Help Needed with Reverse Engineering Subaru GX-204 LE ACC UART Communication

[SiilikeUdus]

Hi everyone,

 

A few weeks ago i bought myself my very first subie, a 2007 Legacy. It has a GX-204 LE radio/ac unit. I had problems with the radio and the ac unit screen. I am sure many of you have experienced these same issues before. 

I have seen many posts about these issues on different sites, but haven't really found any solutions, other then pressing on the screens.

I did replace the radio part of the module with a 2 din pioneer unit after finding a post here saying that the radio and ac unit pcbs are separate.

The ac units functions all seem to work fine, but I started to wonder if I could reverse engineer the signals sent from the ac panel to the ac control module to build an esp32 based climate control panel. 

Of course I could just replace the ac unit but I guess I just don't have enough unfinished projects jet.

 

What I Know So Far:

 

1. From a wiring diagram(I think the radio modules one), I know the AC panel has UART+ and UART- pins. Since they are labelled as such it would make sense that the protocol used is actually UART.

I have made myself a small wiring harness to extend the cable coming from the car to the ac control panel and to be able to listen in on the communication. I have been using a couple of arduinos to listen to the communication going both ways.

 

2. After doing some testing the baud rate seems to be 4800, but I am not so sure about that. I did also do some measurements with an oscilloscope, but it is a small handheld one and I can't really zoom in on the signal enough to measure the length of the signal to calculate the baud rate. Actually I haven’t even really understood how to do that anyway.

I have mostly been using 8N1 UART standard, but have also tested some others. I have been logging the data as HEX.

 

3. The UART signal's "idle" state seems to be low, from what I understand it should usually be highfor UART signals.

 

4. Both sides of the communication constantly output data when the engine is on. I am getting a lot of data from both sides, but I am not seeing any patterns or structure I could use in the data.

 

Has anyone tried to do something similar?

 

Does anyone know the specific protocol structure or patterns used by Subaru AC systems?

 

Is the low idle state common in older Subaru UART systems, or am I misinterpreting something?

 

Any advice on decoding the raw UART data or tips for identifying repeating patterns?

 

If anyone has experience with Subaru AC reverse engineering or similar projects, I’d love to hear about your findings.

 

I’d be happy to share any oscilloscope screenshots, raw data logs, or additional details if it helps.

 

Thanks in advance for your input! Any guidance or insights would be greatly appreciated.