Security Analysis Toolkit For Car Protocols – CANalyzat0r

CANalyzat0r is a Python software project built from scratch with new ideas for analysis mechanisms.

Why CANalyzat0r?

Need for Strive for smart cars were a fast-growing amount of components are interconnected within a single car unit resulted in specialized proprietary car protocols.

However, often no or insufficient authentication and encryption or other security mechanisms can be found in today’s car systems. For this reason, there’s a need for open source, extensible, easy to use and publicly available software to analyze the security state of such networks and protocols.

Speciality of CANalyzat0r

CANalyzat0r is bundled with many features of other CAN tools in one place. Also, it’s GUI based and organized with one tab per specific analysis task

Tool Installation:

Run sudo ./install_requirements.sh along with sudo -E ./CANalyzat0r.sh. This will create a folder called pipenv with a pipenv environment in it.
Or just use the docker version which is recommended at this time (Check the README.md file in the subdirectory)

For more information, read the HTML or PDF version of the documentation in the ./doc/build folder.

Features

Manage interface configuration (automatic loading of kernel modules, manage physical and virtual SocketCAN devices)
Multi interface support
Manage your work in projects. You can also import and export them in the human readable/editable JSON format
Logging of all actions
Graphical sniffing
Manage findings, dumps and known packets per project

Add multiple analyzing threads on the GUI
Ignore packets when sniffing – Automatically filter unique packets by ID or data and ID
Compare dumps
Allows setting up complex setups using only one window
Clean organization in tabs for each analysis task
Binary packet filtering with randomization
Search for action specific packets using background noise filtering
SQLite support
Fuzz and change the values on the fly

Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks.