Vehicle CAN Analysis Using SavvyCAN and Flipper Zero

Modern cars are essentially rolling networks of specialized computers, all talking at once. Decoding this “noise” has traditionally required expensive, proprietary hardware and complex software suites. For many security researchers and hobbyists, the barrier to entry for CAN bus exploration is either too costly or too complex to set up in a mobile environment.

The challenge lies in visibility. While a standard sniffer might show you raw hex values, human-interpretable data remains locked behind proprietary protocols. To truly understand a car's behavior, you need two things: a portable way to connect to the bus and a way to decode those signals into real-world values like RPM, steering angle, or door status.

This tutorial demonstrates an open-source workflow for automotive reverse engineering. By leveraging the Flipper Zero equipped with the Electronic Cats CAN Bus Addon, we transform a pocket-sized multi-tool into a sophisticated serial to CAN bridge. We will then pipe this data into SavvyCAN, the open-source signal analysis software.

Without further ado, let's jump in.

The preps

We have already reviewed the CAN Bus app and how to connect the Add-On to your car in the past here: CAN Flipper hack a car?, so we will go straight to the point.

1. Flipper MCP2515 CAN Bus app

As mentioned above, a separate tutorial already provides a step-by-step guide on how to install the app. You can also find these instructions in the official documentation (CAN Bus app Wiki). For this tutorial, we will focus on the new features of the app and how they are used.

The latest update to the Flipper Zero CAN bus app introduces important performance improvements, most notably a USB-to-Serial bridge. This feature allows the Flipper Zero to operate as a real-time interface for SavvyCAN, enabling continuous CAN data streaming to a PC. In addition, the app now supports the SLCAN protocol, which allows both transmission and reception of CAN messages directly from SavvyCAN.

2. Flipper Zero and Electronic Cats CAN Bus Add-On

Our physical interface will consist of the Flipper Zero and the Electronic Cats Add-On. We will also use the OBD2 connector included with the Add-On.

3. SavvyCAN (Electronic Cats fork)

SavvyCAN is the software used to load, save, capture, and decode CAN bus frames. It is designed to assist with visualization, reverse engineering, debugging, and analysis of CAN bus data.

In this tutorial, we will use a SavvyCAN variant forked by Electronic Cats, which adds support for the Flipper Zero and the CAN Bus app. To install it, follow these steps:

3.1 Go to the repo: Electronic Cats SavvyCAN

3.2 Go to the releases section and download the latest version available. Note: this fork is only available for Windows and Linux machines.

3.3 Go to the path where you saved the downloaded.zip file and unzip it.

3.4 Run the SavvyCAN.exe file:

Note: if SavvyCAN asks for permission to access the local network, allow it; otherwise, the software will not be able to reach USB serial devices.

Once open, you will see a new window with too many blank spaces, but do not worry, as these will be filled soon.

In the image above, we have divided the main view of SavvyCAN into sections to make it easier to understand:

• Data visualization (orange): This section occupies most of the interface. It displays, in real time (if an ongoing session is happening), the data received and transmitted by the software, organized into columns such as frame ID, direction (RX or TX), frame length, and the data payload.
• Control section (blue): This area shows session-related information such as the total number of captured frames and the frames per second during real-time capture. It also includes buttons and checkboxes used to control the capture session.
• Interpretation and filtering (green): This section is used to filter the captured data and apply interpretation files, such as loaded DBC files, to decode and analyze the CAN frames.

4. DBC file

Now that DBC files have been mentioned, let us briefly explain what they are.

According to Wikipedia, DBC files (CAN database files) are standardized ASCII files used to describe messages transmitted over a CAN bus. They define the message structure and purpose, including message IDs, signal names, scaling factors, offsets, and data types. In practice, DBC files allow CAN data to be decoded from raw hexadecimal values into a human-readable format.

DBC files can be difficult to obtain, depending on the vehicle or device being analyzed. As a starting point, you can refer to open-source projects such as OpenDBC. For this tutorial, we used DBC files shared in a public repository, but you can search online for additional files if needed.

SavvyCAN supports loading multiple DBC files simultaneously. This allows you to import a full set of DBC files instead of manually identifying the correct one. File import will be covered later in this tutorial. You can also refer to the official SavvyCAN documentation for additional details.

5. Other things you require.

• A compatible car. Electronic Cats Add-On v1.X is incompatible with CANFD, so some modern cards may not be compatible.
• A computer/laptop to run SavvyCAN.
• A USB-C cable.

Hands On

Now that we have covered the required components, we can proceed to the test and explain how to use the Flipper Zero with the Add-On as a bridge between the vehicle and SavvyCAN.

1. Readdata from your car.

There are multiple ways to perform this task, thanks to the capabilities of the CAN Bus app. In this tutorial, we will use one specific method, but we encourage you to explore the app and try the other available options.

In this case, we first need to configure SavvyCAN to communicate with the Flipper Zero. To do this, follow the instructions below:

1.1 Plug your Flipper Zero into your computer and open the CAN Bus app. Opening the app will create a second serial port in the Flipper Zero as previously mentioned.

1.2 Open SavvyCAN (Electronic Cats fork).

1.3 In SavvyCAN, go to: Connection > Open Connection Window, which will open a new window.

1.4 Click on "Add New Device Connection", in this new window, select:

1.5 Save the changes by clicking on Create New Connection.

1.6 You can close the Connection Setting window.

1.7 Go to YOUR CAR and look for the OBD2 connector. Refer to your car's user manual for more information about the OBD2 connector location.

1.8 Plug the OBD2 adapter included with the Add-On to the car's connector. Note: If you have not connected the wires of the OBD2 adapter to the Add-On, it is a great time to do it. White for CAN High and black for CAN Low.

1.9 In the CAN Bus app in the Flipper, open the Sniffing option and select Yes when asked to relay the messages received via SLCAN.

1.10 The Sniffing session will start right away, and you will see the updates in SavvyCAN.

As shown in the GIF above, we enabled the options in SavvyCAN to overwrite values for the same CAN bus ID and to activate autoscroll.

In this use case, the Flipper device with the CAN Bus Add-On captured only two CAN IDs. Even so, these IDs contain relevant data and will be analyzed in the following steps.

We recommend saving the sniffing session once you suspend it, either for later analysis or before continuing to the next section.

2. Analyzing the data

SavvyCAN can analyze data from live sessions, suspended sessions, or imported logs. Imported logs use CSV files with a specific format.

In addition to real-time communication, as shown above, the Flipper device can replay previously stored sessions from its internal memory (if log saving was enabled). This is done by selecting Read LOG in the CAN Bus app, choosing a log file, and then using either Export log as CSV or Transmit log to SLCAN.

Now that the different methods for importing data have been defined, we can move on to interpreting and analyzing the captured information.

Note: In this tutorial, the sniffing session was performed in real time and displayed directly on the computer. The session was then saved in SavvyCAN for later analysis.

2.1 Open SavvyCAN and import the sniffing session, or continue with an ongoing sniffing session.

2.2 Import your DBC files to start interpreting the CAN. To do this in SavvyCAN, go to: File > DBC File Manager, this open a new window.

2.3 To import the DBC files, use the Load button and select the file stores in your computer. You can add multiple DBC files one by one in case you have multiple files from the same manufacturer or have sniffed different cars in a single session.

Note that the Associated Bus value is shown as -1. This is expected, as we are analyzing a previously captured sniffing session rather than an active session.

As mentioned earlier, finding compatible DBC files can be challenging, since manufacturers typically keep this information private. However, the community has reverse-engineered and shared DBC files for several vehicles. You can also contribute to projects such as OpenDBC to help expand available coverage.

In this use case, the data was captured from a Dodge Attitude (2006). No direct DBC files were found for this model. Further investigation showed that this vehicle was also sold under the Hyundai brand as the Accent model. Since OpenDBC provides multiple DBC files for Hyundai vehicles, those files were used for the analysis.

2.4 Save the changes in the DBC File Manager by simply closing this Window.

2.5 In the main view of SavvyCAN, tick the Interpret Frames checkbox and click on the Expand All Rows.

As shown in the screenshot, once the data is interpreted and expanded, the information captured by the Flipper can be read in a human-readable format. You may notice minor issues, such as missing spaces or unexpected symbols, but these are normal and not a cause for concern.

Interpreting the data

Now, let us review the captured data. As mentioned earlier, this use case includes only two CAN IDs. In other scenarios, you may be able to capture multiple CAN IDs and obtain more detailed and meaningful information.

3.1 Understanding CAN ID0x316

This is the data obtained from the same CAN ID on three different timestamps. Here is a breakdown of what we may be seeing:

• Message name: EMS11, likely source: Engine Management System (ECU)
• SWI_IGK:1 = Ignition ON
• F_N_ENG:0 = Engine speed signal valid
• ACK_TCS:0 = Traction control not intervening
• PUC_STAT:0 = Normal operation of the Powertrain Unit Control status flag. There are no restrictions or protective modes active
• TQ_COR_STAT: 0 = No torque correction active
• RLY_AC: 0 = Air conditioning clutch OFF
• F_SUB_TQI: 0 = No substitute torque mode
• TQI_ACOR: 5.47 % → 5.08 % = Torque after correctionsThe small variation between frames 1/2 and frame 3 is a normal idle fluctuation
• N: 770–772 rpm = Normal idle speed
• TQI: 5.86 % = Actual indicated engine torque (low, expected at idle)
• TQFR: 8.20 % = Requested or reference torque
• VS: 0 km/h = car speed, stopped
• RATIO_TQI_BAS_MAX_STND: 0 = No torque limitation active

With this data, we can conclude the car was in an idle status, and no issues were observed during this status, indicating a stable functionality of the car overall.

3.2 Understanding CAN ID0x329

This is the data obtained from the same CAN ID on three different timestamps. Here is a breakdown of what we may be seeing:

Note: all three timestamps show identical data.

• Message name: EMS12, likely source: Engine Management System (ECU) showing engine configuration, torque standardization, environmental compensation, and driver input status.
• MUL_CODE: 3 = Engine/calibration variant selector. Value 3 identifies the active engine map or regional configuration.
• TQ_STND: 190 Nm = Standardized reference torque used internally by the ECU. This is not the actual torque output, but a normalization value for torque calculations.
• TEMP_ENG: 74.25 deg = Engine coolant temperature in degrees Celsius. This is consistent with a warm engine, below full operating temperature.
• MAF_FAC_ALTI_MMV: 0.79662 = Air mass correction factor based on altitude/pressure. A value below 1 indicates air density compensation, likely due to elevation or ambient conditions.
• VB_OFF_ACT: 0 = Voltage backup or voltage-off strategy inactive.
• ACK_ES: 0 = No acknowledgment from electronic stability systems.
• CONF_MIL_FMY: 4 = Emissions / MIL configuration family identifier. Used for diagnostics and regulatory logic.
• OD_OFF_REQ: 0 = Overdrive OFF not requested.
• ACC_ACT: 0 = Cruise control inactive.
• CLU_ACK: 0 = Clutch input not active (or automatic transmission logic inactive).
• BRAKE_ACT: 0 = Brake pedal not pressed.
• ENG_CHR: 0 = No engine charging or load-increasing condition active.
• GP_CTL: 0 = Glow plug control inactive (normal for gasoline engine).
• TPS: 1e-06 % = Throttle position effectively 0%, confirming idle or closed throttle.
• PV_AV_CAN: 99.603 % = Average available engine power. Near 100% indicates no power limitation.
• ENG_VOL: 1.4 liter = Engine displacement.

Based on the data, we can determine that the car is in a normal idle condition. The ignition is on, the engine is running steadily at around 770 rpm, and the vehicle is stationary with the throttle fully closed and no brake, clutch, or cruise control activity. The coolant temperature of about 74 °C indicates the engine is warm but not yet fully stabilized at normal operating temperature, as expected for an idle car. Torque and power signals are low and stable, with no torque correction, limitation, or stability intervention active, and available power is near maximum. Confirming a stable ECU state.

Conclustion

This analysis demonstrates how meaningful and detailed information about a vehicle can be obtained from a very small subset of CAN traffic. With only two data frames, it is possible to extract multiple parameters, showing that a single CAN frame does not represent just one data point but rather a compact container of many signals describing the vehicle’s real-time behavior.

Thanks to the combination of SavvyCAN for CAN data capture and analysis, together with DBC files to interpret the raw frames into human-readable signals. The hardware setup, using a Flipper Zero with the Electronic Cats CAN Add-On, acting as an OBD2/CAN bridge between the vehicle and the computer, proved to be an effective and flexible solution for sniffing and analyzing automotive CAN traffic without intrusive modifications.

An especially important aspect of this process is the role of the open-source community, particularly when it comes to DBC files. Without community-shared or reverse-engineered DBCs, CAN frames would remain largely opaque byte streams with no clear meaning. Community collaboration is often the key factor that enables understanding, validation, and further research into vehicle networks.

For this reason, anyone interested in automotive electronics, reverse engineering, or vehicle diagnostics is encouraged to try similar analyses on their own vehicles, when done responsibly and safely, and to share their findings with the community. Contributing DBC files, signal interpretations, or even interesting tools and workflows helps expand collective knowledge and makes automotive CAN analysis more accessible to everyone.