Skip to content

Modern Odometer Manipulation

collinoblivion

Reverse engineers a commercial odometer rollback tool, extracting locked STM32 firmware and showing how CAN messages are intercepted and rewritten.

Summary

The Underground Market for Odometer Fraud

Commercial odometer manipulation tools sold on automotive forums claim compatibility with dozens of vehicle brands, enabling illicit mileage rollbacks that undermine vehicle valuation and consumer safety.

Hardware Teardown and Glitch Extraction

Analyzing a commercial inline manipulation tool revealed an STM32 microcontroller wired directly between the vehicle's instrument cluster and the primary CAN bus harness. Researchers extracted internal flash from the protected microcontroller using open-source hardware exploit techniques.

Reverse Engineering Binary Interception Logic

Decompiling the extracted firmware showed how the device intercepts broadcast CAN speed and distance frames, modifying payload bytes on the fly before forwarding altered values to the dashboard display.

Forensic Detection and Removal Traces

While the inline device alters visual display readings, residual mileage data stored across secondary control units (such as transmission and ABS modules) allows forensic investigators to detect prior odometer tampering.

Related talks

Main Stage·14 min

  • DEF CON
  • Hardware
  • Date: Aug 2025
  • Location: Las Vegas

Archwisp

Explores the evolution of vehicular emissions inspections from physical tailpipe sniffers to OBD-II queries and demonstrates how testing logic can be bypassed.

automotivecan-bushardware+2