1 00:00:01,860 --> 00:00:07,800 Robert does not need an introduction, but he wants me to give you one because he loves to hear other people talk about him. 2 00:00:09,040 --> 00:00:16,300 So, Robert taught me how to hack a Cadillac CTS back in the day. 3 00:00:16,300 --> 00:00:17,480 I think, what was it? 4 00:00:17,820 --> 00:00:24,940 Or you showed me how to allow the DVD to show video while you're driving. 5 00:00:24,940 --> 00:00:25,860 Yeah, while in motion. 6 00:00:25,860 --> 00:00:26,900 You need to. 7 00:00:26,900 --> 00:00:28,900 Yes, that is very important. 8 00:00:29,780 --> 00:00:34,280 And that was a very big learning curve for me. 9 00:00:34,300 --> 00:00:38,460 Of course, I was a big dummy, so I forgot the termination and on and on. 10 00:00:38,560 --> 00:00:38,960 Everything. 11 00:00:39,440 --> 00:00:43,880 So, Robert is going to give his wonderful talk. 12 00:00:44,120 --> 00:00:44,920 CMAP. 13 00:00:45,080 --> 00:00:45,860 Yes, that's right. 14 00:00:45,940 --> 00:00:48,940 CMAP on your... and you've got a repo for this, which we'll put... 15 00:00:49,560 --> 00:00:51,520 I know you've already posted it, but I will... 16 00:00:51,520 --> 00:00:52,420 We'll link it to things. 17 00:00:52,420 --> 00:00:57,200 Yeah, we'll put it into the... and this is track one, correct? 18 00:00:57,200 --> 00:00:57,660 Yes. 19 00:00:57,880 --> 00:01:12,440 So, any Q&A, normally we've been answering that in the track in text, but this one, we'll try to monitor track one text and we will get those questions to Robert at the end, okay? 20 00:01:13,200 --> 00:01:14,180 It's all you, man. 21 00:01:14,180 --> 00:01:15,120 Thank you. 22 00:02:10,290 --> 00:02:11,350 There we go. 23 00:02:11,350 --> 00:02:12,290 Welcome back. 24 00:02:12,370 --> 00:02:13,630 Do you want to kill that music? 25 00:02:13,630 --> 00:02:15,350 In the stream? 26 00:02:16,430 --> 00:02:18,870 It's coming from the Discord channel. 27 00:02:20,210 --> 00:02:21,770 Thank you, Discord. 28 00:02:22,490 --> 00:02:23,890 Thank you. 29 00:02:29,560 --> 00:02:30,560 There. 30 00:02:30,580 --> 00:02:31,820 There it goes. 31 00:02:31,820 --> 00:02:33,100 We got this. 32 00:02:34,420 --> 00:02:37,460 You can see why we didn't do any of the live talks. 33 00:02:38,080 --> 00:02:40,080 For this exact reason. 34 00:02:40,080 --> 00:02:40,480 All right. 35 00:02:40,480 --> 00:02:41,200 Hello, everyone. 36 00:02:41,200 --> 00:02:43,760 My name is Robert Leally, also known as Carfucker. 37 00:02:43,760 --> 00:02:55,660 And I would like to talk a little bit about a tool that will help you analyze or check what services are available on a particular vehicle. 38 00:02:55,660 --> 00:02:58,920 So, I'm currently connected to a vehicle. 39 00:02:59,260 --> 00:03:02,700 Specifically, we have a truck over here. 40 00:03:03,220 --> 00:03:12,680 It's the same truck that we're using for the challenges inside of the DEF CON CHV truck. 41 00:03:12,680 --> 00:03:17,540 So, after I'm done with this, you guys can go get the repo right from GitHub. 42 00:03:17,540 --> 00:03:26,420 So, just go to GitHub.com canbushack and you'll find CMAP there. 43 00:03:26,740 --> 00:03:27,800 Canbushack is one word. 44 00:03:27,800 --> 00:03:30,580 C-A-N-B-U-S-H-A-C-K. 45 00:03:30,580 --> 00:03:33,880 And you'll find the CMAP repo that lives there. 46 00:03:34,120 --> 00:03:38,720 The concept is pretty simple, but kind of basic as well. 47 00:03:38,720 --> 00:03:44,760 So, I'm going to take you through sort of a very deep dive into CMAP, how it works. 48 00:03:44,760 --> 00:03:46,160 Again, this is live. 49 00:03:46,160 --> 00:03:47,820 So, if it fails, sorry. 50 00:03:48,180 --> 00:03:50,000 I'll sort of talk about the concepts. 51 00:03:50,000 --> 00:03:51,200 I don't have any slides. 52 00:03:51,200 --> 00:03:52,520 Like I said, pretty lazy. 53 00:03:52,520 --> 00:03:54,740 But the concepts are really simple. 54 00:03:54,740 --> 00:03:56,140 So, you're just going to go in. 55 00:03:56,260 --> 00:03:57,420 You run this thing. 56 00:03:57,420 --> 00:03:59,040 Connect it to a CAN bus. 57 00:03:59,740 --> 00:04:02,280 Right now, I'm currently using a Raspberry Pi. 58 00:04:03,320 --> 00:04:07,380 Maybe I'll take a second to break out and show you what the Raspberry Pi looks like. 59 00:04:07,380 --> 00:04:09,140 Do like a live feed over there. 60 00:04:10,360 --> 00:04:15,740 It's connected to a Raspberry Pi, which has got a device that essentially enumerates a CAN0 network. 61 00:04:16,080 --> 00:04:18,020 So, CAN0 is socket CAN. 62 00:04:18,020 --> 00:04:22,440 On this one, actually, we are on CAN2. 63 00:04:22,440 --> 00:04:24,500 We're going to be on CAN2, not CAN0. 64 00:04:24,720 --> 00:04:27,520 So, let me just break this real quick. 65 00:04:28,100 --> 00:04:29,240 If I can. 66 00:04:30,040 --> 00:04:33,300 If not, I'll get another terminal window open. 67 00:04:34,220 --> 00:04:36,660 I might just have to grab another terminal window. 68 00:04:38,040 --> 00:04:39,340 Because, you know. 69 00:04:40,520 --> 00:04:41,740 Bad idea. 70 00:04:41,760 --> 00:04:42,360 Okay. 71 00:04:43,500 --> 00:04:45,420 Now my whole screen is frozen. 72 00:04:45,480 --> 00:04:46,600 Nothing wrong with that. 73 00:04:48,260 --> 00:04:49,680 Sorry, guys. 74 00:04:50,000 --> 00:04:51,740 This is why we do it. 75 00:04:55,470 --> 00:04:58,870 So, my computer is not happy with this scenario. 76 00:04:58,870 --> 00:04:59,770 Real quick. 77 00:05:05,130 --> 00:05:06,350 Oh, my goodness. 78 00:05:07,650 --> 00:05:10,330 This is why we didn't do any live talks, by the way. 79 00:05:11,510 --> 00:05:12,950 I apologize. 80 00:05:13,030 --> 00:05:16,550 I cannot get my computer to close this window. 81 00:05:25,800 --> 00:05:28,400 It's completely frozen, my computer. 82 00:05:28,400 --> 00:05:29,460 So, just one second. 83 00:05:30,600 --> 00:05:33,420 Now you guys are missing the real DEF CON experience. 84 00:05:40,620 --> 00:05:43,100 It was working great, just two seconds ago. 85 00:05:45,080 --> 00:05:47,160 So, how's your guys' day so far? 86 00:05:47,160 --> 00:05:48,680 Everything's going well? 87 00:05:48,680 --> 00:05:49,780 Alright, good. 88 00:05:50,660 --> 00:05:56,340 I'm going to take a picture of these screens so everybody can kind of see what's happening over here. 89 00:05:56,340 --> 00:05:58,180 I don't know if you guys got a chance to see this. 90 00:05:58,400 --> 00:05:59,820 But it's pretty crazy. 91 00:05:59,880 --> 00:06:00,640 I'll show you. 92 00:06:00,640 --> 00:06:02,840 Wow , my computer is totally stuck. 93 00:06:04,960 --> 00:06:05,920 This is awesome. 94 00:06:06,160 --> 00:06:12,420 This is what's happening over there. 95 00:06:12,420 --> 00:06:13,580 It's pretty exciting. 96 00:06:13,580 --> 00:06:15,740 Right now, my computer is totally frozen. 97 00:06:15,960 --> 00:06:18,400 So, I've got nothing. 98 00:06:18,400 --> 00:06:19,800 Quite literally. 99 00:06:20,140 --> 00:06:21,800 It's done. 100 00:06:22,000 --> 00:06:24,900 I can't even terminate a window right now. 101 00:06:24,900 --> 00:06:25,960 This is insane. 102 00:06:26,560 --> 00:06:28,580 I've never seen this before. 103 00:06:29,100 --> 00:06:31,060 This is the first time. 104 00:06:32,860 --> 00:06:36,480 I just posted a link to your repo on this holiday. 105 00:06:36,480 --> 00:06:38,220 Yeah, no. 106 00:06:38,660 --> 00:06:39,100 You know what? 107 00:06:39,100 --> 00:06:41,320 We might just try it again in a second. 108 00:06:42,860 --> 00:06:43,980 Because everybody... 109 00:06:43,980 --> 00:06:47,940 It's quite literally just absolutely frozen. 110 00:06:48,320 --> 00:06:52,400 Even my task manager is locked out. 111 00:06:54,460 --> 00:06:56,600 This is why we didn't do any logins. 112 00:06:56,600 --> 00:06:59,880 So, anybody have any questions about how this works? 113 00:07:01,720 --> 00:07:06,780 I'll give it another couple minutes before we bomb out completely. 114 00:07:07,060 --> 00:07:07,940 Are you done? 115 00:07:08,440 --> 00:07:09,040 I'm 116 00:07:14,150 --> 00:07:15,430 better. 117 00:07:15,430 --> 00:07:17,890 I need to plug that in anyways. 118 00:07:18,590 --> 00:07:19,910 Oh, in the office. 119 00:07:20,570 --> 00:07:22,230 It's just next to where I was sitting. 120 00:07:22,230 --> 00:07:23,070 It's just a battery charger. 121 00:07:23,070 --> 00:07:24,070 Battery charger, okay. 122 00:07:24,070 --> 00:07:26,670 I'll be back. 123 00:07:26,970 --> 00:07:29,530 Alright, looks like we're back. 124 00:07:31,050 --> 00:07:35,950 And I will just close these windows down. 125 00:07:36,170 --> 00:07:37,090 I apologize for that. 126 00:07:37,090 --> 00:07:39,250 And it's locked. 127 00:07:39,250 --> 00:07:40,210 Okay, so. 128 00:07:41,170 --> 00:07:43,190 Alright, so I'm going to restart. 129 00:07:44,910 --> 00:07:46,010 So, hello everyone. 130 00:07:46,010 --> 00:07:47,150 My name is Robert Ali. 131 00:07:48,550 --> 00:07:51,410 We're going to edit that out, I'm sure, later. 132 00:07:51,410 --> 00:07:55,350 So, if you guys are just joining us, I just had some computer problems. 133 00:07:55,690 --> 00:08:00,670 I'm going to go ahead and talk about CMAP, my new car mapping tool. 134 00:08:00,870 --> 00:08:04,870 And I'm just going to kind of give you a deep dive of how it works. 135 00:08:04,870 --> 00:08:06,790 What we're doing with it. 136 00:08:06,790 --> 00:08:08,690 What the goal of it is, as well. 137 00:08:08,690 --> 00:08:10,710 So, I guess this is PyCharm. 138 00:08:10,710 --> 00:08:11,970 I have PyCharm loaded. 139 00:08:11,970 --> 00:08:14,130 And actually, I have the actual code itself. 140 00:08:14,130 --> 00:08:18,830 So, if you're going to use this for the first time, there's some configurations that need to happen. 141 00:08:18,990 --> 00:08:21,710 I've documented it a little bit on how it works. 142 00:08:21,710 --> 00:08:25,630 But ultimately, the concept is pretty simple. 143 00:08:25,630 --> 00:08:32,870 We're just going to send CAN bus messages out to different controllers to see if they're there. 144 00:08:32,870 --> 00:08:34,290 Just kind of like a ping. 145 00:08:34,870 --> 00:08:36,090 So, this is like a ping. 146 00:08:36,470 --> 00:08:39,530 Also, with a service mapping tool, as well. 147 00:08:39,530 --> 00:08:41,550 So, the first thing that we're going to do. 148 00:08:41,550 --> 00:08:43,310 So, I'm going to go ahead and go online. 149 00:08:43,570 --> 00:08:45,230 And in debug mode. 150 00:08:45,870 --> 00:08:49,030 And you'll notice, as soon as it does that, it kind of goes into debug mode. 151 00:08:49,030 --> 00:08:50,310 I'll show you the console. 152 00:08:50,570 --> 00:08:51,450 And here we are. 153 00:08:51,450 --> 00:08:55,990 The first thing we're going to do is we're going to create a CAN bus object. 154 00:08:55,990 --> 00:09:01,890 So, this CAN bus object essentially tells me what CAN bus I want to connect to. 155 00:09:01,890 --> 00:09:05,350 So, I can give it different object instantiations. 156 00:09:05,370 --> 00:09:08,110 Maybe I'm not going to be working with CAN0. 157 00:09:08,390 --> 00:09:09,950 But maybe I'm going to be working with other ones. 158 00:09:09,950 --> 00:09:12,110 Sorry, I've got to plug my laptop in. 159 00:09:12,110 --> 00:09:13,030 I can plug it in for you while you're talking. 160 00:09:13,030 --> 00:09:14,070 I appreciate that. 161 00:09:14,130 --> 00:09:15,090 Thank you. 162 00:09:15,090 --> 00:09:25,270 So, after you connect to CAN bus and it gets onto the network using CAN0 or whatever CAN interface you are going to want to search. 163 00:09:25,270 --> 00:09:27,450 Maybe you can enumerate through multiple searches. 164 00:09:27,850 --> 00:09:29,030 That's kind of up to you. 165 00:09:29,030 --> 00:09:36,350 So, this first program here is called scan with class. 166 00:09:36,350 --> 00:09:40,510 So, we're going to scan the network. 167 00:09:40,510 --> 00:09:50,030 But this particular file is meant as an example for you to sort of create your own applications in Python using this program. 168 00:09:50,030 --> 00:09:52,850 So, first thing we do, we create a CAN0. 169 00:09:52,850 --> 00:09:55,430 And now CAN0 can do a lot of things. 170 00:09:55,430 --> 00:10:00,530 So , CAN0 is essentially a network using the network CAN bus class. 171 00:10:00,530 --> 00:10:03,830 And that particular class has a method called scan for IDs. 172 00:10:03,990 --> 00:10:06,630 So, scan for IDs takes a few arguments. 173 00:10:06,630 --> 00:10:09,010 And so, we'll go through those different arguments here. 174 00:10:09,370 --> 00:10:14,210 One is the actual service identifier that we want to use to do our scan. 175 00:10:14,570 --> 00:10:19,210 On a lot of different vehicles, you might have more success with different service IDs. 176 00:10:19,210 --> 00:10:23,510 I have defaulted it to service 3E, which is something called tester present. 177 00:10:23,510 --> 00:10:26,610 In theory, tester present shouldn't do any effects. 178 00:10:26,610 --> 00:10:28,710 It shouldn't have any effects on the vehicle. 179 00:10:28,710 --> 00:10:30,090 It shouldn't start the vehicle. 180 00:10:30,090 --> 00:10:30,990 It shouldn't turn on lights. 181 00:10:30,990 --> 00:10:34,230 It shouldn't do anything weird on the particular vehicle itself. 182 00:10:34,230 --> 00:10:36,890 But sometimes certain controllers don't respond to it. 183 00:10:36,890 --> 00:10:39,190 So, you might want to use a different service ID. 184 00:10:39,250 --> 00:10:43,010 Maybe service 10 for initiate diagnostics or something like that. 185 00:10:43,010 --> 00:10:44,950 So, there's a lot of different services you could use. 186 00:10:44,950 --> 00:10:46,350 You could just use 0. 187 00:10:46,510 --> 00:10:47,470 Whatever you like. 188 00:10:47,470 --> 00:10:52,590 Maybe try different services to see what service IDs work better. 189 00:10:52,590 --> 00:10:54,230 It's a single byte identifier. 190 00:10:54,510 --> 00:10:59,190 If you put something larger than a single byte, it'll just bring it back down to a single byte. 191 00:10:59,190 --> 00:11:01,250 So , just put in a single byte. 192 00:11:01,510 --> 00:11:04,630 The next thing we have is the arbitration ID. 193 00:11:04,750 --> 00:11:08,410 So, this is the actual identifier, 11-bit identifier that we're going to start at. 194 00:11:09,050 --> 00:11:13,430 Since it's 11 bits, we can put any number between 0 and 7FF here. 195 00:11:14,870 --> 00:11:18,110 Since this is a start one, we probably want to start it with a low number. 196 00:11:18,110 --> 00:11:20,770 But you can start it with a high number and put a low number before. 197 00:11:20,770 --> 00:11:21,770 It doesn't matter. 198 00:11:21,910 --> 00:11:24,170 It'll just go in the order that you decide to. 199 00:11:24,170 --> 00:11:31,310 So, if you put a number like 7FF and you put 0 as the end address, then it'll just decrement as opposed to increment. 200 00:11:31,310 --> 00:11:32,490 And I'll show you that later. 201 00:11:32,490 --> 00:11:34,830 So, you can go in whatever order you like. 202 00:11:35,330 --> 00:11:45,650 Sometimes, when I do my scans, I often do decrement because you'll find more things in the top area, like 700s, 600s, as opposed to the bottom area. 203 00:11:45,650 --> 00:11:48,410 So, you're probably going to have more success decrementing. 204 00:11:48,410 --> 00:11:50,870 But it's up to you, whatever order you want to go in. 205 00:11:50,870 --> 00:11:54,490 So, there's the start arbitration ID and the end arbitration ID. 206 00:11:54,730 --> 00:11:56,370 I just accidentally skipped over one. 207 00:11:56,370 --> 00:11:57,310 It's called try twice. 208 00:11:57,310 --> 00:11:59,850 I'm going to get into what try twice is in a little bit. 209 00:12:00,130 --> 00:12:02,770 And then, we'll also prompt wait time. 210 00:12:02,770 --> 00:12:06,270 I'll get into some of these other parameters in a little bit when we hit them. 211 00:12:07,210 --> 00:12:08,490 So, let's go ahead. 212 00:12:08,490 --> 00:12:13,230 So, now we're in that particular method, specifically scan for IDs. 213 00:12:13,510 --> 00:12:16,550 So, we just passed it a bunch of variables. 214 00:12:16,550 --> 00:12:20,010 There are some others that we didn't pass that are just leaving as the default. 215 00:12:20,030 --> 00:12:21,930 And I'll talk about those when we hit them. 216 00:12:21,930 --> 00:12:27,270 So , as we go through, we're going to import the CAN bus Python. 217 00:12:27,350 --> 00:12:30,390 So, these are some of the prerequisites you'll see when you get to the GitHub. 218 00:12:30,510 --> 00:12:31,770 One is CAN. 219 00:12:32,410 --> 00:12:34,150 Logging is something that's usually included. 220 00:12:34,150 --> 00:12:35,610 And time is something that's usually included. 221 00:12:35,610 --> 00:12:40,430 But you do need something called Python-CAN in order for you to... 222 00:12:40,430 --> 00:12:42,690 you do a pip install in order for you to run this. 223 00:12:42,690 --> 00:12:44,450 So, that's important as well. 224 00:12:45,030 --> 00:12:47,250 Oops, what just happened? 225 00:12:47,990 --> 00:12:50,450 You know, always something. 226 00:12:50,450 --> 00:12:51,230 Isn't it? 227 00:12:52,270 --> 00:12:54,150 Frozen bootstrap, I'm not sure. 228 00:12:54,150 --> 00:12:56,010 Oops, I hit the wrong button. 229 00:12:56,010 --> 00:12:56,750 Hopefully. 230 00:12:57,670 --> 00:12:58,630 Of course. 231 00:12:59,010 --> 00:13:01,910 Let me just restart the debugger real quick. 232 00:13:03,430 --> 00:13:05,070 Sitting too long on something. 233 00:13:05,070 --> 00:13:06,710 I think it probably crashed. 234 00:13:09,690 --> 00:13:10,710 Okay. 235 00:13:10,750 --> 00:13:11,550 So, here we are. 236 00:13:11,550 --> 00:13:16,850 So, now here's our input timeout that we're going to use a little bit later. 237 00:13:16,850 --> 00:13:18,970 I'm going to initialize something called common pairs. 238 00:13:18,970 --> 00:13:19,950 I won't get into too much. 239 00:13:19,950 --> 00:13:24,350 I'm just going to go through the more interesting things such as this. 240 00:13:24,350 --> 00:13:28,850 So, the first thing I'll do with CMAP is I'll listen to the bus. 241 00:13:28,850 --> 00:13:30,850 The reason why I do that, there's two reasons. 242 00:13:30,850 --> 00:13:39,970 One, if you have a non-active bus that maybe you have a misconfiguration with how you connect it to the vehicle network, I want you to at least be aware of it. 243 00:13:39,970 --> 00:13:41,790 Maybe there's no traffic on it. 244 00:13:41,790 --> 00:13:47,770 In fact, that's what we're going to see here on our particular vehicle is there's no traffic on that particular bus. 245 00:13:47,770 --> 00:13:50,970 But it's not because the vehicle's off or there's no traffic. 246 00:13:51,370 --> 00:13:53,190 There's just no traffic normally. 247 00:13:53,370 --> 00:13:55,350 The reason why is we have a gateway. 248 00:13:55,350 --> 00:13:59,650 A lot of these vehicles nowadays, especially if we're connecting to the OBD2 port, have a gateway. 249 00:13:59,650 --> 00:14:00,970 And this particular vehicle does. 250 00:14:00,970 --> 00:14:02,970 But don't let that discourage you. 251 00:14:02,970 --> 00:14:06,950 We're using diagnostics and these diagnostic ports are intended for that. 252 00:14:06,950 --> 00:14:11,590 So all of this stuff will still pass quite nicely through a diagnostic connector. 253 00:14:11,590 --> 00:14:14,510 So even if there is a gateway, it shouldn't matter. 254 00:14:14,510 --> 00:14:16,250 Now, it might matter a little bit. 255 00:14:16,250 --> 00:14:20,950 Some gateways do filter some information as it's going across the back. 256 00:14:21,510 --> 00:14:24,530 So you might want to try it on the other side of a gateway too. 257 00:14:24,530 --> 00:14:32,070 But I just want to give you guys an example of, yeah, you can actually do this on what's called the dirty side of a gateway if you want to. 258 00:14:32,070 --> 00:14:34,430 So I'm going to initiate a time thing. 259 00:14:34,430 --> 00:14:38,710 And then essentially what this will do is it'll sit there and listen to the bus. 260 00:14:38,710 --> 00:14:44,810 And if there is no traffic, it'll just warn you, hey, do you really want to continue or not? 261 00:14:45,630 --> 00:14:52,930 And if there is traffic, it'll create a list of IDs for later. 262 00:14:52,930 --> 00:15:04,410 The reason why we want to know those IDs of what is on the bus is because we want to essentially avoid those identifiers later when we're actually transmitting requests. 263 00:15:05,170 --> 00:15:10,090 To scan the bus because those identifiers are not the identifiers we want. 264 00:15:10,090 --> 00:15:15,530 You can almost say that any traffic that's normally on the bus is not something you want to transmit on. 265 00:15:15,530 --> 00:15:19,350 In fact, if we do transmit on it, that can cause problems. 266 00:15:19,350 --> 00:15:21,670 You get lights and other things coming up on your dash. 267 00:15:21,670 --> 00:15:23,550 That's something we're going to try to avoid. 268 00:15:23,550 --> 00:15:29,270 So just be aware that we do intentionally filter out normal traffic. 269 00:15:29,270 --> 00:15:36,190 If you don't want to do that, you can modify this particular class to skip this step if you'd like to. 270 00:15:36,190 --> 00:15:37,790 You don't have to do this particular thing. 271 00:15:37,790 --> 00:15:46,450 But I think it saves a lot of time and it avoids a lot of accidentally overriding messages that we know are not part of our scan. 272 00:15:46,450 --> 00:15:48,370 So that's what I'm going to do here. 273 00:15:48,970 --> 00:15:53,410 And after about two seconds or so, I have this sort of timeout after two seconds. 274 00:15:53,410 --> 00:16:00,730 It says, hey, I wasn't able to... you'll see that my normal message length is actually going to be at zero. 275 00:16:00,990 --> 00:16:06,830 So this is going to say, okay, for sure we need to just sort of warn the user. 276 00:16:06,830 --> 00:16:09,330 And that's what we're going to see here, that there was a problem. 277 00:16:09,330 --> 00:16:11,550 I'm going to go ahead and just jump past that. 278 00:16:12,290 --> 00:16:14,510 So to warn the user, would you like to continue? 279 00:16:14,510 --> 00:16:17,650 I gave a little command prompt and I have a timeout in there. 280 00:16:17,650 --> 00:16:19,150 It's about two seconds or so. 281 00:16:19,290 --> 00:16:20,310 Okay, cool. 282 00:16:20,310 --> 00:16:21,370 Let's move on. 283 00:16:21,530 --> 00:16:23,150 So what's our message length? 284 00:16:23,150 --> 00:16:29,610 Here we have a message length and just some other initialization that's happening of our payload that we're going to send out, etc. 285 00:16:29,610 --> 00:16:33,230 I won't get in too much, but here we'll go down to the pairs list. 286 00:16:33,530 --> 00:16:35,150 And we initialize everything. 287 00:16:35,150 --> 00:16:48,690 And then, of course, if the bus is quiet, one of the challenges with the Python CAN interface is if we're going to listen to the bus and it was quiet, it doesn't let us just sort of timeout. 288 00:16:48,690 --> 00:16:49,930 It's got a kind of a weird bug. 289 00:16:49,930 --> 00:16:55,650 So in order to get around that bug, I actually do create some noise on the network just to... 290 00:16:55,650 --> 00:17:02,130 I have to create some CAN messages just to allow me to receive CAN messages. 291 00:17:02,130 --> 00:17:03,950 It's kind of a weird bug that I found. 292 00:17:03,950 --> 00:17:04,950 I haven't found a way around. 293 00:17:04,950 --> 00:17:07,670 So if anybody knows a way around it, I'd like to hear it. 294 00:17:07,670 --> 00:17:12,010 I create some noise here on the CAN bus just so we can get around that. 295 00:17:12,750 --> 00:17:15,490 Let's just take a look at the CAN bus real quick here. 296 00:17:16,470 --> 00:17:20,170 Go into the device. 297 00:17:20,570 --> 00:17:24,390 And so we should be able to do a CAN dump on CAN 0. 298 00:17:25,350 --> 00:17:28,730 And there's our noise that's going across real quick. 299 00:17:29,370 --> 00:17:36,130 Essentially I'm sending 7FF with a very specific payload that I've initialized earlier. 300 00:17:36,150 --> 00:17:37,370 So there's our noise. 301 00:17:37,370 --> 00:17:39,050 I just want you to know it's there. 302 00:17:39,570 --> 00:17:43,830 I'm actually going to get rid of the noise when we do monitor this CAN bus later. 303 00:17:43,830 --> 00:17:48,710 I don't want to see it, so I'll actually just tell it to remove the noise. 304 00:17:48,710 --> 00:17:51,650 And you can do that by just creating a negative filter or a not filter. 305 00:17:52,210 --> 00:17:55,670 Just a comma 7FF tilde 7FF. 306 00:17:55,670 --> 00:17:59,910 And now anything that has the identifier 7FF will be gone. 307 00:17:59,910 --> 00:18:00,650 So there we have... 308 00:18:01,610 --> 00:18:05,330 Now if I was monitoring the CAN bus, we shouldn't see anything. 309 00:18:05,330 --> 00:18:07,170 Now it looks like some people are doing some scans. 310 00:18:07,170 --> 00:18:09,530 Again, this is a live network right now. 311 00:18:09,530 --> 00:18:18,270 So if anybody's on the network, they will actually be able to see it because people are currently hacking this bus as we speak. 312 00:18:18,270 --> 00:18:22,570 So it's kind of cool to see other people working on it as we are as well. 313 00:18:22,650 --> 00:18:25,090 And they're going to love us in a little bit. 314 00:18:25,610 --> 00:18:31,210 So what I'm going to do is I'm going to send a bunch of CAN IDs. 315 00:18:31,210 --> 00:18:37,970 So I have essentially our low range, our low number, our high number, and the direction that we're going to scan. 316 00:18:37,970 --> 00:18:39,490 So plus 1, negative 1. 317 00:18:39,490 --> 00:18:44,770 Essentially I can skip over IDs if I would like to here, but it's kind of up to me. 318 00:18:44,790 --> 00:18:47,550 So here we're going to go and we're going to set this up. 319 00:18:48,270 --> 00:18:51,790 All right, here's our arbitration ID. 320 00:18:51,790 --> 00:18:54,530 Is it part of our normal messages that we had before? 321 00:18:54,530 --> 00:18:57,310 In other words, do I need to skip this ID or not? 322 00:18:57,890 --> 00:19:05,810 Because if we were monitoring the CAN bus earlier and we noticed, hey, ID 222 is on the bus and I'm about to send 222, I'll skip over that one. 323 00:19:05,810 --> 00:19:09,550 That way we don't have to collide with those particular messages. 324 00:19:09,550 --> 00:19:12,470 So it's sort of an anti-collision way of doing it. 325 00:19:12,470 --> 00:19:17,490 Now since we didn't have any normal messages on the bus, our normal mode message is gone. 326 00:19:17,490 --> 00:19:19,470 It's empty, which is cool. 327 00:19:19,830 --> 00:19:24,490 So we'll move on to the next step. 328 00:19:24,650 --> 00:19:36,470 In this case, we're going to set up our CAN frame, initialize some things, and then we'll do this thing where we check how many tries or set the amount of tries that we want each time to run. 329 00:19:36,470 --> 00:19:37,310 So I'll take a look. 330 00:19:37,310 --> 00:19:39,690 Let's take a look real quick at what that means. 331 00:19:39,750 --> 00:19:51,830 One of the challenges, especially if we're doing this on a busy and active bus, we're going to send out a command and then we're going to listen for some period of time for responses. 332 00:19:51,830 --> 00:19:52,750 Now what is a response? 333 00:19:52,750 --> 00:19:54,230 It's just another message. 334 00:19:54,850 --> 00:20:00,630 So all of these messages that might be going on on the bus at that particular time could all be replies. 335 00:20:00,630 --> 00:20:02,650 So how do we differentiate them? 336 00:20:03,050 --> 00:20:09,230 Well, number one, we have this normal message list that we listen to and we can say, hey, is this in the message list or not? 337 00:20:09,230 --> 00:20:11,970 The other thing we can do is we can try it multiple times. 338 00:20:11,970 --> 00:20:19,430 And if we get the same ID two times, the probability is much greater that this is actually a reply to our message. 339 00:20:19,430 --> 00:20:20,470 So I have this ability. 340 00:20:20,470 --> 00:20:25,610 I built in this thing so you can actually have it either send it one time or two times. 341 00:20:25,610 --> 00:20:29,410 Since this is a quiet bus, we really don't need to do that. 342 00:20:29,650 --> 00:20:30,670 Send multiple tries. 343 00:20:30,670 --> 00:20:37,950 And again, if you send multiple tries, you're going to send it twice, which means it's going to take twice as long to do a scan. 344 00:20:37,950 --> 00:20:40,690 So if you can limit the amount of tries, that's good. 345 00:20:40,690 --> 00:20:41,830 So here we are. 346 00:20:42,210 --> 00:20:45,510 We set our tries to one, so it's only going to try it one time. 347 00:20:45,510 --> 00:20:47,130 I have some logging here. 348 00:20:47,450 --> 00:20:49,630 Here we are recreating our CAN bus. 349 00:20:50,670 --> 00:20:52,190 And I have a time here. 350 00:20:52,190 --> 00:20:57,370 So I want to sort of stop here because this is super time dependent and just go over what I'm about to do. 351 00:20:57,430 --> 00:21:03,390 What I'm going to do here at this particular step is I'm going to send this message that I created earlier. 352 00:21:03,390 --> 00:21:05,950 If you want to take a look, this message is pretty simple. 353 00:21:06,510 --> 00:21:10,970 It's got the identifier 442, so that's where we start. 354 00:21:11,310 --> 00:21:16,650 It's got the data bytes 023E, and then the rest are zero. 355 00:21:16,850 --> 00:21:20,150 The reason why we're sending zeros is because we need to make sure we pad this data. 356 00:21:20,150 --> 00:21:24,750 So essentially, remember I said service 3E is the thing that I'm going to send out? 357 00:21:24,750 --> 00:21:27,550 That's in the data bytes themselves. 358 00:21:27,550 --> 00:21:29,590 You see it's the second data byte there. 359 00:21:29,590 --> 00:21:30,270 So there we are. 360 00:21:30,270 --> 00:21:33,510 We're going to send 023E out onto the bus. 361 00:21:33,510 --> 00:21:36,870 And if I bring this over, eventually we'll see that come across. 362 00:21:36,870 --> 00:21:38,830 So I'm going to do that in just a second. 363 00:21:39,210 --> 00:21:43,610 And then what we're going to do is we're going to say, all right, I sent out a request. 364 00:21:43,610 --> 00:21:46,030 Then we're going to wait on that particular bus. 365 00:21:46,030 --> 00:21:47,830 We're going to wait for a receive message. 366 00:21:47,830 --> 00:21:55,490 And that's the reason why I have some noise there, because we have to generate some messages so that our clock or our timing essentially works. 367 00:21:56,150 --> 00:22:03,490 So we're going to wait for a receive message, and then we're going to take a look and inspect that receive message. 368 00:22:04,210 --> 00:22:05,670 We're going to filter it out. 369 00:22:05,670 --> 00:22:07,090 A few things. 370 00:22:07,110 --> 00:22:09,810 Is that a receive message that we've already seen before? 371 00:22:09,950 --> 00:22:10,470 All right. 372 00:22:10,470 --> 00:22:11,970 Well, I don't want to see that anymore. 373 00:22:12,010 --> 00:22:13,910 That's not the message that I was looking for. 374 00:22:13,910 --> 00:22:17,130 I'm looking for new identifiers, not old identifiers. 375 00:22:17,130 --> 00:22:19,550 So in other words, I'm sending out a request. 376 00:22:19,830 --> 00:22:24,230 I should not see this identifier or should not have seen it in the past before. 377 00:22:24,230 --> 00:22:26,310 So I'm looking for new IDs. 378 00:22:26,550 --> 00:22:29,650 Is this ID the same ID that I just sent out? 379 00:22:29,650 --> 00:22:33,930 Maybe I just was listening to my own data bus, and I saw an ID that I just sent out. 380 00:22:33,930 --> 00:22:34,450 So I don't know. 381 00:22:34,450 --> 00:22:35,430 That's not what I want. 382 00:22:35,630 --> 00:22:40,050 If I'm sending noise, is this the noise identifier payload that I just sent out? 383 00:22:40,050 --> 00:22:42,250 If it is, ignore that as well. 384 00:22:43,050 --> 00:22:45,930 Or is this ID got a DLC that's... 385 00:22:46,630 --> 00:22:59,830 One of the challenges with SocketCAN is that the way it displays error frames is using ID 000 with a DLC of 4, which is just kind of a dead giveaway that this is an error frame. 386 00:22:59,830 --> 00:23:02,030 It's really the only way to know if it's an error frame. 387 00:23:02,030 --> 00:23:03,410 So is this also an error frame? 388 00:23:03,930 --> 00:23:05,390 Is this an error noise on the bus as well? 389 00:23:05,390 --> 00:23:07,310 So I'm filtering out all those other things. 390 00:23:07,310 --> 00:23:18,470 And then what we're left with should be, if it passes all of those because they're not true, then we should say, OK, that is indeed a successful arbitration ID. 391 00:23:18,470 --> 00:23:21,470 And so we will append our list right here. 392 00:23:21,470 --> 00:23:23,570 So let me go ahead and just run this real quick. 393 00:23:23,610 --> 00:23:29,090 And then I'll show you what it kind of looks like on the bus as we're going across. 394 00:23:29,430 --> 00:23:30,470 So there it is running. 395 00:23:30,470 --> 00:23:31,050 Oops. 396 00:23:31,050 --> 00:23:32,270 We caught our first one. 397 00:23:32,270 --> 00:23:33,390 That's not a coincidence. 398 00:23:33,930 --> 00:23:34,650 It started there. 399 00:23:34,690 --> 00:23:37,310 So we caught our first identifier right there. 400 00:23:38,030 --> 00:23:39,130 Just a second. 401 00:23:39,130 --> 00:23:39,510 Oops. 402 00:23:39,510 --> 00:23:40,770 Try a second. 403 00:23:41,050 --> 00:23:42,110 How do I get rid of that one? 404 00:23:42,110 --> 00:23:44,510 No, we haven't caught one yet, but we'll catch one real soon. 405 00:23:44,510 --> 00:23:48,210 Let me get rid of some of these breakpoints so we can just see it run. 406 00:23:48,310 --> 00:23:49,130 And there it goes. 407 00:23:49,130 --> 00:23:49,570 It's running. 408 00:23:49,570 --> 00:23:50,010 It's running. 409 00:23:50,010 --> 00:23:50,510 It's running. 410 00:23:50,510 --> 00:23:56,010 And then pretty soon we're going to get a message. 411 00:23:56,010 --> 00:23:56,670 Cool. 412 00:23:56,850 --> 00:23:58,670 So we got our first message. 413 00:23:58,670 --> 00:23:59,970 Actually, here, let me... 414 00:23:59,970 --> 00:24:00,390 Oops. 415 00:24:00,390 --> 00:24:01,730 Messed up over here. 416 00:24:03,110 --> 00:24:03,830 Let me... 417 00:24:07,990 --> 00:24:09,210 Zoom in here. 418 00:24:09,230 --> 00:24:11,830 So let me just sort of emphasize what just happened here. 419 00:24:11,830 --> 00:24:17,010 So here I sent out this CAN message, 47D. 420 00:24:17,010 --> 00:24:18,670 Didn't see anything come across. 421 00:24:18,670 --> 00:24:20,650 And the same for all these other ones before. 422 00:24:20,670 --> 00:24:23,410 But then I sent out CAN message 47E. 423 00:24:23,710 --> 00:24:24,930 Sent out the same message. 424 00:24:24,930 --> 00:24:27,810 And then what happened was I got a response. 425 00:24:27,930 --> 00:24:29,390 How do I know it was a response? 426 00:24:29,390 --> 00:24:31,910 Well, first of all, I've never seen this ID before. 427 00:24:32,150 --> 00:24:33,870 That was one reason. 428 00:24:34,430 --> 00:24:35,750 I didn't transmit this ID. 429 00:24:35,870 --> 00:24:37,250 This wasn't something that I transmitted. 430 00:24:37,250 --> 00:24:40,030 I know it's the next number here in this list. 431 00:24:40,030 --> 00:24:42,270 But also it's interesting to look at the data bytes. 432 00:24:42,270 --> 00:24:43,250 It's a little bit different. 433 00:24:43,250 --> 00:24:44,930 It's not a 3E here. 434 00:24:44,930 --> 00:24:45,990 It's a 7E. 435 00:24:45,990 --> 00:24:47,870 Now, I don't really care what the data bytes are. 436 00:24:47,870 --> 00:24:49,830 I could do some more data byte inspection. 437 00:24:49,950 --> 00:24:52,070 But for the most part, you don't really have to. 438 00:24:52,070 --> 00:24:55,910 You just need to see an identifier that you didn't send on the bus. 439 00:24:55,910 --> 00:24:57,730 If you did send it, then, well, you can ignore it. 440 00:24:57,730 --> 00:25:00,070 But if you didn't send it, in this case, I didn't send this. 441 00:25:00,070 --> 00:25:01,450 It's just something that I received. 442 00:25:01,750 --> 00:25:02,530 Oh, good. 443 00:25:04,350 --> 00:25:05,390 This is called a pair. 444 00:25:05,490 --> 00:25:07,670 So we add this to our pairs list. 445 00:25:07,670 --> 00:25:08,890 Now, I have two pairs lists. 446 00:25:08,890 --> 00:25:12,310 If I'm trying twice, I'll compare the two pairs lists. 447 00:25:12,310 --> 00:25:13,890 In this case, we're not trying twice. 448 00:25:13,890 --> 00:25:15,750 We just get the one pair list. 449 00:25:15,750 --> 00:25:18,390 So a pair is essentially these two identifiers. 450 00:25:18,510 --> 00:25:22,090 A pair is the identifier 47E and 47F. 451 00:25:22,390 --> 00:25:26,590 Those pairs are essentially how we can communicate directly with the controller. 452 00:25:26,590 --> 00:25:31,250 If we send the ID 47E, we'll get a response back on 47F. 453 00:25:31,250 --> 00:25:34,330 So this is kind of the channel, if you will. 454 00:25:34,330 --> 00:25:35,370 This is an RF thing. 455 00:25:35,370 --> 00:25:37,130 I kind of think about these as the same thing. 456 00:25:37,130 --> 00:25:40,850 This is the channel that we send out on, and it's a different channel that we receive on. 457 00:25:40,850 --> 00:25:42,330 It's the best way to look at that. 458 00:25:42,330 --> 00:25:43,770 And then the data bytes are right here. 459 00:25:43,770 --> 00:25:48,150 So anytime I send out a message on 47E, 47F will respond to me. 460 00:25:48,310 --> 00:25:49,850 So let's keep going. 461 00:25:49,890 --> 00:25:50,870 Let's keep going. 462 00:25:50,870 --> 00:25:52,430 Let's just do this. 463 00:25:53,170 --> 00:25:56,450 And I don't really care about hitting more pairs. 464 00:25:56,450 --> 00:25:59,210 I'm just going to let it go until we get a response. 465 00:26:06,520 --> 00:26:07,340 It should be going. 466 00:26:07,340 --> 00:26:07,880 Sorry. 467 00:26:07,880 --> 00:26:09,040 Okay. 468 00:26:09,240 --> 00:26:11,700 So it's going, and it's going to catch a few more. 469 00:26:12,620 --> 00:26:13,860 As you'll see. 470 00:26:14,420 --> 00:26:16,800 I just realized I need to open up another window. 471 00:26:17,620 --> 00:26:18,560 One second. 472 00:26:41,750 --> 00:26:43,270 So I'm just going to let it keep running. 473 00:26:43,270 --> 00:26:44,990 It'll eventually catch a few more. 474 00:26:45,050 --> 00:26:47,750 It's loading up our list, and I'm just letting it run. 475 00:26:47,750 --> 00:26:50,050 So just give me one second while I 476 00:26:53,140 --> 00:26:55,040 find something. 477 00:26:55,040 --> 00:26:56,200 Yeah. 478 00:26:57,280 --> 00:27:02,700 One part of debugging is there's no way to hit the escape or whatever. 479 00:27:02,700 --> 00:27:05,280 So I've got to do it kind of programmatically. 480 00:27:05,280 --> 00:27:07,500 It's an interesting problem that I have to do. 481 00:27:08,220 --> 00:27:08,660 So... 482 00:27:08,660 --> 00:27:09,840 Boo, boo, boo. 483 00:27:29,760 --> 00:27:30,640 Okay. 484 00:27:31,520 --> 00:27:31,960 All right. 485 00:27:31,960 --> 00:27:33,480 So we finished our scan. 486 00:27:35,100 --> 00:27:37,020 And what do we got here? 487 00:27:37,720 --> 00:27:39,520 So let's take a look at what happened. 488 00:27:39,520 --> 00:27:41,620 So what returns is our pairs list. 489 00:27:41,620 --> 00:27:43,120 So let me just open up our debugger. 490 00:27:43,120 --> 00:27:44,820 And we'll actually take a look at... 491 00:27:44,820 --> 00:27:46,520 We'll watch some of this data. 492 00:27:46,520 --> 00:27:49,880 So just one second while I scroll over. 493 00:27:49,880 --> 00:27:51,240 Take a look at my watch list. 494 00:27:51,240 --> 00:27:52,440 I'll have it open. 495 00:28:05,930 --> 00:28:08,190 Just one second while I move this around. 496 00:28:12,710 --> 00:28:14,670 Where are you variables? 497 00:28:28,460 --> 00:28:30,760 I had them open just two seconds ago. 498 00:28:31,780 --> 00:28:33,140 And I lost them. 499 00:28:53,270 --> 00:28:54,050 All right. 500 00:28:54,050 --> 00:28:56,190 Well, anyways, here's the pairs list. 501 00:28:56,210 --> 00:28:58,050 I was going to just open it up for you. 502 00:28:58,050 --> 00:28:59,790 But the easiest way to just... 503 00:29:00,930 --> 00:29:02,530 So here's the pairs list. 504 00:29:02,610 --> 00:29:04,950 Now, what we'll see here is actually... 505 00:29:04,950 --> 00:29:05,930 It's hard to tell. 506 00:29:05,930 --> 00:29:07,890 But these are all in decimal right now. 507 00:29:07,890 --> 00:29:10,810 But if we wanted to, we could see in hex. 508 00:29:12,450 --> 00:29:13,030 Sort of. 509 00:29:13,030 --> 00:29:13,810 Here's a pair. 510 00:29:14,250 --> 00:29:15,850 That's our first one that we grabbed. 511 00:29:16,290 --> 00:29:17,610 47E, 47F. 512 00:29:17,610 --> 00:29:18,690 So there we have a pair. 513 00:29:18,690 --> 00:29:20,330 And then we have a few more here as well. 514 00:29:20,330 --> 00:29:23,510 And then you have one that actually has a bunch of different pairs in it. 515 00:29:23,510 --> 00:29:32,790 And the reason why we see something like this is you'll look that all of the different IDs are the same values across all of them. 516 00:29:32,790 --> 00:29:34,830 And the reason why is this is called... 517 00:29:35,470 --> 00:29:36,690 This particular identifier... 518 00:29:37,910 --> 00:29:39,350 So I'll show you here. 519 00:29:39,750 --> 00:29:42,990 7DF has multiple different controllers that respond to it. 520 00:29:42,990 --> 00:29:46,270 It's called a functional request. 521 00:29:46,270 --> 00:29:51,330 So every time we send that particular type of request out, we get multiple responses back. 522 00:29:51,330 --> 00:29:53,810 So that's good to know about the functional request. 523 00:29:53,810 --> 00:29:55,450 So the functional request will have... 524 00:29:55,450 --> 00:29:59,090 The pair itself will be just a list of pairs, essentially. 525 00:29:59,090 --> 00:30:02,250 So that's why you'll notice that these lists are actually lists of lists. 526 00:30:02,430 --> 00:30:05,230 And most of the time, there's just a single pair inside of there. 527 00:30:05,230 --> 00:30:07,470 But in this case, there's multiple pairs. 528 00:30:07,470 --> 00:30:09,150 So now we've got a list of pairs. 529 00:30:09,150 --> 00:30:09,990 That's great. 530 00:30:10,050 --> 00:30:11,870 Now we can do something with that. 531 00:30:11,870 --> 00:30:13,210 We have a list. 532 00:30:13,210 --> 00:30:14,390 Basically, you do a ping. 533 00:30:14,390 --> 00:30:20,790 You check out and see all the different IP addresses that you've got on the network. 534 00:30:20,790 --> 00:30:21,490 Same thing. 535 00:30:21,490 --> 00:30:22,690 That's exactly what we just did. 536 00:30:22,690 --> 00:30:24,290 A scan is kind of a ping. 537 00:30:24,370 --> 00:30:28,010 We get a ping for all the different identifiers. 538 00:30:28,010 --> 00:30:30,470 And now we've got a list that we can do something with. 539 00:30:30,650 --> 00:30:34,470 So inside of this CAN0 has nodes. 540 00:30:34,470 --> 00:30:37,810 And those nodes are essentially the pair list that we had before. 541 00:30:38,110 --> 00:30:42,250 So now what we can do is just pull out the pairs inside of the pair node. 542 00:30:43,210 --> 00:30:46,490 So here we're going to go ahead and take apart that particular one. 543 00:30:46,490 --> 00:30:48,610 We're just going to grab the first pair. 544 00:30:48,770 --> 00:30:53,790 If it's a list of multiple pairs like we had that I just showed you, I'm just going to kind of ignore that. 545 00:30:53,950 --> 00:30:58,030 If you have a script and you want to do a little bit more with that, feel free to do that. 546 00:30:58,030 --> 00:31:00,810 And then I'll just go ahead and print it out so we can kind of see. 547 00:31:00,810 --> 00:31:03,070 Here it is, our 47E, 47F. 548 00:31:03,130 --> 00:31:08,410 Just let us know, hey, we're going to do some work with that particular pair. 549 00:31:08,550 --> 00:31:11,730 So let's take a look and see what we're doing next. 550 00:31:11,730 --> 00:31:16,650 So we're going to do another thing. 551 00:31:16,650 --> 00:31:19,490 Actually, I'm going to skip over the initiation of that particular one. 552 00:31:19,490 --> 00:31:23,030 And then go right to the actual method that is interesting for me. 553 00:31:23,030 --> 00:31:25,070 And that's the findServices method. 554 00:31:25,110 --> 00:31:26,710 Now we have the identifiers. 555 00:31:26,710 --> 00:31:29,010 Now what services can we do? 556 00:31:29,010 --> 00:31:30,850 So we've done the ping. 557 00:31:30,850 --> 00:31:32,710 Now let's do a port scan. 558 00:31:32,710 --> 00:31:34,570 That's kind of the best way to describe this. 559 00:31:34,570 --> 00:31:36,530 So findServices is going to do a port scan. 560 00:31:36,530 --> 00:31:40,570 It's going to see what services or functions the particular controller supports. 561 00:31:40,570 --> 00:31:42,330 So let's go ahead and run into that. 562 00:31:43,210 --> 00:31:50,390 And the first thing we're going to do is initialize a list of known services in case we want to filter on just known services. 563 00:31:50,430 --> 00:31:52,850 And that's kind of what I want to do in a little bit. 564 00:31:52,850 --> 00:31:55,930 So we have a few different options here. 565 00:31:55,930 --> 00:32:04,010 We can actually filter our list just to try to do a sweep of every single possible service identifier. 566 00:32:04,010 --> 00:32:08,310 Which is only 256 possible service identifiers. 567 00:32:08,310 --> 00:32:14,370 Or we can just skip service identifiers that are potentially valid. 568 00:32:14,370 --> 00:32:20,330 So half of the service identifiers are reserved for response only, not for transmit. 569 00:32:20,330 --> 00:32:26,310 So if you're going to get data back from the controller, half of them are reserved for that function as well. 570 00:32:26,310 --> 00:32:29,750 So we can say, hey, I just want to work on ones that are valid. 571 00:32:29,750 --> 00:32:32,610 Essentially skip the response-only service identifiers. 572 00:32:32,610 --> 00:32:36,730 Or we can skip and just scan the ones that are known. 573 00:32:36,730 --> 00:32:41,330 So we're just scanning known service identifiers as opposed to unknown ones. 574 00:32:41,330 --> 00:32:44,010 And so that's what I've initialized as true here. 575 00:32:44,010 --> 00:32:47,630 So we're going to use this list that we have right here. 576 00:32:47,630 --> 00:32:50,090 And that's the list of identifiers that we want to go over. 577 00:32:50,090 --> 00:32:54,710 Now depending on what type of service scan you want to do, maybe you want to do a more inclusive one. 578 00:32:54,710 --> 00:32:55,750 So you'll scan everything. 579 00:32:55,750 --> 00:33:01,270 Maybe you want to do a non-inclusive one like this where we just scan the UDS ID. 580 00:33:01,270 --> 00:33:03,030 So I give you like three different options. 581 00:33:03,030 --> 00:33:07,930 You can scan everything, a little bit of everything, or like half of everything, or just a small amount of everything. 582 00:33:07,950 --> 00:33:12,950 So it's just the amount of time you want to spend on doing that. 583 00:33:12,950 --> 00:33:14,230 It's kind of the trade-off. 584 00:33:16,650 --> 00:33:20,870 So if we've already done the scan once, hey, let's not do it again. 585 00:33:21,330 --> 00:33:26,970 Let's just return the container that we store all of the services that that particular node supports. 586 00:33:27,110 --> 00:33:30,250 In this case, we haven't done it yet, so that's good. 587 00:33:30,250 --> 00:33:34,370 So the other thing that we require is something called ISOTP. 588 00:33:34,830 --> 00:33:40,050 I think it's called CAN-ISOTP, if that's the module name. 589 00:33:40,050 --> 00:33:42,370 So we're going to have to use that one as well. 590 00:33:42,370 --> 00:33:49,630 So go ahead and take a look, try to find CAN-ISOTP on the internets so that you can use this as well. 591 00:33:50,030 --> 00:33:51,810 And I'll just keep going. 592 00:33:51,810 --> 00:33:53,430 ISOTP is great. 593 00:33:53,430 --> 00:34:05,210 ISOTP is essentially the diagnostic layer 2, if you will, the transport layer for CAN bus diagnostics. 594 00:34:05,210 --> 00:34:08,250 And it's awesome because there's already a thing for it. 595 00:34:08,250 --> 00:34:23,390 So let's go ahead and create the socket, set the padding options so that we can fill in the data bytes, bind that socket, and then we can say, all right, if the service ID is sort of like limit the service ID, so I'm going to skip over some of this stuff. 596 00:34:23,390 --> 00:34:24,810 It's pretty self-explanatory. 597 00:34:24,810 --> 00:34:27,430 Let's go right into the meat of the actual script. 598 00:34:27,430 --> 00:34:28,930 What is it actually doing? 599 00:34:29,490 --> 00:34:30,910 So we're going to create a range. 600 00:34:30,910 --> 00:34:33,970 So inside of this range, we have two service IDs that we set. 601 00:34:33,970 --> 00:34:35,530 One is the start service ID. 602 00:34:35,530 --> 00:34:36,610 Where do you want to begin? 603 00:34:36,610 --> 00:34:38,010 One is the end service ID. 604 00:34:38,010 --> 00:34:39,110 Where do you want to end? 605 00:34:39,110 --> 00:34:43,010 Again, if we apply some filters, it's going to skip over that. 606 00:34:43,010 --> 00:34:49,370 So typically what I'll say is if you want to grab a small amount, turn on a filter. 607 00:34:49,370 --> 00:34:57,550 But if you know there's just a service ID, maybe you want to target one or two service IDs, then you can limit your range to what service IDs you're going to go after. 608 00:34:57,550 --> 00:35:02,830 Again, service IDs are only one byte, so really there's only going to be 256 options here. 609 00:35:02,830 --> 00:35:05,590 So let's go ahead and see what we want to do. 610 00:35:05,590 --> 00:35:10,210 We just grabbed an identifier and a range. 611 00:35:10,570 --> 00:35:14,670 And we want to... so I'll look at zero. 612 00:35:14,670 --> 00:35:17,630 Hey, do I want to scan this zero ID or not? 613 00:35:17,630 --> 00:35:23,790 Since I have a filter turned on, scan only service IDs, I say yes. 614 00:35:23,790 --> 00:35:28,150 It's only going to scan a service ID that's in my list. 615 00:35:28,150 --> 00:35:29,950 In this case, zero isn't in my list. 616 00:35:29,950 --> 00:35:31,950 So it's just going to skip right over it. 617 00:35:31,950 --> 00:35:34,190 It's going to continue saying, no, I don't want to do that. 618 00:35:34,190 --> 00:35:38,410 So let's go to one where there actually is a service ID I'm interested in. 619 00:35:38,410 --> 00:35:45,430 So in this case, the service ID, the first one is going to be ID 16 decimal or 10 in hexadecimal. 620 00:35:45,430 --> 00:35:54,030 So service ID 10 is the first service of UDS, which is the session control service. 621 00:35:54,450 --> 00:35:57,970 So let's take a look and go through here. 622 00:35:57,970 --> 00:36:04,930 And we're going to add to it payload length, do some fun math here. 623 00:36:04,930 --> 00:36:09,750 And then we're going to go down to the actual loop. 624 00:36:09,750 --> 00:36:12,690 So we send our ID out. 625 00:36:12,690 --> 00:36:13,750 Let's see if I already sent it. 626 00:36:13,750 --> 00:36:14,730 I did. 627 00:36:14,950 --> 00:36:16,310 So here we go. 628 00:36:16,310 --> 00:36:18,030 We sent out a request. 629 00:36:18,430 --> 00:36:21,590 10-0-0-0-3-10-0-0. 630 00:36:21,590 --> 00:36:24,010 And look, we got a response back. 631 00:36:24,010 --> 00:36:27,350 0-3-7-F-10-12. 632 00:36:27,970 --> 00:36:29,910 So don't worry about what that means. 633 00:36:29,910 --> 00:36:31,970 I'll do all the parsing for you. 634 00:36:32,650 --> 00:36:34,190 Well, displaying for you. 635 00:36:34,190 --> 00:36:41,510 And I'll just sort of say, all right, since this is a 10-12, 12 is what's called the negative response code. 636 00:36:41,790 --> 00:36:43,570 This is an error frame. 637 00:36:43,570 --> 00:36:44,330 This is like error. 638 00:36:44,330 --> 00:36:46,910 Hey, you have a problem with your request. 639 00:36:47,470 --> 00:36:50,010 And here's the response. 640 00:36:50,010 --> 00:36:52,170 And 12 is the negative response code. 641 00:36:52,310 --> 00:36:57,070 And what it's trying to tell you is, hey, we have an issue with that request. 642 00:36:57,070 --> 00:37:04,210 And the particular issue in this case, 12, means that the sub-function, 0-0 in this case, is not supported. 643 00:37:04,650 --> 00:37:08,750 What we're trying to do with the service scan is not see if the sub-function is supported or not. 644 00:37:08,750 --> 00:37:10,590 We want to see if the service is supported. 645 00:37:10,590 --> 00:37:12,970 Because we're going to probe to see if the service is supported. 646 00:37:13,070 --> 00:37:15,830 So ultimately, 12 is a good thing. 647 00:37:15,830 --> 00:37:17,950 So we're going to go down here. 648 00:37:17,950 --> 00:37:19,450 And I'm going to go run. 649 00:37:19,490 --> 00:37:22,090 And we're going to take a look at how that logic works. 650 00:37:22,090 --> 00:37:23,810 Hey, we received something. 651 00:37:23,830 --> 00:37:25,030 We got an ID. 652 00:37:25,030 --> 00:37:29,850 We got a negative response code, which is 7F, which we saw here. 653 00:37:29,850 --> 00:37:32,610 And the service identifier here, 7F. 654 00:37:33,690 --> 00:37:35,910 I see negative response code. 655 00:37:35,910 --> 00:37:42,950 We're going to pull that out and say, hey, negative response code came back as 12 hex or 18 decimal. 656 00:37:42,950 --> 00:37:44,570 Is that equal to 11? 657 00:37:44,570 --> 00:37:45,670 Why 11? 658 00:37:45,670 --> 00:37:51,390 Well, 11 is actually the negative response code for a service not supported. 659 00:37:51,390 --> 00:37:53,070 That's specifically what it means. 660 00:37:53,070 --> 00:37:58,070 So since this is a service that is supported, I don't really want to have that in my supported... 661 00:37:58,690 --> 00:38:00,850 I don't want to have this in my not supported list. 662 00:38:00,850 --> 00:38:02,390 I want to have that in my supported list. 663 00:38:02,390 --> 00:38:04,810 So I'm going to create two lists here. 664 00:38:05,630 --> 00:38:07,370 Or two sets, I should say. 665 00:38:07,370 --> 00:38:13,350 Two sets that we can sort of just... 666 00:38:13,350 --> 00:38:14,410 Hey, there's our service ID. 667 00:38:14,410 --> 00:38:16,470 I'm going to add this supported one to it. 668 00:38:16,470 --> 00:38:19,050 Even though I got a negative response, that's not terminal. 669 00:38:19,050 --> 00:38:21,790 It just means that the sub-function that I request isn't supported. 670 00:38:21,790 --> 00:38:23,910 But the service itself is actually supported. 671 00:38:23,910 --> 00:38:24,970 So there we go. 672 00:38:24,970 --> 00:38:26,330 Our service is supported. 673 00:38:26,810 --> 00:38:28,390 And I added that to my list. 674 00:38:28,390 --> 00:38:31,090 I'm just going to go through all of them real quick. 675 00:38:31,090 --> 00:38:32,590 It doesn't take very long. 676 00:38:32,690 --> 00:38:37,430 And we're going to take a look and see what that kind of looks like here. 677 00:38:39,990 --> 00:38:43,910 So I'm going to get rid of some of these breakpoints. 678 00:38:44,950 --> 00:38:45,850 And there we go. 679 00:38:45,850 --> 00:38:47,190 We kind of got the entire list. 680 00:38:47,190 --> 00:38:47,990 That was really fast. 681 00:38:47,990 --> 00:38:50,770 So it doesn't take very long to go through that list. 682 00:38:52,030 --> 00:38:53,590 Maybe we already did it. 683 00:38:53,590 --> 00:38:54,790 Yeah, it went really fast. 684 00:38:54,790 --> 00:38:56,310 Sorry, you guys might not have caught it. 685 00:38:56,310 --> 00:38:57,650 But it didn't take very long. 686 00:38:57,650 --> 00:38:59,970 It went through the entire list really quickly. 687 00:39:00,290 --> 00:39:07,590 And we got a list of all of the services that were particularly supported on that particular one controller. 688 00:39:07,590 --> 00:39:09,270 Now we just went through one controller. 689 00:39:09,270 --> 00:39:10,890 And that's what we're going to do at a time. 690 00:39:10,890 --> 00:39:12,010 Single controller. 691 00:39:12,770 --> 00:39:14,670 And we're going to try... 692 00:39:14,670 --> 00:39:19,510 Now that we have that list, we're going to print it out and see what happens. 693 00:39:19,510 --> 00:39:21,270 So what are we going to do? 694 00:39:21,270 --> 00:39:25,270 We're going to print out a list of all of the different services that are supported. 695 00:39:25,270 --> 00:39:34,630 In this case, 22, 85, 27, 28, 2E, 10, 11, 14, 36, 34, 37, 19, 3E. 696 00:39:34,630 --> 00:39:36,730 Those are all the services that are supported. 697 00:39:36,730 --> 00:39:43,010 Now if you want a good list of what these functions mean, I actually have that as a enumerated... 698 00:39:43,010 --> 00:39:48,230 I have created an enumerated list for all the particular services and what they mean inside of this. 699 00:39:48,230 --> 00:39:50,030 So you can actually reference it. 700 00:39:50,090 --> 00:39:51,670 I forgot where I put it. 701 00:39:51,670 --> 00:39:54,250 So give me a second here while I dig it up. 702 00:39:54,250 --> 00:39:55,650 I think I called it... 703 00:39:56,250 --> 00:39:57,510 Yeah, it's under service. 704 00:39:57,510 --> 00:39:58,310 Makes sense. 705 00:39:58,310 --> 00:39:59,490 Good spot for it. 706 00:39:59,690 --> 00:40:02,790 And I collapsed it here. 707 00:40:02,790 --> 00:40:08,030 But yeah, I have a service description that you can run. 708 00:40:08,310 --> 00:40:10,970 And there's a method called update service description. 709 00:40:10,970 --> 00:40:14,850 And there's a property of every service. 710 00:40:14,850 --> 00:40:16,630 So if you want to, you can enumerate a list. 711 00:40:16,650 --> 00:40:23,510 And just read out the service description from each of these services as well. 712 00:40:23,510 --> 00:40:27,330 There's also a list inside of here which I've collapsed because it's so big. 713 00:40:27,530 --> 00:40:29,150 I don't know where I put it. 714 00:40:29,150 --> 00:40:30,770 But I won't go into too much detail. 715 00:40:30,770 --> 00:40:32,750 But it's in there in the code itself. 716 00:40:32,750 --> 00:40:36,190 Feel free to take a look if you want to see what those service identifiers mean. 717 00:40:36,190 --> 00:40:37,250 But we can take a look. 718 00:40:37,250 --> 00:40:44,710 And there's just a handful that are really unique and interesting that we'll probably want to scan later. 719 00:40:44,710 --> 00:40:47,290 So we'll go ahead and take one of the services. 720 00:40:47,290 --> 00:40:50,170 I think the first one we're going to take is actually service 22. 721 00:40:50,170 --> 00:40:51,730 Because that's our first on the list. 722 00:40:51,750 --> 00:40:56,190 Which is kind of a bummer because that's the biggest of all the services. 723 00:40:56,210 --> 00:40:59,510 But let's go ahead and take a look at what it is we're actually doing here. 724 00:40:59,510 --> 00:41:03,070 So I'm going to create a little report for you after it's done. 725 00:41:03,190 --> 00:41:07,750 A list of all of the different service functions that are there. 726 00:41:07,750 --> 00:41:12,190 And I just want to kind of send out the service and see what's happening. 727 00:41:12,190 --> 00:41:13,990 So give me a second while I run it. 728 00:41:14,930 --> 00:41:19,390 So the next method we're going to do is now we have a list of all the services that are supported. 729 00:41:19,450 --> 00:41:24,250 Let's enumerate all of the particular service sub-functions that are also in there. 730 00:41:24,250 --> 00:41:26,590 So the first thing we did was ping all of them. 731 00:41:26,590 --> 00:41:30,970 Next we did was check the services that are supported. 732 00:41:30,970 --> 00:41:35,270 Now we're going to actually ask it to say, hey, what sub-functions are actually supported? 733 00:41:35,790 --> 00:41:37,990 I'm going to run that real quick here. 734 00:41:40,050 --> 00:41:41,310 Just one second. 735 00:41:41,310 --> 00:41:45,230 I don't want to get in too much right now because we're running out of time. 736 00:41:45,390 --> 00:41:47,070 But this one's pretty cool. 737 00:41:47,090 --> 00:41:50,430 So let's take a look and see what it is it's doing here. 738 00:41:50,430 --> 00:41:53,950 So what it's doing is it's sending out a request. 739 00:41:56,630 --> 00:42:00,750 0322 0091 0092 0093. 740 00:42:00,750 --> 00:42:01,390 You get the idea. 741 00:42:01,390 --> 00:42:06,830 It's just enumerating all possible identifiers or sub-functions for this particular service. 742 00:42:06,830 --> 00:42:10,830 In this case, this is a two bytes service, so it does it for you automatically. 743 00:42:10,830 --> 00:42:12,070 You don't have to tell it. 744 00:42:12,190 --> 00:42:16,210 That's part of the specification, how many bytes each particular service supports. 745 00:42:16,210 --> 00:42:21,250 So we're just going to enumerate through a list of all possible sub-functions that are supported. 746 00:42:21,970 --> 00:42:27,790 And eventually, when we're done, we're going to get a good list of all of the IDs that come through. 747 00:42:27,790 --> 00:42:40,710 Now, I did have a plan here on canceling this scan midway through so that we could get a list, but unfortunately, this particular service doesn't allow us to do that. 748 00:42:40,710 --> 00:42:44,290 So what I'm going to do is I'm going to go to a diff. 749 00:42:44,290 --> 00:42:47,170 I'm going to figure out how to exclude. 750 00:42:47,470 --> 00:42:50,690 Let me just think about how I can exclude a particular service ID. 751 00:42:51,690 --> 00:42:52,910 Maybe I can't. 752 00:42:52,910 --> 00:42:57,130 What I really want to do is, let me just look it up real quick while we hang it out. 753 00:42:57,130 --> 00:42:59,190 I'm going to check out the scan real quick. 754 00:42:59,190 --> 00:43:10,210 And I'm going to see what this particular... I need to issue a keyboard halt error. 755 00:43:10,210 --> 00:43:12,510 And that will break out of it. 756 00:43:50,800 --> 00:43:54,120 So, just one second, I'm going to... 757 00:43:54,880 --> 00:43:57,120 So there's a really cool utility called... 758 00:43:58,460 --> 00:44:00,300 Oops, sorry. 759 00:44:03,920 --> 00:44:05,540 Called psutil. 760 00:44:05,540 --> 00:44:08,520 So I opened up another Python window. 761 00:44:08,520 --> 00:44:15,340 We use psutil, which allows me to send a SIGINT to a process. 762 00:44:15,640 --> 00:44:19,440 So we need to do a SIGINT and then it's called process. 763 00:44:19,560 --> 00:44:34,280 And then the process ID, which is pit equals 9971.signal.signal. 764 00:44:34,280 --> 00:44:35,240 I think it's two. 765 00:44:37,740 --> 00:44:38,620 Network. 766 00:44:39,260 --> 00:44:40,140 Oops. 767 00:44:41,340 --> 00:44:42,700 Send signal, sorry. 768 00:44:47,330 --> 00:44:50,730 And what that did is, it did a keyboard halt. 769 00:44:50,730 --> 00:44:53,030 So it's a good way to do debugging. 770 00:44:53,030 --> 00:44:59,410 It's just essentially, I'd have a try, catch, try, not catch, but try command. 771 00:44:59,410 --> 00:45:00,230 So here it is. 772 00:45:00,230 --> 00:45:01,670 It tried to... 773 00:45:01,670 --> 00:45:04,490 It actually ended that particular scan. 774 00:45:04,490 --> 00:45:09,650 So that, just for demonstration purposes, I wanted to show you what kind of report we were able to get out of that. 775 00:45:09,650 --> 00:45:13,910 And there you can kind of see, here's a list of all the identifiers. 776 00:45:14,810 --> 00:45:18,850 This is service 22 on this particular node, 747F. 777 00:45:18,850 --> 00:45:21,250 I don't know what node that is in the vehicle yet. 778 00:45:21,290 --> 00:45:24,070 Maybe I can get that from doing my service scan. 779 00:45:24,690 --> 00:45:25,650 But here it is. 780 00:45:25,650 --> 00:45:28,870 We have a list of parameter IDs. 781 00:45:28,870 --> 00:45:33,050 So this is sort of a matrix of 00, 010, etc. 782 00:45:33,070 --> 00:45:39,630 And so as we scroll down, you can kind of see, hey, this is a service that has a negative response code of 31. 783 00:45:39,650 --> 00:45:45,650 So 31 means that the request that I sent is out of range. 784 00:45:45,650 --> 00:45:51,630 So I sent an ID 0000 to it, and it says it doesn't support that. 785 00:45:51,630 --> 00:45:54,930 But where it shines is we can actually see what is supported. 786 00:45:54,930 --> 00:45:59,810 In this case, 0108 is supported. 787 00:45:59,810 --> 00:46:06,350 So if I scroll down and keep scrolling, you'll eventually see that some of these services are indeed supported. 788 00:46:06,350 --> 00:46:10,470 So we create a cool map of the services that are actually supported. 789 00:46:10,530 --> 00:46:12,910 And here we have a longer list. 790 00:46:12,910 --> 00:46:14,370 We can kind of get an idea. 791 00:46:14,370 --> 00:46:24,410 And not only that, we see the services that are supported, but I also, after I'm done printing the report, I'll also print the actual data bytes that I received from the service itself. 792 00:46:24,410 --> 00:46:30,590 So in the case of 0001, I got these data bytes. 793 00:46:30,590 --> 00:46:34,410 This is a byte string that returned back to me. 794 00:46:34,410 --> 00:46:37,090 So I can get a byte string of the actual data itself. 795 00:46:37,090 --> 00:46:40,790 Maybe there's some interesting information that's stored inside of the byte string. 796 00:46:41,290 --> 00:46:49,690 What I can do later with this list is I can say, OK, now that I have a list, I can go back and just kind of recapture the data over and over and over again. 797 00:46:49,930 --> 00:46:51,170 And so that's the idea. 798 00:46:51,170 --> 00:46:52,370 That's what CMAV does. 799 00:46:52,370 --> 00:46:54,890 It gives you kind of a cool list. 800 00:46:54,890 --> 00:46:56,010 I'm going to keep it running. 801 00:46:56,950 --> 00:46:57,910 Oops. 802 00:47:01,190 --> 00:47:06,990 Keep it running so we can actually get some other sub-functions or services that might come up. 803 00:47:06,990 --> 00:47:11,370 Some of the other services are much faster, so I'll let them run real quick. 804 00:47:11,510 --> 00:47:12,770 Here's another one. 805 00:47:13,070 --> 00:47:17,210 And pretty quickly get rid of all our debug information. 806 00:47:17,310 --> 00:47:18,010 And I'll scroll down. 807 00:47:18,010 --> 00:47:23,410 Here's service 85 and all the different sub-functions it responded back to. 808 00:47:23,410 --> 00:47:25,590 So it might not be that interesting. 809 00:47:25,590 --> 00:47:29,290 Maybe we'll get a 12, which means sub-function not supported. 810 00:47:29,350 --> 00:47:31,070 But in some cases, we don't get a 12. 811 00:47:31,070 --> 00:47:33,930 We get a 7F, which is incorrect. 812 00:47:34,070 --> 00:47:40,430 We can do this function or the sub-function, but not in this particular service or session. 813 00:47:40,430 --> 00:47:42,070 So we have to change our session. 814 00:47:43,210 --> 00:47:45,250 And what sessions are available? 815 00:47:45,250 --> 00:47:49,150 Well, there's another report that's going to come up later on what sessions are supported. 816 00:47:49,150 --> 00:47:50,710 So we can keep scrolling through. 817 00:47:50,710 --> 00:47:58,230 And as we're running through all of these things, we can kind of say, hey, look, service 28, what's unique about all of them? 818 00:47:58,250 --> 00:48:00,330 Or what's not unique about them? 819 00:48:00,330 --> 00:48:01,130 So here we are. 820 00:48:01,130 --> 00:48:02,370 We're continuing to run. 821 00:48:02,370 --> 00:48:05,910 We're on service 2E right now. 822 00:48:06,010 --> 00:48:07,950 Same with service 22. 823 00:48:07,950 --> 00:48:14,010 2E is a very long one, so I'll issue another reset command as well. 824 00:48:14,390 --> 00:48:18,770 So we'll kind of speed this up a little bit, but you don't have to reset every time. 825 00:48:18,770 --> 00:48:20,370 Here we are. 826 00:48:20,630 --> 00:48:24,010 Oh, sometimes it'll get a little stopped up here. 827 00:48:24,010 --> 00:48:27,370 This is kind of a bug that I know I'm going to try to fix in the next revision. 828 00:48:27,790 --> 00:48:34,350 But if I don't get a response back from a particular controller, it sits there and waits for this 5 or 10 second timeout. 829 00:48:34,350 --> 00:48:36,250 And I really should just limit the timeout. 830 00:48:36,250 --> 00:48:38,290 I thought I was doing it, but it's not working right now. 831 00:48:38,290 --> 00:48:42,950 So this is something that is a known bug, but sometimes we'll get these no responses. 832 00:48:43,210 --> 00:48:45,050 And this is actually a correct no response. 833 00:48:45,050 --> 00:48:46,670 It shouldn't respond back to us. 834 00:48:46,670 --> 00:48:48,090 That particular one doesn't. 835 00:48:48,090 --> 00:48:49,250 So we'll wait for it. 836 00:48:49,250 --> 00:48:49,770 There it is. 837 00:48:49,770 --> 00:48:52,090 There's our service 10. 838 00:48:52,110 --> 00:48:56,010 It responds back that it supports these particular sub-functions. 839 00:48:56,010 --> 00:48:58,070 So I was just talking about modes before. 840 00:48:58,070 --> 00:49:00,350 There are actually three modes that it supports. 841 00:49:01,250 --> 00:49:04,130 10.01, 10.02, and 10.03. 842 00:49:04,170 --> 00:49:05,850 It supports all three of them. 843 00:49:05,850 --> 00:49:09,410 You'll notice that this is negative response code 12, which means it doesn't support it. 844 00:49:09,410 --> 00:49:11,150 But in this case, it does support. 845 00:49:11,450 --> 00:49:13,930 Service 10.01 is supported. 846 00:49:13,930 --> 00:49:22,050 10.02 is also supported, but it has a negative response code of 33, which means that you need security access first in order to do this one. 847 00:49:22,050 --> 00:49:26,790 So as a security researcher, you may be really interested, why do I need security access to do a 10.02? 848 00:49:26,790 --> 00:49:34,010 If you do a little bit more digging on this particular service or sub-function, this is the reprogramming mode. 849 00:49:34,010 --> 00:49:39,630 So it wants you to do security access in order to reflash the controller. 850 00:49:39,630 --> 00:49:40,950 This is actually very unusual. 851 00:49:40,950 --> 00:49:42,970 Most cars don't require this. 852 00:49:42,970 --> 00:49:46,150 But it's something that's new for these particular vehicles. 853 00:49:46,550 --> 00:49:49,990 Service 11 is an ECU reset service. 854 00:49:49,990 --> 00:49:53,550 If this had succeeded, we would have had some issues probably through here. 855 00:49:53,550 --> 00:49:56,070 The controller would have reset and taken a very long time. 856 00:49:56,070 --> 00:49:58,010 Don't know why these all fail. 857 00:49:58,050 --> 00:50:00,950 Maybe it doesn't have a sub-function, and that might be why. 858 00:50:01,130 --> 00:50:04,110 Service 14, similarly, quite interesting. 859 00:50:04,290 --> 00:50:07,450 Service 34, all of these need to be in a different sub-function. 860 00:50:07,450 --> 00:50:16,010 So we get a lot of really cool information just from the get-go of what may or may not be supported on these particular controllers. 861 00:50:16,150 --> 00:50:21,050 Including what is supported and what gives us a little bit of an empty spot. 862 00:50:21,050 --> 00:50:24,090 It means I didn't get a response back, so I don't know what to tell you. 863 00:50:24,090 --> 00:50:24,930 It's empty. 864 00:50:24,970 --> 00:50:26,910 So you get a lot of really cool information. 865 00:50:26,910 --> 00:50:34,330 If you run these for a very long time across all the different controllers, you're going to get a ton of information from the particular vehicle. 866 00:50:34,490 --> 00:50:36,370 And then maybe you can save it and do something. 867 00:50:36,370 --> 00:50:40,970 So I finished with one controller, and now I would move to the next one. 868 00:50:40,970 --> 00:50:49,470 So that's essentially what this is telling me it wants to do, is go to the next controller, etc., etc., and find all the services and sub-functions on that. 869 00:50:49,490 --> 00:50:51,370 So I'm going to do that real quick. 870 00:50:51,410 --> 00:50:56,070 We're kind of running out of time, but I'd like to try to see what else we can get out of it. 871 00:50:56,130 --> 00:51:01,010 There it is, trying to get data from these controllers. 872 00:51:01,010 --> 00:51:03,390 Scroll down... it's really quite interesting. 873 00:51:03,390 --> 00:51:08,690 Now it's scanning this ID 620, and it has a response of 504. 874 00:51:08,730 --> 00:51:11,730 19, 22, and 3E are all supported. 875 00:51:11,730 --> 00:51:15,190 So this one only has three functions that are supported. 876 00:51:15,190 --> 00:51:17,070 Again, I'm running through a gateway. 877 00:51:17,310 --> 00:51:29,690 My thought process here is maybe if I get past the gateway, I'll actually have some more information that's available on the other side of the gateway, which I do have this connected, I just haven't done that yet. 878 00:51:29,690 --> 00:51:33,670 We have five minutes left, or ten minutes left, because I can't count. 879 00:51:34,110 --> 00:51:35,550 I think this is a good time to stop. 880 00:51:35,550 --> 00:51:40,070 I think I am giving you guys the information, but hopefully it's enough for you guys to go. 881 00:51:40,070 --> 00:51:45,050 Again, let me just type in the web page right here. 882 00:51:45,510 --> 00:51:50,170 www.github.com I'm typing in something else. 883 00:51:50,450 --> 00:51:51,690 Canvas at... 884 00:51:53,430 --> 00:51:54,730 There it is. 885 00:51:54,730 --> 00:51:56,250 It opened an edge. 886 00:51:56,250 --> 00:51:57,010 You're welcome. 887 00:51:57,570 --> 00:51:59,090 I'll fix it. 888 00:52:00,050 --> 00:52:01,590 You get the idea. 889 00:52:01,810 --> 00:52:02,710 It's awesome. 890 00:52:02,710 --> 00:52:03,890 Thanks, Microsoft. 891 00:52:05,190 --> 00:52:06,350 That's what I want. 892 00:52:06,350 --> 00:52:08,630 And then CMAP is right here. 893 00:52:10,030 --> 00:52:14,210 So CMAP, essentially, you can go ahead and get this code that I just showed you guys today. 894 00:52:14,210 --> 00:52:16,190 I'm sure I'll be pushing some updates. 895 00:52:16,870 --> 00:52:19,530 Give me my first pull request. 896 00:52:19,770 --> 00:52:24,470 Somebody, right now, first pull request gets free CMAP. 897 00:52:25,350 --> 00:52:29,310 And if you guys have any other questions, I'll be around all day. 898 00:52:29,690 --> 00:52:34,450 Just hit me up on the Twitter at C-A-R-F-U-C-A-R. 899 00:52:35,150 --> 00:52:43,810 If you want to do your own Canvas hacking or anything like that, I highly encourage you to get to the virtual.carhackingvillage.com. 900 00:52:44,050 --> 00:52:46,850 This car that I just showed you, it is on there. 901 00:52:46,850 --> 00:52:48,670 Everything I've just shown you is on there. 902 00:52:49,090 --> 00:52:55,370 You can put CMAP on there if you'd like to right now and run these right now on the same vehicle that I just ran this on. 903 00:52:55,370 --> 00:53:00,670 And if you have some questions, regardless of that, we'll be available to give you some hands. 904 00:53:00,670 --> 00:53:03,750 Alright, if there's anything else, any questions from the field? 905 00:53:04,190 --> 00:53:05,550 I've not seen anything. 906 00:53:06,190 --> 00:53:09,650 Maybe there wasn't anybody because of the initial start that we had. 907 00:53:09,650 --> 00:53:10,650 Yeah, this is horrible. 908 00:53:10,650 --> 00:53:12,430 For some reason, I was... 909 00:53:12,430 --> 00:53:13,430 A lot? 910 00:53:13,430 --> 00:53:14,010 Like two? 911 00:53:14,010 --> 00:53:14,690 Or three? 912 00:53:15,250 --> 00:53:16,130 Thirty! 913 00:53:16,570 --> 00:53:17,790 Hey, you over there. 914 00:53:17,790 --> 00:53:18,370 Yeah, you. 915 00:53:18,370 --> 00:53:20,030 How come you're not asking me a question? 916 00:53:21,050 --> 00:53:21,650 No, that. 917 00:53:21,650 --> 00:53:22,690 Over there. 918 00:53:23,430 --> 00:53:24,410 Yeah, you. 919 00:53:25,370 --> 00:53:27,310 Alright, maybe they don't have any questions. 920 00:53:27,430 --> 00:53:29,590 Yeah, I've seen no questions in the chat. 921 00:53:29,590 --> 00:53:30,250 That's fine. 922 00:53:30,250 --> 00:53:32,490 I guess I'm just that good at presenting. 923 00:53:32,750 --> 00:53:33,470 Or the opposite. 924 00:53:33,470 --> 00:53:34,530 Linted is telling me. 925 00:53:34,830 --> 00:53:35,690 Hey, Linted. 926 00:53:35,690 --> 00:53:36,710 Oh no, not Linted. 927 00:53:36,970 --> 00:53:38,030 Linted wants to know. 928 00:53:38,030 --> 00:53:39,650 He's got a technical question. 929 00:53:39,750 --> 00:53:41,850 Robert, what's wrong with the cars right now? 930 00:53:42,090 --> 00:53:42,810 Talk about... 931 00:53:42,810 --> 00:53:46,110 Talk about hardware checkout. 932 00:53:46,110 --> 00:53:46,710 Alright. 933 00:53:47,190 --> 00:53:47,790 I think you have to... 934 00:53:47,790 --> 00:53:50,530 Is Discord stream muted or is that just me? 935 00:53:50,710 --> 00:53:51,990 That's his question. 936 00:53:53,590 --> 00:53:53,990 So... 937 00:53:53,990 --> 00:53:55,330 You gotta go on Twitch, man. 938 00:53:55,370 --> 00:53:56,590 That's all there is to it. 939 00:53:57,210 --> 00:53:58,170 Alright, cool. 940 00:53:58,630 --> 00:53:59,450 Thank you.