Intro to UDS video - DEF CON 27 Car Hacking Village

In this technical deep dive at the DEF CON 27 Car Hacking Village (TransportHax), Aaron Cornelius from GRIMM provides a comprehensive guide to understanding and reverse engineering Unified Diagnostic Services (UDS / ISO 14229) across automotive CAN bus networks. He begins at 05:00 by explaining that while UDS standardizes high-level service requests, automotive manufacturers customize parameter identifiers, necessitating active bus interrogation to map functionality.

Aaron walks through ISO-TP (ISO 15765-2) network layer framing at 10:00, contrasting single-frame requests with multi-frame segmented packets used to transfer larger data buffers across eight-byte CAN payloads. At 15:00, he demonstrates techniques for scanning unknown CAN buses to enumerate active Electronic Control Units (ECUs), isolating diagnostic arbitration IDs, and querying software version identifiers.

Moving to active interaction at 20:00, Aaron explains diagnostic service handlers including RoutineControl (0x31) and DiagnosticSessionControl (0x10). He illustrates ECU fingerprinting at 25:00, showing how systematically cycling diagnostic sessions and observing physical resets (such as an infotainment display restarting) allows researchers to unambiguously correlate unseen CAN arbitration IDs with specific hardware modules inside the car. (AI summary — Gemini Flash)