SavvyCAN

About | CAN BUS REVERSE ENGINEERING | AI CAN BUS REVERSE ENGINEERING

SavvyCAN is a popular open source tool for CAN bus reverse engineering use cases.

Note

You can use SavvyCAN with your CANsub, but we strongly recommend webCAN for most general CAN streaming use cases - and AI agents for pure reverse engineering use cases

Installation

Download the build below (incl. the required plugin), unzip it and open SavvyCAN.

Windows

Linux (x86_64/amd64)

Linux (ARM64)

Note

The API version for each CANsub firmware release is listed in the CANsub Docs changelog

Connect your CANsub

  1. Ensure your CANsub is ready for streaming (see the get started section)

  2. Click ‘Connection/Open Connection Window/Add New Device Connection’

  3. Select ‘QT SerialBus Devices/CANsub’ and select from the available CANsub CAN channels

  4. Click ‘Create New Connection’, update the bit-rate and click ‘Save Bus Settings’[1]


Main window

Below we outline a number of key functionalities of the main window:

  • Auto Scroll Window: Toggle if the window should scroll with the data (streaming only)

  • Overwrite Mode: Show only a single line for each unique ID (with the latest frame information)

  • Interpret Frames: Use the loaded DBC to decode matched frames (see the Data column)

  • Frame Filtering: Show/hide specific CAN IDs

Load files (DBCs, log files)

To load a DBC file, click File/DBC File Manager/Load and set the ID match criteria (Exact/J1939). You can toggle DBC decoding via the ‘Interpret Frames’ button.

You can also load a previously saved log file (File/Load Log File) for offline analysis. For example, you can take a webCAN CSV export and convert it to Vector ASC via the python-can can_logconvert CLI tool, then load the output in SavvyCAN[2].

Useful analysis tools

Below we outline some of the useful specialized reverse engineering features:

Sniffer

This tool shows you the unique CAN IDs and helps identify changing bits/bytes - e.g. in response to physical events you perform while streaming data.


Range State

This is a great tool for reverse engineering continuous parameters like speed, RPM, SoC% etc. You add your hypothesis on the signal details (CAN ID(s), length, …) and press ‘Recalculate Candidate Signals’. The tool then produces plots for all possible signals that match your criteria[3].


Flow View

This view lets you control the playback of a log file (or an active CAN stream) to analyze changes to bits and bytes. Bits will be colored based on changes vs. the start of the session/log or vs. the previous frame (toggle via ‘Auto Reference’). The tool is useful for e.g. reverse engineering if you’re looking for correlating specific events or patterns.


Frame Data Analysis

This lets you analyze the CAN frames in your data using histograms, e.g. to understand the distribution of specific data bytes throughout a session.


Transmit custom CAN frames

You can transmit custom CAN frames in real-time via SavvyCAN in multiple ways.

Custom frame sender

This lets you specify CAN frames to be transmitted. You can specify the ID, bus, payload, frequency - and optionally apply ‘modifications’ to customize the payload.

Example settings for sending a static CAN frame every 1000 ms:

En: Click the checkbox to enable
Bus: 0
ID: 0x123
Data: 0x00 0x11 0x22 0x33 0x44 0x55 0x66 0x77
Interval: 1000

Playback

The Playback window lets you load a CAN bus log file and replay it onto a CAN bus. This can be useful in e.g. reverse engineering use cases or simulation. You can use the ‘original frame timing’ when playing it back and optionally filter the data to only replay a subset of the CAN frames.

Note

We recommend the python-can can_player CLI tool for playback as it offers better performance