Tool
Automated CAN Payload Reverse Engineering
Research Python and R scripts that automate reverse engineering of Controller Area Network (CAN) payloads recorded from passenger vehicles, implementing the pipeline from Brent Stone's AFIT dissertation. The Python pipeline pre-processes a CAN log into per-arbitration-ID data frames, pulls out public SAE J1979 diagnostic data, runs a lexical analysis that guesses individual signal time-series boundaries, then a semantic analysis that builds a correlation matrix and hierarchically clusters related signals, with plots and a dendrogram as output. A separate R script set applies the rEDM empirical dynamic modeling package to engine-RPM, brake-pressure and vehicle-speed time series to study causal relationships.
Requirements & limits
- Dissertation research code with no releases or tags; the reviewed commit dates to 2022-02-01. The README says the scripts were developed and tested on Python 3.6 and need NumPy, Pandas, scikit-learn and (for plotting) matplotlib listed in requirements.txt; the R scripts need R with the rEDM package. There is no packaging or install step, and the README says the scripts will not run immediately after cloning.
- Two Python folders implement the same concept: Pipeline is the basic single-file version driven from Main.py, and Pipeline_multi-file is the more complete batch version that the README says contains bug fixes not back-ported to Pipeline. Input is a CAN capture in the bundled loggerProgram0.log delta-time/ID/DLC/hex format; an April 2020 addition also reads the can-utils log format via a -c/--can-utils argument, and other formats require editing PreProcessor.py.
- The user supplies their own CAN capture. The repository bundles the author's own example data: the loggerProgram0.log vehicle capture, example pipeline output, an OBD2 PID table, and R-folder CSV time series of engine RPM, brake pressure and vehicle speed for different driving conditions, plus the author's dissertation PDF. The results are signal-boundary and clustering estimates that need analyst validation, not confirmed signal definitions.
- The repository includes a GPL-3.0 LICENSE file, while the README states the code is a work of the U.S. Government not subject to copyright protection in the United States, cleared for public release (case 88ABW-2019-0910). The scripts read passive logs and perform analysis only; no device interaction or frame transmission is described. Nothing was run, and the reviewed sources establish no REA connection.
About this entry
- Type
- Tool
- Category
- Protocol analysis tools
- Relationship
- Foundation tool
- Targets
- Protocol
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · brent-stone/CAN_Reverse_Engineering · Revision 096dfe8
- requirements.txt GitHub · brent-stone/CAN_Reverse_Engineering · Revision 096dfe8
- Pipeline GitHub · brent-stone/CAN_Reverse_Engineering · Revision 096dfe8
- Pipeline_multi-file GitHub · brent-stone/CAN_Reverse_Engineering · Revision 096dfe8
- R GitHub · brent-stone/CAN_Reverse_Engineering · Revision 096dfe8
- LICENSE GitHub · brent-stone/CAN_Reverse_Engineering · Revision 096dfe8
More in Protocols
- open-appleremote: Siri Remote protocol reconstruction · Case study
- GAMEKB-K17: reconstructing a macropad configuration protocol · Case study
- cooler-lcd: a Thermalright display protocol implementation · Case study
- NJFE: a Soulear camera protocol bridge for desktop inspection · Case study
- hw-harness: scanner USB protocol investigation · Case study
- Roborock Local Server: a self-hosted stand-in for Roborock’s vacuum cloud · Case study