Approved for public release.

Not confidential 1
Reverse engineering the MINI
Cooper automotive CAN bus
message format.
Software study group presentation
February 2011
Approved for public release. Not confidential 2
> Everyone has heard that modern cars use the CAN bus
to send messages between various parts of the vehicle.
> Those messages must be interesting or the
manufacturer wouldnt build an entire bus to transport
them right?
> Wouldnt you like to know what the various bits of your
car are saying to each other?
Why spend time reverse engineering a CAN bus?
Approved for public release. Not confidential 3
> CAN is a message based protocol, designed specifically
for automotive applications but now also used in other
areas such as industrial automation and medical
equipment.
> Development of the CAN-bus started originally in 1983 at
Robert Bosch GmbH. The protocol was officially
released by the SAE in 1986. The first CAN controller
chips, produced by Intel and Philips, came on the market
in 1987. Bosch published the CAN 2.0 specification in
1991.
Controller Area Network bus overview.
(Copied from Wikipedia)
Approved for public release. Not confidential 4
> ISO 11898-1: CAN Data Link Layer and Physical
Signaling. (Costs $, so I didnt read it.)
> Microchip AN228: A CAN Physical Layer Discussion
+ 2-wire differential signaling. NICE!
> Lots of CAN-to-USB converters out there. I borrowed
one from a local FAE and wired it to the MINI
> A single CAN bus connects the Instrument cluster,
Engine Control Module, Automatic Transmission Module,
Antilock Braking System, Automatic Stability Control,
Electro Hydraulic Steering and the Steering Angle
Sensor together. (What could possibly go wrong!)
So CAN I get access to the data somehow?
Approved for public release. Not confidential 5
> Since the CAN bus is differential, looking at one wire
with respect to ground looks approximately like this:
*&@!#^(*@&^$#(*&(!*^@%$(!^%@#%!&@^%#(&!^
> Trying to hook two oscilloscope probes up, inverting one
signal and adding them while balancing a scope on your
lap without accidentally unplugging it from the extension
cord, dropping it on the garage floor or shorting out the
CAN bus didnt help much.
> How about the Ill know the data is right when I see it
method: Pick rates until it looks right. This is pretty easy.
There are only a few well-known possibilities.
Problem #1 data transmission rate?
Approved for public release. Not confidential 6
> The protocol adapter does all the hard work. You get
nice messages out of it once you pick the right bit rate.
> CAN messages are well-defined:
+ I got a timestamp, Message ID and message bytes.
+ All messages had 8 data bytes.
327a 0153 00 51 00 00 00 f f 00 80
327a 01f 0 0a 20 0a 00 0a 00 0a 00
327a 01f 8 00 00 00 00 f e f f 00 00
327c 0316 01 00 00 00 00 00 00 00
327c 0336 00 00 f e 02 82 15 b0 67
What do you get?
Approved for public release. Not confidential 7
> 327a 0153 00 51 00 00 00 f f 00 80
Ti mest amp: 327a
Message I D: 0153
8 byt es of dat a: 00 51 00 00 00 f f 00 80
The parts of a message:
Approved for public release. Not confidential 8
Count Message ID
158865 0x0153
158865 0x01f 0
158865 0x01f 8
216338 0x0316
216334 0x0329
216335 0x0336
124942 0x0545
5432 0x0613
5432 0x0615
5432 0x0618
6010 0x061a
2209 0x061f
556 0x0630
I recorded 1.2 messages while I drove around.
There were 13 different massage IDs
Approved for public release. Not confidential 9
> The number of messages received and the message IDs
are inversely-related! What? I got more messages with
low numbered IDs than I got messages of high
numbered IDs.
> Using Google, I found this: "A message consists
primarily of an ID which represents the priority of the
message and up to eight data bytes."
> That would explain it. Lower message IDs are higher
priority and occur more often.
> (Dont look too closely at the table and complain that
some of the counts and message IDs don't fall nicely into
the description above. Real life is messy.)
Things to notice:
Approved for public release. Not confidential 10
> How about message ID 0x0153 since its the highest
priority message encountered.
> gr ep " 0153" l og1_cl ean | head
327a 0153 00 51 00 00 00 f f 00 80
3281 0153 00 51 00 00 00 f f 00 80
3288 0153 00 51 00 00 00 f f 00 80
328f 0153 00 51 00 00 00 f f 00 80
3296 0153 00 51 00 00 00 f f 00 80
329d 0153 00 51 00 00 00 f f 00 80
32a4 0153 00 51 00 00 00 f f 00 80
BORING!!!!!
What to look at first?
Approved for public release. Not confidential 11
> grep " 0153" log1_clean | cut -d' ' -f2- | sort | uniq | head
0153 00 01 01 00 00 ff 00 80
0153 00 01 02 00 00 ff 00 80
0153 00 01 03 00 00 ff 00 80
0153 00 01 04 00 00 ff 00 80
0153 00 01 05 00 00 ff 00 80
0153 00 01 06 00 00 ff 00 80
0153 00 01 07 00 00 ff 00 80
> That looks more interesting.
> Theres data in byte #1 at least. Lets look there.
Let's toss the timestamp, sort the data, remove all
the duplicates and see if there's something more
interesting going on.
Approved for public release. Not confidential 12
Byte #1 data: Looks like somethings there.
0
50
100
150
200
250
300
1
2
8
4
5
6
7
8
5
0
1
1
3
3
1
4
1
6
1
6
9
9
1
9
8
2
2
2
6
5
2
5
4
8
2
8
3
1
3
1
1
4
3
3
9
7
3
6
8
0
3
9
6
3
4
2
4
6
4
5
2
9
4
8
1
2
5
0
9
5
5
3
7
8
5
6
6
1
5
9
4
4
6
2
2
7
6
5
1
0
6
7
9
3
7
0
7
6
7
3
5
9
7
6
4
2
7
9
2
5
8
2
0
8
8
4
9
1
8
7
7
4
9
0
5
7
9
3
4
0
9
6
2
3
9
9
0
6
1
0
1
8
9
1
0
4
7
2
1
0
7
5
5
1
1
0
3
8
1
1
3
2
1
1
1
6
0
4
1
1
8
8
7
1
2
1
7
0
1
2
4
5
3
1
2
7
3
6
1
3
0
1
9
Byte1
Byte2
Approved for public release. Not confidential 13
J ust look at the first 1,000 messages. Looks better!
0
50
100
150
200
250
300
1
2
1
4
1
6
1
8
1
1
0
1
1
2
1
1
4
1
1
6
1
1
8
1
2
0
1
2
2
1
2
4
1
2
6
1
2
8
1
3
0
1
3
2
1
3
4
1
3
6
1
3
8
1
4
0
1
4
2
1
4
4
1
4
6
1
4
8
1
5
0
1
5
2
1
5
4
1
5
6
1
5
8
1
6
0
1
6
2
1
6
4
1
6
6
1
6
8
1
7
0
1
7
2
1
7
4
1
7
6
1
7
8
1
8
0
1
8
2
1
8
4
1
8
6
1
8
8
1
9
0
1
9
2
1
9
4
1
9
6
1
9
8
1
Byte1
Byte2
Approved for public release. Not confidential 14
> The plot looks continuous from 0 through about 153 and
then starts over at zero and looks continuous again for a
while.
> This is the classic pattern for the lower-significance bits
of a larger bit field.
> Imagine looking at a ramp from 0 to 100, but cover up
the most significant digit. Youll see
0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9
> Thats just what were seeing, so lets look for the upper
bits. They are probably in the packet. Byte #2 maybe?
This is a pattern to look out for:
Approved for public release. Not confidential 15
> Some of the data in the packet might be the same for all
packets in the log. How can we tell which bits CHANGE
at least once in the log?
> Thanks to Cooper and Elmquist, this algorithm works:
1) Record the data for the first packet of a type.
2) Exclusive-or the new packet with the saved packet to get
just the bits that are different.
3) OR those bits into an array holding all the bits that have
changed.
At the end, print out the array.
But, not so fast. It would be great to know which
bits change in the packet first.
Approved for public release. Not confidential 16
> 153 10 f 8 3f 00 00 00 00 80
> 1f 0 f f e7 f f c7 f f 27 f f 87 Thi s I D l ooks f un.
> 1f 8 7f 00 00 00 00 00 00 00 One 7- bi t val ue?
> 316 01 00 f f 7f 00 00 00 00
> 329 f 3 7f 00 00 00 f f 00 00
> 336 f f 7f 00 02 f f 1f f f 7f
> 545 12 f f f f 00 00 00 00 00
> 613 00 00 00 00 00 df f 7 00
> 615 00 00 00 03 02 00 00 00 Onl y 3 bi t s change!
> 618 00 00 3f 00 00 00 00 00 J ust one 6- bi t f i el d?
> 61a 07 00 00 f f 00 f f 00 00
> 61f f f f f 0f c0 42 00 00 00
> 630 00 00 00 00 00 00 00 00 Thi s I D i s real bor i ng.
Which bits changed in which packets:
Approved for public release. Not confidential 17
> We plotted byte #1 and got this: (Lets look closer at it.)
Back to the packet ID 0x0153
0
50
100
150
200
250
300
1
2
2
4
3
6
4
8
5
1
0
6
1
2
7
1
4
8
1
6
9
1
9
0
2
1
1
2
3
2
2
5
3
2
7
4
2
9
5
3
1
6
3
3
7
3
5
8
3
7
9
4
0
0
4
2
1
4
4
2
4
6
3
4
8
4
5
0
5
5
2
6
5
4
7
5
6
8
5
8
9
6
1
0
6
3
1
6
5
2
6
7
3
6
9
4
7
1
5
7
3
6
7
5
7
7
7
8
7
9
9
8
2
0
8
4
1
8
6
2
8
8
3
9
0
4
9
2
5
9
4
6
9
6
7
9
8
8
Byte1
Byte2
Approved for public release. Not confidential 18
> Why do I see a 0x51 (D81)in there? The 1 bit never
changes since we see a change mask of 0xF8
> It looks like the least-significant bits dont change.
> Looking at the beginning and removing dups we see this:
+ 81
+ 89
+ 97
+ 113
+ 121
> HEY! They go up by 8 each time. (16 if you do the math)
> The least-significant 8 bits probably dont matter. >>3
But byte #1 has bits-changed of 0xF8.
Approved for public release. Not confidential 19
Now the data goes up and down by 1 (with a bias)
0
5
10
15
20
25
30
35
18
1
5
2
2
2
9
3
6
4
3
5
0
5
7
6
4
7
1
7
8
8
5
9
2
9
9
1
0
6
1
1
3
1
2
0
1
2
7
1
3
4
1
4
1
1
4
8
1
5
5
1
6
2
1
6
9
1
7
6
1
8
3
1
9
0
1
9
7
2
0
4
2
1
1
2
1
8
2
2
5
2
3
2
2
3
9
2
4
6
2
5
3
2
6
0
2
6
7
2
7
4
2
8
1
2
8
8
2
9
5
3
0
2
3
0
9
3
1
6
3
2
3
Series1
Approved for public release. Not confidential 20
So where are the more significant bits? Next byte?
0
50
100
150
200
250
300
1
2
1
4
1
6
1
8
1
1
0
1
1
2
1
1
4
1
1
6
1
1
8
1
2
0
1
2
2
1
2
4
1
2
6
1
2
8
1
3
0
1
3
2
1
3
4
1
3
6
1
3
8
1
4
0
1
4
2
1
4
4
1
4
6
1
4
8
1
5
0
1
5
2
1
5
4
1
5
6
1
5
8
1
6
0
1
6
2
1
6
4
1
6
6
1
6
8
1
7
0
1
7
2
1
7
4
1
7
6
1
7
8
1
8
0
1
8
2
1
8
4
1
8
6
1
8
8
1
9
0
1
9
2
1
9
4
1
9
6
1
9
8
1
Byte1
Byte2
0
1
1
2
2
3
3
4
4
1
2
1
4
1
6
1
8
1
1
0
1
1
2
1
1
4
1
1
6
1
1
8
1
2
0
1
2
2
1
2
4
1
2
6
1
2
8
1
3
0
1
3
2
1
3
4
1
3
6
1
3
8
1
4
0
1
4
2
1
4
4
1
4
6
1
4
8
1
5
0
1
5
2
1
5
4
1
5
6
1
5
8
1
6
0
1
6
2
1
6
4
1
6
6
1
6
8
1
7
0
1
7
2
1
7
4
1
7
6
1
7
8
1
8
0
1
8
2
1
8
4
1
8
6
1
8
8
1
9
0
1
9
2
1
9
4
1
9
6
1
9
8
1
Byte2
Byte3
Approved for public release. Not confidential 21
> Every time byte #1 has a discontinuity, byte #2
increments or decrements.
> This is EXACTLY what we want to see if a bit field is split
into two parts. All we need to do is glue them together.
> Take byte #2 shift it left 8 bits (multiply by 256) and add it
to byte #1.
> Then shift the whole mess right 3 bits (divide by 8)
> Then subtract 10.
> Simple right? What do you get then?
See how byte #2 goes up or down?
Approved for public release. Not confidential 22
Final graph of who-knows? Looks fabulous!
0
20
40
60
80
100
120
1
2
3
4
5
6
7
8
9
1
1
1
1
3
3
1
5
5
1
7
7
1
9
9
2
2
1
2
4
3
2
6
5
2
8
7
3
0
9
3
3
1
3
5
3
3
7
5
3
9
7
4
1
9
4
4
1
4
6
3
4
8
5
5
0
7
5
2
9
5
5
1
5
7
3
5
9
5
6
1
7
6
3
9
6
6
1
6
8
3
7
0
5
7
2
7
7
4
9
7
7
1
7
9
3
8
1
5
8
3
7
8
5
9
8
8
1
9
0
3
9
2
5
9
4
7
9
6
9
9
9
1
BiasRemoved
BiasRemoved
Approved for public release. Not confidential 23
Longer plot of whatever it is.
0
100
200
300
400
500
600
700
800
900
1
2
9
7
5
9
3
8
8
9
1
1
8
5
1
4
8
1
1
7
7
7
2
0
7
3
2
3
6
9
2
6
6
5
2
9
6
1
3
2
5
7
3
5
5
3
3
8
4
9
4
1
4
5
4
4
4
1
4
7
3
7
5
0
3
3
5
3
2
9
5
6
2
5
5
9
2
1
6
2
1
7
6
5
1
3
6
8
0
9
7
1
0
5
7
4
0
1
7
6
9
7
7
9
9
3
8
2
8
9
8
5
8
5
8
8
8
1
9
1
7
7
9
4
7
3
9
7
6
9
1
0
0
6
5
1
0
3
6
1
1
0
6
5
7
1
0
9
5
3
1
1
2
4
9
1
1
5
4
5
1
1
8
4
1
1
2
1
3
7
1
2
4
3
3
1
2
7
2
9
1
3
0
2
5
BiasRemoved
BiasRemoved
Approved for public release. Not confidential 24
> I wrote down what I did:
> 1) Back down driveway
> 2) Stop
> 3) Drive through neighborhood
> This could be vehicle speed! (Maybe)
> In what units? MPH, KPH, furlongs-per-fortnight?
> MPH? (probably not since I dont drive 600 MPH.)
> Somewhere along the line I decided I needed to divide
by 22 to get MPH. That seems dubious, but I dont have
records of the drive anymore, so OK, lets go with that.
What is it?
Approved for public release. Not confidential 25
Longer Speed plot. (Captured from older dataset)
-10
0
10
20
30
40
50
60
0 50000 100000 150000 200000 250000
MPH
MPH
Approved for public release. Not confidential 26
> Byte #0 has changing data in the 2^4 bit (0x10)
> Byte #7 has changing data in the 2^7 bit. (0x80)
> (Looking at byte #7 its 0x80 until I turn the car off, so its
not very interesting.)
> Plot byte #0 on top of the speed:
OK, we nailed that one. What are the other bits?
Approved for public release. Not confidential 27
Speed and Byte #0
-10
0
10
20
30
40
50
60
70
0 50000 100000 150000 200000 250000
MPH
B0(Scaled)
Approved for public release. Not confidential 28
> It looks like Byte #0 bit 2^4 goes to a 1 whenever Im
decelerating.
> I know from looking at OBD data that that happens when
the fuel system goes open-loop This could be an
indication of that condition. It would be easy to correlate
it with a live OBD reading to make sure.
Thats interesting.
Approved for public release. Not confidential 29
> I found these values over the course of about 2 weeks of
investigating:
OK, now just do the same thing with all the other
message types
Approved for public release. Not confidential 30
Message type 0x153
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
Bits
used
10 F8 3F 00 00 00 00 80
For
What?
00 or
10
(Fuel
open-
loop?)
Vehicle or wheel
speed
80
when
car is
on?
Approved for public release. Not confidential 31
Message type 0x1F0
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
Bits
used
FF E7 FF C7 FF 27 FF 87
For
What?
8 bits +
next 3
bits
Wheel
speed
00, 20,
40, 60
pattern
+ 3 bits
of
wheel
speed
8 bits +
next 3
bits
Wheel
speed
00, 20,
40, 60
pattern
+ 3 bits
of
wheel
speed
8 bits +
next 3
bits
Wheel
speed
00, 20,
40, 60
pattern
+ 3 bits
of
wheel
speed
8 bits +
next 3
bits
Wheel
speed
00, 20,
40, 60
pattern
+ 3 bits
of
wheel
speed
Approved for public release. Not confidential 32
Message type 0x1F8
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
Bits
used
7F 00 00 00 00 00 00 00
For
What?
Correla
ted to
Wheel
speed
Approved for public release. Not confidential 33
Message type 0x316
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
Bits
used
01 00 FF 7F 00 00 00 00
For
What?
Ignition
on
RPM * 6
(LSBFirst)
Approved for public release. Not confidential 34
Message type 0x329
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
Bits
used
F3 7F 00 00 00 FF 00 00
For
What?
11, 62,
80, C0
pattern
Coolant
Temp *
4 in C
Throttle
position
Approved for public release. Not confidential 35
Message type 0x336
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
Bits
used
FF 7F 00 02 FF 1F FF 7F
For
What?
Correlated with
RPM. Ignition
advance?
Ignition
on?
? ? ? ?
Approved for public release. Not confidential 36
Message type 0x545
Byte 0 Byte
1
Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
Bits
used
12 FF FF 00 00 00 00 00
For
What?
12when
not
running.
Parking
Brake?
Fuel
consumed?
Approved for public release. Not confidential 37
Message type 0x613
Byte 0 Byte
1
Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
Bits
used
00 00 00 00 00 DF F7 00
For
What?
? ?
Approved for public release. Not confidential 38
Message type 0x615
Byte 0 Byte
1
Byte 2 Byte 3 Byte 4 Byte
5
Byte 6 Byte 7
Bits
used
00 00 00 03 02 00 00 00
For
What?
? Ignition
on?
Approved for public release. Not confidential 39
Message type 0x618
Byte 0 Byte
1
Byte 2 Byte 3 Byte 4 Byte
5
Byte 6 Byte 7
Bits
used
00 00 3F 00 00 00 00 00
For
What?
?
Approved for public release. Not confidential 40
Message type 0x61A
Byte 0 Byte
1
Byte 2 Byte 3 Byte 4 Byte
5
Byte 6 Byte 7
Bits
used
07 00 00 FF 00 FF 00 00
For
What?
? Odo? ?
Approved for public release. Not confidential 41
Message type 0x61F
Byte 0 Byte
1
Byte 2 Byte 3 Byte 4 Byte
5
Byte 6 Byte 7
Bits
used
FF FF 0F C0 42 00 00 00
For
What?
? ? ? ? Bit 2
blinker
Approved for public release. Not confidential 42
Message type 0x630
Byte 0 Byte
1
Byte 2 Byte 3 Byte 4 Byte
5
Byte 6 Byte 7
Bits
used
00 00 00 00 00 00 00 00
For
What?
Approved for public release. Not confidential 43
I even managed to figure out which wheel sensor
was which. How?
Approved for public release. Not confidential 44
> See that there are two lines that are almost identical? Id
say thats probably a front wheel and a rear wheel.
> I turned right, left then straight. Which side is left?
+ As you turn right, the right wheels travel less distance, so theyll
go slower.
> OK, we have right vs. left figured out. Front vs. back?
> See the sharp spikes? Could that be sticks or cracks in
the road which will make the wheel speed change?
> There are places where a spike happens in one line and
then happens later in the other line. That looks like front
vs. rear to me.
Which wheel is which?
Approved for public release. Not confidential 45
> This project was great fun.
> I suggest you try it with some random data stream
someday.
Thats it.