5. Flipper Add‐On: CAN bus

How does CAN bus work?

Controller Area Network (CAN), is a special kind of communication system designed for devices to talk to each other. It's most commonly used in cars where it allows all the electronic control units (ECUs) to chat with each other.

Instead of a continuous flow of data, CAN bus sends information in short messages. Each message has an ID that tells the other devices what kind of data it is. This makes it easier to find specific information.

Not all messages are equal. Some messages are more important than others. CAN bus lets important messages get sent first, which is crucial in situations like when the anti-lock brakes need to talk to the engine right away.

This is one of the coolest things about CAN bus. It only uses two wires to transmit messages.

Flipper Add‐On: CAN bus

This Add-On along with the MCP2515 CAN bus app allow you to interact with a CAN bus network. You can read messages that are transmitted, watch bytes from every node in the network, and catch any message/package to then resend it or send other data to the same address. Making the app a nice tool for analysis, error detection and peripherals control in a CAN bus network.

Tech Specs

MCP2515

Is a stand-alone Controller Area Network (CAN) controller that implements the CAN specification, Version 2.0B. It is capable of transmitting and receiving both standard and extended data and remote frames. The MCP2515 has two acceptance masks and six acceptance filters that are used to filter out unwanted messages, thereby reducing the host MCU’s overhead. The MCP2515 interfaces with microcontrollers (MCUs) via an industry standard Serial Peripheral Interface (SPI).

• Operates from 2.7V-5.5V
• 5 mA active current (typical)
• Can be used as a clock source for other device(s)
• High-Speed SPI Interface (10 MHz)

Read more of its characteristics in the datasheet.

Schematics

Find the project files here → FLIPPER_CANBUS

Understanding Flipper Add‐On: CAN bus

Main functions

This Add-On allows you to analyze and view IoT traffic in CAN bus networks. You will be able to analyze the traffic of the signals and even replicate them to control peripherals in a CAN bus network.

Connecting your Add-On to Flipper

Use the pin headers to plug your Add-On to your Flipper.

Flipper Add-On CAN bus pinout

Important

To easily the OBD2 connector lines:

• CAN-High (CAN H) is represented by a white wire.
• CAN-Low (CAN L) is represented by a black wire.

First steps with Flipper Add‐On: CAN bus

Important

The first step for using the CAN bus Add-On is installing the CAN bus app in the Flipper. You can find the instructions here.

Setting up

In the main menu, go to the CAN bus app path where you installed the app.

Now go to the Settings option and open it to configure the CAN bus network parameters to what the Add-on will be connected to.

• Bitrate: Set the transmission bitrate.
• Clock: NOT CONFIGURABLE. It shows the work clock frequency.
• Save LOGS?: Select whether you want to record the sniffing sessions or not.
  • Save All: save all data sent through the CAN bus network
  • Only Address: save only the data sent for one node in the CAN bus network.

You can use the arrow buttons on the different settings to move through the different options.

Sniffing

Watch data traveling through a CAN bus network.

• Once the sniffing session begins you will see the addresses list (in HEX) or each CAN bus network node.

Note

If the Add-On is not connected to the CAN bus network, the screen will be blank.

• Select any node address to watch the packets' transmission. You will watch the node address, the data length, and the bytes send by the node. Data bytes are divided in square brackets with its respective HEX values ([Byte Number]: XX value). At the last is printed the delay time.

Important

If "Save LOG" feature is selected to:

• Save All, a LOG file will be saved with all the sniffed packets.The saved LOG file name format will be "Log_N" ("N" represent the LOG file number).
• Only Adress, you must choose one address to start saving the data from the sniffing session. The saved LOG file name format will be "L_address_dd_mm_yyyy_N"(address is the sniffed address, "dd" the day, "mm" the mounth, "yyyy" the year and "N" represents the number of file you sniffed in that address).

Packet injection

1. In the Main menu select Sender option.

2. Set up your work environment:
3. Choose ID.

Select a node address from previous sniffing sessions. The selected address will be shown in the next point (ID).

Note

If you have not sniffed yet and use the Choose ID option, the next screen will be displayed.

If you have selected an ID address from the above point the ID will be already set. Otherwise, select the “ID” option and write an address HEX format.

4. Set the Data Length of the packet. If you want to increment or decrement use the left and right buttons. The maximum number is eight.

5. Set the remote request

To set a remote request, set the Request option to 1.

6. Set the data to send.

With the option CLIC TO SET DATA you can modify all the bytes or use BYTE[n] to modify only one byte of the data.

Using the “CLIC TO SET DATA” option

Using the “BYTE[n]”

7. Send the message.

After using the SEND MESSAGE option there are three possible screens:

• The message was sent.

• The message was sent wrong or the device is not detected (You must attach the Flipper CAN bus Add-On).