Reverse engineering

CanLab

A desktop workstation for reverse-engineering CAN bus data, from a raw capture to an exported DBC, with the diagnostic stack (UDS, ISO-TP, J1939, OBD-II, XCP, DoIP) in the same window.

  • Python 3.11+
  • PyQt6
  • SocketCAN
  • python-can
  • DBC
  • MIT
01 / The problem

Nobody publishes the DBC

A vehicle's CAN bus is a continuous stream of numbered frames carrying packed binary signals. What each arbitration ID means (which bits are speed, which are state of charge, which are a rolling counter or a checksum) lives in a DBC file that manufacturers treat as proprietary. Without one, a capture is noise.

Deriving a DBC by hand means correlating thousands of frames against known physical events, finding signal boundaries in packed bytes, distinguishing a real value from a counter that happens to look like one, and proving the result rather than guessing it. The existing tools split that work across a sniffer, a spreadsheet and a separate diagnostics utility.

CanLab puts the whole loop in one place: load, inspect, analyse, interpret, export, plus the diagnostic protocols you need to ask an ECU directly.

02 / How it works

One loop, five stages

LOADcapture / live busINSPECTframes + signalsANALYSEcounters, checksumsINTERPRETAI-assisted IDEXPORTDBCDiagnostics (UDS · ISO-TP · J1939 · OBD-II · XCP · DoIP) run against the same session.
  • Load: open a stored capture or attach to a live bus through SocketCAN.
  • Inspect: browse frames and decoded signals as they arrive, keyed per arbitration ID.
  • Analyse: offline passes look for rolling counters, checksum bytes and signal boundaries inside packed payloads, so you start from candidates rather than a blank grid.
  • Interpret: optional AI assistance proposes a meaning for an unknown ID from its behaviour and context.
  • Export: build the DBC and write it out.
CanLab frame view: live CAN frames listed per arbitration ID with changing bytes highlighted
Frame view. Every arbitration ID on the bus, with the bytes that changed since the last frame highlighted, which is where signal boundaries start to show themselves.
03 / What ships

The capability surface

AreaWhat it covers
AnalysisFrame and signal inspection, counter and checksum detection, signal boundary search, DBC build and export
DiagnosticsUDS, ISO-TP, J1939, OBD-II, XCP, DoIP
Bench onlyFrame injection, replay, fuzzing, and a MitM gateway
InterfacePyQt6 desktop application, Python 3.11+
QualityCovered by an automated test suite
LicenceMIT
CanLab DBC builder: signal editor with bit layout matrix, scale, offset and value type
DBC builder. Signal definition with the bit-layout matrix, byte order, scale, offset and range, exported straight to a DBC.
04 / Safety

Read this before touching a vehicle

Isolated bench use only

The injection and gateway features can transmit frames onto a bus. Use them only on isolated bench setups: a benchtop ECU, vcan0, or dedicated lab hardware. Injecting or forwarding frames on a live vehicle bus can interfere with braking, steering and airbag systems.

Honest limitations

Actively developed, single-author, and best treated as alpha. Some features need optional dependencies. Some analysis methods are heuristics, not guarantees. It has not been validated across a wide range of real vehicles.