collin80 / gvret

Generalized Vehicle Reverse Engineering Tool - firmware for Arduino Due based boards

GEV-RET

Generalized Electric Vehicle Reverse Engineering Tool

A project turn the GEVCU hardware into a specialized reverse engineering tool.

The project now builds in the Arduino IDE. So, use it to compile, send the firmware to the Arduino, and monitor serial. It all works very nicely.

Requirements:

You will need the following to compile this project:

• Compatible hardware such as GEVCU, CANDue (1.1 or 2.0), or EVTVDue
• Arduino IDE 1.5.4 or higher (tested all of the way up to 1.6.6)
• due_can - Object oriented canbus library for Arduino Due compatible boards.
• can_common - Common structs and functions for CAN libraries.
• MCP2515 - Facilitate CAN functionality with the onboard MCP2515 CAN controller.
• due_wire - An alternative I2C library for Due with DMA support.
• SdFat - Arduino FAT16/FAT32 Library (Note - now using Beta version!)
• DueFlashStorage DueFlashStorage saves non-volatile data for Arduino Due.
• Wire_EEPROM I2C based routines to support EEPROM on the Due.

All libraries belong in %USERPROFILE%\Documents\Arduino\libraries (Windows) or ~/Arduino/libraries (Linux/Mac). You will need to remove -master or any other postfixes. Your library folders should be named as above.

The canbus is supposed to be terminated on both ends of the bus. This should not be a problem as this firmware will be used to reverse engineer existing buses.

License:

This software is MIT licensed:

Copyright (c) 2014-2017 Collin Kidder, Michael Neuweiler, Charles Galpin

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

gvret's Issues

SavvyCAN won't connect with Arduino DUE

I flashed the GVRET bin with the GVRET updater(https://savvycan.com/GVRETupdate.zip) but SavvyCAN is unable to connect. I tried to see the error in the console, but all it gave was "failed to connect, trying ESPRET connection"
I tried to flash the firmware multiple times with no success. Sometimes the arduino would appear as Bossa device in Device manager. Is the latest GVRET firmware not compatible with plain Due(without the E2P)?

Bug in time sync

Going through the source code to document the interface, I think there is a bug in the TIME_SYNC block (line 619, build 322). I know it doesn't do a thing now, but it also doesn't reset the state to IDLE. Doesn't that lock it up?

Missing files?

Hi, when I try to compile this project I get this error:

No such file or directory
#include <MCP2515_sw_can.h>

I'm using Due as board on the IDE.

Glitch if powering via USB before 12v

Sending single wire CAN traffic (with CANDue 2.2 boards) won't work if you connect USB before 12V. I do not yet know why. Receive seems to always work. So, the proper order of operations is to connect all wires and turn on 12v power then connect USB.

Looking at SPI traffic with a logic analyzer shows 0xA0 command to MCP2515 (Get Status Flags) and a proper response of 0 (nothing pending). This is correct. What should happen next is a command to write to the TX registers. This doesn't happen when the problem manifests. Instead nothing happens on SPI and the transmission just plain disappears. Oddly this is fixed by the above mentioned power application strategy. I have no idea why that would matter.

A few new commands in the making

I am working on, and still adding a few more commands and functions. There is nothing I am requesting or reporting, just announcing that it might pop up somewhere soon, avoid double work and well, to be polite.

1. a command to echo a CAN frame. Goal: test analytic software running on PC on the desk, but with a full datacom / timing environment.
2. a command to switch the binary output to one of the serials (and back), also specifying a baud rate. Goal: to use GVRET as a back end to any tablet app, through a cheap Bluetooth/Serial connector (HC-05) wired to one of the SAM's UARTS. This might end up in a new board, based on Teensy 3.0. In theory, this might also be beneficial to SavvyCan (less wires, sitting outside the car)

The combination of the two will allow for desk/bench testing of Apps, using a small application on the PC to read CRTD files and replaying them to GVRET.

twi.h not found

Collin,

I have tried to run the GVRET build with due_wire and all dependencies in placed on the Content/Library. When I've tried to compile, it has given me this error

Arduino: 1.6.8 Hourly Build 2016/02/19 11:12 (Mac OS X), Board: "Arduino/Genuino Uno"

In file included from 
/Applications/Arduino.app/Contents/Java/libraries/due_wire/due_wire.h:25:25: fatal error: include/twi.h: No such file or directory
 #include <include/twi.h>
                         ^
compilation terminated.
exit status 1
Error compiling.

This report would have more information with
"Show verbose output during compilation"
option enabled in File -> Preferences.

I have downloaded twi.h and required dependencies but it seems it should be inside the Arduino Application contents. Any clue ?

Thanks,
Andrew

GVRET Compile Error - EVTVDue

I am trying to compile GVRET for the EVTVDue in order to use it with SavvyCAN. Some files were initially missing but I was able to get over that error using MCP2515 libraries (in addition to the ones in readme) at:
https://github.com/macchina/mcp2515
https://github.com/macchina/Single-Wire-CAN-mcp2515

Now I get this compile error.

Arduino: 1.8.4 (Windows 7), Board: "Arduino Due (Native USB Port)"

C:\Work\GY_Hardware_Docs\EVTV CanDue Board\GVRET\GVRET.ino: In function 'void loop()':

GVRET:639: error: no matching function for call to 'MCP2515::GetRXFrame(CAN_FRAME&)'

     if (SysSettings.dedicatedSWCAN && settings.singleWire_Enabled && SWCAN.GetRXFrame(incoming))

                                                                                               ^

C:\Work\GY_Hardware_Docs\EVTV CanDue Board\GVRET\GVRET.ino:639:95: note: candidate is:

In file included from C:\Users\A418842\Documents\Arduino\libraries\Single-Wire-CAN-mcp2515\src/MCP2515_sw_can.h:34:0,

                 from C:\Work\GY_Hardware_Docs\EVTV CanDue Board\GVRET\GVRET.ino:37:

C:\Users\A418842\Documents\Arduino\libraries\mcp2515\src/MCP2515.h:67:7: note: bool MCP2515::GetRXFrame(Frame&)

  bool GetRXFrame(Frame &frame);

       ^

C:\Users\A418842\Documents\Arduino\libraries\mcp2515\src/MCP2515.h:67:7: note:   no known conversion for argument 1 from 'CAN_FRAME' to 'Frame&'

GVRET:885: error: 'class MCP2515' has no member named 'sendFrame'

                     if (out_bus == 2) SWCAN.sendFrame(build_out_frame);

                                             ^

exit status 1
no matching function for call to 'MCP2515::GetRXFrame(CAN_FRAME&)'

This report would have more information with
"Show verbose output during compilation"
option enabled in File -> Preferences.

Setting speed doesn't take immediate effect

In the bleeding edge SavvyCAN (143) and the bleeding edge GVRET (330) the bus speed does not immediately update when you change it in SavvyCAN. It seems to store the new value and use it upon next boot though. Figure out which end is messing up here. The issue is here at GVRET because that's the most likely culprit since the new value seems to be stored. Fix it!

Setting SysType doesn't work

It seems that attempting to change the SysType variable will instead cause it to switch to a completely different value upon being saved to EEPROM. Thereafter the device will come up with a bogus SysType. It might be some sort of overlap in EEPROM or perhaps the EEPROM page is full.

Won't compile without SPI.h

I found that if you try to compile this without an #include "SPI.h" the firmware will not compile with a vanilla copy of the Arduino IDE 1.8.7 giving the following error:

/home/blackfire_tx/Downloads/GVRET/GVRET.ino: In function 'void setup()':
GVRET:360:9: error: 'SPI' was not declared in this scope
SPI.begin();
^
/home/blackfire_tx/Downloads/GVRET/GVRET.ino: In function 'void loop()':
GVRET:1110:21: error: 'SPI' was not declared in this scope
SPI.begin();
^
exit status 1
'SPI' was not declared in this scope

Frame forwarding is on by default

This firmware has the capability to forward traffic between CAN0 and CAN1. This can be handy but unfortunately it is currently on as the default state. That's likely to cause all sorts of issues if you aren't expecting it. To stop this you can ground pins 11 and 12. But, this needs to be corrected so that forwarding is not the default. Forwarding should probably be an option within the serial menu and not tied to hardware pins (or maybe allow hardware pins but optionally).

"Listen Only" Mode

The underlying due_can library has support for enabling listen only mode. This mode essentially disconnects the TX line so that one is unable to have any effect at all on the connected bus - no ACK, no frame sending. In some cases this mode might be preferable for safety as it doesn't allow for any "oops" moments where you break the bus and cause things to fault.

Complete list of Libraries for GVRET.

Thanks for the code. I have the due and seen that GVRET using the MCP2515.h library. I have those libraries that are titled mcp2515.h but not MCP2515. When I change the capitalization of the library it works but then all hell breaks lose which missing libraries.

Just wondering is there is something I am missing with out of the box installation for GVRET on a new DUE board.

Thanks

SWCAN pins aren't initialized

When starting up GVRET, output pins SWCANMode0 and SWCANMode1 aren't initialized. They were floating around 1.5 volts until CAN1 is turned on or off.

Complation fails due to FirmwareReceiver

Not able to complie and not really sure why, can't find any file including a struct for FirmwareReceiver though.

Get the following output from Arduino IDE 1.6.5, tried 1.6.9 with same result.

Arduino: 1.6.5 (Linux), Board: "Arduino Due (Programming Port)"

GVRET:56: error: 'FirmwareReceiver' does not name a type
GVRET.ino: In function 'void setup()':
GVRET:293: error: 'fwReceiver' was not declared in this scope
GVRET:293: error: expected type-specifier before 'FirmwareReceiver'
GVRET:293: error: expected ';' before 'FirmwareReceiver'
'FirmwareReceiver' does not name a type

  This report would have more information with
  "Show verbose output during compilation"
  enabled in File > Preferences.

Free frame buffering

Colin, assuming I would build, supply and test the code, would you consider including a function set to:-

• stop spontaneous output;
• buffer, on a buffer-per-ID, all incoming CAN traffic;
• output the latest received frame on request, of course for a given ID.

Goal is to display certain parameters as fast as possible, with the datacom (Bluetooth) and display device (phone or cheap tablet) being the limiting factor.

I am aware of this drifting away from the pure analytic goal and moving towards a more operational mode. The alternative is to clone the project and go my own way, or start with something new.

LAWICEL Support

Support should be added for lawicel serial protocol. This protocol can be used to allow the device to act as a serial canbus device for socketcan on linux. This isn't cross platform but there doesn't appear to be any harm in adding it.

Incorrect baud causes hardware to go into an error state

If you set the wrong baud rate for the bus and then try to use be on the bus it causes the firmware to go into an error state it doesn't seem to ever recover from. The only fix is power cycling. It might only do this on reception but either way this isn't a great feature for "reverse engineering" firmware. :(

Super slow canbus sending

Current version won't send frames faster than 6 per second. Investigate and correct. March 2015 version of code 304 or so works fine

No saving to EEPROM?

Every time I boot up GVRET it tells me it is using the defaults. I could see nothing wrong in the code, but it is what it does. Could be my hardware is fault. Are changes (i.e. bus speed set through SavvyCan) supposed to be saved to EEPROM?

I can test the hardware and check if valid data is in the EEPROM if this is not reproducable.

buffer overflow in SerialConsole.cpp

hi, great project!

There is a buffer overflow vulnerability in the handleConfigCmd function of the SerialConsole.cpp file. When cmdString == String("FILEEXT")), the newString is copied to fileNameExt without checking the length, and overflow may occur.

void SerialConsole::handleConfigCmd()
{
    int i;
    int newValue;
    char *newString;
    bool writeEEPROM = false;
    bool writeDigEE = false;
    char *dataTok;

    if (ptrBuffer < 6)
        return; //4 digit command, =, value is at least 6 characters
    cmdBuffer[ptrBuffer] = 0; //make sure to null terminate
    String cmdString = String();
    unsigned char whichEntry = '0';
    i = 0;

    while (cmdBuffer[i] != '=' && i < ptrBuffer) {
        cmdString.concat(String(cmdBuffer[i++]));
    }
    i++; //skip the =
    if (i >= ptrBuffer) {
        Logger::console("Command needs a value..ie TORQ=3000");
        Logger::console("");
        return; //or, we could use this to display the parameter instead of setting
    }

    newValue = strtol((char *) (cmdBuffer + i), NULL, 0); //try to turn the string into a number
    newString = (char *)(cmdBuffer + i); //leave it as a string

    if (cmdString == String("CAN0EN")) {

......

    } else if (cmdString == String("FILEBASE")) {
        Logger::console("Setting File Base Name to %s", newString);
        strcpy((char *)settings.fileNameBase, newString);
        writeEEPROM = true;
    } else if (cmdString == String("FILEEXT")) {
        Logger::console("Setting File Extension to %s", newString);
        strcpy((char *)settings.fileNameExt, newString);
        writeEEPROM = true;