[Vias]

Hi everyone!
Anyone know how to use this jobs:
STEUERN_TRANSDIAG_SEND_CANFRAME_ONCE
STEUERN_TRANSDIAG_RECEIVE_CANFRAME_ONCE
STEUERN_RECEIVE_CAN_FRAME_START
STEUERN_RECEIVE_CAN_FRAME_STOP
STEUERN_SEND_CAN_FRAME_START
STEUERN_SEND_CAN_FRAME_STOP
_STEUERN_DEBUG_CAN_UMSCHALTUNG
This a jobs have comments, but I can't write right argument.
I want to send\receive raw message from CAN-bus, like:
12F     50 54 8A DD F1 05 30 C1
1A1     2F C3 00 00 81
0A5     25 01 5B B9 95 00 00 71
19F     FF FF 0C 80 FF 2F
Thanks for answering! 

[Vias]

Well I play with it and what I get in this moment:
STEUERN_RECEIVE_CAN_FRAME_START
0x03;0x0002;0x0130;0x00000064

PAYLOAD = 05,F1,FC,FF,FF
_REQUEST = 31,01,F7,65,03,00,02,01,30,00,00,00,64
_RESPONSE = 71,01,F7,65,01,00,00,00,02,01,30,05,05,F1,FC,FF,FF
DL_LAENGE = �
JOB_STATUS = OKAY
TI_ZYKLUSZEIT = 100
CAN_ID_EMPFANG = 0x0130
BUS_INDEX_EMPFANG = �

great, but:
STEUERN_TRANSDIAG_RECEIVE_CANFRAME_ONCE
0x04;0x0130;0x00000002
[13:02:23] JOB_STATUS = ERROR_ECU_REQUEST_OUT_OF_RANGE

1. BUS_INDEX (char)
0x01 ... B-CAN
0x02 ... FA-CAN
0x03 ... K-CAN
0x04 ... D-CAN
2. CAN_ID (int)
CAN Identifier der CAN_FRAME (2 Bytes)
3. TIMEOUT (long)
Zeit in ms.wo man eine CAN_FRAME empfangen soll
----------------------------------------------------------------
STEUERN_SEND_CAN_FRAME_START
0x04;0x00000008;0x00000001;0x0130;0x03;FCFFFF;
[13:04:40] JOB_STATUS = ERROR_ECU_SECURITY_ACCESS_DENIED

1. BUS_INDEX (char)
Bit 0 Body-CAN
Bit 1 FA-CAN
Bit 2 K-CAN
Bit 3 D-CAN
Bit 4 ZSG-CAN
2. TI_ZYKLUSZEIT (long)
Zykluszeit in ms. (4 Bytes) (falls R_WIEDERHOLUNGEN > 1)
3. R_WIEDERHOLUNGEN (long)
Anzahl der Wiederholungen (4 Bytes)
0xFFFFFFFF unendlich verschicken
4. CAN_ID (int)
CAN Identifier der CAN_FRAME (2 Bytes)
5. DL_LAENGE (char)
Lange der Payload (1 Byte)
6. PAYLOAD (string)
Payload der CAN_FRAME (1 - 8 Bytes)
<PL1><PL2>...<PL8>
Beі5ріel A0FF01FF00 (5 Bytes)
A0FF01FF00010001 (8 Bytes)
======================================

Who know how send any raw can-message thought їсош?

[Vias]

ZGW_01 raw CAN transmission:

I got it working over ENET using ёdїдbд5.

1. Keep one dїдgиo5тїc connection and tester identity. Enter extended session: 10 03.

2. Send 27 61. For a fresh authorization, the response is 67 61 plus a 20-byte challenge. An all-zero challenge means this tester is already authorized.

3. Using a tester credential accepted by the gateway, sign the challenge with RSA-1536, SHA-1 and PKCS#1 v1.5.
Send: 27 62 || signature[192 bytes] || tester certificate[DER]
Require 67 62 before proceeding.

4. Run STEUERN_SEND_CAN_FRAME_START, for example:
0x04;0x00000064;0x00000001;0x12F;0x08;8B5E8ADDF10136C1

Arguments: bus mask; cycle in milliseconds; repeat count; CAN ID; DLC; contiguous hex data.
This sends once. Use a nonzero cycle even for one frame. Mask 04 reached K-CAN4 connection.

5. For a running sender, use STEUERN_SEND_CAN_FRAME_STOP with the CAN ID as its sole argument.
6. Finish with 31 01 F7 76 to revoke MessageTunnel authorization, then 10 01.

With ёdїдbд5, use UDS_TEL_ROH_BINAER_BUFFER for the long authentication telegram.

[remcar]

thanks a lot, that was exactly the missing piece.

For anyone finding this later: the trick is the SecurityAccess level. I'd been authenticating the ZGW MessageTunnel at sub-function 0x03/0x04 and getting a valid grant (67 04), but STEUERN_SEND_CAN_FRAME (routine F766) still came back 7F 31 33 (SecurityAccessDenied). Switching to 0x61/0x62 — same certificate, same RSA‑1536 / SHA‑1 / PKCS#1v1.5 signature over the 20‑byte seed — and F766 is accepted.

Redacted log (2017 G31, ZGW over ENET; signature + certificate bytes removed):

Code:

10 03                        -> 50 03 ...            (extended session)

# the level I had before: grants, but send stays denied
27 03                        -> 67 03 <20-byte seed>
27 04 <sig ||       cert>    -> 67 04                (GRANTED)
31 01 F766 ...               -> 7F 31 33            (SecurityAccessDenied)

# the right level — MessageTunnel 0x61/0x62
27 61                        -> 67 61 <20-byte seed>
27 62 <sig ||       cert>    -> 67 62                (GRANTED)  [key material redacted]
31 01 F766 <bus> <cyc> <rep> <id> <dlc> <data> -> 71 ...  (ACCEPTED)

So: 10 03 → 27 61 (seed) → 27 62 (sign the seed with the cert) → F766 sends. Revoke afterwards with 31 01 F776.