SavvyCAN
SavvyCAN is ideal for analyzing raw and/or DBC decoded CAN bus data.
You can load the raw CLX000 log files (TXT) or stream CAN data via USB.
Table of Contents
Connect your interface
- Setup your device to stream data (see the Stream section)
- Click ‘Connection/Open Connection Window/Add New Device Connection’
- Select ‘QT SerialBus Devices/csscan’ and the relevant COM port[1]
- Click ‘Create New Connection’ - the raw data stream should now appear in the main window[3]
Note
If you do not follow the steps in the Stream section, you will not see your device in SavvyCAN
Note
The bit-rate is controlled via the device configuration - it cannot be controlled via SavvyCAN
Main window
Below we outline a number of key functionalities of the main window:
- Auto Scroll Window: Toggle if the window should scroll with the data (streaming only)
- Overwrite Mode: Show only a single line for each unique ID (with the latest frame information)
- Interpret Frames: Use the loaded DBC to decode matched frames (see the Data column)
- Frame Filtering: Show/hide specific CAN IDs
Load log file and DBC file(s)
To load a raw TXT log, click File/Load Log File, select the CLX000 format and load your file[2].
To load a DBC file, click File/DBC File Manager/Load and set the ID match criteria (Exact/J1939). You can toggle DBC decoding via the ‘Interpret Frames’ button.
Export DBC decoded data to CSV
You can export the decoded frames to CSV via ‘File/Save Decoded Frames CSV’.
Note
Youu can optionally filter the exported data via the Frame Filtering section.
Useful analysis tools
Below we outline some of the ‘RE Tools’ that can be useful for analysis or reverse engineering. For a more detailed documentation, see the above links for the official docs and intro video.
Graph Data
This lets you plot specific CAN signals either real-time (for streamed data) or based on a log file. Simply right click the plot and select ‘Add new graph’. You can select a signal based on your DBC file, or you can manually add one[4]. You can also right-click the graph to reset the view and/or follow the end of the graph (for streaming).
Sniffer
This tool shows you the unique CAN IDs and helps identify changing bits/bytes - e.g. in response to physical events you perform while streaming data. It is ideal for reverse engineering state parameters (open/closed, on/off, …).
Range State
This is a great tool for reverse engineering continuous parameters like speed, RPM, SoC% etc. You add your hypothesis on the signal details (CAN ID(s), length, …) and press ‘Recalculate Candidate Signals’. The tool then produces plots for all possible signals that match your criteria[5].
Flow View
This view lets you control the playback of a log file (or an active CAN stream) to analyze changes to bits and bytes. Bits will be colored based on changes vs. the start of the session/log or vs. the previous frame (toggle via ‘Auto Reference’). The tool is useful for e.g. reverse engineering if you’re looking for correlating specific events or patterns.
Frame Data Analysis
This lets you analyze the CAN frames in your data using histograms, e.g. to understand the distribution of specific data bytes throughout a log file.
Transmit custom CAN frames
You can transmit custom CAN frames in real-time via SavvyCAN in multiple ways.
Danger
Transmitting data via CAN bus can be dangerous. Do not transmit data into your CAN bus unless your setup is safe and you are 100% sure that you know what you are doing
Custom frame sender
This tool is embedded in the main window and lets you specify one or more custom CAN frames to be transmitted. You can specify the ID, bus, payload, frequency - and even apply ‘modifications’ to customize the payload.
Example settings for sending a static CAN frame every 1000 ms:
En: Click the checkbox to enable
Bus: 0
ID: 0x123
Data: 0x00 0x11 0x22 0x33 0x44 0x55 0x66 0x77
Interval: 1000
Playback
The Playback window lets you load a CAN bus log file (e.g. from a CLX000/CANedge by converting it to Vector ASC) - and replay it onto a CAN bus. This can be useful in e.g. reverse engineering use cases or simulation. You can use the ‘original frame timing’ when playing it back and optionally filter the data to only replay a subset of the CAN frames.
| [1] | If you have multiple interfaces connected in parallel, you can find their COM ports by opening your Device Manager/COM ports overview |
| [2] | For some log file formats, the SavvyCAN file format ‘auto-detect’ feature may not work, in which case you can simply directly load the log files without first selecting the CLX000 format via the dropdown. |
| [3] | If data does not appear, ensure that your device is correctly set up for streaming data as per the Stream guide |
| [4] | Note that for J1939 signals, you’ll need to manually overwrite the CAN ID to ensure it matches the exact 29-bit CAN ID in your data. The Graph Data does not currently implement the J1939 match type that is used in the main window. Further, for OBD2 data the plot tool is not ideal as it does not yet support multiplexing - as such it will only yield useful plots if your data contains only a single OBD2 PID |
| [5] | The tool plots the decimal values of the extracted bits based on your criteria (using an offset of 0 and a scale factor of 1). To get the final signal, you’ll need to identify how to offset/scale the chart, though this is typically a fairly simple task. The tool is ideal for post processing - e.g. if you’ve logged data during a trip while you’ve made timestamped notes of the physically observable values (e.g. speed in km/h). Your notes can be used to produce a ‘rough graph’, which can then be compared vs the suggested signal plots |