start	end	text
10410	19510	Got the correct audio set up here. So just one second...
30460	35860	There we go. Mr. Liali.
38140	41760	Hey, how's it going, John? Good. How are you, sir?
43260	46900	I'm good. Sorry about the background noise. Hopefully it's not too bad.
47960	50980	No, I think we'll be able to deal with that.
54140	55100	Excellent.
60630	63750	So it's your show. What can you tell us about
63750	67830	fundamentals of diagnostic requests over CAN bus?
72450	78410	So this is a new one for me. Not diagnostic over CAN, but trying to present from a garage
78410	81790	that doesn't have air conditioning. So wish me some luck.
82410	88550	So right now I'm in the Car Hacking Village garage that we're hosting the Village. So
88550	96530	behind me, you'll hear the emcee for our 101 talk. So there's a little bit of crosstalk,
96530	102050	but once that's over, it'll just be me. Hello, everybody. My name is Robert Liali.
102050	110770	I also go by CarPlucker. So you'll find me on the Discord right now. I have actually two different
110770	115590	names going on. One so I can get the experience of the user, and one so I have the experience
115590	121630	of the Village user. So you'll see two CarPluckers, C-A-R-F-U-C-A-R. So just go ahead and DM
122530	126850	any one of those. I should get that if you guys have any follow-up questions.
127130	132770	I'm also in the voice channel right now. I've muted myself, but later when I take some questions,
132770	137110	I'll make sure I unmute myself so I can hear some of the questions that might be coming up.
137110	143330	I won't be able to respond to them because I don't have... I'm as a normal user, but I'll
143330	149610	try to type it in there, and maybe as John is rebroadcasting, I'll try to get some of that
149610	154590	information out. So let me go ahead and get started and just kind of go over real quickly
154590	162850	what is Diagnostics. So I don't have a very perfect presentation here, but I do have an
162850	168850	old presentation that I've given before. So let me just close this up and just kind of go over
168850	175690	the concepts of Diagnostics as it relates to vehicle systems. So Diagnostics is a layer
175690	181590	of communications that allow you to connect and send requests directly to
182630	190190	vehicle controllers, right? So one of the challenges though is Canvas has a very limited
190190	195610	amount of space that you can put data bytes in. Specifically, you can't send more than eight
195610	204830	data bytes. So in order to do that, they need to send... they need to send about 4,095 bytes. You
204830	210370	have to use other protocols. So specifically, most Diagnostics in vehicle systems use a protocol
210370	219290	called ISO 15765-2. This is sometimes referred to as the transport protocol or ISOTP
219820	225590	or CAN ISOTP sometimes. This is the transport protocol that nearly every Diagnostic protocol
225590	232230	builds upon. So this is that middle layer or transport layer that bridges the CAN bus limitations
232230	239390	to allow for longer message lengths. So a lot of people and a lot of companies
240770	248850	GM, Ford, Toyota, everybody uses this... seems to use this protocol now for all of their Diagnostic
248850	253930	protocols. Now there are a handful of different Diagnostic or what we call high-level protocols
253930	259770	or application layer protocols. I'm going to focus on one. It's called UDS. And the reason
259770	266810	why I'm going to focus on UDS is because it's the most well-known and highest used one.
266810	272190	Almost all Diagnostic protocols are kind of based off this particular one. So what I want to do is
272190	278570	I'm going to take you through a process. Now this is a process that is actually related to OBD2,
278570	285390	but this particular process takes apart a Diagnostic CAN message. So here's a flow
285390	291250	for Diagnostic CAN messages. Let me just... I have two screens, so this is coming across
291250	303850	the wrong screen. So let me just turn that feature off so that we can play this back on
303850	313490	the main screen. I would like to run the slideshow from the current slide, but I don't want presenter
313490	321010	mode. So let me just find out. No, I don't want that. I want to do that out of the primary monitor
321690	326950	and from the current slide. So this should allow us to see this a little bit better.
327310	333550	So I'm going to take you through the individual process, just sort of on a slide, and then I'm
333550	337370	going to take you through it on an actual vehicle, but actually going to take you through on the
337370	342750	vehicles that we're using for the Car Hacking Village challenges today. So
343950	351230	here is ISO 15765-2. There are high-level protocols that run on top of it. I'm going to
351230	357190	talk about specifically the OBD2, in this case this will be OBD2 Diagnostic Protocol, sometimes
357190	365370	called J1979. So this is sort of like a standard protocol family that's across all vehicles,
365370	370930	makes and models that are on the road today. So let's take a look at a flow of messages,
370930	376010	the example of flow. So I'm going to take a really simple one that really illustrates every
376650	383210	facet of this particular protocol, ISO 15765-2, specifically the VIN request. So the VIN request
383210	393670	has the two bytes. The two bytes are 09 and 02. So 09 is what we call the service byte.
394230	399270	The service byte is essentially the function that we're asking the controller to perform.
399270	403670	In this case, we'll ask the engine controller, because every vehicle tends to have an engine
403670	410210	controller. We'll ask the engine controller, hey, what is the VIN? And the first part of every
410210	414810	request is the service or function you want it to perform. Now there's a list of all of these
414810	423150	functions, specifically OBD2 functions. If you just google OBD2 services or OBDIDS, you'll see
423670	431270	Wikipedia has a very good list of the individual services called modes that are available for OBD2.
431270	441650	So service 09 is a request service. The function or sub-function 02 is the parameter ID for the
441650	446370	VIN. So if I were to change that from 02 to 01, I would get the VIN. I'd get something else
446970	451830	from the controller. But it'd still be a request, but for a different parameter.
451830	459270	So here's my VIN request, 0902. And I'm going to go ahead and move this up to my VIN request.
459270	465070	Look at that. Pretty exciting. Kind of came through the video. I'm also monitoring the
465070	469390	video. It looks like you guys saw a little bit of animation. Spent a whole two hours
469390	475570	working on that animation, so give me some credit there. So there's our request, 0902.
476430	481630	Everybody with me? Raise your hand if you are. Okay, good. Excellent. I like to see that.
481630	486230	So next, we have our VIN response. So you'll see our VIN response is significantly larger
486230	492010	than our request, because it includes our information about the success of the request,
492010	497850	information about how the request is encoded, and the actual VIN characters in ASCII databytes.
497850	503610	So the VIN on most vehicles, in fact, vehicles in the United States, are 17 characters long.
503610	508670	So we'll have at least 17 characters to encode the VIN. In fact, in this case, we'll have 20
508670	517630	characters, 17 characters plus three overhead bytes that are happening. So we see the 0902,
517630	523990	but now our response will come back, and you'll see it says 4902. So as you guessed it,
523990	529450	that first databyte is, again, a service indicator, so a service byte. But it's not the service or
529450	534350	function that we perform, but rather the response or the information that's coming back from the
534350	541630	service itself. And rather, will we see a successful request or not? And each time we see 49,
541630	547270	or 40 hex more than our original service ID, we know that this is a positive response. So in this
547270	553930	case, this request that we're getting, that we sent out, was successful. Our response is positive,
553930	560750	because we see 40 hex more than our original request. The 02 is just an echo of the original
560750	565890	parameter ID, or PID, in this case, the VIN request. So even if we didn't see what the initial
565890	573350	response was, we could tell that this wasn't that, indeed, a response to the VIN request.
573390	581030	The next byte, the 01, is actually an encoder to let us know that this is actually an ASCII-encoded
581030	588110	parameter. So now one challenge we have here is this is now 20 bytes. If you know anything about
588110	594150	CAN bus, CAN bus only allows 8 bytes per frame. So we have to do something about this. If we can't
594150	598590	fit this into a CAN bus frame, we have to segment it. We have to break it apart.
598830	605210	And so, how do we do that? So we take the first part of the message, we take the second part of
605210	609110	the message, then we take the third part of the message and we break them across three different
609110	616110	frames. Okay? So now we have three frames of CAN bus messages. So here they are,
616990	622070	490201C. It's the same frames, but we had to break them up into different frames. Okay? So
623610	629770	I'm going to go back. I'll reiterate that we are sending this message to the engine control system.
629770	636010	So since it's to the engine controller, we need to identify each frame. Each frame identifier
636510	641590	is essentially part of the arbitration ID of a CAN message. Every CAN message has an arbitration ID,
641590	645550	and inside of that arbitration ID is the identifier for the controller that we're
645550	652370	talking to. In this case, we're talking to the engine controller, which is legislated at 7E0
652370	661130	for 11-bit CAN bus system. So since we're talking on an 11-bit CAN bus system, we'll say 7E0 and
661130	669290	then we'll say 0902. Okay. Awesome. Here we have a message that goes across. But we need to add
669290	675050	some more information specifically about how large this particular message is going to be.
675050	679950	So then what we do is we're encoding something called PCI data or program control information.
680370	688510	So the PCI data could be the frame type specifically. So here we put a 0 in. A 0
688510	696050	is a frame type. That frame type 0 is a single frame message. So right away in the first data
696050	701910	byte of this particular frame, we know that this message is going to be a single frame message
701910	707870	because there's a 0 encoded in the first nibble of the first data byte of the frame.
708750	715150	The second part of that particular nibble, the second nibble of that byte, is the data length.
715150	720550	So it indicates how many bytes this particular message is going to be. In this case, since our
720550	726830	message is 0902, we have two bytes in our message, we put a 2 in that data byte, indicating that
726830	735910	there's two bytes of data. Really simple. 02. Very obvious if you think about it. Here we have a 020902.
736310	741550	And now we'll do one more thing. We'll do this thing called padding. Padding is a way of filling
741550	747850	in the data. Not all cars require this, but I always recommend it because some cars do require it.
747850	753550	And later what I do in my demo, I'm going to show you guys how that is the case. So now we fill in
753550	758250	the rest of this data with padding. The reason why we know it's padding, because again, we go back to
758250	764250	the beginning of the data frame, and we see the 02. That 2 is an indicator of how big this
764250	770070	particular message is. So we count one, two bytes, 0902. Those are our two bytes of our message.
770070	775510	Anything after that must be padding, right? Because it's not part of the message itself.
775510	780850	So even if there were data there, we could ignore it because it's not part of the actual message.
780950	786790	All right, so we send a request out. Now we should get a response back.
786790	791610	Our response ID has got to be different than our request ID, but it's usually just a little bit
791610	795890	different. Sometimes it's significantly different, but sometimes it's very much the same. In this
795890	803350	case, our response ID will be 8 more than our request ID. So 70E0 returns a 70E8. This is
803350	809550	part of the OBD2 specification for emissions-related controllers, so that's just very
809550	815610	common, as you'll see. So again, we'll have a frame type, just like we had before in the first nibble
815610	821030	of the first byte of the last frame. We do the same thing here. We have a one to indicate that
821030	829010	this is indeed a multi-frame message. So one equals multi-frame. Just like before, we had a
829010	835910	data length, but since our multi-frame messages can be over 4,000 bytes, 4,095 to be exact,
835910	841650	because we can have 4,095 bytes, we need more bits to encode that information. So the four bits,
841650	847330	or one nibble, that we saw in the single frame message just before is not enough. We need more
847330	853690	bits. So we expand. Now that we use those four bits, but we also use the next eight bits as well,
853690	861930	giving us a total of 12 bits, so 2 to the power of 12 total number of values that we can have,
861930	869970	so 4,095. So now we know how many bytes we can have. So I put a 014 to indicate that this is
869970	877230	actually going to be 20 bytes long. So 014 is hex. That equals 20 in decimal. And then we fill in the
877230	885770	rest of the actual message itself. So recall the VIN message starts at the 49, 02, 01, 31, 32, 33.
885770	892410	So that's the data that's going to be encoded in the VIN. So we just sent a request to a controller.
892410	897910	It just responded back to us saying it's going to send us a multi-frame response. What if we can't
897910	905150	handle a multi-frame response? Or what if we need to reserve a buffer and we need to do that quickly?
905150	912090	We need to give some feedback to the controller saying, hey, listen, I'm either able to do this or
912090	915750	I'm not able to do this. So that's what we call our flow control. So we're going to send another
915750	922750	message back to the controller to let it know that the kind of the rules of how it's allowed
922750	928530	to transmit the rest of the data back to us. So we'll send a 70, 0 back to the controller.
928530	933970	And then we'll send a 3 for the frame type indicating this is a flow control message.
933970	939110	So we're going to send a flow control response back to it. Now, we have to do this within 100
939110	944010	milliseconds of the request that we sent. So you have to do this programmatically. You'll never be
944010	948750	able to do this by hand or manually. So if you're typing in, like, send flow control or something
948750	953470	like that, you'll never get the timing that you need in order to do that. So you have to run some
953470	959410	sort of script locally to the hardware or something like that in order to have success with it. Or
959410	964470	your hardware needs to support this particular feature. So that's something that's important to
964470	970890	keep in mind when you're doing diagnostics. Next, we need to send a... it's clear to send.
971050	977790	So we say a 0 in the next nibble of the next bite indicating it's clear to send. If it's not a 0,
977790	983870	it's some error. 1 is an error. Hey, you can't send this. So usually that will mean
983870	989730	that the controller stops sending its request. The next is the block size. So that's how many
989730	996010	blocks or messages or frames, I should say, that you need to... you can send before another
996670	1003590	flow control is sent back. So normally that's set to 0, meaning I'm not going to send any more
1003590	1008850	blocks. Don't worry about the blocks. I'm just going to... I'm just going to send this one flow
1008850	1013310	control frame. You finish up the rest of the message. You don't need to hear from me again.
1013310	1019190	These are the rules. Sometimes it can be a number not 0, meaning if that was a 0, 1,
1019190	1023290	then the controller would send a message back to me, and then I would send another flow control
1023290	1026210	frame, and then the controller would send another message, and I would send another flow control
1026210	1032010	frame, et cetera, et cetera, et cetera. So that number essentially is how many more frames until
1032010	1039710	I send a flow control. Last parameter here is the frame separation. This is the actual time
1040410	1045610	in milliseconds that we need to wait between... that the controller that's returning the data
1045610	1050790	back to me needs to wait for it to send a message. So 0A equals 10 milliseconds.
1050990	1058630	And again, we have padding as well. Now we get a response back. The next frame comes after the
1058630	1063870	first frame that we got. The next data bytes. In fact, the next seven data bytes. Why seven,
1063870	1068630	not eight in the Canvas frame? Because we still have more PCI data. Specifically,
1068750	1074250	a frame type of two. Two indicates that this is a... what we call a consecutive frame. A frame
1074250	1079310	that happened after a first frame. So if you were just to look at this and just monitoring the
1079310	1083030	Canvas, and you saw that this is a consecutive frame and you didn't have the first part of the
1083030	1088510	frame, you would know that you missed some data. So it's super important to know that if some other
1088510	1093550	system is monitoring it, that this is not the first part of the data. But what part of the data
1093550	1098410	is it? Well, we have this rolling code that comes next, indicating that this is the first
1099670	1106450	consecutive frame. So we have a one there. The next frame will come. It will also be a... have
1106610	1111130	a two as well, because it's also a consecutive frame. But instead of having a one in the rolling
1111130	1116630	code section, it will have a two. And guess what? The next one will have a three and a four and a
1116630	1121250	five, et cetera, all the way until we hit F. And then we just roll back over to zero. So you'll
1121250	1127370	see it go 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F, and then go back to zero, 1, 2, 3, 4,
1127370	1131290	5, et cetera, et cetera, if there were more data or more frames that needed to be sent.
1131430	1135870	But for the most part, this is pretty simple. We've essentially requested the VIN and received
1135870	1143050	the VIN back from the controller, all pretty quickly and pretty simply. So I want to take
1143410	1148370	a little bit of time. So I'm about 18 minutes in. Great. I'm doing well on time. I want to
1148370	1153030	take some time and do a little live demo. Now, you know what live demos are. They're always bad.
1153030	1157030	Don't ever do this. So I'm going to go ahead and do this. All right? So let me bring up
1158110	1166130	all of these. I've got a few different windows open here. Specifically related to our system
1166130	1174050	here. I'm going to go ahead and minimize a few things here. Okay. So this is the
1176150	1180530	this is SocketCAN. If you're not familiar with SocketCAN, we have some really cool information
1180530	1185310	about how to get started with SocketCAN. In fact, everything I'm doing right now, you can come over
1185310	1192890	to the CarHacking Village. Join the virtual.carhackingvillage.com CTF. It's easy to join.
1192950	1198550	Just sign up and you can get into the queue. And you, too, can also plug into this vehicle
1198550	1203050	virtually as well and do all of these same things. So I highly recommend you guys do that
1203050	1208990	if you have time. And we have some pretty good getting started instructions on our web page as
1208990	1214910	well. If I have time, I'll try to go into those as well. So I've taken a few seconds and created
1216190	1220710	a couple different windows. One window looks like some people are having some fun on these
1220710	1225690	networks as well. So we might get some spurious data coming across. Also, I'm going to clear up
1225690	1232090	some of these windows real quick. Let me just cancel out of this and reload it. Okay. So
1232650	1236550	it might be a little tight to see. You might need to zoom in, squint your eyes.
1236850	1241170	Let me just see if I can make this a little bit bigger. Yeah, a little bit bigger. Okay.
1241170	1248510	A little bit bigger. All right. That's a little bit bigger. That's nice. That's very nice. Okay.
1249930	1256410	Same here. Okay. So I made it a little bit bigger. Hopefully you guys can see a little bit easier.
1256910	1261550	So what we have, I have three different windows. One I use for... these are all terminal windows.
1261550	1267450	One I use a program called CanSend. It's a CAN utility. You can download CAN utilities available
1267450	1273290	as well. It's already available on this particular device for you. CanSend essentially takes a few
1273290	1280270	arguments. One is the device that we want to send the data on. We have two CAN buses that are
1280270	1286450	available. CAN0 and CAN2 are available on this particular vehicle. If I send data on CAN2,
1286450	1295570	it's actually on a gateway network. So you can't see the data. This is actually the CAN dump of
1295570	1303750	CAN2. So what we see below here is nothing. So if I were to send a CANSend message, which I'll do.
1303750	1309930	In fact, I'm going to do a bad message. So you guys can see a bad message go across. Of course,
1309930	1317810	I sent it on CAN1, my bad. I'm going to send it on CAN2. Give me a second here.
1317990	1326530	It's a little slow. All right. So I sent a message on CAN2, and then I was monitoring CAN2 using
1326530	1333190	CAN dump. Again, I sent my message. I actually sent what's called a tester present message. So
1333190	1337350	it's a pretty standard way of just kind of pinging the network, just saying, hey, there's a tester
1337350	1344370	here. I sent it on an ID7DF, which is a broadcast ID to a handful of controllers. So hopefully I
1344370	1348730	get one of them to respond back to me. But I malformatted the message intentionally. I sent
1348730	1353870	it with seven data bytes, not eight. And remember, I was talking about padding. Padding is important.
1353870	1358170	So you have to make sure that you pad with all eight data bytes. As soon as I do that, you'll
1358170	1364310	see I get a few more responses back. Again, this is a broadcast message to a handful of controllers.
1364310	1369730	I actually got three different messages happen after my initial request. So here's my initial
1369730	1377850	request right here. I don't know if you can see this very well. But it's essentially 7DF023E,
1377850	1384550	and then the rest are zeros. That is a tester present. And so I get a bunch of responses back
1384550	1389870	from three different controllers, two of which give me what are called the negative response.
1389870	1395830	The negative response is a 7F, and the positive response is a 7E, which is 40x more than my
1395830	1401810	initial request. So I set the request correctly, but I got different responses back. That tells
1401810	1405910	me a lot about the system right away, that these different controllers are configured with
1405910	1414130	different versions of diagnostic request services. So it's quite normal to see that different
1414130	1420750	controllers run different diagnostic request applications, and that's no different here. So
1420750	1428930	you might find something like that. So let's go back to our original concept of sending a
1428930	1440330	request for our engine, or our VIN. So again, 7E0020902, and then I'll fill this in with
1440750	1449110	zeros. So I send that request. Of course, you know how it goes. There it goes. I get my response
1449110	1453690	back. Let me just clear this up a little bit, so it's a little bit harder to see what's going on.
1453730	1457850	I'm sure if it's hard for me, it's even more difficult for you. So let me just try to make
1457850	1467030	this even bigger, so you guys can see it a lot better. Okay, so I'll send my request.
1467490	1473250	I got to actually hand dump. Okay, send my request again.
1475030	1482930	And you'll see we get a request and response. So our response is the first part of the VIN
1483490	1486890	on this particular vehicle. I'm not going to do the rest, because I'm broadcasting
1487610	1492270	live on a real vehicle, and you can get the idea. You know, sending VINs out there,
1492270	1496590	as cool as that is, if you want this VIN, you got to get it yourself. But you know what the
1496590	1501930	next thing is, I have to send a flow control frame. Now, like I told you, I can't do this
1501930	1508850	by hand, right? So if I want to send a flow control, I would need to send a 70, 0,
1509970	1519890	3, 0, and then space there. It's a little slow here on my end. You guys are going through.
1519890	1525110	But I'd have to set something like this. Now, because of my timing, I'm not going to get this
1525110	1529910	message going out correctly. Even if I wanted to, I'd have to script this in some way. So I could
1529910	1534830	create a bash command to send one and then the other within a certain period of time. I could
1534830	1539910	create a script. I could try to chain them together, maybe with an ampersand. It's, you know,
1539910	1545870	maybe a little time sleep between them. Something like that. I don't know if time sleep has a
1545870	1550910	millisecond control on bash. But if it did, we could do it that way. We just did a little bit
1551810	1557450	of a delay. Maybe there's enough of a delay already. But if we send our flow control a little
1557450	1564590	too fast before the actual controller sends its response, it might ignore our follow-up.
1564590	1571170	So that's kind of how we can send a simple request to these controllers. Later tomorrow,
1571170	1579230	I'm going to have a whole talk related to what I call CMAP. It's a way of mapping out diagnostic
1579230	1586030	requests across the board. Not necessarily using SocketCAM, but using a Python interface that just
1586030	1592730	says, hey, I'm going to sort of copy or take all of this information and broadcast it out to you.
1592870	1599010	I have also here the actual powertrain network that's on the bus. Now, you'll notice there's a
1599010	1602710	lot of data running across there. I'm going to go ahead and cancel this. And what I'm going to
1602710	1607770	do is I'm just going to filter. I want to show you a little bit about SocketCAM filtering.
1608410	1615150	So CanDump, we can monitor the CanDump, but I'm going to monitor a different network,
1615150	1620490	specifically Can0, which is the powertrain network. Can2 is the diagnostic network. So
1620490	1626250	any diagnostic, as I said, I can see they get transferred over to the correct network
1626250	1632730	that is supposed to manage that particular identifier. In this case, 70.0 should get
1632730	1641090	rebroadcast by the gateway over to the powertrain network, which is Can0 in this case.
1641090	1645250	But because there's so much data, it's really hard to see it. So what's cool about CanDump is
1645250	1652070	you can do some filtering. In this case, I'll filter on 70.0, but I also want to capture the
1652070	1659310	70.8 message. So I'll type in 70.0 here, but what I'll actually do is I'll add a filter mask. If I
1659310	1666350	just want to do 70.0 messages, I put a 7FF, which is an indicator of 11 bits of 1s. If you understand
1666350	1672550	how bit masks work, if you don't, I recommend doing a reading up on bit masks. Specifically,
1672550	1677530	what I'm interested in is I want to see anything that starts with 7E, but I don't care about what
1677530	1683950	the last byte is or bit or nibble, I should say. Now, in this case, I'll just put a 0 there,
1683950	1692010	I don't care what's in those last four bits, I just want to see anything that's 7E, anything.
1692010	1698830	So I just put a 7F there. If I hit enter here, now only messages that have 7E something in them
1698830	1702870	will show up. So I'll go ahead and send my initial request. Now remember, I'm sending on
1702870	1709210	Can2 right now, but I will see it on Can0, which are two separate, physically separate networks,
1709210	1713610	but there is a controller in between them that is gatewaying that information. So go ahead and send
1713610	1718970	that request. Oops, I did not send the actual request. Let me send this one again. And we can
1718970	1725610	see both my message going across, not only on the Can2 network, which I anticipate, right? You
1725610	1729270	monitor a network, you look at it, you're going to get the data back, but you also see it on a
1729270	1735010	separate network as well. That's because I'm actually sending through something. Now, the
1735010	1739470	reason why I set it up this way is I wanted to see if somebody could go through and say, hey,
1740250	1748070	I'm going to scan all possible identifiers on the diagnostic network and see what comes out,
1748070	1756610	see what actually is being forwarded between the diagnostic side and the non-diagnostic side,
1756610	1760930	or the powertrain side. There's probably some correlation. You can learn a lot about how the
1760930	1766730	system works just by poking at it. It's a great way to poke at it. So I've run about 30 minutes,
1766730	1771190	which was my goal today, to hit about 30 minutes. So what I'm going to do is take it there and then
1771190	1776510	see if there are any questions for you from the audience. So I'm going to turn my audio back on
1776510	1782790	so I can hear you guys if you guys are talking in this channel. And go ahead and fire an audio
1782790	1790770	question away. If there's a question inside of the one-on-one chat section, I'll also switch
1790770	1796610	over to that support. So I'm also monitoring the one-on-one chat. So if there are any questions,
1796610	1802110	I'm happy to take them. If not, I'll say, hey, thank you very much. And hopefully you guys get
1802230	1811130	a chance to hack these cars. Please go ahead, anybody. Robert, thank you so much for the
1811130	1824310	presentation. It was fun. Sorry, I have an echo. Sorry, it might be my fault. Let me just fix my
1824310	1831870	end. Just one second. I'm going to mute myself. No, I don't know where it's going.
1837000	1845920	Don't worry, it's okay. Did that exit? No, that didn't exit. No problem. No, it's not my fault then.
1848600	1853400	Actually, I have a question. What kind of tools are you using
1854240	1861780	to do this? Like, what hardware? I typically, I mean, I use Vehicle Spy right now. And Vehicle
1861780	1867840	Spy is? Yeah, I use Vehicle Spy with a value can. I'm a big fan of it because I used to work there.
1868240	1875280	So Vehicle Spy is a commercial tool. So it's not a free one, but it really, you know, when you're
1875280	1880440	first learning this, one of the hardest parts is just setting it up and plugging it in. And if you
1880440	1885520	got the time and the money, you know, to do it, I recommend getting a commercial tool because they
1885520	1890820	work really well and there's support. But, so not everybody has that ability or their
1890820	1899160	wherewithal to do that. So, you know, the obvious tools are out there are the Cannibal by
1903620	1910020	Eric Evacek. He's got the, or not the Cannibal, he's got the Cantac, sorry. He's got the Cantac
1910020	1914140	Pro that just came out. Those are really good tools that I've used several times.
1914600	1921100	There's a lot of different CAN devices out there. You know, in general, you'll probably spend, no
1921100	1925880	matter what you buy, you'll probably be in the $100 range, no matter, like for a good one. So I
1925880	1931900	recommend it. There are tools called Elm, Elm devices. I, you know, for a beginner, I, and
1931900	1937100	somebody who really wants to get into this, I would recommend staying away from them only because
1937100	1944920	they really limit your ability to see what is actually happening. So I feel like you're limited
1944920	1951120	to that particular protocol, which is great. Once you learn how diagnostics works, you can switch
1951120	1956060	over to one of these tools, but I wouldn't start there. I think you're going to not get the full
1956060	1960500	picture. And that's the reason why I like using one of these other tools that kind of, you can
1960500	1964980	see everything on the bus, whereas these other tools are very hard to configure. Just something
1964980	1968600	that you can plug in and just start monitoring right away. And that's the reason why I like the
1968600	1976300	ValueCAN. It's pretty simple to set up. Even it works on Windows, it works on Linux. It works in
1976440	1983360	a ton of different environments. Thank you for the question. Yeah, yeah, of course. And actually,
1983360	1989740	so you have hardware, and then which software is to use most often?
1992340	1997680	Again, Vehicle Spy is my number one tool. And then I write my, like, write your own, you know,
1997680	2004800	Python. Probably Python is my biggest, like, fallback. But I like, I'll prototype it usually
2004800	2009340	in Vehicle Spy, because it's really easy to write scripts and everything like that in it. And then
2009340	2015700	once I'm ready to, like, make a tool and try it again, I'll switch over to Python and write
2015700	2020600	everything there. There's a lot of good CAN libraries in Python as well.
2022400	2029260	Okay, great. Thank you so much. Yeah, there was a lot of discussion going on in the Discord channel
2029260	2039420	about getting involved, getting started, and how to, which hardware, which softwares,
2039420	2044480	and which tools in general. So if you have any recommendations about where you would like to get
2044480	2050540	started, or if you were getting started, I think that would really help everyone.
2051820	2056900	Yeah. You know, my problem is I'm a little biased just because I started working at the
2056900	2060420	company that makes the tools. So I know them really, really, really well. And I also know
2060420	2068060	the people who wrote the tool. So I have a very distinct advantage. So that helps. So not a lot
2068060	2071280	of people have that particular thing. So it's really hard for me to recommend other tools,
2071280	2076300	because honestly, I don't use anything else that much, besides writing my own tools. I typically
2076300	2083900	stay with what I know, not to say that there's not other good tools out there. And I've heard a lot
2083900	2088440	from a lot of other tools, like good news from other tools. So it's really hard for me to answer
2088440	2093500	that. But there's a lot out there. I mean, over the past four or five years, it's just been an
2093500	2098760	explosion of CAN bus tools. It seems like every year DEF CON, somebody's releasing a new CAN bus
2098760	2105520	tool. So, you know, just check out a bunch of talks. Find out what you like. Ask your friends.
2106300	2111240	And, you know, we're using the value CANs attached to Raspberry Pis here
2111240	2115060	at the Car Hacking Village. And so they work really well.
2122360	2125180	Yeah, absolutely. Please.
2125860	2134620	Robert, just one last question. So where do you find all your resources? Like,
2134620	2141800	is there a specific place that you like to look for different links or different, like, softwares?
2144500	2151440	There's not a lot of good resources out there. I've been trying to make them happen.
2151960	2158820	I feel like, you know, there's a couple of good forums out there that I've used before.
2160620	2171780	MHH Auto is a really good forum out there that you can get on. I've also used,
2171780	2176100	that I've been a part of, that are really good. So some private slacks. I don't know
2176100	2181340	if there's one that's public right now. Some car research slacks. I don't know. I'm sure
2181340	2187120	the ASRG has probably some good ones out there, too, that are happening that might be available.
2187460	2191480	But, you know, everything's, you know, the automotive industry is pretty tight-lipped
2191480	2198660	in general about how to access these systems. So you've just got to, like, you know,
2198660	2205900	figure it out, like, with just poking at the vehicle sometimes. There's some good, like,
2205900	2214540	databases that are coming up in GitHub. There's a CAN OpenDBC, I think it's called,
2215520	2224440	GitHub repository by comma AI that I really like. So it's not perfect, but it's a great start. It
2224440	2231460	gives you an idea of what's on the other end. Now, these DBC files are sort of de facto standard
2231460	2237680	for CAN bus normal messages that doesn't really do much for diagnostics. So diagnostics,
2237680	2244200	I typically take existing scan tools, get my hands on them in whatever way I can.
2244260	2248400	I like the eBay borrow method. If you've never had done the eBay borrow method,
2248400	2253220	you buy something on eBay, and then you resell it on eBay after you're done with it for the
2253220	2258720	same price you bought it for. It's a really great way to get into this space for very cheap.
2258820	2264540	These tools used tend to not devalue after you purchase them, and especially if you're using
2264540	2268880	them only for a few months. So it's a great way to, like, be out a few, you know, maybe if it's
2268880	2273200	$1,000, but you can turn around and sell it for $1,000 a few months later. So it's not like,
2273200	2278780	you know, it's not like you're out a ton of money. Even if you're out only 100 bucks,
2279420	2284720	so just borrowing tools, scan tools from different companies, each manufacturer tends to sell their
2284720	2290320	own. Great resources for it. So there's a lot of different ways to do this.
2290800	2297940	Awesome. Well, thank you so much for the talk, the presentation, the demonstration and everything.
2299740	2304100	Robert, I don't think we have any more questions, so I think we're just going to move on to the
2304100	2308160	next talk. The next talk is in 21 minutes.