canbus: reverse-engineer OneControl IDS-CAN bus (read fully mapped, write auth-gated)
Tapped the X180T's CAN bus via CANable 2.0 at the monitor panel's terminator port. The bus is NOT RV-C — it's Lippert's proprietary IDS-CAN (250k, 11-bit IDs, (page<<8)|node, 1 Hz broadcasts). Read side fully mapped from live captures: - device classes (page-2 type byte: 0x0A tank, 0x1E switched load, 0x21 motor) - node map for this rig (Catalina 263BHSCK): tanks 27/E2/7D/FE, lights 2A/F8, heater 95, pump 61, awning 75 (+ direction & live motor current) - battery voltage on 29-bit extended frames Write side: commands are DLC-0 ext frames 0006<node><op>, but auth-gated by a rolling challenge-response (page 42/43). Replay confirmed dead (spoofed cansend did not actuate). Not the BLE TEA cypher. response=f(challenge) is deterministic (no session state) so crackable offline later — seeded 42 pairs in sniff/2A-auth-pairs.txt. Includes raw captures (sniff/*.log, force-added past *.log ignore), a read-only esp32_can ESPHome skeleton, and the log-can.sh sniff helper. Full writeup in canbus/README.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,45 @@
|
||||
# Lippert IDS-CAN command-auth challenge/response pairs
|
||||
# node 2A (exterior lights), captured 2026-06-11, app-driven on/off x~20
|
||||
# format: <challenge_hex> <response_hex> (both 4 bytes, from page42/page43 payload bytes 3-6)
|
||||
9577DE9B C033B197
|
||||
1ADF97F8 F48604B6
|
||||
E09D5B01 44A5C15E
|
||||
DEA757A0 04DD9CBA
|
||||
8862C15F 29AA626F
|
||||
E14DB9AE 25373B94
|
||||
23A3ED5D 3250A48A
|
||||
F3A3B602 A6E58995
|
||||
FC5F3883 47780DAF
|
||||
16B2AE10 28FE5A23
|
||||
11C34FD9 6A1B9415
|
||||
2FFC637D 0A5CE05B
|
||||
DB284B0C 052D2687
|
||||
FA14432F 71EDD5F4
|
||||
B140D087 356CFD45
|
||||
20337B7E 81D3136A
|
||||
968F0543 F91AB4A3
|
||||
28DA207A 781A423E
|
||||
AB4040DE 5B652F23
|
||||
7A3CA469 48DF5FCF
|
||||
AFDFBC25 2E52F019
|
||||
B7394203 C62B24EE
|
||||
ECA9CD68 361924A5
|
||||
83198E6B 7E9DF4D9
|
||||
4D3F6429 86793E68
|
||||
0804DD8B 953137D5
|
||||
E1525A39 1091BB17
|
||||
C77CAA9B F9746AAC
|
||||
B98C209C 46385C66
|
||||
BBE34815 F717E80E
|
||||
2DAA8E0C BB1CF451
|
||||
D4AAC54D FD806835
|
||||
E1ECB36C FE26F014
|
||||
BF066519 4F23CAAF
|
||||
DA8EF86C ED575807
|
||||
0FD2C9B9 6B0EF761
|
||||
4B192BC2 0DC60551
|
||||
A0421A64 54A5AD6D
|
||||
2BE06274 BD49B339
|
||||
8FF0B6E5 C18D49F2
|
||||
45FE7D5E 0A44BB97
|
||||
BAA07C27 54E5C64B
|
||||
Reference in New Issue
Block a user