canbus: reverse-engineer OneControl IDS-CAN bus (read fully mapped, write auth-gated)

Tapped the X180T's CAN bus via CANable 2.0 at the monitor panel's terminator
port. The bus is NOT RV-C — it's Lippert's proprietary IDS-CAN (250k, 11-bit
IDs, (page<<8)|node, 1 Hz broadcasts).

Read side fully mapped from live captures:
- device classes (page-2 type byte: 0x0A tank, 0x1E switched load, 0x21 motor)
- node map for this rig (Catalina 263BHSCK): tanks 27/E2/7D/FE, lights 2A/F8,
  heater 95, pump 61, awning 75 (+ direction & live motor current)
- battery voltage on 29-bit extended frames

Write side: commands are DLC-0 ext frames 0006<node><op>, but auth-gated by a
rolling challenge-response (page 42/43). Replay confirmed dead (spoofed cansend
did not actuate). Not the BLE TEA cypher. response=f(challenge) is deterministic
(no session state) so crackable offline later — seeded 42 pairs in
sniff/2A-auth-pairs.txt.

Includes raw captures (sniff/*.log, force-added past *.log ignore), a read-only
esp32_can ESPHome skeleton, and the log-can.sh sniff helper. Full writeup in
canbus/README.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
wes
2026-06-11 23:20:49 -04:00
co-authored by Claude Fable 5
parent 34155fd7f9
commit b97401fec8
11 changed files with 43218 additions and 0 deletions
+45
View File
@@ -0,0 +1,45 @@
# Lippert IDS-CAN command-auth challenge/response pairs
# node 2A (exterior lights), captured 2026-06-11, app-driven on/off x~20
# format: <challenge_hex> <response_hex> (both 4 bytes, from page42/page43 payload bytes 3-6)
9577DE9B C033B197
1ADF97F8 F48604B6
E09D5B01 44A5C15E
DEA757A0 04DD9CBA
8862C15F 29AA626F
E14DB9AE 25373B94
23A3ED5D 3250A48A
F3A3B602 A6E58995
FC5F3883 47780DAF
16B2AE10 28FE5A23
11C34FD9 6A1B9415
2FFC637D 0A5CE05B
DB284B0C 052D2687
FA14432F 71EDD5F4
B140D087 356CFD45
20337B7E 81D3136A
968F0543 F91AB4A3
28DA207A 781A423E
AB4040DE 5B652F23
7A3CA469 48DF5FCF
AFDFBC25 2E52F019
B7394203 C62B24EE
ECA9CD68 361924A5
83198E6B 7E9DF4D9
4D3F6429 86793E68
0804DD8B 953137D5
E1525A39 1091BB17
C77CAA9B F9746AAC
B98C209C 46385C66
BBE34815 F717E80E
2DAA8E0C BB1CF451
D4AAC54D FD806835
E1ECB36C FE26F014
BF066519 4F23CAAF
DA8EF86C ED575807
0FD2C9B9 6B0EF761
4B192BC2 0DC60551
A0421A64 54A5AD6D
2BE06274 BD49B339
8FF0B6E5 C18D49F2
45FE7D5E 0A44BB97
BAA07C27 54E5C64B