[GH-ISSUE #3725] [Feature] Software-defined vehicle reverse engineering: AUTOSAR Adaptive, SOME/IP, DDS, DoIP, UDS and service graphs #1437

New issue

Open

opened 2026-10-16 21:05:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:25 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3725

Problem Statement & Context

Modern automotive systems are transitioning from hardware-centric microcontrollers to Software-Defined Vehicles (SDV) governed by high-performance Electronic Control Units (ECUs), vehicle computers, and service-oriented architectures (SOA):

AUTOSAR Adaptive Platform & CAPI (Common Application Programming Interface): C++ application framework standardizing communication management (ara::com), execution management (ara::exec), and diagnostic services.
Service-Oriented Protocols (SOME/IP & SOME/IP-SD): Scalable service-Oriented MiddlewarE over IP handling service discovery, remote procedure calls, events, and field notifications over automotive Ethernet.
Data Distribution Service (DDS): Publish/subscribe middleware for real-time sensor streams (radar, LiDAR, camera feeds, telematics).
Diagnostics over IP (DoIP) & Unified Diagnostic Services (UDS / ISO 14229): Diagnostics framing over TCP/UDP used for ECU flashing, calibration, and security routines.
Machine & Application Manifests (.arxml): AUTOSAR XML manifests declaring process startup configs, service deployment bindings, and access control policies.

Reverse engineering an automotive ECU binary or vehicle network capture currently requires fragmented tools. REA needs a dedicated SDV semantic engine capable of parsing SOME/IP and DDS traffic, decompiling ara::com bindings, and reconstructing vehicle service graphs.

Proposed Architecture

flowchart TD
    A["Vehicle Capture (PCAP Ethernet / DoIP) / ECU Firmware (.arxml, C++ binaries)"] --> B["Software-Defined Vehicle Semantic Engine"]
    B --> C["AUTOSAR Manifest & C++ Binding Analyzer"]
    B --> D["SOME/IP & Service Discovery Slicer"]
    B --> E["DDS & Real-Time Sensor Stream Decoder"]
    B --> F["DoIP & UDS Diagnostic Flow Reconstructor"]
    
    C --> C1[".arxml Manifest Parser (Service Interfaces, Endpoints)"]
    C --> C2["ara::com Proxy & Skeleton Decompilation"]
    
    D --> D1["SOME/IP-SD (Service Discovery: Find, Offer, Subscribe)"]
    D --> D2["SOME/IP Message Serialization (RPC Calls, Return Codes, Events)"]
    
    E --> E1["RTPS / DDS Topic & Partition Discovery"]
    E --> E2["CDR (Common Data Representation) Deserialization"]
    
    F --> F1["DoIP Routing Activation & Header Slicing"]
    F --> F2["UDS Services (DiagnosticSessionControl, ReadDataByIdentifier)"]
    
    C & D & E & F --> G["Synthesized Vehicle Service Graph & Diagnostic Topology"]

Technical Capabilities & Modules

AUTOSAR Manifest & Binary Modeling:
- Parse AUTOSAR Adaptive XML (.arxml) manifests: service interfaces, methods, fields, events, deployment port configurations, and process startup configurations.
- Decompile native C++ binaries using ara::com: identify Proxy classes (service consumers) and Skeleton classes (service providers).
SOME/IP & Service Discovery Analysis:
- Dissect SOME/IP binary headers: Message ID (Service ID + Method/Event ID), Request ID, Protocol Version, Interface Version, Message Type (Request, Request_No_Return, Notification, Response, Error).
- Parse SOME/IP-SD packets: track Service Offers, Service Finds, Eventgroup Subscriptions, and endpoint IP/port mappings.
- Reconstruct serialized payload arguments (primitive types, dynamic arrays, structs).
DDS & RTPS Protocol Dissection:
- Parse Real-Time Publish-Subscribe (RTPS) protocol frames: GUID prefixes, topic names, partition strings, and participant announcements.
- Deserialize OMG Common Data Representation (CDR) payload formats.
DoIP & UDS Diagnostic Flow Analysis:
- Parse DoIP (ISO 13400) headers: routing activation, diagnostic messages, alive checks.
- Dissect UDS diagnostic request/response pairs:
  - 0x10: DiagnosticSessionControl.
  - 0x22: ReadDataByIdentifier (DID mappings).
  - 0x27: SecurityAccess challenge/response sequences.
  - 0x2E: WriteDataByIdentifier.
  - 0x31: RoutineControl.
Vehicle Service Graph Reconstruction:
- Synthesize an interactive service graph depicting which ECUs produce or consume specific vehicle services (e.g. Steering, Powertrain, ADAS, Infotainment).

Acceptance Criteria

Automated dissection of SOME/IP, SOME/IP-SD, and DoIP network captures.
Parsing of AUTOSAR Adaptive .arxml manifests and correlation with native C++ binaries.
Decoding of UDS diagnostic service sessions and DID parameter values.
Reconstruction of DDS pub/sub topics and CDR payload structures.
Generation of an end-to-end vehicle service interaction graph.

Complements #3641 (USB protocol reverse engineering)
Complements #3626 (Windows kernel driver reverse engineering: IOCTL correlation)
Complements #3698 (Interactive entertainment runtime and asset reverse engineering tracker)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3725 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context Modern automotive systems are transitioning from hardware-centric microcontrollers to **Software-Defined Vehicles (SDV)** governed by high-performance Electronic Control Units (ECUs), vehicle computers, and service-oriented architectures (SOA): - **AUTOSAR Adaptive Platform & CAPI (Common Application Programming Interface)**: C++ application framework standardizing communication management (`ara::com`), execution management (`ara::exec`), and diagnostic services. - **Service-Oriented Protocols (SOME/IP & SOME/IP-SD)**: Scalable service-Oriented MiddlewarE over IP handling service discovery, remote procedure calls, events, and field notifications over automotive Ethernet. - **Data Distribution Service (DDS)**: Publish/subscribe middleware for real-time sensor streams (radar, LiDAR, camera feeds, telematics). - **Diagnostics over IP (DoIP) & Unified Diagnostic Services (UDS / ISO 14229)**: Diagnostics framing over TCP/UDP used for ECU flashing, calibration, and security routines. - **Machine & Application Manifests (`.arxml`)**: AUTOSAR XML manifests declaring process startup configs, service deployment bindings, and access control policies. Reverse engineering an automotive ECU binary or vehicle network capture currently requires fragmented tools. REA needs a dedicated SDV semantic engine capable of parsing SOME/IP and DDS traffic, decompiling `ara::com` bindings, and reconstructing vehicle service graphs. ### Proposed Architecture ```mermaid flowchart TD A["Vehicle Capture (PCAP Ethernet / DoIP) / ECU Firmware (.arxml, C++ binaries)"] --> B["Software-Defined Vehicle Semantic Engine"] B --> C["AUTOSAR Manifest & C++ Binding Analyzer"] B --> D["SOME/IP & Service Discovery Slicer"] B --> E["DDS & Real-Time Sensor Stream Decoder"] B --> F["DoIP & UDS Diagnostic Flow Reconstructor"] C --> C1[".arxml Manifest Parser (Service Interfaces, Endpoints)"] C --> C2["ara::com Proxy & Skeleton Decompilation"] D --> D1["SOME/IP-SD (Service Discovery: Find, Offer, Subscribe)"] D --> D2["SOME/IP Message Serialization (RPC Calls, Return Codes, Events)"] E --> E1["RTPS / DDS Topic & Partition Discovery"] E --> E2["CDR (Common Data Representation) Deserialization"] F --> F1["DoIP Routing Activation & Header Slicing"] F --> F2["UDS Services (DiagnosticSessionControl, ReadDataByIdentifier)"] C & D & E & F --> G["Synthesized Vehicle Service Graph & Diagnostic Topology"] ``` ### Technical Capabilities & Modules 1. **AUTOSAR Manifest & Binary Modeling:** - Parse AUTOSAR Adaptive XML (`.arxml`) manifests: service interfaces, methods, fields, events, deployment port configurations, and process startup configurations. - Decompile native C++ binaries using `ara::com`: identify Proxy classes (service consumers) and Skeleton classes (service providers). 2. **SOME/IP & Service Discovery Analysis:** - Dissect SOME/IP binary headers: Message ID (Service ID + Method/Event ID), Request ID, Protocol Version, Interface Version, Message Type (Request, Request_No_Return, Notification, Response, Error). - Parse SOME/IP-SD packets: track Service Offers, Service Finds, Eventgroup Subscriptions, and endpoint IP/port mappings. - Reconstruct serialized payload arguments (primitive types, dynamic arrays, structs). 3. **DDS & RTPS Protocol Dissection:** - Parse Real-Time Publish-Subscribe (RTPS) protocol frames: GUID prefixes, topic names, partition strings, and participant announcements. - Deserialize OMG Common Data Representation (CDR) payload formats. 4. **DoIP & UDS Diagnostic Flow Analysis:** - Parse DoIP (ISO 13400) headers: routing activation, diagnostic messages, alive checks. - Dissect UDS diagnostic request/response pairs: - `0x10`: DiagnosticSessionControl. - `0x22`: ReadDataByIdentifier (DID mappings). - `0x27`: SecurityAccess challenge/response sequences. - `0x2E`: WriteDataByIdentifier. - `0x31`: RoutineControl. 5. **Vehicle Service Graph Reconstruction:** - Synthesize an interactive service graph depicting which ECUs produce or consume specific vehicle services (e.g. Steering, Powertrain, ADAS, Infotainment). ### Acceptance Criteria - [ ] Automated dissection of SOME/IP, SOME/IP-SD, and DoIP network captures. - [ ] Parsing of AUTOSAR Adaptive `.arxml` manifests and correlation with native C++ binaries. - [ ] Decoding of UDS diagnostic service sessions and DID parameter values. - [ ] Reconstruction of DDS pub/sub topics and CDR payload structures. - [ ] Generation of an end-to-end vehicle service interaction graph. ### Related Issues & Dependencies - Complements #3641 (USB protocol reverse engineering) - Complements #3626 (Windows kernel driver reverse engineering: IOCTL correlation) - Complements #3698 (Interactive entertainment runtime and asset reverse engineering tracker)

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:11:25 +00:00

[PR #1437] [MERGED] fix(javascript): preserve effects through yielded array references #2886