# opendash: reconstructing the Scanmatik SM3 J2534 adapter protocol > Speaks the undocumented protocol of the Scanmatik SM3, a J2534 vehicle interface that otherwise talks only to its own Windows software, and exposes it to an Android phone as an ELM327 bridge with a diagnostics app on top. The author recovered the framing — a 16-byte header with sequence, CRC-based and sum-based check words, opcode and length — by capturing the device's bundled driver and measuring the replies, and docs/protocol.md separates what was established from what is still open. Reported results come from one Opel Astra J over five sessions with the car present. - Type: Case study - Targets: Protocol - Category: Independent reconstruction cases - Relationship: Independent reconstruction project - Sources reviewed: 2026-10-27 - Added to the catalog: 2026-11-03 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/opendash-scanmatik-sm3-protocol-case/index.md) ## Requirements & limits - Reviewed at the main-branch head of 2026-10-16, one README-only commit after the v0.4.2-beta release. README reports reading identification, standard OBD-II data and GM service 0x22 parameters, and module-driven streaming at about 98.7 Hz per packet, on one Opel Astra J 1.7 CDTI; the ELM327 bridge has been exercised against emulated modules but not yet against the car, and two long recordings stopped early for reasons not yet understood. - Requires the user's own Scanmatik SM3 reached over its Wi-Fi access point. Standard SAE J1979 PIDs ship with the app; richer per-brand catalogues are generated from a GM GDS2 installation the user already has, and README says they are not distributed because the data belongs to GM. No catalogue data, vendor driver, firmware or driving recordings are committed. - The app is read-only by design: README lists the diagnostic services it permits, and requests that write data, control inputs and outputs or routines, clear codes or request security access are refused before reaching the socket. One known actuator command sits behind a settings switch that requires the phone's device lock and is off by default. - Android 8.0+ app built with Gradle, AGP 9.4.1, Kotlin 2.4.20 and JDK 21. A separate Rust core implements framing, check words, ISO-TP and ELM327 handling but is not yet wired into the app, whose Kotlin bridge README says has moved ahead of it. CI runs cargo test, which replays 200 recorded writes and checks the computed check word against what the device sent, and builds the debug APK without the Rust core; Kotlin unit tests exist but are not run in CI. - GPL-3.0 (LICENSE). Scanmatik, GM, GDS2 and Opel remain trademarks of their owners. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. ## More in Protocols - [OWL: an open Apple Wireless Direct Link implementation](https://awesomerea.org/resources/owl-awdl-open-implementation-case/index.md) · Case study - [QuestPad: a USB gamepad from the Quest Touch radio protocol](https://awesomerea.org/resources/questpad-case/index.md) · Case study - [Stadiacast: reconstructing the Stadia Controller's Wi-Fi service](https://awesomerea.org/resources/stadiacast-case/index.md) · Case study - [os-xgs-npu: reconstructing Sophos XGS coprocessor interfaces](https://awesomerea.org/resources/os-xgs-npu-case/index.md) · Case study - [LibreMP: an Epson EasyMP screen caster from packet-capture research](https://awesomerea.org/resources/libremp-easymp-case/index.md) · Case study - [Sony CDX-A250: reconstructing the LCD panel interface](https://awesomerea.org/resources/lc75826-sony-cdx-a250-case/index.md) · Case study ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.