The Controller Area Network (CAN) bus serves as a foundational communication architecture in modern vehicles, supporting a wide range of functions, from engine control to auxiliary systems. However, lacking built-in security mechanisms makes CAN vulnerable to cyberattacks. Accurately mapping CAN signals to specific car-control actions becomes critical as it allows the detection of security breaches by pinpointing potential vulnerabilities exploited to compromise vehicular functions. Existing mapping techniques rely on CAN reverse engineering, which struggle to achieve bit-level resolution due to the huge search space of IDs and payload combinations. To address this challenge, we propose a systematic framework that includes signal boundary identification, targeted fuzz testing, and control bit analysis. Our method achieves high efficiency and precision in mapping control bits in CAN frames to car-control actions. Additionally, we developed a compact and user-friendly reverse engineering toolkit, incorporating a graphical interface to facilitate practical vehicle function testing and CAN message monitoring. Experiments on Tesla Model 3 and Leapmotor C11/C10 demonstrate that our framework is validated across different vehicle models and capable of identifying a wide range of car-control actions. Compared with previous works, our method significantly improves the resolution and automation of CAN reverse engineering.