Extracting SecOC Keys From A 2021 Toyota RAV4 Prime

With the recently introduced SecOC (Secure Onboard Communication) standard, car manufacturers seek to make the CAN bus networks that form the backbone of modern day cars more secure. This standard adds a MAC (message authentication code) to the CAN messages, which can be used to validate that these messages come from a genuine part of the car, and not from a car thief or some third-party peripheral.

To check that it isn’t possible to circumvent SecOC, [Willem Melching] and [Greg Hogan] got their hands on the power steering (EPS) unit of a Toyota RAV4 Prime, as one of the first cars to implement this new security standard.

The 2021 Toyota RAV4 Prime's power steering unit on the examination bench. (Credit: Willem Melching)
The 2021 Toyota RAV4 Prime’s power steering unit on the examination bench. (Credit: Willem Melching)

As noted by [Willem], the ultimate goal is to be able to run the open source driver assistance system openpilot on these SecOC-enabled cars, which would require either breaking SecOC, or following the official method of ‘rekeying’ the SecOC gateway.

After dumping the firmware of the EPS Renesas RH850/P1M-E MCU via a voltage fault injection, the AES-based encryption routines were identified, but no easy exploits found in the main application. This left the bootloader as the next target.

Ultimately they managed to reverse-engineer the bootloader to determine how the update procedure works, which enabled them to upload shellcode. This script then enabled them to extract the SecOC keys from RAM and send these over the CAN bus. With these keys the path is thus opened to allow any device to generate CAN messages with valid SecOC MACs, effectively breaking encryption. Naturally, there are many caveats with this discovery.

Continue reading “Extracting SecOC Keys From A 2021 Toyota RAV4 Prime”

A Dashboard Outside The Car

One of the biggest upsides of open communications standards such as CAN or SPI is that a whole world of vehicle hacking becomes available, from simple projects like adding sensors or computers to a car or even building a complete engine control unit from the ground up. The reverse is true as well; sensors and gauges using one of these protocols can be removed from a car and put to work in other projects. That’s the idea that [John] had when he set about using a vehicle’s dashboard as a information cluster for his home.

The core of the build is an Astra GTE dashboard cluster, removed from its host vehicle, and wired to an Arduino-compatible board, in this case an ESP32. The code that [John] wrote bit-bangs an SPI bus and after some probing is able to address all of the instrument gauges on the dashboard. For his own use at home, he’s also configured it to work with Home Assistant, where each of the gauges is configured to represent something his home automation system is monitoring using a bit mask to send data to specific dials.

While this specific gauge cluster has a lot of vehicle-specific instrumentation and needs a legend or good memory to tie into a home automation system without any other modification, plenty of vehicle gauges are more intuitive and as long as they have SPI they’d be perfect targets for builds that use this underlying software. This project takes a similar tack and repurposes a few analog voltmeters for home automation, adding a paper background to the meters to make them easier to read.

Continue reading “A Dashboard Outside The Car”

Vehicle-to-Grid Made Easy

As electric cars continue to see increased adoption, one associated technology that was touted long ago that still hasn’t seen widespread adoption is vehicle-to-grid or vehicle-to-home. Since most cars are parked most of the time, this would allow the cars to perform load-levelling for the grid or even act as emergency generators on an individual basis when needed. While this hasn’t panned out for a variety of reasons, it is still possible to use an EV battery for use off-grid or as part of a grid tie solar system, and now you can do it without needing to disassemble the battery packs at all.

Normally when attempting to use a scrapped EV battery for another use, the cells would be removed from the OEM pack and reorganized to a specific voltage. This build, however, eliminates the need to modify the packs at all. A LilyGO ESP32 is used to convert the CAN bus messages from the battery pack to the Modbus communications protocol used by the inverters, in this case a Fronius Gen24, so the inverter and battery can coordinate energy delivery from one to the other automatically. With the hard part out of the way, the only other requirements are to connect a high voltage DC cable from the battery pack to the inverter.

[Dala], the creator of this project, has taken other steps to ensure safety as well that we’d recommend anyone attempting to recreate this build pays close attention to, as these battery packs contain an extremely large amount of energy. The system itself supports battery packs from Nissan Leafs as well as the Tesla Model 3, which can usually be found for comparably low prices. Building battery energy storage systems to make up for the lack of commercially-available vehicle-to-home systems isn’t the only use for an old EV battery, though. For example, it’s possible to use Leaf batteries to triple the range of other EVs like [Muxsan] did with this Nissan van.

Continue reading “Vehicle-to-Grid Made Easy”

A Smart Home That CAN Do It All

In an ideal smart home, the explosion of cheap WiFi and Bluetooth chips has allowed hundreds of small wireless devices to control the switches, lights, and everything else required for a “smart home” at a relatively low price. But what if you don’t want hundreds of internet-connected devices in your home polluting the wireless spectrum and allowing potential security holes into your network? If you’re like [Lucas Teske], you might reach for something wired and use cheap and (currently) available Raspberry Pi Picos to create PicoHome.

The unique twist of PicoHome is that it uses a CAN bus for communication. One of [Lucas’] goals was to make the boards easily swappable when hardware failed. This meant board-to-board communication and protocols like I2C were susceptible to noise (every time a relay triggered, the bus would lock up briefly). The CAN bus is designed to work in an electrically noisy environment.

There are two parts to the system: pico-relay and pico-input. The first connects to a 16 relay board and can control 16 different 24v relays. The second has 16 optoisolators to read from 12v-24v switches and various buttons throughout the house. These can be placed in a giant metal box in a central wiring location and not worry about it.

The firmware and board files are all released under an Apache 2.0 license, but the CAN2040 library this project relies on is under GPL. We covered the CAN2040 library when it was first released, and it’s lovely to see it being used for something entirely unexpected.

Continue reading “A Smart Home That CAN Do It All”

All Aboard The Garbage Express

Cog railways are a somewhat unusual way of train locomotion, typically only installed when a train needs to climb steep terrain. Any grade above about 10% needs the extra traction since the friction between the wheels and rails won’t be enough to push the train forward or keep it from falling backwards. Even without a steep hill to climb, sometimes a cog railway is necessary for traction as [Max Maker] discovered while building a train for his garbage cans.

The build started out as a way to avoid having to wheel his seven waste bins to the curb every month. Originally he built a more standard railway with a simple motor to drive the train, but he quickly realized that there wasn’t enough grip even when using plastic wheels, even though this track follows fairly flat terrain. Since the rail is built out of steel he quickly welded up a rack-and-pinion system to one of the rails. The build goes through many iterations before he finally settles on a design that solves the problem, and it includes several other features as well such as remote control and a spring-loaded automatic charger for the train at its station in the back yard.

While we always appreciate the eccentricity of those who would automate a relatively simple task that only happens once a month, [Max Maker] hopes to build this into a commercial product aimed at the elderly or disabled who would really benefit from a reliable, semi-automatic system that takes their trash bins to the curb for them. And, if your system only involves a single trash can, there are other ways of automating the task of taking the garbage to the curb.

Continue reading “All Aboard The Garbage Express”

This ESP32 CAN!

Since modern cars use the CAN bus for so many of their functions, it’s unsurprising that it’s a frequent object of interest for those in our community. Some people go no further than commercial plug-in analysers, while others build their own CAN devices. This is what [Magnus Thomé] has done, with his RejsaCAN microcontroller board.

It’s a small PCB with an onboard CAN interface from an ESP32-S3 and a car-friendly power supply circuit, and perhaps most importantly, it has an auto-shutdown feature to prevent battery drain. Software-wise it’s a blank piece of paper for the user to roll their own application, but since the ESP32 is supported by the Arduino ecosystem, there are libraries that make talking CAN as easy as it can be.

[Magnus] has a list of potential applications for the board, many of which take advantage of the ESP’s wireless capabilities. So far, [Magnus] has hooked it up to an LCD display, but we can see so many other useful things coming out powered by something like this.

You haven’t tried playing with your car’s CAN bus yet? Maybe you should read this to whet your appetite.

Part of a picture showing all kinds of different CAN devices in a car

CAN Peripheral For RP2040, Courtesy Of PIO

[Kevin O’Connor] writes to us about his project, can2040adding CAN support to the RP2040. The RP2040 doesn’t have a CAN peripheral, but [Kevin] wrote code for the RP2040’s PIO engine that can receive and send CAN packets. Now we can all benefit from his work by using this openly available CAN driver. This library is written in C, so it’s a good fit for the lower-level hackers among us, and in all likelihood, it wouldn’t be hard to make a MicroPython wrapper around it.

The CAN bus needs a peripheral for the messages to be handled properly, and people have been using external chips for this purpose until now. These chips, [Kevin] tells us, have lately been unavailable due to the chip shortage, making this project more valuable. The documentation is extensive and accessible, and [Kevin] details how to best use this driver. With such a tool in hand, you can now turn your Pico into a CAN tinkering toolkit, or wire up some CAN devices for use in your own projects!

[Kevin] says this code is already being used in Klipper, a framework powering 3D printers and other machines like them. As for your own purposes, you can absolutely use such a CAN tool to hack on your car – here’s a treasure trove of car hacking documentation, by the way! Thanks to the PIO engine, there seems to be no end to the RP2040’s versatility – you can even drive HDMI monitor with this PIO-based DVI code.

Continue reading “CAN Peripheral For RP2040, Courtesy Of PIO”