André Rösti

Automotive Reverse Engineering

Seat León 5F CAN Sniffing

The 2019 Seat León 5F has six different CAN buses for comfort, engine, infotainment, etc. Intrigued by the wealth of data that could be extracted from these buses (and unwilling to spend thousands of dollars on proper CAN software), I decided to try to reverse-engineer this data stream with an Arduino and open-source software (much to the amusement of some of my friends who considered this a futile project).

So far, I have built an adapter that plugs into to the passanger-side door connector and splits off the comfort CAN bus into an Arduino MKR with a CAN shield. I have not yet gotten any further than identifying which bytes are responsible for the window lifter, but if I get around to it I will continue this project. The next goal is to figure out the ambient lighting codes and possibly get a little disco going in the car. I am sure to an electrical engineering student all of this is beginner's stuff, but it definitely was a learning experience to me!

To anyone seeking to do the same thing for the same make and model, I will list the parts that took me forever to find on this page. Everything on this page is provided as-is with absolutely no warranty! I'm not responsible if you try this yourself and brick your car. If you do try it though, I'd be very interested in hearing your experiences.

Passenger-side door connector

The door connector is relatively easily accessible without having to remove any other stuff. Just open the door, and it's there. As far as I could tell, nothing bad happens if the wires to the passenger-side door are disconnected when the ignition is turned on (except that the keyless lock/unlock, window lifters, speakers and ambient light on that side will stop working, of course). Therefore it seems to me like it is relatively harmless to experiment at this connecting point.

I inquired at the official VW dealership and was told the VW OEM parts numbers for the connector and crimped wires are as follows:

Connector housing
8K0972701	(Flachkontaktgehäuse mit Kontaktverriegelung)
8K0972702 	(Flachkontaktgehäuse mit Kontaktverriegelung)

Crimped cables
000979035E 	(Satz Einzelleitungen 0,5QMM mit je 2 Kontakten, im Beutel zu 5 Stück)
000979034E 	(Satz Einzelleitungen 0,5QMM mit je 2 Kontakten, im Beutel zu 5 Stück)
000979226E 	(Satz Einzelleitungen 2,5QMM mit je 2 Kontakten, im Beutel zu 5 Stück)
000979242E 	(Satz Einzelleitungen 2,5QMM mit je 2 Kontakten, im Beutel zu 5 Stück)

Some information about this can also be found on this website. See also my post on Electrical Engineering Stack Exchange.

I ended up only buying the connector housing from the dealer, and got my cables plus crimp terminals much cheaper at Conrad (Total CHF 45.75):

1499782		FLACHSTECKER 0.5-0.75 (1718760-1)
1499780		BUCHSENKONTAKTE 0.5-0.75 (1452668-1)
1311639		BUCHSENKONTAKT MCP 2.8 1.0-2.5MM(1-9688
1020714		FLACHSTECKER 2,8X0,8 1,5-2,5 CUSN VERZ

T27b connector pinout

The following is the pinout I determined for the passenger-side door connector using the schematics available through the official Seat erWin portal for mechanics. Drivers side (T27a) is pretty much the same.

T27b	Steckverbindung, 27fach, an der A-Säule rechts
 1	0.35mm vi/gr	W93 Einstiegsleuchte Beifahrerseite
 4	0.35mm or/gn	B397 Verbindung 1 (CAN-Bus Komfort High) im Hauptleitungsstrang 
 5	0.35mm or/br	B406 Verbindung 1 (CAN-Bus Komfort Low) im Hauptleitungsstrang
 7	0.5mm ws	G180 Crashsensor für Seitenairbag Beifahrerseite
 8	0.5mm br	G180 Crashsensor für Seitenairbag Beifahrerseite
 9	0.5mm bl/gn	R98 —> W87 Leuchte für Türambientebeleuchtung Beifahrerseite
10	0.5mm ws	R99  —> W87 Leuchte für Türambientebeleuchtung Beifahrerseite
12	0.5mm vi/ws	V472 Motor für Fensterheber hinten Beifahrerseite
13	0.35mm sw/bl	G416 Sensor für Türaussengriffberührung Beifahrerseite
14	0.35mm gn/sw	R135 Antenne Beifahrerseite für Zugang und Startsystem
15	0.35mm ws/sw	R235 Antenne Beifahrerseite für Zugang und Startsystem
16	0.5mm br	367 Masseverbindung 2 im Hauptleitungsstrang
17	0.35mm vi/ws	[—> 127] K133 Kontrollleuchte für SAFE-Funktion der Zentralverriegelung
18	2.5mm br	371 Masseverbindung 6 im Hauptleitungsstrang
19	2.5mm rt/ge	[—> 11] B318 Plusverbindung 4 (30a) im Hauptleitungsstrang
20	1.5mm br/gn	B103 Verbindung (Plus, Lautsprecher vorn rechts) im Hauptleitungsstrang
21	1.5mm br/bl	B104 Verbindung (Minus, Lautsprecher vorn rechts) im Hauptleitungsstrang

Additionally, there were one or two connections (I do not remember exactly) somewhere in there for the keyless door lock/unlock/antenna.

Connector for the J533 data bus

Another option would be to connect to all the CAN buses that run into the J533 gateway device, which is located behind the steering column. I did not end up actually using these as it seemed too risky to me to mess with the connections at this very central point. Furthermore, it is much more difficult to access this spot. Nevertheless, here are the parts I have found:

According to the schematics the pinout at this connector looks something like this:

Steckverbindung, 20fach T20a
1	0.35mm	rot / weiss
2	0.5mm	rot / violett
3	0.35mm	violett / weiss
5	0.35mm	orange / violett	CANL KOMFORT
6	0.35mm	orange / violett	CANL ANTRIEB
7	0.35mm	orange / violett	CANL EXTENDED
9	0.35mm 	orange / violett	CANL DIAGNOSE
10	0.35	orange / braun		CANL INFOTAINMENT
12	0.5mm	braun
13	0.35mm	violett / blau
14 	0.35mm	violett / schwarz
15	0.35mm	orange / grün		CANH KOMFORT
16	0.35mm	orange / schwarz	CANH ANTRIEB
17	0.35mm	orange / grau		CANH EXTENDED
18	0.35mm 	orange / blau		CANH FAHRWERK / SCHALTTAFELEINSATZ
19	0.35mm	orange / schwarz	CANH DIAGNOSE
20	0.35mm	orange / violett	CANH INFOTAINMENT

To be continued!