ScanDoc for Developers

J2534 specification and function reference ›
ELM327 specification and command reference ›

The ELM327 interface is available on the Nano ET. The other ScanDoc adapters use the J2534 PassThru protocol.

Developer News

Changes in the J2534 DLL, ELM327 and ScanDoc adapter firmware that affect integration: new functions, protocols and parameters — with usage examples.

---

DLL 2.0.0.200, Nano ET firmware build 83 04.08.2026

Download J2534 libraries 2.0.0.200 — Windows x86/x64/ARM64 (separate builds for Windows 7), macOS (universal), Linux (x64, x86, ARM, ARM64), Android (arm64-v8a, armeabi-v7a, x86, x86_64), iOS.

Nano ET firmware — build 83

New

• DoIP (ISO 13400) and BMW HSFZ — new protocols ISO13400_PS (0x8FFD) and HSFZ_PS (0x8FFC). They are not part of the SAE J2534 standard — this is a proprietary ScanDoc extension: diagnostics over Ethernet — vehicle discovery on the network (VIN, logical address), TCP connection, routing activation, UDS exchange. The default tester address is 0 — set ISO13400_SOURCE_ADDR before routing activation, otherwise the gateway refuses; the ECU address is passed in every message ([TA][SA][UDS]), ISO13400_TARGET_ADDR is not set via Set/GetConfig. Transmission is serialized by P2: one outstanding UDS request at a time, NRC 7F xx 78 extends the wait to P2*max (6 s). New channel parameter ISO13400_P3_DOIP (0x8108) — pause between messages.
  Example

  uint32_t ch, code = 0;
  pt_config_t sa  = { ISO13400_SOURCE_ADDR, 0x0E80 };
  pt_config_list_t cfg = { 1, &sa };
  
  PassThruConnect(dev, ISO13400_PS, 0, 0, &ch);
  PassThruIoctl(ch, SET_CONFIG, &cfg, NULL);                 /* SA — before routing activation */
  PassThruIoctl(ch, ISO13400_DISCOVER_VEHICLES, NULL, NULL); /* the ECU IP is remembered automatically */
  PassThruIoctl(ch, ISO13400_CONNECT_TCP, NULL, NULL);
  PassThruIoctl(ch, ISO13400_ACTIVATE_ROUTING, NULL, &code); /* 0x10 = success */
  /* then PassThruWriteMsgs / PassThruReadMsgs — regular UDS */

• Bus fault diagnostics — bus-off (broken/shorted wiring, no ACK) and a wrong CAN bit rate now return an informative error string including the baud rate instead of a generic failure code.
• Single TCP port for J2534 and ELM327 — the separate ELM327 port 35000 has been removed; both protocols are served on command port 53983. The protocol is detected by the first byte of the connection: 0x55 (J2534 frame marker) — J2534, anything else (text AT command) — ELM327.
• BLE — resolvable private address (RPA): scanners see a random address, bonded devices resolve it via the IRK; only Secure Connections are accepted.

Fixed

• CAN filters on data bytes — PassThruStartMsgFilter compared only the 4 CAN ID bytes, ignoring the given filter length. Frames are now matched over the full length as the standard requires: PASS/BLOCK by frame content works.
  Example

  /* Suppress TesterPresent responses (07E8 02 7E ...) in the receive queue */
  pt_msg_t mask = {0}, pattern = {0};
  mask.protocol_id = pattern.protocol_id = CAN;
  mask.data_size   = pattern.data_size   = 6;   /* 4 CAN ID bytes + 2 data bytes */
  memcpy(mask.data,    "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
  memcpy(pattern.data, "\x00\x00\x07\xE8\x02\x7E", 6);
  uint32_t fid;
  PassThruStartMsgFilter(ch, BLOCK_FILTER, &mask, &pattern, NULL, &fid);

• J2534 — each received frame gets an individual timestamp at the moment of reception, as the specification requires (previously one per batch); the echo of a transmitted CAN frame is returned only on successful transmission — an echo on TX failure misled the host about the bus state.
• ELM327 — the AT SH command on an active CAN channel broke Flow Control (the FC went out without padding, DLC=3 — the gateway sent no Consecutive Frames) and overwrote the receive filter with its own TX ID (reception without AT CRA broke). Per the datasheet, AT SH sets only the transmit header — the receive filter is now controlled only by AT CRA/CF/CM.
• BLE pairing with Android 14+ (Pixel) — failed when the system Fast Pair / Find My Device started pairing in parallel with the device.
• K-Line/KWP — the last byte of a response was lost during dense traffic; the ACK block went out ~70 ms late and broke identification; the channel got stuck after a failed connect.
• PassThruStopPeriodicMsg could send one extra frame after stopping.
• TP2.0/TP1.6 _PS — pin selection via SET_CONFIG(J1962_PINS) was not applied, frames never reached the bus.
• Malformed data handling — validation of malformed frames (ISO15765 First/Single Frame, DoIP packet length, TP2.0/TP1.6 reassembly) and host parameters (ReadMsgs, IOCTL): instead of hanging or corrupting memory, the device returns regular J2534 error codes.

J2534 libraries — 2.0.0.200

Fixed

• WLAN/LAN control-command timeout raised to 1000 ms — on slow or congested networks, control commands to the device timed out.

---