Open-source CAN bus toolkit · Firmware v2.3
CAN Commander
A CAN bus toolkit for vehicle reverse engineering, diagnostics and signal injection.
ESP32 firmware does the CAN work. You drive it from a Flipper Zero app, or from a command line over USB or Wi-Fi. Created and maintained by Matthew KuKanich.
tool start replay bus=can0 id=2C1
tool config cmd=record
# hold window button for 2 seconds
tool config cmd=stop
recording stopped frames=47
tool config cmd=replay
replay complete
- Tools
- 12, from read-all to replay
- CAN buses
- 1 or 2, normal or listen-only
- Bitrates
- 5 kbit/s to 1 Mbit/s
- Interfaces
- Flipper Zero, USB, Wi-Fi
What it does
Twelve tools for finding, decoding and sending CAN signals
Each tool runs in the firmware and is available from every interface. The names in amber are what you type at the command line.
01
Monitor & Discovery
See what is on the bus, then narrow it down to the message, byte and bit that matter.
- Auto Reverse Engineer
reverse - Learns the bus's background noise, then shows only the IDs and bytes that change when you perform an action.
- Bit Tracker
bittrack - An 8-byte bit grid for one ID that shows exactly which bits flip as you operate the vehicle.
- Value Tracker
valtrack - Byte-by-byte value changes with running minimum and maximum for one message stream.
- Read All Frames
read_all - Streams every frame on one or both buses, with frame detail, recent-frame and statistics views.
- Filter & Read Frames
filtered - Streams only frames that match an ID mask and filter, for isolating one ECU or message family.
- Unique IDs
unique_ids - Counts and lists every CAN ID seen on the bus.
- CAN Speed Test
speed - Reports messages per second for throughput checks and bus-load comparisons.
02
Control & Injection
Transmit on the bus: raw frames, modified copies of live frames, or a recorded sequence played back with its original timing.
- Smart Injection
custom_inject - Five slots that track the latest live frame for an ID and resend it with only your chosen bits, bytes or fields changed.
- Replay
replay - Records one ID and plays the sequence back with the original inter-frame timing.
- Write Frames
write - Sends a frame once, in a burst, or periodically until stopped.
03
Vehicle Diagnostics
Standard OBD-II over CAN, without needing to know anything about the vehicle's own messages.
- OBD-II Live Data
obd_pid - Polls Mode 01 PIDs: RPM, speed, coolant temperature, throttle, load, fuel level and more, or any PID by number.
- Fetch VIN
obd_pid pid=vin - Reads the vehicle identification number from the ECU.
- Fetch and Clear DTCs
obd_pid pid=dtc - Reads stored, pending and permanent trouble codes from every responding module, and clears them.
04
DBC & Databases
Turn raw frames into named engineering values using signal definitions from a DBC file.
- DBC Decode
dbc_decode - Decodes live frames into scaled values: Intel and Motorola byte order, signed values, factor and offset, multiplexed signals.
- Decoding Profiles
.dbcprof - Curated signal sets stored on the Flipper's SD card. Load one and decoding starts immediately.
A typical session
From an unknown bus to a working command
You do not need a DBC file or prior knowledge of the vehicle. The tools hand off to each other, so finding a signal and reproducing it is one continuous workflow.
-
Calibrate
Leave the vehicle alone. Auto Reverse Engineer records every byte that changes by itself and blacklists it as background noise.
reverse · calibration phase
-
Act
Press the button, flick the switch. Only the IDs and bytes that were stable until now are shown, so the message you want stands out.
reverse · monitoring phase
-
Isolate
Jump straight into Bit Tracker for the ID you picked and watch which bits flip when you repeat the action.
bittrack
-
Reproduce
Set those bits in a Smart Injection slot, or record the frames and replay them with their original timing.
custom_inject · replay
Smart Injection changes only what you ask it to
A vehicle message usually carries several signals. Send a frame you built by hand and you overwrite all of them.
Smart Injection keeps the latest frame it has seen for each slot and applies your change on top, so the rest of the message goes out exactly as the vehicle last sent it. It works on single bits, multi-bit fields and multiplexed messages.
tool config cmd=bit slot=1 bit=10 value=1 sets one bit in byte 1; every other byte is copied from the most recent frame on the bus. Per byte: modified = ((latest & ~mask) | (value & mask)) ^ xor
How it fits together
The firmware is the product. The interface is your choice.
Receiving, filtering, decoding, transmitting and timing all happen on the ESP32. The Flipper app and the command line are two ways of driving the same tools, and they can be connected at the same time.
Flipper Zero app
Dashboards for every tool, profiles on the SD card. Powers the board.
UART · 921600 baud
USB command line
Any serial terminal on a laptop. Scriptable text commands.
USB serial · 115200 baud
Wi-Fi command line
The board hosts its own access point. Off by default.
Raw TCP · port 7777
CAN Commander firmware
ESP32-S3 or classic ESP32. One tool active at a time; ownership rules keep the interfaces from colliding.
- read_all
- filtered
- unique_ids
- bittrack
- reverse
- valtrack
- speed
- write
- custom_inject
- replay
- obd_pid
- dbc_decode
CAN0
The ESP32's built-in TWAI controller with a transceiver.
CAN1 (optional)
MCP2517FD/MCP2518FD or MCP2515 over SPI.
Get started
Pick the path that matches what you have
Flipper Zero + official board
Plug in and go
The official board plugs onto the Flipper's GPIO header and has two CAN ports. Install the app, connect the CAN wires, and start with a read-only tool.
Build your own
Two modules and a few wires
An ESP32-S3 dev board and an SN65HVD230 transceiver give you a single-bus CAN Commander that runs the same firmware and every tool.
No Flipper
Use the command line
Every tool is a text command over USB, or over a Wi-Fi access point the board can host. Works from a laptop, a phone or a script.
The project
Independent, open source, and built in the open
CAN Commander is created and maintained by Matthew KuKanich, an automotive cybersecurity and embedded systems engineer. The source, the documentation and the issue tracker are all on GitHub.
Source
GitHub repository
Firmware, Flipper app, host tests and build scripts.
Community
Discord
Ask questions, get help with a vehicle, and follow development.
Hardware
Supported boards
The official dual-bus board, a single-bus DIY build, and the other ESP32 and controller combinations the firmware supports.
CAN Commander can transmit on a live vehicle network. Injected or replayed frames can set fault codes, light warnings or operate real vehicle functions. Start with read-only tools or listen-only mode, test on a bench or a parked vehicle, and only work on vehicles you own or are authorised to test.