The Renault Clio circa 2016 is a worthy enough machine. But exciting? Not so much. Until now, that is, thanks to a cybersecurity outfit in the UK, Pen Test Partners, that has converted just one such mainstream shopping machine into a driving game controller by intercepting CAN bus data (via The Reg). Oh, and yes, the car can still be driven. But preferably not while playing games.
While a 2016 Renault Clio is hardly the last word in bleeding-edge automotive tech, it is new enough to have sensors where it matters—on the steering, the brakes and the throttle pedal. And that means there's data flying around the car whenever you use those controls.
Pen Test Partners tapped into the Clio's Can bus, which is the primary data system used by modern cars. They accessed the Body Control Module (BCM) by tapping directly into the CAN wires using a wire splicer.
"The splicers are cheap products that just cut away a tiny bit of insulation from the wires and allow a tap to be made. They are often used for adding third party products to cars (e.g. monitoring black boxes) and can be bought from a number of places. Mine came directly from Amazon," says David Lodge of Pen Test Partners. Not exactly rocket science, then.
Well, not yet. Identifying what messages are sent when using the steering wheel, brake and throttle was the first problem.
"Some time in the hack car moving the steering wheel and pressing the pedals allowed me to identify the arbitration IDs and which bits of data were used for each state. I’m not going to go too far into the CAN protocol here, in essence, once you get the electrical state right and know the bus speed (which I used a Kvaser Leaf Pro for), a standard CAN packet consists of an 11 bit arbitration ID, 8 octets of data and a selection of flags and metadata about the packet," Lodge explains.
Well, obvs!
"Because CAN packets are so small (8 octet payload) and there are only a small number of arbitration IDs (0x800, or 2048 in decimal) and smaller arbitration IDs have a higher priority, often messages go down to specific bits within the packet. Several CAN database formats refer to the packet as a stream of bits rather than using octets, but my mind works in octets," he explains.
Me too, David, me too.
If that's the signals decoded, final step is feeding them into a game somehow. "Making the CAN messages do something required a translation method, I could patch the SuperTuxKart source to take controller input from CAN, but this would have taken quite a bit of time and required a full build environment. So I cheated found an easy route," Lodge says.
He used the Python module pynput to issue input device events but found the casr's CAN bus system was actually too fast. "When testing I steered, it then pressed that key for every packet, leading to hundreds of key presses for each event, with SuperTuxKart lagging way behind the CAN bus," he says.
After filtering the outputs from the Can bus to make them usable, the last major problem was the steering. "Steering though, steering was my bane," Lodge says. "We weren’t engaging the engine, the power steering wasn’t engaged. We also had the car’s tyres on a physical floor and as there was a mechanical link to the front wheels, they always moved.
"I didn’t want to tear up the tyres or the floor, so I made the steering threshold relatively small (< 0x8030 was right, > 0x80d0 was left). This mostly worked, except for a couple of people who tried to steer like it was a car which must’ve been hard to do and probably took off quite a bit of rubber from the tyres," he explains.
For the future, there are some details Pen Test Partners would like to add. "SuperTuxKart has weapons which could be fired. I really hoped I could put in a control for these, ideally the horn. Unfortunately the Clio uses LIN to manage the controls on the steering wheel and the horn doesn’t use CAN."
Lodge also says that sending messages to the instrument cluster to show speed "would’ve been the cherry on the top," but he ran out of time. That said, next time, Lodge wants to do something slightly different. "Anybody got a cheap motorcycle they want to sell?" Watch this space. And the road, if you're driving.
