search

secdev / scapy

Scapy: the Python-based interactive packet manipulation program & library.
https://scapy.net
GNU General Public License v2.0
10.83k stars 2.04k forks source link

obdscanner ignores all valid responses #4410

Closed yomannnn closed 6 months ago

yomannnn commented 6 months ago

Brief description

the integrated tool obdscanner does not seem to react to valid responses on the can bus. According to the can trace there are several valid responses that are ignored by obdscanner. I'm not an experienced scapy user. However I'm happy to support the investigation ....

Scapy version

scapy-2.6.0rc1.dev21

Python version

Python 3.11.6

Operating system

Linux 6.5.0-35-generic x86_64

Additional environment information

setup: PCAN usb2can adapter external OBD-Simulator

How to reproduce

python3 -m scapy.tools.automotive.obdscanner --channel can0 --source 0x7df --destination 0x7e0

Actual result

several correct OBD requests were sent, however 0 are marked answered.

Expected result

according to the candump can trace some requests have correctly been answered. eg

  can0  7DF   [8]  02 01 00 CC CC CC CC CC
  can0  7E8   [8]  06 41 00 B8 7B 30 10 00

Related resources

candump 

  can0  7DF   [8]  02 01 00 CC CC CC CC CC
  can0  7E8   [8]  06 41 00 B8 7B 30 10 00
  can0  7DF   [8]  02 01 20 CC CC CC CC CC
  can0  7DF   [8]  02 01 40 CC CC CC CC CC
  can0  7DF   [8]  02 01 60 CC CC CC CC CC
  can0  7DF   [8]  02 01 80 CC CC CC CC CC
  can0  7DF   [8]  02 01 A0 CC CC CC CC CC
  can0  7DF   [8]  02 01 C0 CC CC CC CC CC
  can0  7DF   [8]  02 01 E0 CC CC CC CC CC
  can0  7DF   [8]  03 02 00 00 CC CC CC CC
  can0  7E8   [8]  07 42 00 00 48 18 00 00
  can0  7DF   [8]  03 02 20 00 CC CC CC CC
  can0  7DF   [8]  03 02 40 00 CC CC CC CC
  can0  7DF   [8]  03 02 60 00 CC CC CC CC
  can0  7DF   [8]  03 02 80 00 CC CC CC CC
  can0  7DF   [8]  03 02 A0 00 CC CC CC CC
  can0  7DF   [8]  03 02 C0 00 CC CC CC CC
  can0  7E8   [8]  07 42 C0 00 12 26 11 28
  can0  7DF   [8]  03 02 E0 00 CC CC CC CC
  can0  7DF   [8]  02 06 00 CC CC CC CC CC
  can0  7DF   [8]  02 06 20 CC CC CC CC CC
  can0  7DF   [8]  02 06 40 CC CC CC CC CC
  can0  7DF   [8]  02 06 60 CC CC CC CC CC
  can0  7DF   [8]  02 06 80 CC CC CC CC CC
  can0  7DF   [8]  02 06 A0 CC CC CC CC CC
  can0  7DF   [8]  02 06 C0 CC CC CC CC CC
  can0  7DF   [8]  02 06 E0 CC CC CC CC CC
  can0  7DF   [8]  02 08 00 CC CC CC CC CC
  can0  7DF   [8]  02 08 20 CC CC CC CC CC
  can0  7DF   [8]  02 08 40 CC CC CC CC CC
  can0  7DF   [8]  02 08 60 CC CC CC CC CC
  can0  7DF   [8]  02 08 80 CC CC CC CC CC
  can0  7DF   [8]  02 08 A0 CC CC CC CC CC
  can0  7DF   [8]  02 08 C0 CC CC CC CC CC
  can0  7DF   [8]  02 08 E0 CC CC CC CC CC
  can0  7DF   [8]  02 09 00 CC CC CC CC CC
  can0  7E8   [8]  07 49 00 01 FC 00 00 00
  can0  7DF   [8]  02 09 20 CC CC CC CC CC
  can0  7DF   [8]  02 09 40 CC CC CC CC CC
  can0  7DF   [8]  02 09 60 CC CC CC CC CC
  can0  7DF   [8]  02 09 80 CC CC CC CC CC
  can0  7DF   [8]  02 09 A0 CC CC CC CC CC
  can0  7DF   [8]  02 09 C0 CC CC CC CC CC
  can0  7DF   [8]  02 09 E0 CC CC CC CC CC
  can0  7DF   [8]  01 03 CC CC CC CC CC CC
  can0  7E8   [8]  02 43 00 00 00 00 00 00
  can0  7DF   [8]  01 07 CC CC CC CC CC CC
  can0  7E8   [8]  06 47 02 01 10 01 48 00
  can0  7DF   [8]  01 0A CC CC CC CC CC CC

obdscanner output

INFO: Specify "conf.contribs['OBD'] = {'treat-response-pending-as-answer': True}" to treat a negative response 'requestCorrectlyReceived-ResponsePending' as answer of a request. 
The default value is False.
Starting OBD-Scan...
INFO: [i] Scan progress 0.00
INFO: Scan path [session1]
INFO: Target reset
INFO: Execute <scapy.contrib.automotive.obd.scanner.OBD_S01_Enumerator object at 0x705a510a2190> for path [session1]
INFO: Finished iterator execution
INFO: Finished iterator execution
INFO: Scan path [session1]
INFO: Target reset
INFO: Execute <scapy.contrib.automotive.obd.scanner.OBD_S02_Enumerator object at 0x705a510a2290> for path [session1]
INFO: Finished iterator execution
INFO: Finished iterator execution
INFO: Scan path [session1]
INFO: Target reset
INFO: Execute <scapy.contrib.automotive.obd.scanner.OBD_S06_Enumerator object at 0x705a510a23d0> for path [session1]
INFO: Finished iterator execution
INFO: Finished iterator execution
INFO: Scan path [session1]
INFO: Target reset
INFO: Execute <scapy.contrib.automotive.obd.scanner.OBD_S08_Enumerator object at 0x705a510a2510> for path [session1]
INFO: Finished iterator execution
INFO: Finished iterator execution
INFO: Scan path [session1]
INFO: Target reset
INFO: Execute <scapy.contrib.automotive.obd.scanner.OBD_S09_Enumerator object at 0x705a510a2650> for path [session1]
INFO: Finished iterator execution
INFO: Finished iterator execution
INFO: Scan path [session1]
INFO: Target reset
INFO: Execute <scapy.contrib.automotive.obd.scanner.OBD_S03_Enumerator object at 0x705a510a27d0> for path [session1]
INFO: Finished iterator execution
INFO: Scan path [session1]
INFO: Target reset
INFO: Execute <scapy.contrib.automotive.obd.scanner.OBD_S07_Enumerator object at 0x705a510a2910> for path [session1]
INFO: Finished iterator execution
INFO: Scan path [session1]
INFO: Target reset
INFO: Execute <scapy.contrib.automotive.obd.scanner.OBD_S0A_Enumerator object at 0x705a510a2a50> for path [session1]
INFO: Finished iterator execution
INFO: [i] Scan progress 1.00
INFO: Scan path [session1]
INFO: Scan path [session1]
INFO: Scan path [session1]
INFO: Scan path [session1]
INFO: Scan path [session1]
INFO: Scan path [session1]
INFO: Scan path [session1]
INFO: Scan path [session1]
INFO: Execute failure or scan completed. Exit scan!
INFO: Target reset

==========================================
     Available data in OBD service 01
------------------------------------------

8 requests were sent, 0 answered, 8 unanswered
Statistics per state
-------------------+-----+----------+
                   | all | session1 | 
-------------------+-----+----------+
answertime_avg     | -   | -        | 
answertime_avg_nr  | -   | -        | 
answertime_avg_pr  | -   | -        | 
answertime_max     | -   | -        | 
answertime_max_nr  | -   | -        | 
answertime_max_pr  | -   | -        | 
answertime_min     | -   | -        | 
answertime_min_nr  | -   | -        | 
answertime_min_pr  | -   | -        | 
num_answered       | 0   | 0        | 
num_negative_resps | 0   | 0        | 
num_unanswered     | 8   | 8        | 
-------------------+-----+----------+

0 negative responses were received

These negative response codes were received 

The following negative response codes are blacklisted: ['generalReject', 'serviceNotSupported']

=== No data to display ===

==========================================
     Available data in OBD service 02
------------------------------------------

8 requests were sent, 0 answered, 8 unanswered
Statistics per state
-------------------+-----+----------+
                   | all | session1 | 
-------------------+-----+----------+
answertime_avg     | -   | -        | 
answertime_avg_nr  | -   | -        | 
answertime_avg_pr  | -   | -        | 
answertime_max     | -   | -        | 
answertime_max_nr  | -   | -        | 
answertime_max_pr  | -   | -        | 
answertime_min     | -   | -        | 
answertime_min_nr  | -   | -        | 
answertime_min_pr  | -   | -        | 
num_answered       | 0   | 0        | 
num_negative_resps | 0   | 0        | 
num_unanswered     | 8   | 8        | 
-------------------+-----+----------+

0 negative responses were received

These negative response codes were received 

The following negative response codes are blacklisted: ['generalReject', 'serviceNotSupported']

=== No data to display ===

==========================================
     Available data in OBD service 06
------------------------------------------

8 requests were sent, 0 answered, 8 unanswered
Statistics per state
-------------------+-----+----------+
                   | all | session1 | 
-------------------+-----+----------+
answertime_avg     | -   | -        | 
answertime_avg_nr  | -   | -        | 
answertime_avg_pr  | -   | -        | 
answertime_max     | -   | -        | 
answertime_max_nr  | -   | -        | 
answertime_max_pr  | -   | -        | 
answertime_min     | -   | -        | 
answertime_min_nr  | -   | -        | 
answertime_min_pr  | -   | -        | 
num_answered       | 0   | 0        | 
num_negative_resps | 0   | 0        | 
num_unanswered     | 8   | 8        | 
-------------------+-----+----------+

0 negative responses were received

These negative response codes were received 

The following negative response codes are blacklisted: ['generalReject', 'serviceNotSupported']

=== No data to display ===

==========================================
     Available data in OBD service 08
------------------------------------------

8 requests were sent, 0 answered, 8 unanswered
Statistics per state
-------------------+-----+----------+
                   | all | session1 | 
-------------------+-----+----------+
answertime_avg     | -   | -        | 
answertime_avg_nr  | -   | -        | 
answertime_avg_pr  | -   | -        | 
answertime_max     | -   | -        | 
answertime_max_nr  | -   | -        | 
answertime_max_pr  | -   | -        | 
answertime_min     | -   | -        | 
answertime_min_nr  | -   | -        | 
answertime_min_pr  | -   | -        | 
num_answered       | 0   | 0        | 
num_negative_resps | 0   | 0        | 
num_unanswered     | 8   | 8        | 
-------------------+-----+----------+

0 negative responses were received

These negative response codes were received 

The following negative response codes are blacklisted: ['generalReject', 'serviceNotSupported']

=== No data to display ===

==========================================
     Available data in OBD service 09
------------------------------------------

8 requests were sent, 0 answered, 8 unanswered
Statistics per state
-------------------+-----+----------+
                   | all | session1 | 
-------------------+-----+----------+
answertime_avg     | -   | -        | 
answertime_avg_nr  | -   | -        | 
answertime_avg_pr  | -   | -        | 
answertime_max     | -   | -        | 
answertime_max_nr  | -   | -        | 
answertime_max_pr  | -   | -        | 
answertime_min     | -   | -        | 
answertime_min_nr  | -   | -        | 
answertime_min_pr  | -   | -        | 
num_answered       | 0   | 0        | 
num_negative_resps | 0   | 0        | 
num_unanswered     | 8   | 8        | 
-------------------+-----+----------+

0 negative responses were received

These negative response codes were received 

The following negative response codes are blacklisted: ['generalReject', 'serviceNotSupported']

=== No data to display ===

==========================================
     Available DTCs in OBD service 03
------------------------------------------

1 requests were sent, 0 answered, 1 unanswered
Statistics per state
-------------------+-----+----------+
                   | all | session1 | 
-------------------+-----+----------+
answertime_avg     | -   | -        | 
answertime_avg_nr  | -   | -        | 
answertime_avg_pr  | -   | -        | 
answertime_max     | -   | -        | 
answertime_max_nr  | -   | -        | 
answertime_max_pr  | -   | -        | 
answertime_min     | -   | -        | 
answertime_min_nr  | -   | -        | 
answertime_min_pr  | -   | -        | 
num_answered       | 0   | 0        | 
num_negative_resps | 0   | 0        | 
num_unanswered     | 1   | 1        | 
-------------------+-----+----------+

0 negative responses were received

These negative response codes were received 

The following negative response codes are blacklisted: ['generalReject', 'serviceNotSupported']

=== No data to display ===

==========================================
     Available DTCs in OBD service 07
------------------------------------------

1 requests were sent, 0 answered, 1 unanswered
Statistics per state
-------------------+-----+----------+
                   | all | session1 | 
-------------------+-----+----------+
answertime_avg     | -   | -        | 
answertime_avg_nr  | -   | -        | 
answertime_avg_pr  | -   | -        | 
answertime_max     | -   | -        | 
answertime_max_nr  | -   | -        | 
answertime_max_pr  | -   | -        | 
answertime_min     | -   | -        | 
answertime_min_nr  | -   | -        | 
answertime_min_pr  | -   | -        | 
num_answered       | 0   | 0        | 
num_negative_resps | 0   | 0        | 
num_unanswered     | 1   | 1        | 
-------------------+-----+----------+

0 negative responses were received

These negative response codes were received 

The following negative response codes are blacklisted: ['generalReject', 'serviceNotSupported']

=== No data to display ===

==========================================
     Available DTCs in OBD service 10
------------------------------------------

1 requests were sent, 0 answered, 1 unanswered
Statistics per state
-------------------+-----+----------+
                   | all | session1 | 
-------------------+-----+----------+
answertime_avg     | -   | -        | 
answertime_avg_nr  | -   | -        | 
answertime_avg_pr  | -   | -        | 
answertime_max     | -   | -        | 
answertime_max_nr  | -   | -        | 
answertime_max_pr  | -   | -        | 
answertime_min     | -   | -        | 
answertime_min_nr  | -   | -        | 
answertime_min_pr  | -   | -        | 
num_answered       | 0   | 0        | 
num_negative_resps | 0   | 0        | 
num_unanswered     | 1   | 1        | 
-------------------+-----+----------+

0 negative responses were received

These negative response codes were received 

The following negative response codes are blacklisted: ['generalReject', 'serviceNotSupported']

=== No data to display ===
yomannnn commented 6 months ago

I just realized that the can id had to be corrected:

yomannnn commented 6 months ago

see above