CAN Analysis

comma.ai cabana

cabana is a CAN analysis tool and DBC editor that runs on Linux and macOS. It's designed as a CAN reverse-engineering tool and has multiple ways to help you find signals. In the left column it shows the raw CAN frames, and highlights any changes. By suppressing highlighting in bytes that change all the time, and then performing a vehicle action, it's easy to spot the messages that relate to that action.

After selecting the message, it's possible to see where in the payload of the message the corresponding signal can be found. The bits that change more often are highlighted in a darker shade than bits that change less often. Since the LSB in a signal changes more often than the MSB, it will be colored darker.

Once signals are found, cabana has versatile graphing options. This allows the user to correlate different signals and see how they change over time. For example, you can see that the left wheel spins faster than the right wheel when the angle of the steering wheel changes and the car starts turning left.

cabana has native support for the comma.ai panda, but also supports SocketCAN and recorded routes from a comma.ai openpilot device.

SavyCAN

SavyCAN is another open source Qt-based CAN bus analyzer. The UX is a bit more rudimentary, but it has many of the same features as cabana to help with reverse engineering. It also has some nice tools such as an ISO-TP decoder, and can also actively send messages on the bus to fuzz signals or scan for UDS services.

VehicleSpy

VehicleSpy is a tool made by Intrepid Control Systems. Besides reverse engineering it can also be used to build dashboards, or create automations using their graphical programming tool.

VehicleSpy X is an alternative for the older VehicleSpy 3. It has a more modern UI, cross-platform support, and Python scripting support. However, it seems more geared toward testing and automation than reverse engineering.

Wireshark

Wireshark can also be used to analyze CAN traffic. It has a CAN dissector, and can also decode ISO-TP messages. However, it's not as user-friendly as the other tools mentioned in this chapter, and is not really meant for finding signals. It can be useful for analyzing diagnostic protocols. There is a plugin from CSS Electronics that adds some of the missing features such as signal decoding and graphing.