clive!

I’ve designed Soooooooo many PCBs with STM32 chips. That guy has a dual CAN controller so the firmware is just intercepts the traffic and sends it back out with the data overwritten. Very clever!

The slope control input is used to control emf noise. The higher the slew rate, the more noise the chip produces.

The adjustable slew is used to "relax" the leading and trailing edges of the CAN signal. It cuts down on unnecessary noise. Anyone who has ever lived through DeviceNet knows what happens when the slew is set for "Flat out". :)

I can't help but think, this channel is like Scott Manley's secret electrical engineer brother...

The 5 empty pins on the bottom of the board are for a micro USB connection. From left to right it is 5V, Data -, Data +, Mode Detect, and GND. That's how they programmed it. Likely it is programmed with Arduino but could also be Python. Judging by the CANBUS controller chips tell me it is Arduino. You can extract the code in binary and use a disassembler to convert the code.

A big Fan out here in Kenya. It would really help if the various videos were categorized into some playlists based on the 'genre' of equipment.

Hah that QA sticker. They put it on top of the ARM chip surely as there's no doubt the ARM chip itself has passed QA ;) Can't say that's false.

Hey Clive, you just needed a USB - FTDI and connect headers to the 4 solder points shown @ 9:10 and read in Arduino's console :)

typically all the signals are sent from the ecu to the dashboard, because the the dashboard is a display, and the ecu can light up certain lights. on ones that have a display, they can have a second board to handle running it that talks to the ecu

You are a master in that info, thank you for sharing, love the site.

Love the technique of using the blow-up photos!

I actually built a very similar circuit a few weeks ago. But in my case I did it to translate the data and that I could retrofit an instrument cluster from a newer car :-D

Really well made and informative. As for who made it, I'm guessing a car dealership sub contracted it out. If they paid £€$100 per chip they were raking it in.

The jumper connections on the right side are for different vehicles, this board is jumped for W166 which is a Mercedes ML class, the W222 option would be used for Mercedes S class.

If you want an interesting look into figuring out the special sauce for programming an ECU over CAN, look up Just4Trionic. Used it extensively while tuning my 1997 SAAB 900, to avoid having to take the ECU out every time I needed to program it (using Motorola's proprietary "BDM" interface; kinda like JTAG for the embedded Motorola 68K's). Unfortunately the 1994-1998 900's didn't have the CAN lines brought out to the OBD port, so I had to make a custom adapter cable for SAAB's proprietary 'debug' plug hidden behind the glove box. Neat stuff, especially given how old the SAAB Trionic 5 ECU design is.

What printer do you use to print out your stunning PCB photos?

Excellent little device. Possible expansionism ideas as well. Monitor or even monitor and location. Professional piece of hardware. Shame the criminal wasn’t professional enough to remove it.. I may have to contact the thieves guild on this one. :). Good video, cheers Clive.

That is actually a adapter module to use a newer dash cluster with a older model vehicle and that also explains why the kilometer reading was lower than what it should have been because it was replaced with a newer cluster from another vehicle

i know on Lincoln's from the mid '90s the mileage was stored locally on the dash, i had a customer who pulled the dash fuse to keep the mileage low :/ and yes it worked

It's that way around so that device zero is the highest priority.. If 1 was the active state then device 255 would have to be the highest priority..

At GM Holdens there was a discussion about encrypting HSCAN data for sensitive information - we pushed for ALL data to be encrypted to obfuscate all sensitive communications. GM didn't want to spend the money.

Hi there B.C ! - This is very interesting ! - Thankyou for showing & sharing this ! - I have passed this episode? - On to my mechanic son ! All the best S.B. British Isles

For us old timers that is a Berg header plugged into a wire wrap header. I wonder if That ARM 7 is hardwired to simply subtract 40,000 km or does it compute a proportional mileage reduction, say 75% of actual mileage. Between seeing this and the GPS tracker gizmos found on used cars glad we buy ours new and use them until the wheels fall off.

As others have mentioned - it would be cool to get the hex dump of the ARM chip. Not sure how similar the process is for the STM32 chips, but for basic Arduino family of chips it's not too hard - as long as the fuses haven't been burned to prevent it. Put the dump.on paste bin and see what we can discover as a community. Perhaps it's really simple or mega complex ..??

This CAN filter is readily available in the UK for £43 from Cardiag in Gray's , Thurrock in Essex , England . Lots of Mercedes models and all BMWs. Plenty of other companies sell them . Can be main dealer installed . I think the term 'shady Essex car dealer' may apply here if used incorrectly .

Just came across this video. Nice little device! Depending on the level of protection set for this device (Level 0, 1 or 2) and if they boot from Flash or SRAM, via SWD or JTAG the flash cant be accessed but the SRAM can still be accessed, extracted and reverse engineered using something like Radare2. But is seems now that the protection for this device is broken. A google search ("breaking the stm32f1 read-out protection") shows a few options. Would have been nice to get at the firmware to see if there are any clues as to who developed it, developers to like to tag their code, and to see how professional a job it was.