AwesomeREA.org

Case study

opendash: reconstructing the Scanmatik SM3 J2534 adapter protocol

Speaks the undocumented protocol of the Scanmatik SM3, a J2534 vehicle interface that otherwise talks only to its own Windows software, and exposes it to an Android phone as an ELM327 bridge with a diagnostics app on top. The author recovered the framing — a 16-byte header with sequence, CRC-based and sum-based check words, opcode and length — by capturing the device's bundled driver and measuring the replies, and docs/protocol.md separates what was established from what is still open. Reported results come from one Opel Astra J over five sessions with the car present.

Targets
Protocol
Category
Independent reconstruction cases
Relationship
Independent reconstruction project
Sources reviewed

Requirements & limits

  • Reviewed at the main-branch head of 2026-10-16, one README-only commit after the v0.4.2-beta release. README reports reading identification, standard OBD-II data and GM service 0x22 parameters, and module-driven streaming at about 98.7 Hz per packet, on one Opel Astra J 1.7 CDTI; the ELM327 bridge has been exercised against emulated modules but not yet against the car, and two long recordings stopped early for reasons not yet understood.
  • Requires the user's own Scanmatik SM3 reached over its Wi-Fi access point. Standard SAE J1979 PIDs ship with the app; richer per-brand catalogues are generated from a GM GDS2 installation the user already has, and README says they are not distributed because the data belongs to GM. No catalogue data, vendor driver, firmware or driving recordings are committed.
  • The app is read-only by design: README lists the diagnostic services it permits, and requests that write data, control inputs and outputs or routines, clear codes or request security access are refused before reaching the socket. One known actuator command sits behind a settings switch that requires the phone's device lock and is off by default.
  • Android 8.0+ app built with Gradle, AGP 9.4.1, Kotlin 2.4.20 and JDK 21. A separate Rust core implements framing, check words, ISO-TP and ELM327 handling but is not yet wired into the app, whose Kotlin bridge README says has moved ahead of it. CI runs cargo test, which replays 200 recorded writes and checks the computed check word against what the device sent, and builds the debug APK without the Rust core; Kotlin unit tests exist but are not run in CI, and this review ran neither the tests nor the app.
  • GPL-3.0 (LICENSE). Scanmatik, GM, GDS2 and Opel remain trademarks of their owners, and the reviewed sources establish no AI or REA use.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. docs/protocol.md GitHub · PabloSoage/opendash · Revision 7c8d729
  2. README.md GitHub · PabloSoage/opendash · Revision 7c8d729
  3. core/src/frame.rs GitHub · PabloSoage/opendash · Revision 7c8d729
  4. core/src/h4.rs GitHub · PabloSoage/opendash · Revision 7c8d729
  5. core/tests/protocol.rs GitHub · PabloSoage/opendash · Revision 7c8d729
  6. .github/workflows/ci.yml GitHub · PabloSoage/opendash · Revision 7c8d729
  7. LICENSE GitHub · PabloSoage/opendash · Revision 7c8d729
  8. https://github.com/PabloSoage/opendash/releases/tag/v0.4.2-beta

More in Protocols

All 66 entries in ProtocolsProtocols case studies (26)