CAN Bus Sniffer - Reverse Engineer Vehicle Data [SavvyCAN/Wireshark]

Once you know the bit position/length of your signal, it is time to "scale it" via a linear combination of offset and scale. If this is unfamiliar, check our intro to CAN bus. In short, the equation is as below:

physical_value = offset + scale * raw_value_decimal

In the wiper case, the signal may be a boolean (on/off) - and you may simply set the offset to 0 and scale to 1.

For 'continuous' variables (speed, SoC, RPM, ...), you may follow below steps:

1. Log CAN data while driving and recording the 'true parameter value' from e.g. the vehicle dashboard using a camera
2. Create a plot in e.g. Excel of the unscaled decimal value of the signal vs. the (manually) timestamped true values
3. Set a zero offset, overlay the two plots and adjust the scale to "match them"
4. Finally, update the offset to ensure a direct overlap between the graphs

The above process is easier if you can log smooth transitions from MIN to MAX of the parameter. Also, if your parameter has an OBD2 equivalent (e.g. RPM, Speed, ...), it can be helpful to compare vs. the logged OBD2 data for faster analysis.

Below, we list a range of useful guides for vehicle reverse engineering:

• Hackaday: Great set beginner tutorials on how to hack your CAN bus
• Kenny Kuchera: Cool step-by-step guide to hacking a car (incl. good deep-dives)
• Alexandre Blin: Awesome 'backup camera' vehicle hack with an exciting walkthrough

Some online blogs and examples of automotive hacks use Arduino modules and CAN bus shields to build low cost CAN bus decoders. In particular, this may appeal to hobbyists who are familiar with Arduino boards and CAN bus shields. Similarly, various Raspberry Pi modules with CAN bus modifications exist that can serve as CAN bus sniffers. There are even examples of ELM327 modules being used for CAN sniffing.

Generally, modules like the Arduino and Raspberry Pi are versatile - but not designed specifically as CAN bus interfaces.

As such, the CLX000 offers a great alternative:

• The CLX000 is plug & play with 100% free software tools, letting you quickly focus on CAN sniffing
• You can easily configure the device - e.g. with CAN ID filters to focus on specific messages of interest
• The SavvyCAN/Wireshark tools provide a user-friendly GUI for analyzing the raw CAN data - and DBC decoding it
• Once you've identified relevant signals, you can create a DBC and use the free SavvyCAN software to decode CLX000 log files
• The CLX000 CAN bus analyzer is both a CAN logger and CAN-to-USB interface - making it a flexible CAN hacking tool
• We provide 100% free and fast support if you have technical questions regarding the CLX000 or software
• The price of the CLX000 is low - and typically lower than the Arduino/Rasperry Pi if the time-to-get-started is considered

If you are in doubt what solution is best for you, please contact us.

As part of reverse engineering your car data, you may want to test whether a specific CAN frame can be used to trigger certain behavior in your vehicle. For example, you may want to unlock your door, blow your horn, turn on the wipers, toggle the radio or manipulate your car dashboard.

To do this, you'll need to send specific CAN frames into your CAN bus with the right CAN ID and data payload. If you're successful, the vehicle may respond accordingly - though some cars may have functionality that block such attempts.

The CLX000 lets you setup custom transmit lists for periodic transmission - as well as real-time control of data transmission via SavvyCAN (via USB). With this, you can e.g. send custom CAN frames, playback log files into your CAN bus - or perform advanced fuzzing. With that said, we recommend that you only do so if you know what you're doing. Generally speaking, it's one thing to use CAN sniffing and CAN bus decoders to extract information for the purpose of e.g. visualizing your car data - it's very different (and risky) to use CAN hardware to try and control your vehicle.

An alternative use case for the CLX000's ability to transmit CAN data frames is to request OBD2 data. ODB2 data can offer easy access to continuous parameters like speed, temperatures, rpm etc. - which may provide useful for side-by-side comparisons when you're e.g. trying to reverse engineer correlated data parameters.

Originally, the CLX000 only integrated with Wireshark, for which we developed a set of useful features for CAN reverse engineering. Since then, we have added SavvyCAN to our list of integrations - and we generally believe it is superior for most CAN bus reverse engineering use cases. However, if you e.g. have prior experience using Wireshark, you can of course still use that tool. Below is an example of how to achieve similar steps as shown for SavvyCAN above.

In the following, we illustrate how you can do the reverse engineering steps #1 and #2 using the CLX000 in Wireshark.

Streaming raw CAN data

When you first start streaming raw CAN data with the CLX000, you will get a lot of CAN packets on your screen.

Wireshark provides multiple tools for analyzing this view (filters, column configuration, plots) - but none of them are ideal for the initial reverse engineering efforts.

Using the 'CAN Live' feature

Instead, we recommend to use the CAN Live Wireshark plugin feature - which lets you show a 'trace' of your data.

To open this, click Statistics/CAN Live IDs when streaming to bring up the trace window. As evident, this view shows one row for each CAN ID - providing a great overview for CAN hacking.

When a CAN bus data byte changes, it is colored blue - and the color fades as the byte stays constant. This provides immediate visual feedback when comparing raw CAN bus data patterns versus physical events (e.g. turning on the car wipers). In practice, this helps turn Wireshark into a powerful CAN bus decoder software tool.