<!--
SPDX-FileCopyrightText: AISEC Pentesting Team

SPDX-License-Identifier: CC0-1.0
-->

# Introduction

Gallia is a comprehensive penetration testing toolchain for cars.
The scope of the toolchain is conducting penetration tests from a single ECU up to whole cars, with the main focus on the UDS interface.

## Artifacts Folder Structure

Gallia uses its own folder structure to store its scan results (called artifacts).
The structure is as follows:
```
<Scanner Name>
- run-<timestamp>
- LATEST -> <latest run dir>
```

Every scan run creates the following artifact files:

| File                   | Description                            |
|------------------------|----------------------------------------|
| `OUTPUT.zstd`          | Compressed log file                    |
| `META.json`            | Information about the executed Scanner |
| `ecu_params_pre.json`  | ECU parameters read before the scan    |
| `ecu_params_post.json` | ECU parameters read after the scan     |
| `*.pcap.gz`            | Network capture                        |


## Discover Endpoints
When physically connected to the ECU, we first need to identify all available endpoints on the DUT.
Depending on the target protocol, different discover scanner are provided:
* `gallia discover-can-ids` (UDS)
* `gallia discover-endpoints` (UDS)
* `gallia discover-iso-tp-addr` (UDS)
* `discover-xcp` (XCP)

The identified endpoints are stored in the `ECUs.txt` artifact file.

## UDS Scanner

The following table shows the most important UDS scanner.
For a compleat list, please have a look at the help page.

| Scanner            | Description                                             |
|--------------------|---------------------------------------------------------|
| `scan-services`    | Iterate sessions and services and find endpoints        |
| `scan-sessions`    | Iterate Sessions (recursively)                          |
| `scan-identifiers` | This scanner scans DataIdentifiers of various services. |

## Database

Gallia can log all its scan result into a sqlite database.
For more details see: [Database](database)