UDS Discovery Issue

[safwannasser]

Hi,

If there are any periodic CAN messages sending 0x50 in its 1st byte, the UDS discovery functoin catches all those as a valid server ID, so I'm getting the server ID for all client requests. Whats a workaround for this?
Thanks in advance

[safwannasser]

For the posted issue, I blacklisted my current IDs, so the program doesnt catch those.

there's another issue where if the ECU sends both 11 bit and 29 bit CAN ID and if we are expecting a 29 bit CAN ID, the filter function in python will pass the 11 bit IDs through., and during service discovery, many services are falsely being identified as valid service.

[kasperkarlsson]

Hello @safwannasser and thank you for reaching out!

A verification step was previously added to prevent accidental matches - after all, the is_valid_response(message) function is quite likely to give false positives on CAN buses with high traffic.

Just as you have already figured out, the --blacklist B [B ...]/-b B [B ...] option can be used to remove any known IDs. There is also an option --autoblacklist N/-ab N which can be used to listen for false positives to automatically blacklist before running the discovery. For example, caringcaribou uds discovery -autoblacklist 10 will listen for 10 seconds and blacklist any matches during this period, before initiating the discovery.

As for the 11 vs 29 bits mismatch, I do believe that this might warrant a fix. This could be implemented via an optional argument to apply stricter filtering based on arbitration ID length. Can you please supply an example of the command you currently run and a few CAN messages resulting in a false positives? Just to give me an example to test for during development 🙂

[safwannasser]

Hi,
I fixed it myself .You just have to add a extended: True in the set_filter_single_arbitration_id function as below.
def set_filter_single_arbitration_id(self, arbitration_id):
"""Set a filter to only receive incoming messages on 'arbitration_id'"""
if arbitration_id > ARBITRATION_ID_MAX:
extended = True
else :
extended: False
arbitration_id_filter = [{"can_id": arbitration_id, "can_mask": ARBITRATION_ID_MAX_EXTENDED,"extended" : extended}]
self._set_filters(arbitration_id_filter)

For an example for you to run, I won't be able to give the exact values I ran, but I was trying to filter a 29 bit CAN ID like '0x18DA2FF0', but the above function was passing through some 11 bit CAN ID's like '0x6901', 0x6903', etc before I added the extended keyword to the filter.

Also another update to be made.
in sub_discovery function, it should be subservice_status.append(status) rather than subservice_status.append(reponse[1]). This issue was causing many false postives in service discovery. rectified code below
if response is None:
# No response received
continue

        # Parse response
        if len(response) >= 2:
            # print("Response:", " ".join(f"0x{b:02X}" for b in response))
            
            response_id = response[0]
            response_service_id = response[1]
            if len(response) >= 3:
                status = response[2]
            else:
                status = None
            if Iso14229_1.is_positive_response(response):
                found_subservices.append(i)
                subservice_status.append(0x00)
            elif (response_id == Constants.NR_SI and response_service_id == service and
                  status != NegativeResponseCodes.SUB_FUNCTION_NOT_SUPPORTED):
                # Any other response than "service not supported" counts
                found_subservices.append(i)
                subservice_status.append(status)
        

        time.sleep(timeout)

[kasperkarlsson]

Thank you very much for these clarifications, and great job finding both of these bugs!

You are of course welcome to send a PR with these fixes! Otherwise I can of course implement them on my own, but I would rather let you get the credit 🙂

[safwannasser]

Hi,
I'm happy for you to do it. I already made many other changes as well. I'm implementing more fuzz test cases for many of the UDS services.