[{"data":1,"prerenderedAt":143},["Reactive",2],{"kb-nav":3,"kb-doc":96},[4,10,15,20,25,30,35,40,45,50,55,60,65,70,75,81,86,91],{"_path":5,"title":6,"description":7,"part":8,"chapterNumber":9},"/knowledge-base/networks/introduction","Introduction","Overview of the communication networks used in modern vehicles, from LIN to Automotive Ethernet.","Vehicle Networks & Protocols",1,{"_path":11,"title":12,"description":13,"part":8,"chapterNumber":14},"/knowledge-base/networks/vehicle-documentation","Vehicle Documentation","Where to find manufacturer wiring diagrams, J2534 passthrough devices, and the different types of diagrams that are useful when researching a vehicle.",2,{"_path":16,"title":17,"description":18,"part":8,"chapterNumber":19},"/knowledge-base/networks/lin-bus","Local Interconnect Network (LIN)","Local Interconnect Network — a single-wire low-speed bus used as a low-cost alternative to CAN for non-critical body electronics.",3,{"_path":21,"title":22,"description":23,"part":8,"chapterNumber":24},"/knowledge-base/networks/controller-area-network","Controller Area Network (CAN)","ISO 11898 — the differential bus that became the backbone of automotive networking. Frames, bit timing, errors, CAN FD, message contents, and practical attacks.",4,{"_path":26,"title":27,"description":28,"part":8,"chapterNumber":29},"/knowledge-base/networks/flexray","FlexRay","Time-triggered, deterministic automotive bus standardized as ISO 17458, designed for higher speeds and drive-by-wire systems.",5,{"_path":31,"title":32,"description":33,"part":8,"chapterNumber":34},"/knowledge-base/networks/automotive-ethernet","Automotive Ethernet","Automotive variants of Ethernet — 100BASE-T1, 1000BASE-T1, and 10BASE-T1S — built around single twisted-pair cabling and strict EMC requirements.",6,{"_path":36,"title":37,"description":38,"part":8,"chapterNumber":39},"/knowledge-base/networks/secure-onboard-communication","Secure Onboard Communication (SecOC)","AUTOSAR's standard for cryptographic message authentication on in-vehicle networks — freshness values, MAC computation and key management.",7,{"_path":41,"title":6,"description":42,"part":43,"chapterNumber":44},"/knowledge-base/diagnostics/introduction","Overview of automotive diagnostic protocols — ISO-TP, OBD-II, UDS, CCP and XCP — and how they layer on top of CAN.","Diagnostic Protocols",8,{"_path":46,"title":47,"description":48,"part":43,"chapterNumber":49},"/knowledge-base/diagnostics/iso-tp","ISO 15765-2 (ISO-TP)","ISO 15765-2 transport layer for sending diagnostic payloads larger than 8 bytes over CAN — single, first, consecutive and flow-control frames.",9,{"_path":51,"title":52,"description":53,"part":43,"chapterNumber":54},"/knowledge-base/diagnostics/vw-tp20","VW Transport Protocol 2.0 (TP 2.0)","Volkswagen's pre-ISO-TP transport layer for KWP2000 over CAN — channel setup, parameter negotiation, and the data exchange counter scheme.",10,{"_path":56,"title":57,"description":58,"part":43,"chapterNumber":59},"/knowledge-base/diagnostics/obd-ii","On-board diagnostics (OBD-II)","On-Board Diagnostics II — the J1962 connector, signal protocols, service IDs, parameter IDs, and DTC encoding.",11,{"_path":61,"title":62,"description":63,"part":43,"chapterNumber":64},"/knowledge-base/diagnostics/uds","Unified Diagnostic Services (UDS)","ISO 14229-1 — the modern diagnostic protocol for sessions, Read/Write DID, Security Access, Routine Control and firmware Request Download / Upload.",12,{"_path":66,"title":67,"description":68,"part":43,"chapterNumber":69},"/knowledge-base/diagnostics/ccp","CAN Calibration Protocol (CCP)","A low-level debug/calibration protocol over CAN — Command Receive Object, Data Transfer Object, and the commands used to read and write ECU memory.",13,{"_path":71,"title":72,"description":73,"part":43,"chapterNumber":74},"/knowledge-base/diagnostics/xcp","Universal Measurement and Calibration Protocol (XCP)","ASAM XCP — successor to CCP supporting CAN, CAN FD, FlexRay, and Ethernet, with synchronous data acquisition, stimulation, and calibration.",14,{"_path":76,"title":77,"description":78,"part":79,"chapterNumber":80},"/knowledge-base/tools/can-adapters","CAN Adapters","USB-to-CAN adapters — comma.ai red panda and PEAK-System PCAN — and the standard DB-9 pinout for CAN.","Tools",15,{"_path":82,"title":83,"description":84,"part":79,"chapterNumber":85},"/knowledge-base/tools/can-analysis","CAN Analysis","Tools for analysing and reverse-engineering CAN traffic — comma.ai cabana, SavyCAN, VehicleSpy, and Wireshark.",16,{"_path":87,"title":88,"description":89,"part":79,"chapterNumber":90},"/knowledge-base/tools/scripting","Scripting","Python libraries and CLI tools for talking to a CAN bus — comma.ai panda, SocketCAN can-utils, python-can, and Scapy with ISO-TP and UDS examples.",17,{"_path":92,"title":93,"description":94,"part":79,"chapterNumber":95},"/knowledge-base/tools/dbc-files","DBC Files","The DBC file format used to describe the contents of CAN messages — nodes, messages, signals, comments, and value tables.",18,{"_path":41,"_dir":97,"_draft":98,"_partial":98,"_locale":99,"title":6,"description":42,"part":43,"chapterNumber":44,"body":100,"_type":138,"_id":139,"_source":140,"_file":141,"_extension":142},"diagnostics",false,"",{"type":101,"children":102,"toc":136},"root",[103,111,117,122,127],{"type":104,"tag":105,"props":106,"children":108},"element","h1",{"id":107},"introduction",[109],{"type":110,"value":6},"text",{"type":104,"tag":112,"props":113,"children":114},"p",{},[115],{"type":110,"value":116},"This part of the knowledge base discusses a variety of diagnostic protocols. First, ISO-TP is explained — a protocol layer to send payloads larger than 8 bytes over CAN. ISO-TP is used as a transport layer in many diagnostic protocols. While ISO-TP is the most common transport layer, VW TP2.0 is also used in some Volkswagen vehicles and is explained as well.",{"type":104,"tag":112,"props":118,"children":119},{},[120],{"type":110,"value":121},"Then OBD (On-Board Diagnostics) is discussed — the first standardized diagnostic protocol, intended for emissions-related testing. OBD evolved into OBD-II, which is still in use today. UDS is the most common enhanced diagnostic protocol in modern cars, allowing functionality such as reading live values, running routines, unlocking security levels, and reflashing ECUs. It can also be used over networks other than CAN.",{"type":104,"tag":112,"props":123,"children":124},{},[125],{"type":110,"value":126},"Finally, CCP (CAN Calibration Protocol) and XCP (Universal Measurement and Calibration Protocol) are introduced. These are more low-level debugging interfaces meant for use during final calibration or testing of an ECU. However, in practice they are sometimes left enabled or can be enabled by an attacker. They are useful protocols to extract firmware or read RAM to help with reverse engineering or exploit development.",{"type":104,"tag":112,"props":128,"children":129},{},[130],{"type":104,"tag":131,"props":132,"children":135},"img",{"alt":133,"src":134},"Schematic representation of how diagnostic requests are transported using ISO-TP over CAN.","/images/knowledge-base/diagnostics/can_isotp_uds.png",[],{"title":99,"searchDepth":14,"depth":14,"links":137},[],"markdown","content:7.knowledge-base:2.diagnostics:1.introduction.md","content","7.knowledge-base/2.diagnostics/1.introduction.md","md",1778093002000]