Automated Cross-Platform Reverse Engineering of CAN Bus Commands From Mobile Apps Haohuang Wen Qingchuan Zhao Qi Alfred Chen Zhiqiang Lin The Ohio State University The Ohio State University University of California, Irvine The Ohio State University
[email protected] [email protected] [email protected] [email protected] Abstract—In modern automobiles, CAN bus commands are blocks for in-vehicle fault diagnosis [56][52], vehicle security necessary for a wide range of applications such as diagnosis, testing [38][27][43][32], security monitoring [47][28], security monitoring, and recently autonomous driving. However, and recently programmable vehicle control (e.g., autonomous only a small portion of CAN bus commands is standardized, driving) [15]. and a vast majority of them is developed privately by car manufacturers. Today, the most effective way of revealing the Although CAN bus commands are highly valuable, only a proprietary CAN bus commands is to reverse engineer with small portion of them is standardized and the vast majority of real cars, which unfortunately is time-consuming and costly. them is developed privately by car manufacturers. As a result, In this paper, we propose a cost-effective (no real car needed) there are usually completely different CAN bus commands and automatic (no human intervention required) system, CAN- across different car models [20]. Over the years, a significant HUNTER, for reverse engineering of CAN bus commands using just car companion mobile apps. To achieve high effectiveness, amount of effort has been made to reverse engineer CAN we design an efficient technique to uncover the syntactics of bus commands for different car models.