Aperture Controls

Subaru CANBus Info

There is a lot of work still to be done figuring out the CANbus addresses, but here is what I have.


My Subaru reverse engineering setup

If you look at an ECU firmware image, you can see what addresses and which direction the ECU is expecting.

  • Byte 0,1 - CANBus address
  • Byte 2 - Direction : 00 is transmitted from the ECU, 01 is received to the ECU
  • Byte 3 - ECU mailbox ID possibly
  • Byte 4 - Packet size?
  • Byte 5 - unknown
  • Bytes 6-9 - Address of handler/structure in the ECU RAM for this address

This data is from a 2010 STI ROM. 
	04 20 01 05 08 00 FF FF 5F 20	-
	04 21 01 0B 08 00 FF FF 5F 28 	- 
	05 14 01 09 08 00 FF FF 5F 45	- BIU
	06 20 01 10 08 00 FF FF 5F 4D	- BIU
	05 15 01 11 08 00 FF FF 5F 8C	-
	05 20 01 12 08 00 FF FF 5F 94 	-
	05 01 01 02 08 00 FF FF 5F E9	- VDC/ABS
	05 12 01 03 08 00 FF FF 5F F1	- VDC/ABS
	05 13 01 0C 08 00 FF FF 5F F9	- VDC/ABS
	04 10 00 04 08 00 FF FF 60 3F	- ECU
	04 11 00 01 08 00 FF FF 60 47	- ECU 
	04 12 00 06 08 00 FF FF 60 4F 	- Found with unknown data
	06 00 00 08 08 00 FF FF 60 57	- ECU
	06 01 00 07 08 00 FF FF 60 5F	- Found with unknown data
	07 DF 01 0D 08 00 FF FF AF 68	-
	07 E0 01 0E 08 00 FF FF AF 68	-
	07 E8 00 0F 08 00 FF FF AF 70	- Broadcast?

2010 Impreza STI addresses (High speed bus, 500k/sec):

  • 0x002 - Steering Sensor
    • Byte 02 - Possible watchdog byte
    • Byte 01 - 00 when turning left, FF when turning right
    • Byte 00 - Degrees turned from center?

  • 0x070 - Yaw Sensor
  • 0x080 - Yaw Sensor
  • 0x410 - ECU
    • Bytes 0x5-0x6 - RPM : Unsigned Int, 16 bit, little endian
    • Byte 0x4 - Throttle pedal position
    • Byte 0x1 - Throttle blade position

  • 0x411 - ECU
    • Byte 0x7
      • xxx01xxx - S# Mode
      • xxx10xxx - I Mode
      • xxx00xxx - I Mode
      • xxx11xxx - S Mode

    • Byte 0x6
      • 1xxxxxxx - Cruise control SET
      • x1xxxxxx - Cruise control CRUISE

    • Byte 0x3 - Looks like an analog signal
    • Byte 0x2 - Keepalive bits possibly

  • 0x412 - ECU
    • Byte 05 - Throttle position in encoder counts?
    • Byte 00 - Throttle position in percent

  • 0x430 - Driver Controlled Center Differential (DCCD)
    • Byte 0x2
      • xxxxx000 - Level 1
      • xxxxx001 - Level 2
      • xxxxx010 - Level 3
      • xxxxx011 - Level 4
      • xxxxx100 - Level 5
      • xxxxx101 - Lock
      • xxx01xxx - Illuminated solid
      • xxx10xxx - Slow flash
      • xxx11xxx - Fast flash

    • Byte 0x1
      • xxxx1001 - Auto
      • xxxx1010 - Auto -
      • xxxx1011 - Auto +
      • xx01xxxx - Slow flash Auto
      • xx11xxxx - Fast flash Auto

    • Byte 0x0 - Watchdog byte

  • 0x501 - Vehicle Dynamics Controller (VDC)
  • 0x511 - Vehicle Dynamics Controller (VDC)
    • Byte 0x7
      • xxxxxxx1 - Traction Control active light on
      • xxxxxx1x - Traction Control fast flash
      • xxxxx1xx - Hill start light on
      • xxx1xxxx - Green TCC disabled light on

    • Byte 0x1 - Steering angle LSB
    • Byte 0x0 - Steering angle MSB

  • 0x512 - Vehicle Dynamics Controller (VDC)
    • Byte 0x5 - Watchdog or counter
    • Byte 0x4
      • xxx1xxxx - Brake pressure detected

    • Bytes 0x2-0x3 - Vehicle speed (MPH = (MSB * 256) + LSB * 0.03495)

  • 0x513 - Vehicle Dynamics Controller (VDC)
    • Bytes 0x6-0x7 - Rear right wheel speed
    • Bytes 0x4-0x5 - Rear left wheel speed
    • Bytes 0x2-0x3 - Front right wheel speed
    • Bytes 0x0-0x1 - Front left wheel speed
    • Wheel speed in MPH = (MSB * 256) + LSB * 0.03495

  • 0x514 - Body Integrated Unit (BIU)
  • 0x600 - ECU
    • Byte 0x6
      • xx1xxxx - Makes dash beep on rising edge signal


  • 0x601 - ECU
  • 0x620 - ECU

2015 Impreza WRX (High speed bus, 500k/sec):

  • 0x018 - Steering Angle
  • 0x370 - Power steering controller (EPS)
  • 0x371 - Power steering controller (EPS)

2013 BRZ addresses (High speed bus, 500k/sec):

  • 0x018 - Steering Angle
  • 0x0D0 - Vehicle Dynamics Controller
    • Bytes 0x0-0x1 - Steering angle

  • 0x0D1 - Vehicle Dynamics Controller
  • 0x0D2 - Vehicle Dynamics Controller
  • 0x0D3 - Vehicle Dynamics Controller
  • 0x0D4 - Vehicle Dynamics Controller
  • 0x140 - ECU
    • Byte 0 - Throttle position

  • 0x141 - ECU
  • 0x144 - ECU
  • 0x360 - ECU
    • Bytes 0x0-0x1 - RPM