SavvyCAN
SavvyCAN is ideal for analyzing raw and/or DBC decoded CAN bus data.
You can load the raw CLX000 log files (TXT) or stream CAN data via USB.
Table of Contents
Installation
Windows: Download below build (which includes the CLX000 plugin)[1].
Linux: Download below build and copy the Linux plugin into the canbus/ folder.
Load log file and DBC file(s)
To load a raw TXT log, click File/Load Log File, select the CLX000 format and load your file[2].
To load a DBC file, click File/DBC File Manager/Load and set the ID match criteria (Exact/J1939).
Stream data via the CLX000
- Setup the CLX000 to stream CAN data (see the Stream section)
- Click ‘Connection/Open Connection Window/Add New Device Connection’
- Select ‘QT SerialBus Devices/csscan’
- Click ‘Create New Connection’ - the raw data stream should now appear in the main window[3]
Note
If you do not follow the steps in the Stream section, you will not see your device in SavvyCAN
Main window
Below we outline a number of key functionalities of the main window:
- Auto Scroll Window: Toggle if the window should scroll with the data (streaming only)
- Overwrite Mode: Show only a single line for each unique ID (with the latest frame information)
- Interpret Frames: Use the loaded DBC to decode matched frames (see the Data column)
- Frame Filtering: Show/hide specific CAN IDs
Export DBC decoded data to CSV
If you have loaded a TXT log file and DBC file, as well as enabled the Interpret functionality, you will see your decoded data in the main trace window. You can now export the decoded frames to CSV via ‘File/Save Decoded Frames CSV’.
Note
Youu can optionally filter the exported data via the Frame Filtering section.
Useful analysis tools
Below we outline some of the ‘RE Tools’ that can be useful for analysis or reverse engineering. For a more detailed documentation, see the above links for the official docs and intro video.
Graph Data
This lets you plot specific CAN signals either real-time (for streamed data) or based on a log file. Simply right click the plot and select ‘Add new graph’. You can select a signal based on your DBC file, or you can manually add one[4]. You can also right-click the graph to reset the view and/or follow the end of the graph (for streaming).
Sniffer
This tool shows you the unique CAN IDs and helps identify changing bits/bytes - e.g. in response to physical events you perform while streaming data. It is ideal for reverse engineering state parameters (open/closed, on/off, …).
Range State
This is a great tool for reverse engineering continuous parameters like speed, RPM, SoC% etc. You add your hypothesis on the signal details (CAN ID(s), length, …) and press ‘Recalculate Candidate Signals’. The tool then produces plots for all possible signals that match your criteria[5].
Flow View
This view lets you control the playback of a log file (or an active CAN stream) to analyze changes to bits and bytes. Bits will be colored based on changes vs. the start of the session/log or vs. the previous frame (toggle via ‘Auto Reference’). The tool is useful for e.g. reverse engineering if you’re looking for correlating specific events or patterns.
Frame Data Analysis
This lets you analyze the CAN frames in your data using histograms, e.g. to understand the distribution of specific data bytes throughout a log file.
Send frames via the CLX000
As of Firmware 5.85, you can freely control the CLX000 CAN frame transmit functionality in real-time. This can be done via custom script integrations (see the CLX000 Docs), or via the SavvyCAN ‘Send Frames’ tools. Below we describe the relevant tools in brief.
Danger
Transmitting data via CAN bus can be dangerous. Do not transmit data into your CAN bus unless your setup is safe and you are 100% sure that you know what you are doing. This is particularly so for the Playback and Fuzzing tools.
Custom frame sender
This tool lets you specify one or more custom CAN frames to be transmitted by the CLX000. You can fully control the ID, payload, transmit frequency - and even apply advanced functions.
Playback
The Playback window lets you load a CAN bus log file (e.g. from your CLX000) - and replay it back onto a CAN bus. This can be useful in e.g. reverse engineering use cases or if you want to use the CLX000 as a simulation device. You can use the ‘original frame timing’ when playing it back and optionally filter the data to only replay a subset of the CAN frames.
Fuzzing
The fuzzing window can be used to transmit “controlled randomness” onto the CAN bus. We mainly recommend using this for simulation purposes or for highly controlled reverse engineering, as sending random CAN data into e.g. a vehicle is dangerous.
| [1] | The CLX000 plugin allows for streaming the CLX000 data into SavvyCAN. To use the latest release of SavvyCAN, simply download it and add the CLX000 plugin to the canbus/ folder manually on either Windows or Linux. For convenience, our Windows download link has the plugin pre-included. Note that if your PC does not have Visual Studio redistributables installed, you may get a vcruntime140_1.dll was not found error. In this case, use the vc_redist.x64.exe to install the redistributables |
| [2] | For some CLX000 log file formats, the SavvyCAN file format ‘auto-detect’ feature may not work, in which case you can simply directly load the log files without first selecting the CLX000 format via the dropdown. |
| [3] | If the data does not appear, ensure that your device is correctly set up for streaming data as per the Stream guide |
| [4] | Note that for J1939 signals, you’ll need to manually overwrite the CAN ID to ensure it matches the exact 29-bit CAN ID in your data. The Graph Data does not currently implement the J1939 match type that is used in the main window. Further, for OBD2 data the plot tool is not ideal as it does not yet support multiplexing - as such it will only yield useful plots if your data contains only a single OBD2 PID |
| [5] | The tool plots the decimal values of the extracted bits based on your criteria (using an offset of 0 and a scale factor of 1). To get the final signal, you’ll need to identify how to offset/scale the chart, though this is typically a fairly simple task. The tool is ideal for post processing - e.g. if you’ve logged data during a trip while you’ve made timestamped notes of the physically observable values (e.g. speed in km/h). Your notes can be used to produce a ‘rough graph’, which can then be compared vs the suggested signal plots |