Notice the blue colorization in the video / images?
These reflect when a given CAN bus data byte is changing value and fade out as the byte stays constant. This is useful when comparing the CAN bus data versus physical events (e.g. turning on the car wipers).
Analyzing these patterns comprise the basics of CAN bus hacking.
Hiding CAN IDs to simplify CAN bus reverse engineering
Still, that's quite a lot of data to review!
Luckily, CAN Live allows you to hide CAN IDs that are not relevant to your analysis!
Simply click the Hide check-mark to the left and the ID will disappear until you reopen the window.
This allows you to reduce complexity and get a clean slate for physical event testing.
For example, you can hide all the IDs that appear when your car is standing still with the ignition turned on.
Once you then start driving, you will start to see IDs related to that “delta event” alone - which makes it far easier to separate IDs.
Another cool feature is “auto trimming” which is turned on by default:
This feature removes all IDs that do not have changing data bytes for a specified amount of time to help ensure focus.
By leveraging these features, you'll be a pro CAN bus decoder in no time!