Automotive Ethernet Training

Automotive Ethernet Training#

4 Exercises:

Automotive Ethernet AudiCgw
Ethernet DoIP/UDS AudiCgw
ECU Simulation TLS/DoIP/UDS
SomeIP BCM

Optional: Sniff UART#

Audi cGW3.1 UART/JTAG Wiring Solution

ECU Point of View!. 6 pins to connect for JTAG communication: GND, VCC, TDI, TMS, TCK, TDO. 2 pins to connect for UART communication: TX, RX.

Audi cGW3.1 UART Connection Solution

#Bash
picocom  --imap=lfcrlf -b 921600 /dev/ttyUSB0

Automotive Ethernet with AudiCgw#

Connection with Hydralink#

When using a Hydralink to connect to the Gateway, please follow the instructions at dissecto-GmbH/hydralink to configure the hydralink in 100mbps slave mode.

On linux, you will need to add the following to a file such as /etc/udev/rules.d/70-hydralink.rules to allow non-root users to configure the Hydralink:

SUBSYSTEMS=="usb", ATTRS{idVendor}=="0x0424", ATTRS{idProduct}=="0x7801", MODE="0660", TAG+="uaccess"

Connect + and - to the first automotive ethernet pin pair and then turn the ECU on by connecting KL15 and +12V together to power, and GND to ground.

1. Ethernet DoIP/UDS AudiCgw#

Connect ECU#

Audi cGW3.1 Wiring Solution

Pro Solution

Setup Ethernet (Blinking = Good)
Should work automatically if ECU and Eth Activation Line are Powered

Sniff for a DoIP Announcment using Tshark / Wireshark#

Tshark Solution

Wireshark Solution

Do a nmap Scan of the ECU#

Nmap cmd hint

sudo nmap -p 1-65535 -e ethX 192.168.XXX.XXX

Nmap options hint

Read the table in subchapter IP and Service Scanning in the chapter Automotive Ethernet

Nmap Solution

sudo nmap -n -Pn -v -sT -sV -r -p 1-65535 -e ethX 192.168.XXX.XXX --disable-arp-ping --max-retries 10 --max-rtt-timeout 100ms

Add IP in the same subnet to your PC:#

Ip link Solution

sudo ip addr add IP/NETMASK dev DEVICE

Send UDS Packet to the ECU#

Audi cGW3.1 DoIP Solution send UDS over DoIP

#PYTHON
from scapy.all import *
from scapy.contrib.automotive.doip import DoIPSocket
from scapy.contrib.automotive.uds import UDS, UDS_RDBI

load_contrib("automotive.doip")

sock = DoIPSocket("169.254.117.238")
pkt = DoIP(source_address=0xe80, target_address=0x4010)/UDS()/UDS_RDBI(identifiers=[0x1000])
resp = sock.sr1(pkt, timeout=1)
resp.show()

Scan your way into the Bootloader of the ECU#

UDS DoIP Scan Solution

#Python
from scapy.all import *
from scapy.contrib.automotive.doip import DoIPSocket, UDS_DoIPSocket
from scapy.contrib.automotive.uds import UDS, UDS_RDBI
from scapy.contrib.isotp import *
from scapy.contrib.automotive.uds_scan import *
from scapy.contrib.automotive.uds_ecu_states import *

load_contrib("automotive.doip")
conf.contribs['CANSocket'] = {'use-python-can': False}
conf.contribs['ISOTP'] = {'use-can-isotp-kernel-module': True}

sock = UDS_DoIPSocket("169.254.117.238")

def reset():
    sock.sr1(UDS()/UDS_ER(resetType="hardReset"), verbose=False, timeout=1)

s = UDS_Scanner(sock, reset, test_cases=[UDS_ServiceEnumerator, UDS_DSCEnumerator])
s.scan(timeout=10)
s.show_testcases()

ECU Simulation TLS / DoIP / UDS#

Connect ECU Simulation#

Pro Solution

Setup Ethernet (Blinking = Good)
Should work automatically if ECU and Eth Activation Line are Powered

Sniff for a DoIP Announcment using Tshark / Wireshark#

Do a nmap Scan#

Nmap Solution

sudo nmap -n -Pn -v -sT -sV -r -p 1-65535 -e ethX 192.168.XXX.XXX --disable-arp-ping --max-retries 10 --max-rtt-timeout 100ms

Download Testssl.sh#

Testssl Download Solution

git clone --depth 1 https://github.com/drwetter/testssl.sh.git 

Do a Testssl.sh Scan#

Testssl Solution

./testssl.sh --nodns=none --connect-timeout=2 192.168.0.2:44446

Connect to DoIP with/without TLS#

UDS DoIP Connections Solution

from scapy.all import *
import socket as socketlib
from scapy.contrib.automotive.doip import *
from scapy.contrib.automotive.uds import UDS, UDS_RDBI

from concurrent.futures import ProcessPoolExecutor

def connect_DoIP_TCP():
   socket = DoIPSocket("127.0.0.1")
   pkt = DoIP(payload_type=0x8001, source_address=0xe80, target_address=0x1000) / UDS() / UDS_RDBI(identifiers=[0x1000])
   resp = socket.sr1(pkt, timeout=1)
   print("Received response:", resp)

def connect_DoIP_TLS():
   # Create client-side SSL context
   context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)

   # This disables hostname verification
   context.check_hostname = False
   # This disables server certificate validation entirely.
   context.verify_mode = ssl.CERT_NONE

   # Load client certificate and key required by the server
   context.load_cert_chain(certfile="client-cert.pem", keyfile="client-key.pem")

   socket = DoIPSocket(ip="127.0.0.1", tls_port=4433, force_tls=True, context=context)
   pkt = DoIP(payload_type=0x8001, source_address=0xe80, target_address=0x1000) / UDS() / UDS_RDBI(identifiers=[0x1000])
   rep = socket.sr1(pkt, timeout=1)
   print(repr(rep))
   socket.outs.unwrap()

client-cert.pem

client-key.pem

SomeIPs#

Connect ECU#

Pro Solution

Setup Ethernet (Blinking = Good)
Should work automatically if ECU and Eth Activation Line are Powered

Sniff for a SomeIp using Tshark / Wireshark#

Have Fun with a Scapy answering Server#

Audi cGW3.1 DoIP Solution send UDS over DoIP

#PYTHON
#! /usr/bin/python3
from copy import copy
from scapy.contrib.automotive.someip import SD, SOMEIP, SDOption_IP4_EndPoint, SDEntry_EventGroup
from scapy.layers.inet import IP, UDP
from scapy.layers.l2 import Dot1Q, Ether
from scapy.packet import Packet
from scapy.sendrecv import sendp, sniff

def answering_server(pkt: Packet):
    sd_options = [SDOption_IP4_EndPoint(addr="160.48.199.17", l4_proto="UDP", port=30498)]

    if pkt.haslayer(SOMEIP):
        if pkt[IP].src != "160.48.199.16":
            return

        offer_pkts = []
        sub_pkt_array = []
        if not pkt.haslayer(SD):
            return
        try:
            offer_pkts = [copy(p) for p in pkt[SD].entry_array if p.type == 1]
        except AttributeError:
            pass
        for p in offer_pkts:
            print(
                f"Found SomeIP Discovery Offer for Service {p.srv_id}, InstanceID {p.inst_id}\n", flush=True)
            sub_pkt_array.append(SDEntry_EventGroup(srv_id=p.srv_id, inst_id=p.inst_id, type=0x06, n_opt_1=0x01,
                                                    n_opt_2=0x00, index_1=0x00, index_2=0x00, eventgroup_id=0x1,
                                                    ttl=4, res=0, cnt=0, major_ver=1))
            print(
                f"Creating Subscribe for Service {p.srv_id}, InstanceID {p.inst_id}\n", flush=True)
        if sub_pkt_array:
            sd_pkt = SD(flags="REBOOT+UNICAST", entry_array=sub_pkt_array, option_array=sd_options)
            offer_pkt = (
                    Ether(dst="d8:18:2b:c0:bd:81") /
                    Dot1Q(vlan=73) /
                    IP(dst="160.48.199.16", src="160.48.199.17") /
                    UDP(sport=30490, dport=30490) /
                    SOMEIP(srv_id=0xffff, client_id=0x0, proto_ver=0x01, iface_ver=0x01) / sd_pkt
            )
            sendp(offer_pkt, iface="enp7s0f3u1", verbose=False)

sniff(iface="enp7s0f3u1", prn=answering_server)

Automotive Ethernet Training

Contents

Automotive Ethernet Training#

Optional: Sniff UART#

Automotive Ethernet with AudiCgw​#

Connection with Hydralink#

1. Ethernet DoIP/UDS AudiCgw​#

Connect ECU​#

Sniff for a DoIP Announcment using Tshark / Wireshark#

Do a nmap Scan of the ECU​#

Add IP in the same subnet to your PC:#

Send UDS Packet to the ECU#

Scan your way into the Bootloader of the ECU#

ECU Simulation TLS / DoIP​ / UDS#

Connect ECU​ Simulation#

Sniff for a DoIP Announcment using Tshark / Wireshark#

Do a nmap Scan#

Download Testssl.sh#

Do a Testssl.sh Scan#

Connect to DoIP with/without TLS#

SomeIPs#

Connect ECU​#

Sniff for a SomeIp using Tshark / Wireshark#

Have Fun with a Scapy answering Server#

Automotive Ethernet with AudiCgw#

1. Ethernet DoIP/UDS AudiCgw#

Connect ECU#

Do a nmap Scan of the ECU#

ECU Simulation TLS / DoIP / UDS#

Connect ECU Simulation#

Connect ECU#