2

I'm trying to reverse engineer the protocol used by a fairly old video intercom. Using a UART logic analyser was able to guess the baud rate, data bits, start/stop bit. It idles at 14v and pulls to GND for 0.

when I press the same sequence repeatedly of buttons I get the following bytes:

PREAMBLE (sent when waking up unit):
0x02 0x16 0x10 0x10 0x10 0x10 0x10 0x10 0x11 0x11 0x18 0x03

VIDEO ON:
0x02 0x3c 0x31 0x09 0x38 0x25 0x11 0x6f 0x00 0x1e 0x71 0x03 0x02 0x3d 0x11 0x6f 0x00 0x1e 0x31 0x09 0x38 0x25 0x72 0x03

MIC ON:
0x02 0x4a 0x31 0x09 0x38 0x25 0x11 0x6f 0x00 0x1e 0x7f 0x03 0x02 0x4c 0x11 0x6f 0x00 0x1e 0x31 0x09 0x38 0x25 0x01 0x03

UNLOCK DOOR:
0x02 0x38 0x31 0x09 0x38 0x25 0x31 0x45 0x11 0x1e 0x74 0x03 0x02 0x3a 0x31 0x09 0x38 0x25 0x11 0x6f 0x00 0x1e 0x6f 0x03

Does this appear to be a protocol standard of any kind of control system?

EDIT: Here is the best I could understand: https://docs.google.com/spreadsheets/d/e/2PACX-1vQRyUafqa6CEMd9BOOyAWO4OKGXNKsGLvs6epR5PjqnqBRMbpWOqz2-ij51mFDz4lBUOcVSR7jxK505/pubhtml?gid=1867863786&single=true

It seems as though the format is as follows: BYTE1 = STX BYTE2 = COMMAND BYTE3,4,5,6 = SRC BYTE7,8,9,10 = DST BYTE11 = SUM of BYTE2 BYTE10 trimmed to 8-bit

3
  • Could you please in detail describe what inputs or sequences of inputs cause what outputs, e.g. something made that second last message different from the previous blocks.
    – Reroute
    Commented Apr 27, 2020 at 13:44
  • I did some further digging and came up with the following pattern: docs.google.com/spreadsheets/d/e/… Commented Apr 28, 2020 at 1:12
  • It appears that when I press a button, the controller sends 2x 12 byte messages. Byte 1 is a START, byte 2 is unique number, byte3,4,5,6 is an address? Its possible the second 12 byte message is a response from the controller... Commented Apr 28, 2020 at 1:19

1 Answer 1

2

Based on how you have laid it out, you look to have it mostly mapped out correctly,

The preamble (control device wake up) would be a general broadcast message to all units on the data bus, (The pull down bus means it can be multi-master) as such it does not need an acknowledge,

The other messages follow a command + acknowledge scheme,

The check is a generic sum from the command byte to end of destination, (38 + 31 + 09 + 38 + 25 + 31 + 45 + 11 + 1e) = 0x174, cut that down to 1 byte, = 0x74

I would suspect if you power cycle the devices you may also find more commands while the devices handshake with each other (the addresses may not be fixed, but randomly chosen on power up)

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.