Gallia DISCOVERY

[binderiya1]

Hello everybody,
I am having a trouble in discovery session, if possible my team would really appreciate your help !!!
PS : this might sound bit silly, we are so sorry
I am connected to the testbed ECU by an "Peak system " usb and we can get an CAN messages from it using the PCAN view !
Now I want to use gallia pentesting tool for our testbed and receive/send UDS messages. As we write our command line its important to write the target ECU address right ? Since we are connected by USB, whats our ECU address would be ?

Thank you for reading till here ! And if there is any misunderstandment, please feel free to correct me !

PEAK USB : (https://www.peak-system.com/PCAN-View.242.0.html?&L=1&fbclid=IwY2xjawFjJd5leHRuA2FlbQIxMAABHcwMs5eTOgGyM7UioP_XNXep7UwRUuZAsXJ5l2kDZNPDHOyiaN5nJTVsLQ_aem_qxamFUQ_63JhGGK9VMHuLw)

[rumpelsepp]

Hi!

First of all, it seems you use a virtual CAN interface an your system (it is common to name virtual CAN interfaces like vcan0, vcan1, …). Using a recent Linux system, the Peak Adapter should be recognized by your operating system out-of-the-box and be named like can0, can1, …. You can check this using the command ip link show. You need to configure the bitrate of your bus using something like ip link set can0 type can bitrate 500000. You can verify if your settings works using candump or cansend.

In order to setup gallia for using the peak adapter, you need to configure a transport. On CAN commonly ISO-TP is used. You need to configure the transport parameters using a target url; the target url is passed via --target. For finding src_addr and dst_addr there is a discover scanner available (gallia discover uds isotp). Finding the optional settings is up to you. :)

Please note: A Linux system is required, since gallia uses the native CAN stack provided by the kernel. Windows, WSL or similar is not supported. Linux VMs should work.

[Munkhzull]

Hello, Stefan, thank you so much for your fast reply on such short notice! After your message, we completed the discovery scan ( everything is working well thanks to Gallia) and got an open ECU address, with that however, we are having slight trouble with the session and service scan due to a timeout while waiting for the ECU. Is it an internal problem with our car, or are there any restrictions on scanning the service and session due to the ECU timeout? Or do you have any idea why this error is occurring? Thank you again so much for your kind help.

[rumpelsepp]

The dst address looks weird and the received data does not look like UDS data. Have you tried different adressing schemes? You could try --extended-addr or --padding 0xaa.

[rumpelsepp]

You can also try can fd and non can fd.