3

Hello =) I am attempting to reverse engineer a communications protocol to some obsolete equipment. Communication happens on an RS485 line.

I have captured several exchanges and seem to have figured out a bit the structure.

What I am missing at the moment is to see how I would calculate the last 2 bytes which seem to be a CRC, Checksum, LRC,... some sort of Calculated bytes depending on the data.

This is a Master -> Slave Communication. M: Hex bytes sent by master Sx: Hex Bytes replied by Slave x

Serial Numbers of Slaves: S1: F376150801196 S2: F306103101122 S3: F306093001029

  • Broadcasting message to Discover devices

  • M: ff 00 00 04 00 00 00 00 00 13 00 02 00 00 18 01

  • S1: fe 00 f3 04 00 00 00 00 00 00 00 00 ac 04 a5 02

  • S2: fe 00 f3 04 00 00 00 00 00 00 00 00 62 04 5b 02

  • S3: fe 00 f3 04 00 00 00 00 00 00 00 00 05 04 fe 01

Devices getting enumerated :

  • M: ff 00 f3 02 ac 04 00 00 00 1b 00 00 00 00 bf 02

  • S1: fe 00 f3 02 ac 04 38 30 35 31 36 37 ac 04 8e 04

  • M: ff 00 f3 03 ac 04 00 00 00 1b 00 00 00 00 c0 02

  • S1: fe 00 f3 03 ac 04 38 30 35 31 36 37 ac 04 8f 04

  • M: ff 00 f3 16 ac 04 00 00 00 1b 00 00 ac 04 83 03

  • S1: fe 00 f3 16 ac 04 38 30 35 31 36 37 ac 04 a2 04

  • M: ff 00 f3 02 62 04 00 00 00 1b 00 00 00 00 75 02

  • S2: fe 00 f3 02 62 04 31 33 30 31 36 30 62 04 ea 03

  • M: ff 00 f3 03 62 04 00 00 00 1b 00 00 00 00 76 02

  • S2: fe 00 f3 03 62 04 31 33 30 31 36 30 62 04 eb 03

  • M: ff 00 f3 16 62 04 00 00 00 1b 00 00 62 04 ef 02

  • S2: fe 00 f3 16 62 04 31 33 30 31 36 30 62 04 fe 03

  • M: ff 00 f3 02 05 04 00 00 00 1b 00 00 00 00 18 02

  • S3: fe 00 f3 02 05 04 30 33 39 30 36 30 05 04 37 03

  • M: ff 00 f3 03 05 04 00 00 00 1b 00 00 00 00 19 02

  • S3: fe 00 f3 03 05 04 30 33 39 30 36 30 05 04 38 03

  • M: ff 00 f3 16 05 04 00 00 00 1b 00 00 05 04 35 02

  • S3: fe 00 f3 16 05 04 30 33 39 30 36 30 05 04 4b 03

Acknowledgement of recieved command from different slaves to the commands of move slave from Master

  • S1: fe 00 f3 41 00 00 00 00 00 00 00 00 ac 04 e2 02
  • S2: fe 00 f3 41 00 00 00 00 00 00 00 00 62 04 98 02
  • S3: fe 00 f3 41 00 00 00 00 00 00 00 00 05 04 3b 02

Commands, acknowledged by the acknowledge command of each respective Slave accordingly

  • S1 Stop Movement:

  • M: ff fb f3 41 00 00 90 01 c2 01 00 03 ac 04 35 05

  • S2 Stop Movement:

  • M: ff fb f3 41 ff 00 00 00 00 00 00 03 62 04 96 04

  • S3 Stop Movement:

  • M: ff fb f3 41 ff 00 00 00 00 00 00 03 05 04 39 04

  • S3 Go Right ff fb f3 41 ff 01 00 00 00 00 00 03 05 04 3a 04

  • S3 Go Left ff fb f3 41 ff 02 00 00 00 00 00 03 05 04 3b 04

  • S3 Go Down ff fb f3 41 ff 03 00 00 00 00 00 03 05 04 3c 04

  • S3 Go Up ff fb f3 41 ff 04 00 00 00 00 00 03 05 04 3d 04

  • S2 Go Right ff fb f3 41 ff 01 00 00 00 00 00 03 62 04 97 04

  • S2 Go Left ff fb f3 41 ff 02 00 00 00 00 00 03 62 04 98 04

  • S2 Go Down ff fb f3 41 ff 03 00 00 00 00 00 03 62 04 99 04

  • S2 Go Up ff fb f3 41 ff 04 00 00 00 00 00 03 62 04 9a 04

  • S1 Go Right ff fb f3 41 ff 01 90 01 c2 01 00 03 ac 04 35 06

  • S1 Go Left ff fb f3 41 ff 02 90 01 c2 01 00 03 ac 04 36 06

  • S1 Go Down ff fb f3 41 ff 03 90 01 c2 01 00 03 ac 04 37 06

  • S1 Go Up ff fb f3 41 ff 04 90 01 c2 01 00 03 ac 04 38 06

S3 Go to

  • 400 , 450 : ff fb f3 41 ff 05 90 01 c2 01 00 03 05 04 92 05
  • 401 , 450 : ff fb f3 41 ff 05 91 01 c2 01 00 03 05 04 93 05
  • 402 , 450 : ff fb f3 41 ff 05 92 01 c2 01 00 03 05 04 94 05
  • 403 , 450 : ff fb f3 41 ff 05 93 01 c2 01 00 03 05 04 95 05
  • 404 , 450 : ff fb f3 41 ff 05 94 01 c2 01 00 03 05 04 96 05
  • 405 , 450 : ff fb f3 41 ff 05 95 01 c2 01 00 03 05 04 97 05
  • 406 , 450 : ff fb f3 41 ff 05 96 01 c2 01 00 03 05 04 98 05
  • 407 , 450 : ff fb f3 41 ff 05 97 01 c2 01 00 03 05 04 99 05
  • 408 , 450 : ff fb f3 41 ff 05 98 01 c2 01 00 03 05 04 9a 05
  • 409 , 450 : ff fb f3 41 ff 05 99 01 c2 01 00 03 05 04 9b 05
  • 410 , 450 : ff fb f3 41 ff 05 9a 01 c2 01 00 03 05 04 9c 05

From my observations the Structure I have the following identified:

ff fb f3 41 ff 05 9a 01 c2 01 00 03 05 04 9c 05

byte1 byte2 byte3 --------------------------------- byte13 byte14 byte15 byte16

  • bytes 13 and 14 are to identify the specific device which is in a multi-drop network for whom the command is for. It is the last 5 numbers of the serial number represented in Hexadecimal.

    • 0405 -> 01029 <- S3: F306093001029
    • 0462 -> 01122 <- S2: F306103101122
    • 04ac -> 01196 <- S1: F376150801196

  • bytes 15 and 16 are the calculated ones, which I am trying to figure out how they get calculated.

I have been manually attempting to calculate and compare several 16 bit CRCs and also tried running several frames through Reveng with out much luck, no models ever get found.

Any help and insights would be greatly apreciated.

Thanks!

Improve this question

1 Answer 1

Reset to default
2

So, after reviewing This following Stack Overflow Question

I opened up an excel and made some tests and effectively

Sum of all bytes is the calculation

  • Hex ff 00 00 04 00 00 00 00 00 13 00 02 00 00 18 01
  • Dec 255 0 0 4 0 0 0 0 0 19 0 2 0 0
    • Sum of all in Decimal = 280 --> Respresented in Hex 0118

Sometimes we search for too complicated answers to simple things.

Thanks anyway for having a look.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.