AI
The Readiness Monitor Trap
Archwisp moved from Kansas City to the West Coast with a Mazda RX-8 that had its catalytic converter removed. The collectible vehicle exemption required a second daily-driver car. Reinstalling the converter triggered readiness monitors that would not clear after months of driving. The ECU needed a specific drive cycle with the air conditioner off in the desert. That failure led to reverse engineering the OBD-II CAN bus.
Reverse Engineering CAN Bus Authentication
The OBD-II protocol uses authentication IDs 0 through 8. ID 0 is the ECU. Archwisp built a breadboard with a logic analyzer and an AC coupling circuit to capture the differential CAN signal. The signal never goes near zero volts; it sits at +2.5V. A capacitor rounds the square wave. With a $6 transceiver and an ESP32, he could send and receive frames. The scanner sends a request; the ECU must respond with the correct PID data.
AI Coding Agents and the Proxy
Archwisp tried an AI coding agent to write the proxy firmware. The agent handled register reads and debugging well but thought about hardware like a high school student who read one book. It convinced him his understanding was wrong. He abandoned the original design. The ESP32’s built-in CAN controller is a pseudo-copy of the SJA1000 and hides timing details. He switched to an external SPI-controlled MCP2515, which also allowed running multiple CAN buses on one board for proxying.
Live Demo and Code Release
The demo showed the RX-8 idling normally. The OBD-II scanner initially reported multiple incomplete monitors. Archwisp unplugged the scanner, inserted his proxy adapter, and reconnected. Within two minutes the scanner showed zero incomplete monitors and 11 ready. The device sits between the scanner and the ECU, responding as the ECU. He released the code and build instructions at the talk’s end.
Notable Quotes
malicious ignorance is about the best uh word I can or phrase I can come up with to describe that experience Archwisp · ▶ 08:51
thinks about hardware like a high school level kid who just read a book on hardware thinks Archwisp · ▶ 09:09
don’t listen to it Archwisp · ▶ 09:26
I chose specifically not to uh include any kind of uh active testing in this presentation. You can extrapolate from that what you want. Archwisp · ▶ 13:13
Key Takeaways
- CAN bus authentication on OBD-II uses IDs 0-8; spoofing the ECU is possible with an ESP32.
- AI coding agents can mislead hardware development; verify all generated code.
- A $6 transceiver and ESP32 can build a proxy that passes emissions testing.
About the Speaker(s)
Archwisp is a long-time tech nerd, car enthusiast, and hardware hacker.