OTA_RVCReq analysis

[nanomad]

Just leaving here some notes on my analysis on OTA_RVCReq. Will create a proper PR once I'm done analyzing it.

ReqType = 0 (FIND MY CAR)

• Field 1 must be 1
• Field 2 is 1 for Honking
• Field 3 is 1 for Flashing lights

Effect

• Running lights on
• Hazards on
• Continous Honking (unless Field 3 is 0, then it is a single honk)

ReqType = 2 (UNLOCK)

• Field 7 is the lock identifier.
  • 0x3 is the central locks.
  • 0x2 is the tailgate

ReqType = 3 (WINDOW CONTROL)

• Field 8 is the Sunroof (0x1 to select)
• Field 9 is the Driver Window (0x1 to select)
• Field 13 is the direction (0x0 Close, 0x3 Open)
  Note that the app seems to be using Open only on the sunroof, commands have no effect on MG4

ReqType = 5 (Heated Seat Control)

• Field 17 is 1 for Driver Side
• Field 18 is 1 for Passenger Side

ReqType = 6 (AC Control)

• Field 19 is probably the fan speed control. As it is controllable in other API calls

  • 0 OFF
  • 1 Blowing only,
  • 5 for defrost ON

• Field 20 is the temperature setting. On defrost mode it follows the EP21 decoding table

Temperature	Byte
OFF	0
16	2
17	3
18	4
19	5
20	6
21	7
22	8
23	9
24	10
25	11
26	12
27	13
28	14

• Field 22 is 1 for Defrost/AC ON, 0 for OFF

ReqType = 32 (Rear Heat Control)

• Field 23 is 1 for Rear Heat ON, 0 for OFF

ReqType = 17 (ENGINE CONTROL)

Only field 16 set to 1. Not called anywhere.
Tried calling it on an MG4 with door unlocked and driver belted in (without keys). Error is something like "Please make sure the car is off and locked before running this command".
Didn't have the guts to try it in that state