CAN Bus Reverse Engineering - A (Very) Simple Intro

Before we get practical, let's illustrate how vehicle reverse engineering can be done.

First, note that vehicle sniffing has many applications - see below examples:

• Adding custom functionality to mobile machinery (proprietary J1939 decoding)
• Estimating productivity of forestry machinery (hacking J1939 data)
• Tracking the performance of a Tesla EV battery over time (EV hacking)
• Building a vehicle predictive maintenance model (proprietary OBD2 decoding)
• Hacking a car to show off to engineering buddies (classic)
• Establishing a telematics system or predictive maintenance setup as a non-OEM

Despite the diversity, we've generalized 3 core steps to vehicle hacking below:

1# LINK PHYSICAL EVENT TO MESSAGE CAN ID

Let's say you desperately need to log data from your windscreen wipers. To do so, you first need to identify what CAN ID contains your wiper data. Two methods exist for this:

1. Log CAN data to an SD - and compare vs. the timing of physical events (e.g. wiper on/off)
2. Stream CAN data live - and look for correlations via CAN sniffer software in real-time

This way you can "trim away" irrelevant IDs until you find the wiper CAN ID.

2# IDENTIFY CAN SIGNAL BIT POSITION & LENGTH

Great! Now you know what CAN ID reacts to your windscreen wipers.

Next, you'll locate the wiper CAN signal amongst the 64 CAN data bits.

To do so, analyse how the data bits react to the physical event (e.g. starting byte-by-byte).

Example: You may find that Byte 2 consistently changes between two values when the wipers are on/off - while all other bytes stay constant. Byte 2 is then (probably) the wiper signal.

3# IDENTIFY SCALE & OFFSET

Once you know the bit position & length of your CAN signal, it's time to "scale it" via a linear combination of Offset and Scale factors. If this is new to you, check our intro to CAN bus.

In the wiper case, the signal may be a boolean (on/off) - and you'd set Offset = 0 and Scale = 1.

In other cases, like RPM, you'd follow below steps:

• Plot the decimal data vs. a "manual" plot of data on the real RPM vs. time
• Next, assume a zero offset, "overlay" the two plots and "match them" by adjusting the Scale
• Finally, set the Offset to ensure a clean overlap between the graphs

This is easier if you can log smooth transitions from MIN to MAX of the parameter.

Also, if your parameters have OBD2 equivalents (e.g. RPM, Speed, ...), it's helpful to compare the logged OBD2 data for faster analysis.

While the above is heavily simplified, it should be clear:

Hacking even a single CAN bus signal takes skill - and time!

We suggest you store the decoded CAN conversion rules in a CAN .DBC file for easy use in CAN software.

For more detailed tutorials on CAN hacking, check the below links:

CAN bus hacking - guides & tutorials

Below, we list a range of useful guides for vehicle reverse engineering:

• Hackaday: Great set beginner tutorials on how to hack your CAN bus
• Kenny Kuchera: Cool step-by-step guide to hacking a car (incl. good deep-dives)
• Alexandre Blin: Awesome 'backup camera' vehicle hack with an exciting walkthrough
• Open Garages: Great video intros to CAN bus reverse engineering

Next, let's show how you can do step 1# and 2# in practice using the CLX000 in Wireshark:

Streaming Raw CAN Bus Data in Wireshark

For a guide on how to get started with Wireshark, see our article on streaming OBD2 data with Wireshark. 

You'll need the below:

• A CLX000 CAN analyzer (either a CL1000, CL2000 or CL3000)
• A DB9-to-OBD2 connector (for car hacking) or DB9-to-J1939 connector (for heavy duty)
• Wireshark 2.4 (enable 'Wireshark 1' during install)
• Our free CANvas software (this auto-installs the Wireshark plugin)

---

How To Reverse Engineer CAN Data using 'CAN Live'

Now you may be thinking: "Wow, that's a lot of CAN packets!"

By default, Wireshark simply provides you with an unfiltered stream of raw CAN bus data.

You've got many tools for analyzing this, incl. filtering, column configuration, plots and more.

However, here we focus on the 'CAN Live' plugin feature - which allows you to show a 'trace' of your data.

To open this view, click Statistics/CAN Live IDs when streaming - this brings up the below window:

As evident, this view shows one row for each broadcasted CAN ID - providing a great overview for CAN bus hacking.

For each CAN ID, a number of data fields are shown:

• Count: Number of times the CAN ID has been observed in the data
• Frame No: Frame number of the latest observation of the ID
• Time (s): Time of the latest observation of the ID (since start of streaming)
• Period Time (s): Time between the latest ID and the previous ID observation
• CAN ID: HEX value of the CAN ID
• D0-D7: The 8 data bytes of the CAN message (in HEX)
• Frame No. (Last Change): Frame of last different valued occurrence of the ID 
• Time (Last Change) (s): Time since start-of-streaming and the latest change in the ID

Notice the blue colorization above?

When a CAN bus data byte changes, it's colored blue - and the color fades as the byte stays constant.

This is useful when comparing raw CAN bus data versus physical events (e.g. turning on the car wipers).

In fact, this type of CAN sniffer software is vital to reverse engineering steps 1# and 2#.

---

Hiding CAN IDs to simplify CAN bus reverse engineering

Finally, for details on configuring the CAN Live settings click below:

Configure the CAN Live Settings

---

Why use the CLX000 for CAN Sniffing?

A number of features makes the CLX000 CAN bus analyzer great for CAN sniffing:

Ready to start reverse engineering your CAN bus?
Then get your CLX000 CAN sniffer below!

 Liked this article? Please share!

• 
• 
• 
• 
• 

---

RECOMMENDED FOR YOU