kentindell / canhack

The Yes We CAN project of Canis Labs

Welcome to the Yes We CAN repository

This repository contains tools and resources for the Yes We CAN project of Canis Labs. There are several related projects here:

• Support for the Canis Labs CANPico (an add-on CAN hardware board for the Raspberry Pi Pico)
• CANHack toolkit (a proof-of-concept low-level CAN protocol hacking library)
• Sigrok CAN protocol decoder (allowing PulseView to decode CAN frames and indicate exceptional low-level protocol events)
• A Python tool for creating CAN frame bit sequences

Canis Labs CTO Dr. Ken Tindell writes about CAN on his blog at: https://kentindell.github.io

Canis Labs CANPico hardware support

MicroPython firmware and documentation is in the CANPico folder. In addition, there is support for C included in the Canis Labs CAN SDK for C, which has drivers for the MCP25xxFD (the MicroPython firmware uses this CAN SDK to provide a MicroPython CAN API).

The Canis Labs CAN SDK repository is:

https://github.com/kentindell/canis-can-sdk

and contains a "hello world" application using the CAN API, with pre-built firmware for the Pico and Pico W with the CANPico board.

CANHack toolkit

The CANHack toolkit is a proof-of-concept toolkit of different CAN protocol attacks, showing the viability of low-level bit-banging attacks on the CAN protocol itself.

It is provided as generic C source code in two files:

src/
    canhack.c
    canhack.h

It has been built into the Canis Labs MicroPython firmware for the Raspberry Pi Pico and Pico W for the following hardware:

• Canis Labs CANPico board
• Canis Labs CANHack board (this uses the same firmware as the CANPico)
• Car Hacking Village DEF CON 30 badge

The MicroPython firmware for the CHV DEF CON 30 badge is located in:

pico/
    micropython/
        firmware-20220805-CHV-DEFCON30.uf2

Documentation for the MicroPython CANHack API is in:

CANPico/
    docs/
        CANHack MicroPython SDK reference manual.pdf

The Canis Labs CTO blog has more information on the CANHack toolkit, including details on how to make a CANHack board using breadboard. There is also a CANHack toolkit demo video that goes into detail on how to use the toolkit from Python, the CAN protocol hacks it includes, and demonstrates it attacking CAN frames in real hardware (NB: the video uses the STM32-based PyBoard, but the API is the same).

Sigrok CAN protocol decoder

A Sigrok protocol decoder for CAN 2.0:

src/
    can2/
        __init__.py
        pd.py

There is a PulseView and can2 demo video showing how to use PulseView as a logic analyzer and seeing CAN frames at a low-level.

The CIA CAN newsletter has published an article describing the protocol decoder and showing how it can spot some CAN protocol attacks.

Python CAN tool

Python tool for creating and parsing a CAN bitstreams (including creating Janus attack frames):

src/
    canframe.py

canhack's Issues

Firmware/Hardware

Hello Ken,

I'm quite confused with the use of 2 boards.
I noticed the difference with the Canis CANHack board vs the Canis CANPico ( includes MCP2518 transceiver), but what is the difference with the firmware? Which one is the best to use with CANHackTool kit?
What is the improvement with the controller?
It is not even clear for me.

Thank you

Regards

Nico

Hardware buffer pointer C1TXQUA sometimes goes out of range

The MCP2517/18FD controller sometimes has the C1TXQUA value exceed the allocated space. This may be a bug in the memory allocation, but either way it seems not possible to use C1TXQUA as an index into the array where the frame control blocks are kept. Instead, allocate slots from a free list and return them when transmitted.

How to build the firmware.uf2 file?

I'm new to the RPi Pico and have installed micropython and the pico-sdk to test some of the provided examples.
I looked at the docs but still have no clue how to build a canhack binary that combines C and micropython components ¯_(ツ)_/¯
Can you please upload some of the needed make/CMake files to build the firmware.uf2?
Thanks!

How to apply v1.16.patch ?

I'm following the steps described in canhack/pico/micropython/README.txt in order to build the last firmware. I am able to patch + build 1.15, but I cannot figure out how to build 1.16 following those instructions. See an extract of my script (I've downloaded patches under /canis-patches):

git clone -b master https://github.com/micropython/micropython.git
cd micropython
git checkout v1.15
git apply --whitespace=nowarn ../canis-patches/v1.15.patch
... here I download some submodules that I require...
make -C mpy-cross
cd ports/rp2
make submodules
make

Where should I apply v1.16.patch? If I do it right after v1.15.patch the patch fails. Should I rebase to Micropython 1.16 just before applying the patch or there is something else I need to consider?

Thanks.

Bus-off status not reported properly

Neither in get_status() nor in the repr string for a CAN controller.

Will no longer compile for Micropython

I know this probably isn't the right place to ask but I would like to do some prototyping in Micropython using an RP2040 / MCP251863 on a custom PCB I am designing (to control over 70 clock faces using stepper motor boards). I have no need for the canhack code and wondered if I can modify to remove all the canhack stuff.

CANHack sometimes freezes, killing USB on a Raspberry Pi host

Sometimes the CANHack library freezes with interrupts locked and this causes the USB to freeze, which causes the USB subsystem in a Raspberry Pi host to fail (requiring a reboot).

A solution is to run the CANHack code on the second core in the RP2040 and use a RAM variable to signal a return code so that if it hangs then at least host does not hang (because USB is driven from the main CPU core).

Create optional Python interrupt callback

The CAN ISR could call a standard MicroPython interrupt function (which is not permitted to use the heap, directly or indirectly).

The function is called with attributes of the incoming CAN frame (or possibly can make a call to read the front of the FIFO and obtain the CAN ID and payload directly: cannot create a CANFrame because cannot trigger garbage collection).

See here for MicroPythpn interrupts: https://docs.micropython.org/en/latest/reference/isr_rules.html

Issue with build a firmware.uf2 on a Pi 4

Hello all,

I have trouble to build a firmware.uf2.
In the readme on the step 4 to make the build in the path "ports/rp2"

It says to me:
/home/canhack/micropython/ports/rp2 (da4b38e75*) # make
[ -d build-PICO ] || cmake -S . -B build-PICO -DPICO_BUILD_DOCS=0 -DMICROPY_BOARD=PICO
make -s -C build-PICO
make[1]: *** Es wurden keine Ziele angegeben und keine „make“-Steuerdatei gefunden. Schluss.
make[1]: *** No targets were specified and no make control file was found. Ending.
make: *** [Makefile:19: all] Fehler 2

Can somebody help me, or upload a firmware.uf2 for me?

Thanks :)

Docs mistake: CANHack_schm.pdf same as CANProbe_schm.pdf

Hello,

Nice job!

I think there is a mistake in : https://github.com/kentindell/canhack/tree/master/docs/pdf

CANHack_schm.pdf seems to be the same as CANProbe_schm.pdf, no RaspberryPico on CANHack_schm.pdf, and the name of the schematic sheet is CANProbe with DB9.

Best regards

Nico

bug in the overwrite mode repeating

retries= doesn't have any effect when overwrite=True for CANHack.spoof_frame()

Screenshot of test follows. Note only one overwrite attempted in target frame despite retries=3

Add MicroPython API call to the CANHack toolkit to mutate bits in the CAN frame

The CANHack toolkit builds a bit pattern for a given frame, and records where fields are, but the MicroPython does not allow the bit fields to be modified after creation (e.g. for when doing fault injection). Add an API call to MicroPython to flip bits in the sequence.

“canis” directory files

I want to say first of all, I’m thoroughly impressed with the CANPico hardware and Micropython SDK. I’m a student with @WURacing, an FSAE design team at WashU in St. Louis. I originally bought one as basically an overpowered CAN reader – letting us easily probe the car’s CAN system and also potentially insert test frames without changing the car’s software. And it’s done that brilliantly, even in the week we’ve had it it’s already been incorporated as a teaching tool for new members learning about CAN for the first time.

After trying it out, I immediately decided we can actually incorporate these into our sensor network. We have 4 more on the way right now to begin working with, which is why I’m hoping I can get a little bit more information about how some of the firmware works for the board.

Actual question starts here:

In the patch for building the MicroPython v1.16-canpico firmware, there’s reference to some source files that I can’t find anywhere else. It seems that there’s an entire “canis” directory with some essential files, specifically I’m very interested in checking out “canis/rp2_can.c” (line 115 of the patch) and “canis/rp2_can.h” (line 31 of the patch), to get a better idea of how the system is implemented and potentially adapt the firmware to our specific purposes. Are these files publicly available/open source? If not, would you be willing to provide them to us directly? I’m happy to preserve whatever license you’re using, as long as the team has access.

Thanks in advance!

compile error

unable to compile:
[ 66%] Building C object CMakeFiles/firmware.dir/main.c.obj
In file included from /pico/micropython/ports/rp2/canis/candrivers/mcp2517fd/mcp2517fd-types.h:23,
from /pico/micropython/ports/rp2/canis/candrivers/canapi.h:27,
from /pico/micropython/ports/rp2/canis/rp2_can.h:22,
from /pico/micropython/ports/rp2/main.c:52:

/pico/micropython/ports/rp2/canis/candrivers/mcp2517fd/rp2/mcp2517fd-rp2.h: In function 'mcp2517fd_spi_pins_init':
/pico/micropython/ports/rp2/canis/candrivers/mcp2517fd/rp2/mcp2517fd-rp2.h:131:5: error: implicit declaration of function 'irq_set_enabled' [-Werror=implicit-function-declaration]
131 | irq_set_enabled(IO_IRQ_BANK0, true);
| ^~~~~~~~~~~~~~~
/home/ivs/pico/micropython/ports/rp2/canis/candrivers/mcp2517fd/rp2/mcp2517fd-rp2.h:131:21: error: 'IO_IRQ_BANK0' undeclared (first use in this function)
131 | irq_set_enabled(IO_IRQ_BANK0, true);
|

Change SPI pins

Hello I have a custom rp2040 based board using MCP251863. I was able to build Micro-python along with the added CAN related code from this repo (except the MIN_PROTOCOL support due to a build error). I have not been able to find out where the GP# pins are defined to interface with the MCP251863. On my board it uses GP pins 8 through 11 which is part of the second SPI bus of the rp2040. Where can I set the SPI pins?
Thank you.

RuntimeError: Cannot put MCP2517/18FD into config mode

Hi,

I tried these commands:
from canpico import *
c = CAN()

Then it raised an error:
RuntimeError: Cannot put MCP2517/18FD into config mode

Any insight?

Thank you.

Regards,
Jhon R Putra

MicroPython CANPico: Is the received CAN messages delayed by the GC?

Hello.

Congratulations for the great project supporting CANBUS on Rp2040 using MicroPython!

I would like to use MicroPython on the rp2040/RPico (CANPico) for realtime communication using CANPico firmware, and I would like to know what is the behaviour if CAN received message when Garbage Collector (GC) is running. Will the received/read message delayed by the GC, or the CAN will interrupt the GC to handle the CAN message?

Thank you very much!

Support for MicroPython 1.21

Is it possible to build MicroPython v1.21 with support for CANPico for the Pico W?

I would like to build a project that uses both BLE and CAN. v1.21 is required for BLE support on the Pico W but the latest firmware appears to be built on v1.19.

Otherwise, I will have to use the C API I guess.

Any help would be appreciated.

Patch V1.18 in macos

I have been able to successfully build the new V1.18 firmware in my Ubuntu box. However, when running the same build in my macos machine I run into the below error:

[ 14%] Building C object CMakeFiles/firmware.dir/Users/user55/dev/mpe-firmware/pico/micropython/py/emitnx86.c.obj
[ 14%] Building C object CMakeFiles/firmware.dir/Users/user55/dev/mpe-firmware/pico/micropython/py/emitnxtensa.c.obj
[ 15%] Building C object CMakeFiles/firmware.dir/Users/user55/dev/mpe-firmware/pico/micropython/py/emitnxtensawin.c.obj
[ 15%] Building C object CMakeFiles/firmware.dir/Users/user55/dev/mpe-firmware/pico/micropython/py/formatfloat.c.obj
/Users/user55/dev/mpe-firmware/pico/micropython/py/formatfloat.c:105:5: internal compiler error: Illegal instruction: 4
  105 |     MICROPY_FLOAT_CONST(1e32), MICROPY_FLOAT_CONST(1e16), MICROPY_FLOAT_CONST(1e8), MICROPY_FLOAT_CONST(1e4), MICROPY_FLOAT_CONST(1e2), MICROPY_FLOAT_CONST(1e1)
      |     ^~~~~~~~~~~~~~~~~~~
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://bugs.linaro.org/> for instructions.
make[3]: *** [CMakeFiles/firmware.dir/Users/user55/dev/mpe-firmware/pico/micropython/py/formatfloat.c.obj] Error 1
make[2]: *** [CMakeFiles/firmware.dir/all] Error 2
make[1]: *** [all] Error 2
make: *** [all] Error 2

Any idea what could be wrong?

CANHACK Porting to PYBV11

Thank you for shared this impressive module.I had been porting to the PYBV11 board.As follow is micropython.mk
`

SRC_USERMOD += $(USERMODULES_DIR)/pyb_canhack.c

CFLAGS_USERMOD += -I$(USERMODULES_DIR)

CFLAGS_EXTRA = -DMODULE_CANHACK_ENABLED=1
`
Put this file to canhack/pyb folder to micropython/. Then to micropython/ports/stm32 build: make BOARD=PYBV11 USER_C_MODULES=../../canhack all.It build OK.But Download the firmware.dfu.Can't found CANHack module.Any issue.Thanks!

CANID class does not seem to have get_id() method

The PDF documentation 'CANPico MicroPython SDK reference manual.pdf' leads me to believe that the CANID object should have a get_id() method.

Hower, calling get_id() on a CANID gives a runtime error.

Error: "AttributeError: 'CANID' object has no attribute 'id'"

Code: "canid = frame.get_canid().get_id()"

I have run the following code on a CANID object to find about the supported methods:

object_methods = [method_name for method_name in dir(frame.get_canid())
                  if callable(getattr(frame.get_canid(), method_name))]
print(object_methods)

Result:
['__class__', 'get_arbitration_id', 'get_id_filter', 'is_extended']

Location of the canis folder required to apply v1.16 patch

Hi,

I was following the README.txt found in canhack/pico/micropython/ to apply the patch on the firmware of the CANPico board but I cannot find the canis folder nor its content in any directory of this repo. Could you please provide some more info about this procedure?

Thanks