AI
The Market for Odometer Manipulation Devices
Odometers set used-car prices. Two identical cars with the same year, make, and model diverge in value purely on mileage, because higher mileage means worn consumables. The assumption had been that modern vehicles made rollback impossible. A discussion on an automotive forum changed that. A European web store was openly selling devices for €300 to €600 that don’t roll back the odometer. Instead, they prevent the count from incrementing at all. The store covered 53 different makes, offered configurable modes, fractional mile recording, and a Bluetooth app. They did not ship to the US.
A Man-in-the-Middle Device on the CAN Bus
Collin bought one of the devices. It arrived as a small PCB wired into a harness with matching connectors on both ends, designed to sit between the instrument panel cluster and the rest of the vehicle. That man-in-the-middle position gives full control over CAN bus traffic in either direction. Inside: an STM32 microcontroller, power circuitry stepping 15 volts down to 3.3, and two CAN transceivers, one for each side of the connector. Installation means unplugging the original cluster connector and inserting the device inline.
Breaking STM32 Flash Read Protection
STM32 flash read protection returns zeros instead of actual data when a debugger is connected. Collin found the solution in a paper called “One Exploit to Rule Them All,” which documents five or six attacks for extracting protected flash. The technique: a Raspberry Pi Pico running code from GitHub user CTXZ power-cycles the STM32 for roughly 2 microseconds. That clears the debugger lock while SRAM retains its payload. A flash patch block then redirects the entry point to stage-2 code in RAM, which dumps flash contents over UART.
One Byte, One Message: The Firmware Logic
After loading the extracted binary in Ghidra with SVD loader handling peripheral labels, Collin traced execution from the reset vector to the main loop. The logic lives in two hook functions that intercept CAN messages from both directions. When the device sees a specific arbitration ID and DLC, it checks its current mode, then modifies one byte: byte six, which Comma AI’s Open DBC project labels odo_count. Mode one zeros the byte. Other modes divide it by a configurable divisor, so a fraction of driven miles registers. The entire manipulation touches one field in one message.
Reading Diagnostics to Detect Fraud
Modern cars store odometer values on multiple ECUs, not just the instrument panel cluster. The gateway module and transmission controller each track mileage independently. Pulling a full diagnostic report and comparing those values can expose a manipulation. Collin found one example: a 2018 Jeep Grand Cherokee showed 19,000 miles on the dash but the secure gateway reported over 30,000. Engine hours and oil change reset counts are additional signals. Collin is still working on a formal set of detection indicators and plans to publish findings.
Q&A
Does newer STM32 hardware patch this extraction technique? Newer STM32s zero out RAM on boot, preventing the SRAM data-retention step the attack depends on. ▶ 19:17
How does one device support dozens of vehicle makes? Each device targets one specific vehicle; buyers need a separate unit per make and model. ▶ 19:38
Would an OEM software update disable the device? CAN message specs change rarely because so many ECUs depend on them, but a targeted update could break it. ▶ 23:26
How long did the full reverse engineering take? Collin dumped the firmware and reversed most of it in a single day. ▶ 24:59
Notable Quotes
really quite a fraudulent feature. It Collin · ▶ 3:17
just modifies one bite of the message Collin · ▶ 15:16
this is so unprotected in my opinion. Collin · ▶ 24:46
Key Takeaways
- One modified CAN byte prevents odometer increments; no encryption or authentication protects the target message.
- STM32 flash read protection falls to a 2-microsecond power glitch combined with SRAM data retention and a flash patch block redirect.
- Comparing odometer values across ECUs can detect fraud: a 2018 Jeep Grand Cherokee showed an 11,000-mile discrepancy between the dash and the secure gateway.