2

I am trying to decode Arad/Master Meter utility water meter RF transmission. So far, I had success with reading the meter serial number and counter reading. The transmission looks like that:

000000003e690aec7ac84bfa1c907300a80600000506cd192cc8f8

where:

00000000 is preamble.

3e690aec7ac84b is fixed in time and the same for other meters in the neighborhood. Probably gearing ratio.

fa1c9073 is Meter serial number. fa1c90 = 9444602, little endian 73= 'S'

00 no idea.

a80600 is the counter reading little endian = 1704

000 no idea.

5 is fixed in time and the same for other meters in the neighborhood.

06cd192cc probably some kind of CRC or checksum - here is where I need help.

8 is getting either 8 or 0 same for other meters in the neighborhood.

f8 is fixed in time and the same for other meters in the neighborhood.

Running:

reveng -w 32 -s 3E690AEC7AC84BDAB18C7300390E000005BFF1DB9F
3E690AEC7AC84B13FE8B7300100500000507CBFECD
3E690AEC7AC84BDAB18C73003B0E0000055C91EB1C
3E690AEC7AC84B3EC68C7300720E000005C6E1CCD5

I get immediately :

no models found

So if I am not doing anything wrong, Reveng doesn't seem to find anything with brute force.
Any other idea?

Here is a list of different transmissions I collected:

000000003e690aec7ac84bfa1c907300a206000005483eab4f28f8
000000003e690aec7ac84bfa1c907300a306000005298634f988f8
000000003e690aec7ac84bfa1c907300a4060000056d9fbad9f8f8
000000003e690aec7ac84bfa1c907300a5060000050c27256f58f8
000000003e690aec7ac84bfa1c907300a6060000058eff8a5ae0f8
000000003e690aec7ac84bfa1c907300a706000005ef4715ec40f8
000000003e690aec7ac84bfa1c907300a80600000506cd192cc8f8
000000003e690aec7ac84b13fe8b73000f050000059576b83160f8
000000003e690aec7ac84b13fe8b7300100500000507cbfecdb8f8
000000003e690aec7ac84b3ec68c7300720e000005c6e1ccd5e8f8
000000003e690aec7ac84b3ec68c7300730e000005a759536348f8
000000003e690aec7ac84b3ec68c7300750e00000582f842f598f8
000000003e690aec7ac84b3ec68c7300760e0000050020edc020f8
000000003e690aec7ac84b3ec68c7300770e0000056198727680f8
000000003e690aec7ac84b3ec68c7300780e00000588127eb608f8
000000003e690aec7ac84bdab18c7300350e000005d4a3786a70f8
000000003e690aec7ac84bdab18c7300360e000005567bd75fc8f8
000000003e690aec7ac84bdab18c7300380e000005de494429e0f8
000000003e690aec7ac84bdab18c7300390e000005bff1db9f40f8
000000003e690aec7ac84bdab18c73003a0e0000053d2974aaf8f8
000000003e690aec7ac84bdab18c73003b0e0000055c91eb1c58f8
000000003e690aec7ac84bdab18c73003c0e0000051888653c28f8
000000003e690aec7ac84bfa1c907300500600000533712209f0f8
000000003e690aec7ac84bfa1c907300510600000552c9bdbf50f8
000000003e690aec7ac84bfa1c9073005206000005d011128ae8f8
000000003e690aec7ac84bfa1c9073005306000005b1a98d3c48f8

1 Answer 1

1

I still cannot directly comment and this is my only option to respond:

here is description of other parameters from same supplier, maybe same model. Some might be transmitted via RF such as battery status. Meter with 9 digits will consume some of the "0"s. Gives opportunity to improve your protocol description.

06cd192cc probably some kind of CRC or checksum - here is where I need help.

You highlighted 9 nibbles. Very unlikely for CRC, for CRC-32 result is 8 nibbles.

8 is getting either 8 or 0 same for other meters in the neighborhood

Means that it is unknown at the moment but changes and it is probably in use and included in Checksum. And the same maybe for final "F8".

For your data it is true that

0x3e690aec7ac84bfa1c9073005**0**0600000533712209f0f8 ^ 0x3e690aec7ac84bfa1c9073005**1**0600000552c9bdbf50f8 == 0x3e690aec7ac84bfa1c9073005**2**06000005d011128ae8f8 ^ 0x3e690aec7ac84bfa1c9073005**3**06000005b1a98d3c48f8

which is true for CRC. So it is not excluding CRC method.

So some options to play with, find right position and length and get a lucky punch with Reveng.

3
  • Could you explain some more as I am new to CRC? Does * in your code line mean wildcard. Does ^ mean power?
    – Avi
    Commented Mar 13, 2022 at 15:19
  • the "wildcards" came from highlighting "0", "1" etc with bold, which looks a bit weird in code. Just to present difference better. "^" is function (at least in Python) for Xor. Commented Mar 13, 2022 at 17:50
  • You are correct. My mistake. The counter should be shifted one nibble left. I have corrected that in my original post. Thank you.
    – Avi
    Commented Mar 15, 2022 at 6:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.