Version 1.5.5 of Alexey Sintsov’s car hacking tool CANToolz has a new feature for analyzing CAN traffic:
CANToolz: mod_stat – diff mode
Small updates in CANToolz in version 1.5-0: Have added DIFF mode to mod_stats module. This can be useful if you want to find what frames are new in the traffic. For example you have traffic dump, then you enable diff mode and do some action, like door unlock. Just after that you can press “print diff” and see all CAN frames that were found in the CAN BUS after enabling DIFF mode but not before. Of course there will be a lot of unneeded traffic as well, but anyway it should help to reduce amount of traffic for manual analysis. If you press “print DIFF (ID only)” then you will see only those CAN frames that have not known (in original dump, before diff mode enabled) arbitration ID. When you disable DIFF mode, all CAN frames will me merged to original mod_stat buffer, so you can repeat this action again and again… Finally you can DUMP diff frames and replay. This hould work faster then “binary search”.
Full post:
http://asintsov.blogspot.de/2016/04/cantoolz-modstat-diff-mode.html
Firmware Security 