Canbus

April 2022

Inspecting the CAN bus of a Ford Fiesta to remotely open and close the car door using an app.

Sniffing the CAN bus

All CAN communications are sniffed using a CAN SPI adapter and an Arduino. The logs are then processed and visualized using CAN Hacker. This free open source tool shows all the CAN messages and their data. The tool also allows sending messages to the bus.

Finding the right commands

After installing the sniffer, we wait for silence on the CAN bus. Then, we press the interior lock button to capture lock and afterwards press again for unlock commands. Both captures are saved. To find the correct commands, we send an entire capture. If the car reacts, we know that the command is in the capture. We then split the capture in half and send each half separately. If the car reacts to one of the halves, we know that the command is in that half. We repeat this process until we find the exact command. By doing this both close and open commands are found.

Sending the commands

The found commands are sent using a Nucleo board paired with a CAN transceiver. The board is connected to the CAN bus and is controlled by an app. The app controls the Nucleo over Bluetooth. The Nucleo then sends the commands to the CAN bus, which opens and closes the car door.