Endpoints
ISO-TP TX/RX pairs across the standard 11-bit range and the 29-bit range, with an optional exhaustive search.
Engine · Enumeration
Know every door into the ECU.
Before you can secure an ECU, you need to know its full diagnostic surface. AutoST enumerates endpoints, sessions, services and data identifiers over UDS, and tells you which ones are risky.
In short
The enumeration engine is a non-destructive discovery scan over UDS (ISO 14229). It finds ISO-TP endpoints across the 11-bit and 29-bit ranges, discovers diagnostic sessions (0x10) including extended and programming, sweeps every service ID from 0x00 to 0xFE in each session and classifies the response, reads data identifiers (0x22, the 0xF180-0xF19F range by default or the full 0x0000-0xFFFF space), and discovers XCP and CCP calibration interfaces. Each risky service is scored against a configurable weighting.
What it does
Discovery, end to end
AutoST probes the bus the way a specialist would, only exhaustively and in minutes.
- endpoint discovery: 11-bit 0x700-0x7FF + 29-bit range
- 10 03session
- 50 03 extended session
- service sweep: SID 0x00-0xFE in each session
- 22 F1 90read DID
- 62 F1 90 VIN readable
- 31 .. 33 RoutineControl: securityAccessDenied
- XCP CONNECT swept from 0x600, CCP station IDs 0x0-0x10
What AutoST finds
The full picture of an ECU
Sessions
Default, extended and programming sessions, with robust entry and safe handling of ECUs that get stuck in programming.
Services
Every SID probed and classified: supported, security-access denied, not supported in session, conditions not correct, or not supported.
Data identifiers
Readable DIDs with their decoded values, either the identification range or the full identifier space.
XCP & CCP
Calibration interfaces exposed on CAN or CAN FD, a frequent and high-impact finding.
Risk flags
Risky services (ECU reset, routine control, memory access, request download) flagged and scored automatically.
FAQ
Frequently asked questions
Is enumeration safe to run?
Enumeration is non-destructive: it discovers and reads, it does not write or fuzz. The programming session is tested last and can be skipped, because some ECUs get stuck in it.
How many services does it check?
It probes every service ID from 0x00 to 0xFE in each discovered session and classifies each one from its response code.
What about data identifiers?
By default AutoST reads the identification DID range (0xF180-0xF19F). An exhaustive mode covers the full 0x0000-0xFFFF space, roughly ten minutes per session.
See it on your ECU
Run AutoST on your own ECU
In one hour we scope a pilot: your bench, your protocols, the targets and what success looks like.
- A concrete test plan for your setup
- Works on CAN, CAN FD, DoIP and SOME/IP
- NDA on request before we start
Your demo is withTom ZaubermannFounder of Zyberum, ex-lead of the VW InCar Security Testing Lab
Already trusted by Tier 1, Tier 2 suppliers and OEMs. References on request.
Or send us a message
We reply within one business day.