Hacking Volvo XC60

I tried to replay everything on my desktop on the car, but HUD doesn't work. Fortunately, the car is still working, so I'm trying to figure out what happened My intuition told me, maybe the MITM latency caused the problem, which caused HUD behavior unexpected (in later article, I would prove this was wrong) Check minimum latency first CAN@500kbps, 8 bytes packets needs roughly 200us 1 bit requires 2us, 8 byte packets requires ~100bits (considering bit-stuffing) t_pkg = 2us * 100bit = 200us Mitm latency (t_delay) includes two parts t_delay = t_mitm + t_pkg t_mitm is internal processing delay within Linux operating system t_pkg is the time to re-transmit packet, so this value would be 200us Unless using FPGA to re-design CAN controller, which sending as receiving. Otherwise, the time can't be avoided in normal method HUD undertakes two shot of t_delay as query & wait-for-response Before t_roundtrip1 = t_pkg + t_pkg = t_pkg*2 After t_roundtrip2 = (t_pkg + t_delay) + (t_pkg...

Purpose With the aid of Pi-WIRE, drive car at 120km/hr in the basement parking lot, prove my superb driving skill To let HUD show something interesting, I shall figure out how it interacts with car. I guess HUD polling the car periodically. So I changed the configuration of MITM in article#4 : replace ELM327 with HUD, observing how does HUD act with Pi-CAR. With Pi-WIRE, I can observe the command sent by HUD. In Pi-CAR, I can response arbitrary speed, and check whether HUD showed the desired speed reported by Pi-CAR Before ELM327  ---- Pi-WIRE ---- Pi-CAR After-1 HUD  ---- Pi-WIRE ---- Pi-CAR (report speed=120) The experiment above proved that I understood the protocol between OBD2/ CAR. As I connect HUD to real car, the car probably running at speed=20. Now I can put a man-in-the-middle, "Pi-WIRE", and let Pi-WIRE increase speed by 1000. Then HUD can show something interesting After-2 HUD( speed=120 ) ---- Pi-WIRE ( report speed=20+100 ) ----  XC60 (speed=20) HUD Reverse...

In previous article , I've described how to use Pi-WIRE to do MITM attack. In this article, let's talk about the pitfall I encountered during making these tools -> analyzing what happened if bad electronics attach to CAN bus. With the story, you can judge whether attaching OBD2 dongles (ELM327, HUD) to the car is OK or NOT; or what to notice To build the tool, I bought several CANBUS modules from China. To save money, I bought cheap electronics to torture myself: WaveShare  RS485 CAN HAT  * 2 Niren MCP2515 CAN Module * 2 CHEAP_SUCK_MODULE Using verified modules (ELM327) to validate unverified tool (Pi-CAR) is important techniques. As the raspberry Pi connecting to  CHEAP_SUCK_MODULE , I encountered trouble immediately ELM327 sends 0902 by 8 bytes, 09 02 00 00 00 00 00 00 With  CHEAP_SUCK_MODULE , I can't receive long packet definitely I can use "ATCAF0" to avoid ELM327 sending 8bytes, which becomes short packet 09 02 However, short packet reception with  CHEA...

In previous post , I realized that ELM327 is not ideal platform to do car hacking. I need to develop some more *interesting* hacking tool to achieve the job. So I turned to Raspberry Pi to continue development Implement a CAR by Raspberry Pi (Pi-CAR) ELM327 communicates to a car, so I need to make a CAR... What? I used a Raspberry Pi plus CAT-HAT to behave like a VOLVO XC60. The HW installation is not difficult, and I used PYTHON-CAN to write car emulator. So it can receives query from ELM327, and responds 0902 (VIN query command) ELM327 ---- Pi-CAR Left rectangular is ELM327, which queries VIN via 0902 command 500kbps CANBUS wire, in the right-buttom corner, connects between ELM327/Pi-CAR Right rectangular is RPi, it responds 0902 command. He says: I'm a Volvo XC60 The experiment shown above Upper window is ELM327 serial port. You can double confirm the result with earlier post . It had the same response as I connected ELM327 to real car Lower window is...

Volvo XC60 2017 doesn't offer the capability of closing tailgate by remote control. I have to press the button in the tailgate (see below) to hand. That's probably because of security reason, but I feel so stupid. M assumption is, the button sends some message to CAN bus. If I can sniffer the signal, I can close the tailgate remotely Challenge Accept !! I connect the ELM327 with my XC60, and successfully read VIN code . Then I tried ATMA (Monitor All) command to sniffer CAN bus... Then... nothing happened !! What the fuck ?! So now I can tell you when the cheap ELM327 makes you disappointed In complete AT command Because Torque App doesn't use ATMA command, so the cloned ELM327 don't offer such capability Poor bluetooth connectivity As sending ATRV command, sometimes I got incomplete response. I guess that's because bluetooth module doesn't work well Even the cheap ELM327 dongle offers ATMA capability, the data rate is far exceeding the blue...

Go to Google play and search keyword of "ELM327 Terminal", all of them were similar, you can just pick arbitrary of one. If you really had some difficult of selection, this one  looks beautiful and just updated recently After connecting the tool with ELM327 and car, type "0902" in the tool to read the VIN code . These PIDs (0902) were industrial standard , and all cars shall implement it. Here's some useful PIDs. That's why HUD (head up display) can connect to all brands of cars with OBD2 connector 01 0D: car speed 01 0C: engine RPM Here's the 0902 query response of my car in the APP. If interested, decode it :-) 7E8 08 01 14 49 02 01 59 56 41 7E8 08 21 44 5A 41 38 42 44 48 7E8 08 22 32 30 37 36 36 38 32 A lot of people read CAN bus by Torque, but only few people read the ELM327's capability document. Check out ELM327 website and download their AT command list , that's all the capability it had. It had different capability...

I bought a Volvo XC60 2017, and the car had an OBD-II port. I always feel the port is inviting me to do some hacking. I had power supply, oscilloscope, soldering equipment, multi-meter. I can read English, and had some embedded system development experience, but no hacking car ever. Maybe with some study, I can learn to do that My adventure starts with ELM327, the equipment is quite cheap. I want to talk pro/con of the cheap China ELM327 unit, and when you will feel disappointed to it ELM327 is basically a Microchip PIC18F2480 with customized FW, which supports various OBD protocol. Picture below is from its datasheet Left-upper corner, MCP2551 is the CAN transceiver It communicates to car by CANL/CANH signals It outputs CAN signal to PIC18F2480 (ELM327) (PIN1/4) PIC18F2480 (ELM327) It accepts the output signal from CAN transceiver The internal CAN controller send/receive from CAN bus It had UART interface in PIN17/18 Option1: FTDI UART to USB interface Conne...