0

I have logfiles in the following format without any documentation:

to 12.03.2020 08:04:15 < '7"\05\04\02\16\F6\C6\D6"'#0D
to 12.03.2020 08:04:15 > '7S"\05\04\00\02\00\01\91\8E"'#0D
to 12.03.2020 08:04:15 < '7"\05\04\02 \22\D1)"'#0D
to 12.03.2020 08:04:15 > '7S"\05\04\00\05\00\01\20\4F"'#0D
to 12.03.2020 08:04:16 < '7"\05\04\02\19e\83K"'#0D
to 12.03.2020 08:04:16 > '7S"\05\04\00\07\00\01\81\8F"'#0D
to 12.03.2020 08:04:16 < '7"\05\04\02\00z\C9\13"'#0D
to 12.03.2020 08:04:16 > '7S"\01\03\00\00\00\05\85\C9"'#0D
to 12.03.2020 08:04:16 < '7"\01\03\0A\00\00\05\DC\00"'#0D
to 12.03.2020 08:04:16 < '7"\02\00\00\00\01AD"'#0D
to 12.03.2020 08:04:16 > '7S"\01\01\00\00\00\10\3D\C6"'#0D
to 12.03.2020 08:04:16 < '7"\01\01\02\00\03\F9\FD"'#0D
to 12.03.2020 08:04:16 > '7S"\05\04\00\00\00\01\30\4E"'#0D
to 12.03.2020 08:04:16 < '7"\05\04\02\17\03\07\01"'#0D
to 12.03.2020 08:04:16 > '7S"\05\04\00\01\00\01\61\8E"'#0D
to 12.03.2020 08:04:16 < '7"\05\04\02\16\F6\C6\D6"'#0D
to 12.03.2020 08:04:16 > '7S"\05\04\00\02\00\01\91\8E"'#0D

This snippet from a log file probably represents the current state and operations of our manufacturing machine. Is there something meaningful in the codes to the right of the time stamp?

Some observations:

  • "to" corresponds to "thu" (for Thursday) in our language.
  • It is not hexidecimal since it occasionally contains "83K", Gs, etc. And "\00" corresponds to "null" in ascii.
  • The log code starts with < '7" or > '7S" and ends with "'#0D on all lines. Except occasionally saying something like > '3V1018'#0D
  • The space in the third line above is an unknown character, displaying as a rectangle in Notepad++.
3
  • 2
    Try to focus on the program that reads the log file instead of the log file itself. – Biswapriyo Mar 31 '20 at 13:05
  • @Biswapriyo, That's unfortunately not an option since the program is binary proprietary closed source with no support. – Jonas Lindeløv Mar 31 '20 at 18:42
  • @JonasLindeløv if you have the binary, you can reverse engineer it and try to figure out what the data means – Igor Skochinsky Apr 5 '20 at 12:00
2

It looks to be MODBUS messages. The bytes at the end are a CRC in exactly the format MODBUS uses. See Modicon Modbus Protocol Reference Guide

The backslash sequences like "\F6" are hexadecimal escapes. Other characters are literal ASCII.

Here is a Python script that decodes the data and calculates the CRC (which you will see matches):

import re
import crcmod.predefined

stuff = r'''
to 12.03.2020 08:04:15 < '7"\05\04\02\16\F6\C6\D6"'#0D
to 12.03.2020 08:04:15 > '7S"\05\04\00\02\00\01\91\8E"'#0D
to 12.03.2020 08:04:15 < '7"\05\04\02 \22\D1)"'#0D
to 12.03.2020 08:04:15 > '7S"\05\04\00\05\00\01\20\4F"'#0D
to 12.03.2020 08:04:16 < '7"\05\04\02\19e\83K"'#0D
to 12.03.2020 08:04:16 > '7S"\05\04\00\07\00\01\81\8F"'#0D
to 12.03.2020 08:04:16 < '7"\05\04\02\00z\C9\13"'#0D
to 12.03.2020 08:04:16 > '7S"\01\03\00\00\00\05\85\C9"'#0D
to 12.03.2020 08:04:16 < '7"\01\03\0A\00\00\05\DC\00"'#0D
to 12.03.2020 08:04:16 < '7"\02\00\00\00\01AD"'#0D
to 12.03.2020 08:04:16 > '7S"\01\01\00\00\00\10\3D\C6"'#0D
to 12.03.2020 08:04:16 < '7"\01\01\02\00\03\F9\FD"'#0D
to 12.03.2020 08:04:16 > '7S"\05\04\00\00\00\01\30\4E"'#0D
to 12.03.2020 08:04:16 < '7"\05\04\02\17\03\07\01"'#0D
to 12.03.2020 08:04:16 > '7S"\05\04\00\01\00\01\61\8E"'#0D
to 12.03.2020 08:04:16 < '7"\05\04\02\16\F6\C6\D6"'#0D
to 12.03.2020 08:04:16 > '7S"\05\04\00\02\00\01\91\8E"'#0D
'''

modbus_crc = crcmod.predefined.mkCrcFun('modbus')

for line in stuff.splitlines(keepends=False):
    if not line:
        continue
    data = line.split('"', 1)[1][:-5].encode('ASCII')
    data = re.sub(br'\\(..)', lambda m: bytes([int(m.group(1), 16)]), data)
    print(format(modbus_crc(data[:-2]), '04x'), data.hex())

Output:

d6c6 05040216f6c6d6
8e91 050400020001918e
29d1 0504022022d129
4f20 050400050001204f
4b83 0504021965834b
8f81 050400070001818f
13c9 050402007ac913
c985 01030000000585c9
1186 01030a000005dc00
009c 02000000014144
c63d 0101000000103dc6
fdf9 0101020003f9fd
4e30 050400000001304e
0107 05040217030701
8e61 050400010001618e
d6c6 05040216f6c6d6
8e91 050400020001918e

I'm not sure about the other content.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.