[{"data":1,"prerenderedAt":256},["Reactive",2],{"kb-nav":3,"kb-doc":96},[4,10,15,20,25,30,35,40,45,50,55,60,65,70,75,81,86,91],{"_path":5,"title":6,"description":7,"part":8,"chapterNumber":9},"/knowledge-base/networks/introduction","Introduction","Overview of the communication networks used in modern vehicles, from LIN to Automotive Ethernet.","Vehicle Networks & Protocols",1,{"_path":11,"title":12,"description":13,"part":8,"chapterNumber":14},"/knowledge-base/networks/vehicle-documentation","Vehicle Documentation","Where to find manufacturer wiring diagrams, J2534 passthrough devices, and the different types of diagrams that are useful when researching a vehicle.",2,{"_path":16,"title":17,"description":18,"part":8,"chapterNumber":19},"/knowledge-base/networks/lin-bus","Local Interconnect Network (LIN)","Local Interconnect Network — a single-wire low-speed bus used as a low-cost alternative to CAN for non-critical body electronics.",3,{"_path":21,"title":22,"description":23,"part":8,"chapterNumber":24},"/knowledge-base/networks/controller-area-network","Controller Area Network (CAN)","ISO 11898 — the differential bus that became the backbone of automotive networking. Frames, bit timing, errors, CAN FD, message contents, and practical attacks.",4,{"_path":26,"title":27,"description":28,"part":8,"chapterNumber":29},"/knowledge-base/networks/flexray","FlexRay","Time-triggered, deterministic automotive bus standardized as ISO 17458, designed for higher speeds and drive-by-wire systems.",5,{"_path":31,"title":32,"description":33,"part":8,"chapterNumber":34},"/knowledge-base/networks/automotive-ethernet","Automotive Ethernet","Automotive variants of Ethernet — 100BASE-T1, 1000BASE-T1, and 10BASE-T1S — built around single twisted-pair cabling and strict EMC requirements.",6,{"_path":36,"title":37,"description":38,"part":8,"chapterNumber":39},"/knowledge-base/networks/secure-onboard-communication","Secure Onboard Communication (SecOC)","AUTOSAR's standard for cryptographic message authentication on in-vehicle networks — freshness values, MAC computation and key management.",7,{"_path":41,"title":6,"description":42,"part":43,"chapterNumber":44},"/knowledge-base/diagnostics/introduction","Overview of automotive diagnostic protocols — ISO-TP, OBD-II, UDS, CCP and XCP — and how they layer on top of CAN.","Diagnostic Protocols",8,{"_path":46,"title":47,"description":48,"part":43,"chapterNumber":49},"/knowledge-base/diagnostics/iso-tp","ISO 15765-2 (ISO-TP)","ISO 15765-2 transport layer for sending diagnostic payloads larger than 8 bytes over CAN — single, first, consecutive and flow-control frames.",9,{"_path":51,"title":52,"description":53,"part":43,"chapterNumber":54},"/knowledge-base/diagnostics/vw-tp20","VW Transport Protocol 2.0 (TP 2.0)","Volkswagen's pre-ISO-TP transport layer for KWP2000 over CAN — channel setup, parameter negotiation, and the data exchange counter scheme.",10,{"_path":56,"title":57,"description":58,"part":43,"chapterNumber":59},"/knowledge-base/diagnostics/obd-ii","On-board diagnostics (OBD-II)","On-Board Diagnostics II — the J1962 connector, signal protocols, service IDs, parameter IDs, and DTC encoding.",11,{"_path":61,"title":62,"description":63,"part":43,"chapterNumber":64},"/knowledge-base/diagnostics/uds","Unified Diagnostic Services (UDS)","ISO 14229-1 — the modern diagnostic protocol for sessions, Read/Write DID, Security Access, Routine Control and firmware Request Download / Upload.",12,{"_path":66,"title":67,"description":68,"part":43,"chapterNumber":69},"/knowledge-base/diagnostics/ccp","CAN Calibration Protocol (CCP)","A low-level debug/calibration protocol over CAN — Command Receive Object, Data Transfer Object, and the commands used to read and write ECU memory.",13,{"_path":71,"title":72,"description":73,"part":43,"chapterNumber":74},"/knowledge-base/diagnostics/xcp","Universal Measurement and Calibration Protocol (XCP)","ASAM XCP — successor to CCP supporting CAN, CAN FD, FlexRay, and Ethernet, with synchronous data acquisition, stimulation, and calibration.",14,{"_path":76,"title":77,"description":78,"part":79,"chapterNumber":80},"/knowledge-base/tools/can-adapters","CAN Adapters","USB-to-CAN adapters — comma.ai red panda and PEAK-System PCAN — and the standard DB-9 pinout for CAN.","Tools",15,{"_path":82,"title":83,"description":84,"part":79,"chapterNumber":85},"/knowledge-base/tools/can-analysis","CAN Analysis","Tools for analysing and reverse-engineering CAN traffic — comma.ai cabana, SavyCAN, VehicleSpy, and Wireshark.",16,{"_path":87,"title":88,"description":89,"part":79,"chapterNumber":90},"/knowledge-base/tools/scripting","Scripting","Python libraries and CLI tools for talking to a CAN bus — comma.ai panda, SocketCAN can-utils, python-can, and Scapy with ISO-TP and UDS examples.",17,{"_path":92,"title":93,"description":94,"part":79,"chapterNumber":95},"/knowledge-base/tools/dbc-files","DBC Files","The DBC file format used to describe the contents of CAN messages — nodes, messages, signals, comments, and value tables.",18,{"_path":82,"_dir":97,"_draft":98,"_partial":98,"_locale":99,"title":83,"description":84,"part":79,"chapterNumber":85,"body":100,"_type":251,"_id":252,"_source":253,"_file":254,"_extension":255},"tools",false,"",{"type":101,"children":102,"toc":245},"root",[103,111,118,124,133,138,143,148,156,164,170,175,183,189,194,199,207,215,221,237],{"type":104,"tag":105,"props":106,"children":108},"element","h1",{"id":107},"can-analysis",[109],{"type":110,"value":83},"text",{"type":104,"tag":112,"props":113,"children":115},"h2",{"id":114},"commaai-cabana",[116],{"type":110,"value":117},"comma.ai cabana",{"type":104,"tag":119,"props":120,"children":121},"p",{},[122],{"type":110,"value":123},"cabana is a CAN analysis tool and DBC editor that runs on Linux and macOS. It's designed as a CAN reverse-engineering tool and has multiple ways to help you find signals. In the left column it shows the raw CAN frames, and highlights any changes. By suppressing highlighting in bytes that change all the time, and then performing a vehicle action, it's easy to spot the messages that relate to that action.",{"type":104,"tag":119,"props":125,"children":126},{},[127],{"type":104,"tag":128,"props":129,"children":132},"img",{"alt":130,"src":131},"Screenshot showing the cabana UI.","/images/knowledge-base/networks/cabana-full.png",[],{"type":104,"tag":119,"props":134,"children":135},{},[136],{"type":110,"value":137},"After selecting the message, it's possible to see where in the payload of the message the corresponding signal can be found. The bits that change more often are highlighted in a darker shade than bits that change less often. Since the LSB in a signal changes more often than the MSB, it will be colored darker.",{"type":104,"tag":119,"props":139,"children":140},{},[141],{"type":110,"value":142},"Once signals are found, cabana has versatile graphing options. This allows the user to correlate different signals and see how they change over time. For example, you can see that the left wheel spins faster than the right wheel when the angle of the steering wheel changes and the car starts turning left.",{"type":104,"tag":119,"props":144,"children":145},{},[146],{"type":110,"value":147},"cabana has native support for the comma.ai panda, but also supports SocketCAN and recorded routes from a comma.ai openpilot device.",{"type":104,"tag":119,"props":149,"children":150},{},[151],{"type":104,"tag":128,"props":152,"children":155},{"alt":153,"src":154},"cabana — bit-level view.","/images/knowledge-base/networks/cabana-bits.png",[],{"type":104,"tag":119,"props":157,"children":158},{},[159],{"type":104,"tag":128,"props":160,"children":163},{"alt":161,"src":162},"cabana — charts view.","/images/knowledge-base/networks/cabana-graphs.png",[],{"type":104,"tag":112,"props":165,"children":167},{"id":166},"savycan",[168],{"type":110,"value":169},"SavyCAN",{"type":104,"tag":119,"props":171,"children":172},{},[173],{"type":110,"value":174},"SavyCAN is another open source Qt-based CAN bus analyzer. The UX is a bit more rudimentary, but it has many of the same features as cabana to help with reverse engineering. It also has some nice tools such as an ISO-TP decoder, and can also actively send messages on the bus to fuzz signals or scan for UDS services.",{"type":104,"tag":119,"props":176,"children":177},{},[178],{"type":104,"tag":128,"props":179,"children":182},{"alt":180,"src":181},"Screenshot showing the SavyCAN UI.","/images/knowledge-base/networks/savycan.jpg",[],{"type":104,"tag":112,"props":184,"children":186},{"id":185},"vehiclespy",[187],{"type":110,"value":188},"VehicleSpy",{"type":104,"tag":119,"props":190,"children":191},{},[192],{"type":110,"value":193},"VehicleSpy is a tool made by Intrepid Control Systems. Besides reverse engineering it can also be used to build dashboards, or create automations using their graphical programming tool.",{"type":104,"tag":119,"props":195,"children":196},{},[197],{"type":110,"value":198},"VehicleSpy X is an alternative for the older VehicleSpy 3. It has a more modern UI, cross-platform support, and Python scripting support. However, it seems more geared toward testing and automation than reverse engineering.",{"type":104,"tag":119,"props":200,"children":201},{},[202],{"type":104,"tag":128,"props":203,"children":206},{"alt":204,"src":205},"VehicleSpy 3 — building dashboards.","/images/knowledge-base/networks/vehiclespy-dashboard.png",[],{"type":104,"tag":119,"props":208,"children":209},{},[210],{"type":104,"tag":128,"props":211,"children":214},{"alt":212,"src":213},"VehicleSpy 3 — graphical programming.","/images/knowledge-base/networks/vehiclespy-scripting.png",[],{"type":104,"tag":112,"props":216,"children":218},{"id":217},"wireshark",[219],{"type":110,"value":220},"Wireshark",{"type":104,"tag":119,"props":222,"children":223},{},[224,226,235],{"type":110,"value":225},"Wireshark can also be used to analyze CAN traffic. It has a CAN dissector, and can also decode ISO-TP messages. However, it's not as user-friendly as the other tools mentioned in this chapter, and is not really meant for finding signals. It can be useful for analyzing diagnostic protocols. There is a ",{"type":104,"tag":227,"props":228,"children":232},"a",{"href":229,"rel":230},"https://canlogger.csselectronics.com/downloads.php?q=wireshark",[231],"nofollow",[233],{"type":110,"value":234},"plugin from CSS Electronics",{"type":110,"value":236}," that adds some of the missing features such as signal decoding and graphing.",{"type":104,"tag":119,"props":238,"children":239},{},[240],{"type":104,"tag":128,"props":241,"children":244},{"alt":242,"src":243},"Screenshot showing the Wireshark UI decoding ISO-TP.","/images/knowledge-base/networks/wireshark.png",[],{"title":99,"searchDepth":14,"depth":14,"links":246},[247,248,249,250],{"id":114,"depth":14,"text":117},{"id":166,"depth":14,"text":169},{"id":185,"depth":14,"text":188},{"id":217,"depth":14,"text":220},"markdown","content:7.knowledge-base:3.tools:2.can-analysis.md","content","7.knowledge-base/3.tools/2.can-analysis.md","md",1778093002016]