Introduction

This part of the knowledge base discusses a variety of diagnostic protocols. First, ISO-TP is explained — a protocol layer to send payloads larger than 8 bytes over CAN. ISO-TP is used as a transport layer in many diagnostic protocols. While ISO-TP is the most common transport layer, VW TP2.0 is also used in some Volkswagen vehicles and is explained as well.

Then OBD (On-Board Diagnostics) is discussed — the first standardized diagnostic protocol, intended for emissions-related testing. OBD evolved into OBD-II, which is still in use today. UDS is the most common enhanced diagnostic protocol in modern cars, allowing functionality such as reading live values, running routines, unlocking security levels, and reflashing ECUs. It can also be used over networks other than CAN.

Finally, CCP (CAN Calibration Protocol) and XCP (Universal Measurement and Calibration Protocol) are introduced. These are more low-level debugging interfaces meant for use during final calibration or testing of an ECU. However, in practice they are sometimes left enabled or can be enabled by an attacker. They are useful protocols to extract firmware or read RAM to help with reverse engineering or exploit development.