Skip to content

Commit 94fb470

Browse files
authored
Merge pull request #1858 from polybassa/ccp
CCP protocol implementation
2 parents e1087d4 + 53c59a0 commit 94fb470

File tree

4 files changed

+1635
-1
lines changed

4 files changed

+1635
-1
lines changed

doc/scapy/advanced_usage.rst

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1570,6 +1570,53 @@ Close the sockets::
15701570
socket0.close()
15711571
socket1.close()
15721572

1573+
CAN Calibration Protocol (CCP)
1574+
------------------------------
1575+
1576+
CCP is derived from CAN. The CAN-header is part of a CCP frame. CCP has to types
1577+
of message objects. One is called Command Receive Object (CRO), the other is called
1578+
Data Transmission Object (DTO). Usually CROs are sent to an ECU, and DTOs are received
1579+
from an ECU. The information, if one DTO answers a CRO is implemented through a counter
1580+
field (ctr). If both objects have the same counter value, the payload of a DTO object
1581+
can be interpreted from the command of the associated CRO object.
1582+
1583+
Creating a CRO message::
1584+
1585+
CCP(identifier=0x700)/CRO(ctr=1)/CONNECT(station_address=0x02)
1586+
CCP(identifier=0x711)/CRO(ctr=2)/GET_SEED(resource=2)
1587+
CCP(identifier=0x711)/CRO(ctr=3)/UNLOCK(key=b"123456")
1588+
1589+
If we aren't interested in the DTO of an ECU, we can just send a CRO message like this:
1590+
Sending a CRO message::
1591+
1592+
pkt = CCP(identifier=0x700)/CRO(ctr=1)/CONNECT(station_address=0x02)
1593+
sock = CANSocket(iface=can.interface.Bus(bustype='socketcan', channel='vcan0', bitrate=250000))
1594+
sock.send(pkt)
1595+
1596+
If we are interested in the DTO of an ECU, we need to set the basecls parameter of the
1597+
CANSocket to CCP and we need to use sr1:
1598+
Sending a CRO message::
1599+
1600+
cro = CCP(identifier=0x700)/CRO(ctr=0x53)/PROGRAM_6(data=b"\x10\x11\x12\x10\x11\x12")
1601+
sock = CANSocket(iface=can.interface.Bus(bustype='socketcan', channel='vcan0', bitrate=250000), basecls=CCP)
1602+
dto = sock.sr1(cro)
1603+
dto.show()
1604+
###[ CAN Calibration Protocol ]###
1605+
flags=
1606+
identifier= 0x700
1607+
length= 8
1608+
reserved= 0
1609+
###[ DTO ]###
1610+
packet_id= 0xff
1611+
return_code= acknowledge / no error
1612+
ctr= 83
1613+
###[ PROGRAM_6_DTO ]###
1614+
MTA0_extension= 2
1615+
MTA0_address= 0x34002006
1616+
1617+
Since sr1 calls the answers function, our payload of the DTO objects gets interpreted with the
1618+
command of our cro object.
1619+
15731620
ISOTP message
15741621
-------------
15751622

0 commit comments

Comments
 (0)