# LibreCAN: Automated CAN Message Translator > LibreCAN reverse-engineers proprietary CAN message formats from traffic recorded at a vehicle's OBD-II port, without the OEM's DBC translation files. Phase 0 extracts candidate signal boundaries from bit-flip behaviour, extending the earlier READ algorithm; Phase 1 correlates extracted signals with standard OBD-II PIDs and smartphone IMU data to identify kinematic signals and estimate their scale and offset; Phase 2 filters the CAN IDs recorded while a driver performs 53 scripted body-related events to shortlist candidate IDs for each event. - Authors: Mert D. Pesé; Troy Stacer; C. Andrés Campos; Eric Newberry; Dongyao Chen; Kang G. Shin - Venue: ACM CCS 2019 - Status: Conference paper - Publication / posting date: November 6, 2019 - Date source: ACM's Crossref deposit gives 2019-11-06 for both print and online publication. The November 11–15 conference dates are not substituted. - DOI: 10.1145/3319535.3363190 - Sources reviewed: 2026-10-27 - Added to the catalog: 2026-11-03 - Original paper: - PDF: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-librecan/index.md) ## Scope and limitations Evaluated on four newer vehicles from a single OEM, using DBC files the authors obtained as ground truth and their own judgement of which CAN signals correspond to each reference signal; they call the evaluation partly subjective because the OEM was not involved. Phase 0 recovered 51.6–62.4% of DBC signals, but only 21.0–36.4% of extracted signals had correct boundaries, partly because normal driving rarely exercises high value ranges. With extracted boundaries, Phase 1 precision was 61.1–78.1% and recall 25.6–57.3%; Phase 2 cut candidates more than tenfold, with 8.5–15.0% precision. Only buses reachable through OBD-II were analysed, so signals on other buses were missed. The system reads traffic only and recovers a partial translation table, not complete DBC files, ECU logic or validated injection. ## Why it fits this collection Adds automated reverse engineering of proprietary in-vehicle CAN message formats from passive traffic and reference signals, complementing the catalog's CAN tooling and network-protocol inference research. ## Publication and review notes Crossref records the title LibreCAN with the subtitle Automated CAN Message Translator, the six-author order and pages 2283–2300. The 18-page copy on the University of Michigan Real-Time Computing Laboratory site is an ACM-formatted author version created on 2019-09-25. The paper reports roughly 40 minutes of manual data collection (a 30-minute drive and a 10-minute event session) and 70–79 seconds of computation per vehicle; its 10-participant event-recording study received IRB approval. Data came from an ELM327 dongle, an OpenXC dongle on a Y-cable and the Torque Pro Android app, and computation used Python 3 on Ubuntu 16.04. The mdp93/LibreCAN_CCS repository at e10aea7 contains only a project README and site configuration, with no license or implementation, and no DBC ground truth or vehicle traces were found in the reviewed sources. ## Primary sources 1. 2. 3. 4. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.