wesandClaude Fable 5
b97401fec8
Tapped the X180T's CAN bus via CANable 2.0 at the monitor panel's terminator port. The bus is NOT RV-C — it's Lippert's proprietary IDS-CAN (250k, 11-bit IDs, (page<<8)|node, 1 Hz broadcasts). Read side fully mapped from live captures: - device classes (page-2 type byte: 0x0A tank, 0x1E switched load, 0x21 motor) - node map for this rig (Catalina 263BHSCK): tanks 27/E2/7D/FE, lights 2A/F8, heater 95, pump 61, awning 75 (+ direction & live motor current) - battery voltage on 29-bit extended frames Write side: commands are DLC-0 ext frames 0006<node><op>, but auth-gated by a rolling challenge-response (page 42/43). Replay confirmed dead (spoofed cansend did not actuate). Not the BLE TEA cypher. response=f(challenge) is deterministic (no session state) so crackable offline later — seeded 42 pairs in sniff/2A-auth-pairs.txt. Includes raw captures (sniff/*.log, force-added past *.log ignore), a read-only esp32_can ESPHome skeleton, and the log-can.sh sniff helper. Full writeup in canbus/README.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
46 lines
980 B
Plaintext
46 lines
980 B
Plaintext
# Lippert IDS-CAN command-auth challenge/response pairs
|
|
# node 2A (exterior lights), captured 2026-06-11, app-driven on/off x~20
|
|
# format: <challenge_hex> <response_hex> (both 4 bytes, from page42/page43 payload bytes 3-6)
|
|
9577DE9B C033B197
|
|
1ADF97F8 F48604B6
|
|
E09D5B01 44A5C15E
|
|
DEA757A0 04DD9CBA
|
|
8862C15F 29AA626F
|
|
E14DB9AE 25373B94
|
|
23A3ED5D 3250A48A
|
|
F3A3B602 A6E58995
|
|
FC5F3883 47780DAF
|
|
16B2AE10 28FE5A23
|
|
11C34FD9 6A1B9415
|
|
2FFC637D 0A5CE05B
|
|
DB284B0C 052D2687
|
|
FA14432F 71EDD5F4
|
|
B140D087 356CFD45
|
|
20337B7E 81D3136A
|
|
968F0543 F91AB4A3
|
|
28DA207A 781A423E
|
|
AB4040DE 5B652F23
|
|
7A3CA469 48DF5FCF
|
|
AFDFBC25 2E52F019
|
|
B7394203 C62B24EE
|
|
ECA9CD68 361924A5
|
|
83198E6B 7E9DF4D9
|
|
4D3F6429 86793E68
|
|
0804DD8B 953137D5
|
|
E1525A39 1091BB17
|
|
C77CAA9B F9746AAC
|
|
B98C209C 46385C66
|
|
BBE34815 F717E80E
|
|
2DAA8E0C BB1CF451
|
|
D4AAC54D FD806835
|
|
E1ECB36C FE26F014
|
|
BF066519 4F23CAAF
|
|
DA8EF86C ED575807
|
|
0FD2C9B9 6B0EF761
|
|
4B192BC2 0DC60551
|
|
A0421A64 54A5AD6D
|
|
2BE06274 BD49B339
|
|
8FF0B6E5 C18D49F2
|
|
45FE7D5E 0A44BB97
|
|
BAA07C27 54E5C64B
|