CAN-BUS SuperSniffer

Previously i developed a tool to scan new messages by dumping data from putty into a file.
But I didn't spend much time in making it user friendly, after a while i wanted to get into scanning the BUS again only to find i forgot how the utility i wrote actually works, I then realized that the utillity will be pretty much useless to anyone trying to use it.

So i revamped it completely, and it actually works allot better, you are able to find messages much quicker!

I also realized that after reading this blog that all the information im sharing is now a bit scattered all over the place.

Hopefully this Blog post will clear things up a bit.


Meet "The CAN-BUS Super Sniffer" your new best friend.

Download  - CAN-BUSSuperSniffer.exe.zip

(The download now includes the SuperSniffer, SuperSniffer Source Code, Arduino Sketch & the SeeedStudio MCP Library which you need to import)
 
This software requires the Microsoft Com control
Its included in the Microsoft VB6 Run-time Libraries downloadable here.

Microsoft Visual Basic 6 Runtime Libraries

Or you can download it from an untrusted source but it's not recommended

NOTE!
You have to get the Arduino+CAN-BUS shield to return data in the following format.
<1,2,3,4,5,6,7,8,9>
"<" is used to determine the start of the Message and ">" to determine the end, if the data returned from the arduino over the serial port is not in the mentioned format it will ignore the data coming in.

I have uploaded the Arduino Sketch code i'm using to Git-Hub, If you are using the same hardware as me, Arduino UNO + Seeed Studio Shield you should be able to just copy and pase without making any changes to the .ino sketch.
https://github.com/mailmartinviljoen/CAN-BUS-Sniffer
Also remember the sketch in the above link is using the Seeedstudion CAN Library so you need to import it into the Arduino IDE
https://github.com/Seeed-Studio/CAN_BUS_Shield

CAN-BUS Super Sniffer Tool Information

The CAN-BUS Super Sniffer tool is designed to help you reverse engineer
a vehicle's CAN-BUS Messaging system in order for you to figure out the meaning of the
messages detected on the CAN-BUS.

***All information in this help file is based on research done on a Jeep JK 2010 2door Rubicon.
If you happen to see incorrect facts please bear in mind its how the information was perceived when
researching and reverse engineering the CAN-BUS. Please use this information "AS IS"
When using this information you use it on your own and cannot hold any one liable if something bad happens.***

Basic CAN-BUS Information to get you started.
In order to get the data readable by the CAN-BUs Super Sniffer, you need an Arduino UNO connected to a Seeed Studio or similar device.
The Seeed studio and similar Arduino Shields are making use of the MCP2551 and MCP2515 CAN Chip, one is in interpiter and the other is a transceiver.
All research has been done on the Interior BUS , which controls all of the internal buttons in the vehicle and is running at 125 kbps
The baud rate is important, if you connect at a lower/higher rate the bus will bot be able to communicate and the system will give an error
in the vehicle, On the Jeep it will beep and various instruments lights will come on as well as the wipers will move up and down.
Also note! – The Arduino connected to the Seeed Studio CAN-BUS shield has 2 serial ports and should not be confused with one another.
The wires connecting to the CAN-BUS of the vehicle should run at 125kbps and the connection between the computer running the Supper Sniffer tool runs at 38400 baud rate, when you see corrupted characters it’s the PC is probably not connecting at the correct rate, althought he software
is set to connect at 38400 on each connection.

More Information
The Interior CAN-BUS messaging system consist out of 9 Bits.
Bit0 = the CAN Message ID  - Each Message ID can broadcast various messages.
Bit1,Bit2,Bit3,Bit4,Bit5,Bit6,Bit7,Bit8

The Arduino sketch is programmed to deliver the messages it finds on the CAN-BUS in the following format.
<CAN_ID,BIT1,BIT2,BIT3,BIT4,BIT5,BIT6,BIT7,BIT8>

an example message will look like this. <680,1,16,255,23,0,0,0,0>

IMPORTANT TO KNOW.
When the Arduino Shield finds messages on the bus its sends the CAN_ID in normal Number format.
But when you send the ID back into the can bus to mimic pressing a button in the vehicle you need to send it in
HEX format, hence the reason why the CAN-BUS Super Sniffer, shows a hex number in the first column
and the full message including the ID bit in number format. So you are able to know to which ID you need to send the detected message.

More Information & examples (The examples are NOT Based on real data and is cannot be used)
ID 286 - Controls around the steering wheel. Left Blinker, Right Blinker,Lights, High Beams, Wipers ect.
ID 680 - Controls on the 4x4 switch pod. Swaybar Disconnect, Lockers front/Back On/Off, ESP electroninc stability program mode.

<680,1,16,0,0,0,0,0,0> = Swaybar disconnect button pressed.
<680,1,17,0,0,0,0,0,0> = ESP Button Pressed
<680,1,18,0,0,0,0,0,0> = Lockers front/Back On/Off button pressed
Note the above is from the same node on the same switch panel in the vehicle, this means that
the node and all its buttons send messages under Message ID 680.

<286,15,20,4> - Left Blinker on (It broadcasts the state on a very regular inverval)
<286,15,16,3> - Right Blinker on (It broadcasts the state on a very regular inverval)
<286,20,16,2> - Lights On (It broadcasts the state on a very regular inverval)
<286,30,16,1> - High Beams On (It broadcasts the state on a very regular inverval)

Although this was done on a Jeep’s Interior BUS, Theoretically this should work on any CAN-BUS driven Vehicle and on any BUS such as the drive terrain.

Connecting the Arduino + CAN-BUS shield to the vehicle’s CAN-BUS.
Since the Radio can be controlled by the CAN-BUS you can TAP into the network via the cable that goes into the Radio.

From the Arduino Connect a USB Cable and ensure all Arduino Drivers are installed.
also ensure when connecting with the Sniffer Tool that you are using the correct COM Port.

From the Tools Menu. Com settings – Allows you to select the comport to connect to, this is the same port the Arduino IDE is used to program the Arduino UNO Connect To COM – Connect the software, once connected all data will start to come in from the CAN BUS into the Sniffer tool which will then automatically start to process the data by grouping them by Message id in the Grid List. Clear ID Ignore List – Will clear the list created to ignore messages by ID. Clear Message Ignore list – Will clear the list created to Ignore messages. Clear All data in the list will  - clear the Grid List but data will immediately start to fill it again.

From the List you are able to Double Click a Message and the utility on the left will pop up, Always Ignore this message – Will ignore this specific message from the BUS I.E if <680, 0,0,0,0,0,0,0,0> was selected to be ignored then <680, 23,0,0,0,0,0,0,0> will not be ignored. Ignore This ID – Will ignore ALL messages coming from Message ID680 Save – Will save the data to a sequential file in the same directory where the application is running. Into a file called canmsgname.txt (It will save it with the ID in the heading of the popup utility screen) The black text box log, will stream all changed messages to the Log box, and  it will not duplicate messages, you are able to clear the box manually by selecting all text and press delete or backspace. And when a message comes in which is not in the log , it will appear again.

Emulating CAN-BUS Data (For when you just want to understand how the Super Sniffer Tool Works) Turn Emulation ON – Will generate CAN-BUS Messages Send Sample Message – Will send a random message into the system (Not to the can bus even if its connected)