RE4AAutomotive engineering & security tools
Language: EN · English
Request a demo
Menu

Testing StudioIn production

Break the vehicle network before someone else does.

Each ECU, tested against its own declared PDX/ODX. AI test plans from your TARA: available to demo.

  • CAN
  • CAN-FD
  • Automotive Ethernet
  • SOME/IP
  • UDS
  • DoIP
RE4A Testing Studio — Test suite
Test suite view
  • 28 built-in test types, 27 armed by default

    built-in test types · 27 armed by default

  • 32 UN R155 Annex 5 rows assessed: 7 mapped, 12 partial, 2 gap, 11 out of scope

    UN R155 Annex 5 rows assessed7 mapped12 partial2 gap11 out of scope

  • 2 selectable standards profiles: UN R155 Annex 5 and GB 44495-2024

    selectable standards profiles: UN R155 Annex 5 and GB 44495-2024

What Testing Studio does

01SEE

Watch the bus.

Decoded live against your own network matrix.

RE4A Testing Studio — Signal lanes
Signal lanes

02ATTACK

Attack automatically.

28 built-in test types, 27 armed by default.

RE4A Testing Studio — Test type selection
Test type list

03PROVE

Evidence each finding.

Verdicts against the ECU’s own PDX/ODX.

RE4A Testing Studio — Report
Failure reason

AI Assist

Bring your TARA. Get a reviewed test plan.

Available to demo · included in the Pentest and Fuzz editions

  1. Read

    Extracts the cybersecurity requirements the workbook contains, for you to confirm.

  2. Map

    Resolves what each requirement protects onto the ECUs, buses and services in your matrix.

  3. Propose

    Selects, clones or generates testcases from the built-in library, ranked with a rationale and UN R155 Annex 5 / GB 44495 references.

  4. Decide

    A security engineer accepts, edits, adds or rejects each proposal, then arms what runs.

  • Your model or none: OpenAI, Anthropic, or a local Ollama or vLLM endpoint — off by default.
  • The API key is encrypted on the machine and never travels in a project.
  • Every decision is recorded in the report with the model that proposed it.

The attack surface

Every new bus is a new way in.

One ECU may sit on three buses at once.

Buses around one ECUA device under test on a CAN bus, a CAN-FD bus and an Automotive Ethernet link.DUTCANCAN-FDAutomotive Ethernet
Diagnostics
ISO 14229 · UDS
Transport
ISO 13400 DoIP · ISO 15765
Data link
CAN · CAN-FD
Ethernet / SOA
AUTOSAR · SOME/IP · SD
ODX database
ISO 22901 · PDX / ODX
Threat model
STRIDE · DREAD
Profiles
UN R155 · GB 44495

Capabilities

One workbench. Watch the bus, probe the ECU, evidence the finding.

Visibility

CAN, CAN-FD and dual-stack Automotive Ethernet, decoded live against your own matrix.

Diagnostics

UDS over DoIP and ISO-TP, probing within the ECU’s own declared policy.

Offense

Spec-differential verdicts against PDX/ODX; destructive tests stay dry until you arm them.

Authoring

SETUP · CONFIG · ATTACK · TEARDOWN steps, template cycles you can customise with the verdict steps locked, and NodeScript nodes.

Evidence

Coverage and verdicts reported separately, each result with an explicit evidence role, and customised runs flagged.

  • UN R155 Annex 5
  • GB 44495-2024

Assurance

Two selectable profiles: UN R155 Annex 5 and GB 44495-2024.

In action

One attack campaign, built once.

RE4A Testing Studio — Test suite
Test suite view
Phase-structured stepsPer-step select and skipProfile-scoped evidence

Attack a live ECU while the rest of the car plays along.

RE4A Testing Studio — Simulation
  • ECU1DUT · real
  • GatewayECUrest-busPLAYING
  • BodyECUrest-busPLAYING
Replaydrive_cycle.blf
Interactive generatorSingle frame · Cyclic stream
RE4A Testing Studio — Signal plot
Signal plot with three decoded lanes
RE4A Testing Studio — NodeScript
NodeScript dialog for a simulated node
RE4A Testing Studio — Diagnostics
Positive response card for a Read Data By Identifier request
Read Data By Identifier (0x22) — positive response
RE4A Testing Studio — Trace
Decoded PCAP trace table
Capture: a PCAP trace, decoded
RE4A Testing Studio — Report
Report detail: failure reason and execution log
The failure reason names the PDX.

The oracle

A fuzzer asks whether the ECU crashed. We ask whether it obeyed its own specification.

Anything answered outside the PDX/ODX is a finding, already argued.

Same request, two oraclesThe crash-only oracle passes the ECU because it stayed up. The spec oracle fails it, because the answer is not declared in the PDX/ODX.Crash-only oraclePASSSpec-differential oracleFAIL

TC_UDS_005 · WriteDataByIdentifier (0x2E)

DID
F190
Latency
53 ms / 30,000 ms timeout
Decoded reason
write DID 2EF190 answered — not declared in the PDX
Maps to
Table A1 example 20.1 · mitigation M7

Execution steps

  1. Open diagnostic sessionPASS
  2. Resolve DID from PDX/ODXPASS
  3. Request security accessPASS
  4. Validate seed/key exchangePASS
  5. Send WriteDataByIdentifierPASS
  6. Capture responsePASS
  7. Decode responsePASS
  8. Close sessionPASS

Coverage, stated honestly

What we reach from the vehicle bus — and what we do not.

Annex 5 Table A1: 32 indexed rows, 30 threats, 69 attack examples.

  • 7 of 32 threat rows: Direct test evidence

    Direct test evidence

  • 12 of 32 threat rows: Partial evidence

    Partial evidence

  • 2 of 32 threat rows: In scope, not yet built

    In scope, not yet built

  • 11 of 32 threat rows: Not reachable from the bus

    Not reachable from the bus

UN R155 Annex 5 Table A1 coverage by threat index
Annex 5 row 1: OUTAnnex 5 row 2: OUTAnnex 5 row 3: OUTAnnex 5 row 4: OUTAnnex 5 row 5: OUTAnnex 5 row 6: PARTIALAnnex 5 row 7: PARTIALAnnex 5 row 8: MAPPEDAnnex 5 row 9: PARTIALAnnex 5 row 10: OUTAnnex 5 row 11: OUTAnnex 5 row 12: OUTAnnex 5 row 13: PARTIALAnnex 5 row 14: MAPPEDAnnex 5 row 15: PARTIALAnnex 5 row 16: GAPAnnex 5 row 17: PARTIALAnnex 5 row 18: MAPPEDAnnex 5 row 19: PARTIALAnnex 5 row 20: MAPPEDAnnex 5 row 21: PARTIALAnnex 5 row 22: PARTIALAnnex 5 row 23: MAPPEDAnnex 5 row 24: PARTIALAnnex 5 row 25: GAPAnnex 5 row 26: MAPPEDAnnex 5 row 27: PARTIALAnnex 5 row 28: OUTAnnex 5 row 29: PARTIALAnnex 5 row 30: MAPPEDAnnex 5 row 31: OUTAnnex 5 row 32: OUT

The catalogue

28 built-in test types. 27 armed by default.

In the default campaign: selected when a run starts. Dry run until armed: sends nothing until armed.

All 28 built-in test types by STRIDE class: S1 T7 R1 I11 D3 E5

RE4A Testing Studio — Step sequence
Step sequence view

Showing 28 of 28 test types

IDTest typeSTRIDEIn the default campaign
UDS_001Session discoveryIYes
UDS_002Service discoveryIYes
UDS_003Security-access enforcementIYes
UDS_004Security-access brute forceDry run until armedEYes
UDS_005DID write protectionDry run until armedTYes
UDS_006DID read enumerationIYes
UDS_007Memory read accessIYes
UDS_008Memory write accessDry run until armedTYes
UDS_009Malformed request handlingDry run until armedTYes
UDS_010Request denial of serviceDry run until armedDYes
UDS_011Firmware-download refusalDry run until armedEYes
UDS_012NVM write enduranceDry run until armedDNo
UDS_013Routine control abuseDry run until armedEYes
UDS_014Communication control abuseDry run until armedTYes
UDS_015Tester-present starvationDry run until armedEYes
UDS_016Session transition integrityTYes
UDS_017Negative-response conformanceRYes
ETH_001Frame fuzzingDry run until armedDYes
ETH_002SOME/IP service scanIYes
ETH_003SOME/IP method abuseDry run until armedIYes
ETH_004DoIP routing abuseDry run until armedIYes
ETH_005Port scanIYes
ETH_006TLS configuration auditIYes
ETH_007Network segmentation checkIYes
ETH_008ARP / neighbour spoofingDry run until armedSYes
CAN_001Signal fuzzingDry run until armedTYes
CAN_002SecOC authenticityTYes
CST_001Custom builder (NodeScript)Dry run until armedEYes

27 of 28 test types are armed by default.

The evidence model

Four vocabularies that never collapse into one number.

Result

  • PASS
  • FAIL
  • NOT COMPLETE
  • NOT RUN

Step status — deliberately not the verdict

Provenance

  1. ARXML
  2. DBC
  3. PDX
  4. Test plan
  5. Session fingerprint
RE4A Testing Studio — Report summary

Synthetic demo run

  • 58selected
  • 7attempted
  • 6passed86% of conclusive
  • 1failed
  • 0non-conclusive
  • 51no verdict

Pipeline

From your network matrix to profile-scoped evidence.

  1. Ingest

  2. Resolve

  3. Plan

    AI proposes · you approve

  4. Execute

  5. Prove

Datasheet

At a glance.

Buses
CAN; CAN-FD up to 64-byte frames with BRS; Automotive Ethernet IPv4/IPv6 with 802.1Q VLAN; SOME/IP
Diagnostics
UDS (ISO 14229) over DoIP (ISO 13400) and ISO-TP (ISO 15765)
Test types
28 built-in, 27 armed by default
Network ingestion
CAN DBC · AUTOSAR ARXML · PDX/ODX
Standards profiles
UN R155 Annex 5 · GB 44495-2024
Simulation
Rest-bus simulation, replay and frame injection — Simulation edition
Capture and replay
BLF (CAN) · PCAP (Ethernet)
Reporting
Self-contained HTML report with a sign-off block
Deployment
Windows client ↔ Linux test server over TCP (127.0.0.1:20009 control, 20010 streaming)
What you bring
A network matrix and a PDX/ODX database
AI assistance
TARA → test-plan proposals reviewed by a security engineer; your own OpenAI, Anthropic, Ollama or vLLM model, off by default. Available to demo.
Editions
Free baseline plus Pentest, Fuzz and Simulation editions; machine-locked, time-limited licenses.

Evaluate it

See it run against a real ECU — with no hardware on your side.

Rest-bus simulation around one real ECU. No hardware needed.

Request a demo