Vahaka.
An electric scooter that lives entirely in software: real ECUs, a live CAN bus and a full instrument cluster you can sniff, replay and spoof. Automotive cyber practice with no vehicle to buy or brick.
- वाहक the carrier
- vcan0 real SocketCAN bus
- AGPL-3.0 free forever
You shouldn’t need a scooter on the bench to learn its bus.
Learning automotive security usually means buying a vehicle, wiring into its CAN bus, and hoping you don’t brick an ECU mid-lesson. That is expensive, fragile, and impossible to hand a whole classroom at once.
Vahaka is a complete electric scooter in software. It stands up a real virtual CAN bus, runs the ECUs, and renders the rider’s cluster, so you can attack a moving vehicle with nothing but a laptop.
Every control is a CAN frame. Press one.
These are the real arbitration IDs and payloads Vahaka puts on vcan0 in fixed-ID mode. Trigger a control and watch the exact frame the simulator would broadcast to the bus.
root@vahaka:~$ candump vcan0
Press a control to put a frame on the bus…A safe range for the whole offensive playbook.
The same attacks you would run on a real vehicle bus, with a reset button instead of a tow truck.
- 01
Sniff the bus
Every control press puts a real frame on vcan0. Run candump and watch the arbitration IDs and payloads for engine, speed, battery and indicators go by.
- 02
Replay and inject
Capture a frame, then send it back with cansend to trigger the cluster yourself: force a reverse-gear indication or a low-battery warning with no rider input.
- 03
Spoof the instrument cluster
The dashboard trusts whatever arrives on the speed and battery IDs. Feed it a fake speed or a dead-battery frame and watch the HMI believe it.
- 04
Reverse the ID map
Switch the server to randomised arbitration IDs and the fixed map is gone. Now you have to identify each function from traffic alone, the way you would on a real vehicle.
Real automotive practice, zero hardware.
For automotive security learners and trainers, CTF builders, students, and researchers prototyping bus attacks before touching a real vehicle.
No vehicle to buy or brick
A real CAN bus and a full instrument cluster run entirely in software. Break the scooter, spoof its speed, kill its battery, then reload the page.
A real bus, not a mock
Vahaka creates a SocketCAN vcan0 interface and puts genuine frames on it, so candump, cansend and can-utils work exactly as they would on a car.
Every control is a frame
Engine, cruise, reverse, indicators, battery and speed each map to an arbitration ID. Press a button and watch the traffic it generates.
Fixed or randomised IDs
Start with a known ID map to learn the ropes, then randomise every ID at boot and reverse the bus from traffic alone, like a real target.
Made for a room full of learners
Built for workshops, training, and academic research. Everyone runs the same simulator, so exercises are repeatable across the whole class.
Open, free and extensible
Released under AGPL-3.0. New connected features (BLE, GSM, OTA) are on the roadmap, and the community drives what gets added.
One command to ride.
The install script pulls Node if it’s missing, sets up the symlink, and creates the vcan0 interface for you. Then run vahaka and open the cluster.
curl -sL https://github.com/Dellon-Technology-Pvt-Ltd/Vahaka/raw/main/install.sh | bash- 01
Install
Run the command above on Linux, or clone the repo and
npm install. - 02
Start
Run
vahaka, then pick fixed or randomised CAN IDs when prompted. - 03
Ride & attack
Open
localhost:7575for the cluster, and sniffvcan0from another terminal.
- OS
- Linux (SocketCAN)
- Node.js
- ≥ 22.13.1
- npm
- ≥ 11.1.0
- Interface
- vcan0 (auto-created)
Want a feature on the bus? Ask for it.
This is v1. BLE, GSM, OTA updates and telemetry are on the roadmap, and the community shapes what lands next. Pull requests, bugs and ideas are all welcome.
Ready to move from the simulator to the real bus?
The team behind Vahaka runs automotive and embedded security assessments for OEMs and Tier-1 suppliers. When you’re testing a real vehicle, we can help.