Tried coding something on a newer VAG car and got "Access denied"?

Congrats, you've just met SFD (Schutz Fahrzeug Diagnose).

It's an additional security layer that requires authorization between the car and VW's servers. No token, no access. Simple as that.

I first ran into it on a Skoda Octavia IV when I just wanted to enable a couple of basic adaptations via OBD. Connected, entered the control module - denied. Took me a while to figure out it wasn't my tools or software. The module was just locked behind SFD.

SFD is used on cars from 2020 onwards - mainly MQB Evo (Golf 8, Octavia IV, Leon IV, Audi A3 8Y) and MEB platforms (ID.3, ID.4, Enyaq). It blocks adaptations, coding and parameterization.

Tokens are only issued through official accounts to registered users. So a regular enthusiast without dealer-level access simply can't get one.

Have you run into SFD yet? Which module blocked you?

One of my clients recently got hit with a surprise software update bill for his Snap-on OBD-II scanner. It was almost $1,200 for a single year, which seems pretty steep.

At that price point, it got me wondering whether there are better options out there, maybe something iPad-based or with a more modern interface. I’m just starting to look into this, so I’m hoping to get some guidance from people who actually use these tools.

My client does auto upholstery work, and he mentioned needing a scanner that can reset certain systems after the work is done. I’m not totally sure which resets he needs yet, but I’d like to understand what options are available besides paying that much every year for updates.

Are there any good alternatives to Snap-on that would work for this kind of use? I’d appreciate any advice from the guys and gals here who have experience with scanners, subscriptions, and update costs.

Thanks very much. I appreciate any guidance you can give me.

I’ve been looking into car coding recently and it’s something I could actually see myself getting into more seriously.

I’m not from a software background but I’m comfortable working on cars and understand how things fit together. What interests me is being able to change or enable certain features, like lighting behavior, comfort settings and other built in functions. The part I’m not clear on is where to start. There seem to be a lot of different tools and software depending on the brand and I’m not sure if it’s better to focus on one platform first or try to learn a bit of everything.

For those who’ve gone down this path, how did you get started with car coding? Did you stick to one brand in the beginning or try to cover multiple?

I have imported a JDM 2024 gr86. I'm trying to find which wires going into the guage cluster are for the can-bus system, so I can wire in a speedometer converter to make the speedo go from kmh to mph. Does anyone have any helpful files on this, or any experience in how I could find which wires are for the can-bus system? Thanks in advance

I’m currently testing the firmware from esp32-can-iot on a real vehicle

Current setup

• ESP32 + CAN transceiver (TJA1042)
• Vehicle: Toyota Vios 2007
• CAN TX/RX pins configured correctly
• DB9 / OBD wiring checked multiple times
• CAN_H and CAN_L continuity verified

What works

• Two ESP32 nodes can communicate with each other perfectly using this firmware.
• Sending and receiving CAN frames between ESP32 devices works normally.

The issue

When using this repo firmware on the actual car:

• No CAN frames are received at all.
• Even after sending OBD-II requests (0x7DF) there is no ECU response.

Questions

1. Has anyone successfully tested this firmware on a real vehicle OBD/CAN bus?
2. Could this be related to timing configuration differences?
3. Are there known issues with ESP32 Arduino-CAN (Sandeep Mistry) on noisy automotive CAN buses?
4. Is there any additional configuration needed for real vehicle CAN communication?

Is anyone able to determine if modules got swapped on a 2014 mercedes e350 coupe. I got my car back from a shop with different seats, steering wheel, rims, loose panels all around the interior, cameras not working like they used to. I got a xentry diagnostic done and they show faults with the seats, steering wheel as well as other things. Is there a way I can prove they swapped it because the xentry might confirm a possibility its swapped but not definitely.

We wanted to have a fun hardware and embedded software project to work on during a break we took with my teammates. So we took an old VW Polo from 2007 and decided to play with it.

We wanted to transform it into an EV and add new features to it, but we wanted to build the whole hardware and software for this ourselves.

So we put a Nissan Leaf Motor in it, built a battery from scratch based on Nissan NV200 battery cells and added a tesla brake booster gen2 to compensate from the lack of brake assistance since we removed the thermal engine. We also used a 2016 VW Polo steering column from which we removed the ECU and replaced it with an arduino. We made all these components talk to each other using Raspberry Pis and Arduinos.

We also wanted to integrate the parts we used as seamlessly as possible. For instance, the original ignition lock powers the whole system, old + new. We used specific CAN messages from the keylock to trigger relays to activate the motor. We also send the RPM from the Nissan electric motor and send the message in the right format for the original instrument cluster to display it.

We wanted to make it look like the car was always made like this.

We also created an infotainment system from scratch so we could see some useful information and have a touchscreen for the automatic gear selection.

https://preview.redd.it/ajw3nft1vpzg1.jpg?width=4032&format=pjpg&auto=webp&s=acdeee68d994b2579681f62528b3dd182f3149a6

https://preview.redd.it/g6drrla4vpzg1.jpg?width=2048&format=pjpg&auto=webp&s=6db5789f2cbdfe82ff590d9f8ccbc9215662b2af

We are running an IOT platform called Nerves on it. It's written in Elixir and it allowed us to iterate on the software quite fast. All the software is available on github: https://github.com/open-vehicle-control-system

We were lucky enough to showcase our work at several conferences:

Fosdem 2025 Playlist & Goatmire 2025 amongst others...

The project was also featured in this month's Raspberry Pi Official magazine.

Our first objective was to make the wheels spin, it involved a lot of welding and fabrication. But we went from this "plan prototype":

https://preview.redd.it/9v0nr0y2wpzg1.jpg?width=1536&format=pjpg&auto=webp&s=26f76ed45910172190494b6b3dee2b267301a506

To the driveable version of our platform:

https://preview.redd.it/snh08xx5wpzg1.jpg?width=2048&format=pjpg&auto=webp&s=4d56598bd4201535c33682e853f17821f5ab6169

https://preview.redd.it/oxhquxx5wpzg1.jpg?width=6960&format=pjpg&auto=webp&s=3e6dfa5f18102a250e3741ca4119260922b94243

The platform is now extensible and we have created a radio control bridge that allows to control the car with a Mavlink radio controller. We also have a ROS2 bridge for those into robotics, and plenty more ideas to build on it.

We have done our fair share of reverse engineering of CAN messages during this project and we were wondering if there were any similar projects out there!

If you want to see the car running, we have made a small intro video a few months ago: https://www.youtube.com/watch?v=QOdd3Ya6qlY

Hello everyone!
I am here asking about something that might as well be impossible, but it doesn't hurt to ask!

Has anyone ever found/open-sourced the Security access key / algorithm used for BMW vehicles?

I have lately been fascinated by tools like bootmod3 / MHD that allow you to unlock the ecu and tune car without needing to bench it (provided it's made pre-2020), but as a software engineer I can't help but think: how did they end up breaking the seed-key algorithm?

So, I've gotten to work, I borrowed a tuned 2016 BMW F30 340i from a friend, and started working in my free time to find what they do.

After using an MHD adapter (which works with both bootmod3 and MHD tuning app), I used wireshark to capture the packets being sent, and what I do know is this:
- The apps request security access, the cars do send a random seed everytime, and the app does respond with the appropriate key (derived from the seed)

- The seed and key change everytime, so it's not a case of the ECU being unlocked and sending the same seed or something like that,

- The seed is 8-bytes, and the key is 128 bytes.

- Both MHD Tuning app and bootmod3 can flash the ecu, and do it in more or less the same way from a tuning standpoint, and at least bootmod3 can do it offline, which means the algorithm and key both reside locally *somewhere* at the time of flashing.

Now, I have been extensively researching but haven't found any key/algorithm for bmw cars, but the MHD, bootmod3, and other apps that do the same thing must have gotten it from *somewhere*, so is there any resource I am missing? or did they just spend a lot of time reverse engineering it? I do find that a bit hard to believe because they support a wide variety of ecus that have different keys and algorithms.

It would be extremely helpful if someone can shed light at what bootmod and MHD are doing and if it can be replicated, I would eventually like to release some open-source tool that can do the same thing if I manage to find out how to do it, obviously it wouldn't have the entire feature-set of MHD/Bootmod, but it would be *something* for hobbyists that want to hack their BMWs without paying a lot of money.