I am currently performing reverse engineering on a Mitsubishi vehicle, and while analyzing the module referred to as LIN, it is observed that when requesting fault code reading, the scanner sends a multiframe message such as 10 0A 31 A0 06 18 02 00, where 10 0A indicates the start of an ISO-TP transmission with a total length of 10 bytes, 31 corresponds to the UDS RoutineControl service, A0 is a proprietary subfunction, 06 identifies the specific submodule, and 18 02 defines the routine for reading Diagnostic Trouble Codes (DTCs). Due to the message length exceeding 8 bytes, the communication continues with a flow control frame 30 00 00 00 00 00 00 00, after which the scanner sends the consecutive frame 21 00 00 00 00 00 00 00 to complete the request. Once the full request is received, the module responds with a positive response frame 71 A0 06 18 02, for example 06 71 A0 06 18 02 00 00 when no faults are present, which is interpreted by the scanner as “No Diagnostic Trouble Code”, or 06 71 A0 06 18 02 12 34 when a DTC is reported within the 8-byte limitation of a CAN frame. To achieve this analysis and validate the responses, the CAN Bus Multiplex Trainer tool was used, as it allows visualization of frames, their interpretation, and the construction of correct responses to match the expected system behavior.
