3

I'm trying to reverse engineer an ECU / GSU protocol from a model airplane jet turbine, in order to make a telemetry adapter. I have decoded several other protocols in the past with good success but this one is especially tough, so I thought I would ask for assistance.

I have an Arduino Nano as the GSU emulator, with a LIN transceiver and verifying communication on a Saleae logic analyser.

The ECU uses a LIN interface but on a proprietary protocol unknown to me. In order to read it I am using an Arduino with a level shifter, and I verified that the incoming data is correct.

When ECU is stand alone, it sends several strings which appear to be interrogations for bus nodes, but nobody is replying obviously.

0x0A 0x00 0x00 0x00 0x00 0x0A
0x14 0x00 0x00 0x00 0x00 0x14
0x1E 0x00 0x00 0x00 0x00 0x1E
0x28 0x00 0x00 0x00 0x00 0x28

When the GSU is connected to the ECU, it responds immediately (0.2ms) after the first string (0x0A 0x00 0x00 0x00 0x00 0x0A), with a 6 byte reply. Each time it is a slightly different reply.

Such a reply is followed by the ECU sending a stream of data, which is the data I need to read.

I tried emulating some of these GSU replies with Arduino, but the ECU never sends the stream of data back on the bus if the arduino is interrogating it; it just ignores it and continues interrogating as if nothing happened. With the GSU interrogating, the ECU replies.

I have attached an Excel table that shows some of the replies and a bit of data processing I played with. It appears that the reply is a 6 byte stream, where the MSB (most significant BIT) of each byte is either 0 or 1. I'm not sure about the rules here and why it's changing.

Does this make sense to anyone? Any reverse engineering experts can share some ideas? So far haven't been able to get the ECU to answer to Arduino.

Thanks for your help.

ECU / GSU init process

  • This is unfamiliar territory for me but it would be good to have pairings of data the ECU sends and what the GSU responds immediately after. My guess is it's either a challenge-response scheme, or the ECU is possibly broadcasting a key of some sorts which is in turn used immediately by the GSU to encrypt its replies. If you have such pairings one could spot a pattern. Also, the fact that just replaying data the GSU sent before isn't working supports that theory (crypto, challenge-response). – Johann Aydinbas Jun 19 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.