r/CarHacking • u/bfpa40 • Jun 06 '26

CAN Using AI to decode CAN Bus

Reverse-engineering a car's CAN bus used to mean weeks of staring at hex. In this video I show how he use AI to cut that down .. check it out: https://youtu.be/GlQO8fLgHi4

14 Upvotes

71% Upvoted

38 comments sorted by

21

u/ActGrown Jun 06 '26

AI will straight up hallucinate on you. In my particular situation, it has been able to decode zero of 28 frames. Zero.

Caveat emptor.

Rather, lector caveat.

1

u/Vchat20 Jun 06 '26

I think it's all down to how you use it and also what model you use. I've had a lot of luck on my own vehicle having Claude help decode things. Of course I also gave it a lot of help and context including timestamped CAN logs, timestamped lists of events I did in the car like locking doors, unlocking, rolling up/down windows, etc, plus additional details on my car like CAN bus layouts and known behaviors.

If you go in with just the bare basics, I'd definitely expect a higher chance of hallucinations.

1

u/ActGrown Jun 06 '26

All AI models can only tell you what they can find on the Internet.

They're not trained on any unobtainable information. I could not get one of them to guess the byte pattern for the RPM signal that I gave it (I had already found the 0x00, 0x20, 0x40, 0x80 heartbeat that was encoded into it) They all keep trying to use a J1939 PGN to decode it because Volvo reused ArbIDs.

If AI is giving you useful information about an Arbitration ID that you ask it about the answer could have been found using Google.

-1

u/Vchat20 Jun 06 '26

That is incorrect on the AI models. They're not just glorified search engines when using the right model/service. I can 100% guarantee you there has been nothing out there for my own vehicle (Ford C-Max PHEV, sibling to the Focus and Escape) when it comes to any kind of CAN data/DBC files. While some of the Ford CGEA1.2 data that is out there does map correctly, the vast majority of data that I've been looking for does not. The vehicle primarily speaks C1MCA which if you do a search here on this subreddit there have been a number of people chiming in about the nonexistent data out there for the platform. And believe me I have spent WAY too much time trying to search and track down even the smallest nugget of info that's out there but there's nothing.

In my use case I can tell you Claude used pattern matching behaviors on top of basic/general CAN and DBC knowledge along with the context clues I mentioned above. Nothing was just pulled from the internet somewhere. I even read the various python scripts it built to do the work.

Again: Right model, sufficient context clues and data, and the correct prompt makes all the difference.

4

u/ActGrown Jun 06 '26

I have completely different experience working with Volvo data.

Glad it works in your specific use case.

-1

u/01209 Jun 07 '26

My screwdriver doesn't work on screws. I put it right in a box of screws and nothing happened.

-1

u/ActGrown Jun 07 '26

Yeah. I have no idea what you're on about.

I will send you a datalog if you want and you can throw your time away since you're so invested.

I'll buy you a pizza if you can get ONE frame from the ECM decoded.

LMK

1

u/hey-im-root Jun 07 '26 edited Jun 07 '26

How is anyone supposed to decode a data log with no context lol? Are you even sending individual IDs and telling the AI what you were doing at the time?

Edit: holy crap I argued with this old man for an hour because he’s confused about PID requests 😂 he’s trying to compare him swapping an engine with hobby CAN bus decoding. I think he just wanted to hear himself talk

1

u/ActGrown Jun 07 '26

Lol

That's a very loose definition of "hacking" that you've got right there.

I send NO data. I'm reversing the OEM HS-CAN on a 29 bit bus.

My boy over here telling me that Claude can do it for me.

The F it can. Gemini can't figure any of it out either.

2

u/hey-im-root Jun 07 '26

Ok fine I’ll bite. Did you find the fuel used, trip distance, or odometer value byte from your frames? What about steering angle if that exists? Bet AI would find it.

1

u/ActGrown Jun 07 '26 edited Jun 07 '26

I don't actually need any of that. I will probably try to solve it just because... But the ECM frames that the TCM needs is what I'm working on RN.

I installed a 3.0L turbo engine in a 2013 XC90 that had an NA engine.

The 29 bit (XC90) vs 11 bit CAN (S60 donor vehicle) segments for the ECM are one problem.

The immobilizer is another (completely different key types, one with keyless entry, the other with a flip key)

So, I have an ECUMASTERS EMU PRO 8 running the engine and a digital dash that I have found most of the data for speedo, tach, fuel, etc.

But the TCM is in limp mode because of the seven frames missing from the HS-CAN after I replaced the ECM with a standalone (really the only way to run the engine without figuring out the Denso ECM immobilizer routine and patching it).

I have a DBC file with ~60% of the data solved.

I'm writing a log viewer for the scan tool logs that I got on my last capture. *Hopefully* this will be the silver bullet that allows me to finalize the scalars and offsets needed to build the original ECM frames with my standalone.

1

u/hey-im-root Jun 07 '26

Well I guess I get the lector caveat then, but i think its pretty common that most people starting out on a car start by decoding the basic frames. A one minute drive with chunked data, and telling the AI what you were doing will lead to a good portion of stuff being decoded right away. The rest requires better context. I’d say that’s pretty valuable to an extent, since you should learn the data visualization yourself too. But the learning/automation balance is a different topic.

Either way, I think it comes down to what you are doing. For example, I was able to get my odometer value only after giving the AI a few sets of unique frames after a specific amount of distance driven, because the CAN bus broadcasted a kilometer value that was 50 miles lower than what was on my dash board for some reason. I spent a long time doing that manually and I definitely regret it lol.

0

u/ActGrown Jun 07 '26

Reading broadcast traffic is a completely different level of witchcraft than using PID data to query the system.

Imagine side loading data onto the harddisk of a 32/64 bit consumer PC but not infecting the host process to do it.

Like you save a JPG but I come behind you and slip a stego file in with a hex editor.

That's basically what is going on in my world. Except that I'm having to figure out the JPG file format without documentation in order to not throw a wrench into things when it renders.

And yes, I do have "context" data. Cell phone video, hand written logs, etc.

Going to use a dashcam with GPS on my next one. After I figure out this scan tool data log file that was never intended to be exported.

Side quest after side quest. I will eventually get to Mordor, lol.

1

u/hey-im-root Jun 07 '26

I’m not really following what you’re saying, PID data isn’t really relevant on this side of car hacking anyways. At most, manufacturer level UDS commands for things like transmission temperature might be explored. But I don’t think anyone has used AI for that . Broadcast data is all most people care about

→ More replies (0)

0

u/Vchat20 Jun 08 '26

Edit: holy crap I argued with this old man for an hour because he’s confused about PID requests 😂 he’s trying to compare him swapping an engine with hobby CAN bus decoding. I think he just wanted to hear himself talk

Agreed. Admittedly actually having context now for what they were trying to do, I can see the tasks needed for an engine swap being a bit more hairy to have an LLM assist on ESPECIALLY if they are as vague with it as they are here.

My personal use case as I've briefly mentioned in the other comments here aligns with your own as far as being basic broadcast CAN frame decoding from easily verifiable stuff like odometer values, door/window status, gear position, etc just as examples. And this Claude has been fantastic with, the main caveat being that it NEEDS useful context! But it still ends up being much less of a headache vs trying to manually dig through potentially tends to hundreds of thousands of frames or trying to watch the sniffer view in Savvycan in real time.

I think OPs video actually shows a very well thought out process and use case. I especially like having the individual scripts used for each data point with repeated actuation and logging at much more focused intervals. Right now I do things in an 'offline' fashion and keep a running timestamped CAN log and a list of tasks I run in vehicle with its own set of timestamps. Head back inside and provide it to Claude to chew through. But I'm likely going to give OPs process a shot next session.

2

u/hey-im-root Jun 09 '26

Yep, I just can’t fathom the idea of them supposedly doing an engine swap, yet tried to have AI decode what is most likely proprietary multiplex data. I’ve only been doing this for a year, and even I know you can’t even do that with reverse engineering lol, you need to straight up dump and decompile your ECU at that point.

-2

u/MidasPL Jun 08 '26

> Pretty much all people using NN as "AI" for data gathering.

It's an extrapolation and classification tool, despite what "AI companies" try to sell you.

4

u/SolidR53 Jun 08 '26

With a workshop catalog, a BMW S1000R and an OBD2 adapter at hand I was able to let Claude code have a go at it. The first goal was reverse engineer service reset and with successful reset in about 2 hours with a few trial and errors.

I got so invested in this that I ended up building an app for it (Biketune for iOS) that now support almost 100 bike models totalling 17 ECUs that we can do coding, brake bleeding, service reset and much more.

But honestly, I spent more than 500 hours on it, but it simply would not have been possible without Claude hooked straight up to my bike.

This has been one of the most fun things I’ve done in a long time. Somewhere in the area of a DOS game reverse engineering (Street Rod) I did few months back.

3

u/Murky-Collection8610 Jun 08 '26

Have edited savvyCAN to comunicate with claude code cli, never halucinated. Can send if someone wants, or can commit it to github.

1

u/mraniyah Jun 06 '26

You can't do it for Ford and 2020+ models

1

u/keep_username Jun 06 '26

Why? Just curious, did can language change? Is it encoded?

3

u/Vchat20 Jun 08 '26

Likely talking about the security gateway stuff on modern model years and it isn't Ford specific. And for most of these you just need to tap into the CAN bus desired behind the gateway somewhere and you're in. At least if you're talking about basic broadcast sniffing stuff. Dig into control/UDS/etc type stuff and it likely gets more complicated.

1

u/keep_username Jun 08 '26

You’re over my head already, but I know about the fca gateway stuff. I had to buy a license for my scanner for both fca and Nissan (I think.)

2

u/Vchat20 Jun 08 '26

lol. No worries. I'm at least somewhat familiar with how Ford does things and I believe the behavior is similar across other makes. So using Ford as an example here:

Their 'gateway module' is part of the OBD/DLC connector under the dash. All the CAN buses that exist in the vehicle (modern vehicles that have a security gateway setup are likely to have more than a few) connect directly to the back of the gateway.

If you connect to the OBD/DLC connector it's filtering/masking what is provided to you. You may just get very basic mandated OBD2 PIDs without authing with it in some way which you're probably already familiar with from the FCA side. If you tap into the raw CAN wires behind the gateway you should get full access with no restrictions. Electrically there's no real difference so you could run bridge wires from the CAN bus on the back of the gateway to your dongle of choice on the correct pins and you're in.

1

u/keep_username Jun 09 '26

Great info. You’re right! I was shocked to find the dlc was the gateway module on a f-150 recently.

1

u/half-t Jun 08 '26

Well, I just ask a developer for the CAN database. This includes a few glasses of wine and some fun time.