MG ZS Hardware
!! STOP !! - Warning
Accessing the vehicle network can be potentially dangerous. CAN works with small voltage changes over two wires. This controls all vehicle ECU communication. If they are damaged, short circuited, or altered in any way then there is a risk that functions, systems, or even the whole car may fail to work as intended.
The OBD Port - Recommended
The OBD port is only connected to CAN on pins 6 and 14. Unlike other vehicles (e.g. LEAF) where the port is connected to all the CAN networks, the MG OBD port limited to diagnostics ( or OBD) communication only. The only traffic you see when connected is an occasional CAN message in the "0x7xx" range, and the bus appears to negotiate speed, communicating at both 500 and 800 kbps speeds. As can be seen in the image, this is all there is on the back connector.
It is not at all surprising that SIAC have done this, OBD is not a Chinese specification, it does not require access to "normal" CAN traffic. It is not very safe on modern cars to allow full access to the whole vehicle CAN on such an accessible port.
But this hasn't stopped us! By reverse engineering a special diagnostic tool we are able now able to query "OBD PIDs" on pretty much all the ECUs within the car, hidden behind the "Gateway". This gives us a lot of data from the car, with very little risk of breaking anything.
Gateway Module and Breakout Lead
With the OBD port's limitations, there is another way into the central vehicle CAN buses. The gateway module itself, located behind the passenger glovebox on RH drive vehicles.
See the Notes here which were made on a 2019 UK spec MGZSEV and 5 CAN buses have been found, one of which is the other side of the OBD port. To access these buses temporarily, wire pins can be pushed into the back of the connector and secured with tape, for a more permanent fix a breakout lead is needed.
As with any CAN taps, no termination resistance should be used, and all of the MG CAN buses appear to operate at 500 kbps.