1

Im hoping to understand the way a auto diagnostics tool is reporting data over usb. I've made a usb capture to look for changes according to known changes to the input it measures. The measurement is of throttle position, and is reported from 0.000000% to 100.000000% (6 decimal shown)

Here as a full packet, throttle 100%
    41 05 2B C0 FF 15 01 00 AA 00 00 00 00 00 FF 15
    16 00 01 AA 00 00 00 00 01 08 11 00 05 61 C6 00
    6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2

Here is a sequence of packets, only showing the last line which changes, along with the times in a row that same packet was recieved

Throttle ~50%
6D C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 72 x3
6C C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 73 x3
6D C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 72 x5
6C C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 73 x1

Throttle 100%
6C C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F3 x2
6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2 x4
6C C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F3 x3
6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2 x3

Throttle 0%
6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x2
6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1
6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x1
6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1
6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x3
6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1

So initially I noticed the 8th byte and thought it might correlate to a ADC reading of 0 - 255 that is then displayed as 0 - 100%. But then i found in the logs that it saves percentage readings to 6 decimal places with _TYPE="FLOAT" .

Ive also noticed that within a group of similar packets that correlate to the same throttle position, there is an alternating pattern of changes to the first and last byte (for that line)

Ive also noticed that the packets are nearly all the same, except for what seem like small differences but which must make larger differences to the stored data than seems.

So can anyone see how it might be stored ?

5
  • Do you have software that communicates with this device? It would be more straightforward to RE the application than the protocol in isolation. Apr 27, 2015 at 10:09
  • Yeah I do and tried that but the functions I'm interested in are inside dll's. Apr 27, 2015 at 12:05
  • Even better, as now you probably have symbols for the exported functions. Apr 27, 2015 at 12:14
  • Its an old program that has the format before pe. I couldnt seen to get anything out of it. Any tipis? Apr 28, 2015 at 1:46
  • This type en.m.wikipedia.org/wiki/New_Executable Apr 28, 2015 at 1:49

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.