Advanced OBD-II diagnostic and security research toolkit for automotive penetration testing.
- Full OBD-II Protocol Support: All 10 diagnostic modes
- Multi-Protocol Detection: Auto-detect vehicle protocol
- PID Scanner: Enumerate supported PIDs
- DTC Management: Read/clear diagnostic trouble codes
- Live Data Streaming: Real-time sensor monitoring
- Security Research: Protocol fuzzing and analysis
- Custom Commands: Send arbitrary OBD-II requests
| Protocol | Standard | Description |
|---|---|---|
| CAN 11-bit | ISO 15765-4 | High-speed CAN (500 kbps) |
| CAN 29-bit | ISO 15765-4 | Extended addressing |
| K-Line | ISO 14230-4 | KWP2000 over K-Line |
| K-Line | ISO 9141-2 | Legacy protocol |
| J1850 PWM | SAE J1850 | Ford protocol |
| J1850 VPW | SAE J1850 | GM protocol |
# Install
git clone https://github.com/bad-antics/nullsec-obdii
cd nullsec-obdii
./install.sh
# Scan for vehicle
obdii-scan --interface can0
# Read DTCs
obdii-dtc --interface can0 --read
# Live data monitoring
obdii-live --interface can0 --pid 0x0C,0x0D,0x05| Mode | Name | Description |
|---|---|---|
| 01 | Current Data | Live sensor data |
| 02 | Freeze Frame | Snapshot at DTC trigger |
| 03 | Read DTCs | Stored trouble codes |
| 04 | Clear DTCs | Reset MIL and codes |
| 05 | O2 Sensors | Oxygen sensor tests |
| 06 | Test Results | On-board monitoring |
| 07 | Pending DTCs | Current drive cycle |
| 08 | Control | Actuator tests |
| 09 | Vehicle Info | VIN, ECU info |
| 0A | Permanent DTCs | Cannot be cleared |
- Protocol-aware fuzzing
- PID enumeration attacks
- Timing analysis
- Response fingerprinting
- ECU identification
- ELM327 (USB/Bluetooth/WiFi)
- CANtact / CANable
- PEAK PCAN-USB
- Kvaser Leaf Light
- SocketCAN interfaces
- Custom J2534 passthru
For authorized security research and educational purposes only. Always obtain proper authorization before testing on vehicles you do not own.
MIT License - Part of NullSec Linux v5.0
- Twitter: x.com/AnonAntics
- NullSec Linux: github.com/bad-antics/nullsec-linux