1

Im hoping to understand the way a auto diagnostics tool is reporting data over usb. I've made a usb capture to look for changes according to known changes to the input it measures. The measurement is of throttle position, and is reported from 0.000000% to 100.000000% (6 decimal shown)

Here as a full packet, throttle 100%
    41 05 2B C0 FF 15 01 00 AA 00 00 00 00 00 FF 15
    16 00 01 AA 00 00 00 00 01 08 11 00 05 61 C6 00
    6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2

Here is a sequence of packets, only showing the last line which changes, along with the times in a row that same packet was recieved

Throttle ~50%
6D C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 72 x3
6C C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 73 x3
6D C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 72 x5
6C C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 73 x1

Throttle 100%
6C C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F3 x2
6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2 x4
6C C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F3 x3
6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2 x3

Throttle 0%
6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x2
6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1
6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x1
6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1
6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x3
6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1

So initially I noticed the 8th byte and thought it might correlate to a ADC reading of 0 - 255 that is then displayed as 0 - 100%. But then i found in the logs that it saves percentage readings to 6 decimal places with _TYPE="FLOAT" .

Ive also noticed that within a group of similar packets that correlate to the same throttle position, there is an alternating pattern of changes to the first and last byte (for that line)

Ive also noticed that the packets are nearly all the same, except for what seem like small differences but which must make larger differences to the stored data than seems.

So can anyone see how it might be stored ?

  • Do you have software that communicates with this device? It would be more straightforward to RE the application than the protocol in isolation. – Jonathon Reinhart Apr 27 '15 at 10:09
  • Yeah I do and tried that but the functions I'm interested in are inside dll's. – Hayden Thring Apr 27 '15 at 12:05
  • Even better, as now you probably have symbols for the exported functions. – Jonathon Reinhart Apr 27 '15 at 12:14
  • Its an old program that has the format before pe. I couldnt seen to get anything out of it. Any tipis? – Hayden Thring Apr 28 '15 at 1:46
  • This type en.m.wikipedia.org/wiki/New_Executable – Hayden Thring Apr 28 '15 at 1:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.