0

I am currently working on analyzing packet exchanges between a computer and an access control system. At present, the computer and this access control system require an intermediary software to communicate. The goal is to eliminate this software and manage the communications between the computer and the access control system by myself. However, there is very little information available about the software or the access control system for me to understand these data properly.

The computer and the access control system communicate using the TCP/IP protocol, which is not difficult to understand. However, Wireshark cannot recognize what the transmitted data corresponds to. The data does not appear to be encrypted, but it seems to be part of another protocol whose pattern I do not recognize.

I have tried various tools to identify this protocol, and I have also used several "decode as" functions in Wireshark, but nothing seems to work.

If someone recognizes this protocol, I would be delighted to learn more about it. If it turns out that the protocol is a customized one, then I will have much more difficulty than expected, and I am aware I might be forced to to reverse engineering on the software itself.

Thank you in advance.

Here are my results: link

And some of the binaries that might be interesting (you can see some patterns in there and some data sent in clear text like the "c.l.c.r.a"):

0000  cc 66 01 01 00 00 00 00 07 00                     .f........

0000  66 cc 02 97 10 00 00 00 00 00 00 00 10 00 08 00   f...............

0000  cc 66 01 01 00 00 00 00 08 00 66 cc 01 00 00 00   .f........f.....
0010  00 01 09 00 02 00 00 00 00 01 08 00 48 01 00 00   ............H...

0000  66 cc 02 e8 01 00 00 00 94 1d 00 00 b0 00 09 00   f...............

0000  cc 66 01 01 00 00 00 00 09 00 66 cc 01 00 00 00   .f........f.....
0010  00 00 00 00 63 00 6c 00 63 00 72 00 61 00 00 00   ....c.l.c.r.a...
0020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0070  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0080  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0090  00 00 00 00 01 00 00 00 de 07 0c 00 01 01 01 01   ................
00a0  01 01 00 00 01 01 01 01 01 00 00 01 01 01 01 01   ................
00b0  00 00 01 01 01 01 01 00 00 01 01 01 42 04 00 00   ............B...
1
  • I really don't think you have any other option than to reverse engineer the software. Even if the protocol used is "standard", you won't know if it has been customized to deal with application specific requirements (i.e. special error conditions, etc.). Commented Mar 1 at 16:39

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.