Questions tagged [serial-communication]

Process of sending data one bit at a time, sequentially, over a communication channel or computer bus. Most of the computer systems, and especially embedded systems, have such communication port.

Filter by
Sorted by
Tagged with
0 votes
1 answer
109 views

Reverse engineering RS-232 motor controller

I have a motor controller and I'd like to communicate with it using Arduino. I can communicate with the controller using a software and I used it to sniff some data from RS-232 commnunication and ...
Jdx's user avatar
  • 1
0 votes
0 answers
32 views

Finding JTAG/UART Connections on smart doorbell

Trying to dump firmware of this device. I can't find the UART/JTAG connections. I've searched over it for awhile now; I feel like I must just be missing something.
Eric's user avatar
  • 1
2 votes
2 answers
110 views

Reverse Engineer an ultrasonic cartridge communication with the station to bypass remaining uses

I Have an ultrasonic machine that has a cartridge with a set amount of uses. When that value gets to 0, the cartridge has to be disposed, and a new one bought. The thing is that with some maintenance ...
fpp's user avatar
  • 41
0 votes
1 answer
85 views

Microchip ATSAME70Q21-CN unable to connect with JTAG or SWD

First time delving into hardware reverse engineering and can't seem to connect using JTAG nor SWD. I found two identical devices that I'm trying to understand how they work and see if I can extract ...
kumaichi's user avatar
0 votes
0 answers
45 views

Reverse Engineering A RS-485 Steam Shower Protocol

Scenario: A residential steam shower with a control box, touch pad display, and single input contact sensor on a half-duplex, RS-485 daisy chained network. Goal: Determine RS-485 based Link Layer from ...
Jay McClure's user avatar
0 votes
0 answers
73 views

embedded Linux, UART & JTAG disabled, how to access system?

So i have this device running embedded Linux, UART and JTAG interfaces are disabled by software. The device creates a WiFi hotspot and i know the password. By entering the devices IP adress i can ...
AB.M's user avatar
  • 1
1 vote
0 answers
70 views

Reading/writing flash ROM connected to OMAP L138 without JTAG

I have a product that uses an OMAP L138 with a flash rom. There are a couple different models of this product available, but they all share the same hardware with the only difference being the ...
Patrick's user avatar
  • 141
3 votes
1 answer
235 views

Reverse Engineer 16 Bit error checking byte calculation

Hello =) I am attempting to reverse engineer a communications protocol to some obsolete equipment. Communication happens on an RS485 line. I have captured several exchanges and seem to have figured ...
Pau Coma Ramirez's user avatar
3 votes
0 answers
444 views

How can I disable watchdog in U-boot using mw command

So I have DVR with 2*Hi3511RBC CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ) and when I enter U-boot (how do I know that I'm in U-boot ? ) well over UART I get following message U-Boot 1.1.4 (...
Vido's user avatar
  • 515
2 votes
0 answers
53 views

Greenpacket OH-735 onboard header

I got myself a Greenpacket OH-735 LTE outdoor unit. On the outside it has a SIM slot and an ethernet interface. Access to the web interface is pretty restricted, not much to set and it is branded with ...
James's user avatar
  • 21
0 votes
0 answers
102 views

Reverse engineering what seems to be a checksum used for RS232 packets

I will try to be as concise as possible: the issue is, I'm trying to develop a custom application for a dielectric tester. I have access to the original program, which was made some 20 years ago or ...
Davide's user avatar
  • 1
1 vote
0 answers
433 views

Getting rid of a custom Shell on a LiteOS based outdoor camera

I started reversing this camera in order to get rid of the unwanted traffic it constantly does towards Chinese servers. I have a serial access to it thanks to an obvious UART port (bottom left in the ...
iMil's user avatar
  • 141
1 vote
1 answer
116 views

ASUS RP-AC51 UART doesn't work with any common baud rate

I have an ASUS RP-AC51. It doesn't broadcast any WiFi network when powered on, the management interface cannot be accessed over Ethernet, and the reset button seemingly does nothing. I decided to try ...
localhost's user avatar
0 votes
1 answer
129 views

determine proprietary 16-bit floating-point format

Background / Introducion CAN message Mercedes-Benz, cannot determine 16-bit data type for temperature. 7E 00 32 01 37 00 According to @rnd-ash (who has reverse engineered ACTIA Basic XS Monitor ...
alecxs's user avatar
  • 113
1 vote
0 answers
128 views

Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly

I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login. I get a prompt ...
Jeremy's user avatar
  • 263
1 vote
1 answer
87 views

How to capture control flow pins on emulated serial port?

I am reverse engineering how a CPS software package communicates to a radio device. I have the basics down, and want to trick the software into thinking COM1 is the radio, when in reality I want to ...
Farhan Yusufzai's user avatar
0 votes
1 answer
93 views

Strategies for Deciphering RS-232 Data

I'm working with an old irrigation controller that is connected to a PC via the DB9 serial port. I was able to capture that data (tapped into the appropriate TX wire) on a separate laptop, but now I'm ...
CragMonkey's user avatar
1 vote
0 answers
395 views

Tapping into Ford SCP BUS

I'm looking to tap into the Ford SCP BUS to display text onto my dashboard on my '01 Jaguar S-Type. This car has a two row screen that displays the odometer, average fuel consumption - amongst other ...
rileyhayes_'s user avatar
1 vote
1 answer
713 views

Is it possible to see the traffic on Virtual COM Port to reverse engineer how a device works?

I have a USB device that when connected into the computer ends up showing up as 4 Virtual COM ports in the device manager. As far as I know, two of these are never used. One of them is seldom used and ...
quantum231's user avatar
2 votes
1 answer
95 views

The Logic Of Incremental Data on Serial Communication Encoding

These are the serial communication reverse values. I am trying to understand the logic behind this. I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct. I tried ...
ömer faruk Cebir's user avatar
2 votes
0 answers
28 views

LIN bus frame replacement

I am searching for a way to replace certain frames on a LIN bus network. My aim is to be able to intercept a frame in transmission, and change certain bits. Naturally, that involves recalculating the ...
Slav's user avatar
  • 41
2 votes
1 answer
1k views

Reverse UART communication protocol

I'm objective is to build a custom wifi module to be used on a Samsung AC AR24HSFSAWKN. I have such an official module SWL-B70F for which I'm trying to reverse engineer the communication with the main ...
KumZ's user avatar
  • 141
1 vote
1 answer
1k views

Wrong keyboard strokes sent to serial in putty

I am attempting to communicate to a device i have via the onboard rx/tx solder points i found on the board. I am doing this via an arduino uno. The problem i am having is that when i connect to it ...
Mattigins's user avatar
  • 111
0 votes
1 answer
191 views

Can a UART port change baud rate at runtime?

I've been probing this CCTV DVR board trying to find a serial port to see if I can get console access to it. I found a set of 4 through holes with no headers that looked like a good candidate. I ...
jvergeldedios's user avatar
0 votes
1 answer
54 views

How to determine commands sent over DC-37 port by software from 1992

Background Since some time we've been in the possession of a greenhouse. It was build around 1990 and had an automated system for climate control. However most of the installation has been removed ...
Bjorn De Rijcke's user avatar
1 vote
1 answer
138 views

t.amp Quadro 500 DSP - calculate checksum

I'm trying to decode the protocol to control the PA amp t.amp Quadro 500 DSP (also branded as FiveO AR4). The serial interface is provided by an PL2303 interface, Baud 57600 8N1. To set volume on ...
user1863017's user avatar
2 votes
1 answer
262 views

Reverse engineering 12-byte serial packets from doorbell

I'm trying to reverse engineer the protocol used by a fairly old video intercom. Using a UART logic analyser was able to guess the baud rate, data bits, start/stop bit. It idles at 14v and pulls to ...
user2006221's user avatar
2 votes
3 answers
219 views

Reverse Engineering RS232 protocol misterious last byte

I have an old water purifier system that consists of a PDA and a main board (I think the ic is a Renesas) that communicate by RS232, I need to know the protocol they use to communicate in order to ...
Pep's user avatar
  • 31
1 vote
2 answers
1k views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...
Terramoto's user avatar
3 votes
2 answers
382 views

Reverse engineering the IBM BSC (Bisync) protocol

I am trying to connect to an old piece of communication controller which use the IBM BSC synchronous protocol but I have problems to get the CRC right. Background The protocol itself is described ...
Mattis Lind's user avatar
1 vote
1 answer
63 views

id the HW port and protocol

i have a vtech baby monitor and since i want to be aware of it while i'm playing in VR (PC, HTC vaive/Valve index) i still want to see if the baby starts crying. on this monitor there is external ...
Anton Vainer's user avatar
0 votes
0 answers
72 views

Checksum of an old serial devices

I've got an old devices which communicate through serial port. There's main device which send simple commands and then asked device responds. I've got almost all sorted out. The only thing left is the ...
h2pc's user avatar
  • 1
4 votes
1 answer
222 views

What is an "mpi register base"?

For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a ...
Rulon Rock's user avatar
2 votes
1 answer
3k views

Help decoding this UART serial signal

I'm trying to break into a doorbell. It has a clearly labeled TX pin. Here's the output from my Labrador oscilloscope/logic analyzer.. I can't get it to make any sense though. Any ideas? I have the ...
justin's user avatar
  • 475
3 votes
1 answer
546 views

Help determining pinout for communications port

I have a Panasonic air conditioner that has a header on the mainboard that various optional (expensive) addon communications modules can connect into eg wifi The unit is a Panasonic Split system from ...
Andrew B.'s user avatar
9 votes
1 answer
5k views

Identifying a toner chip and its communication protocol to re-program it

I need help identifying a chip and how to reset it from a new Brother's toner cartridge TN227 and TN223. This comes from the new Brother HL-L3230CDW laser printer. There is currently no information on ...
benjinne's user avatar
1 vote
1 answer
3k views

2byte checksum for serial traffic

I'm working on an RFID reader that has partial implementation with ISO/IEC 14443-4 although not specifically compliant. I can decode a lot of the strings and understand the command base but I have not ...
Andrew V's user avatar
0 votes
0 answers
136 views

Reverse engineer 8 bit check sequence for old unkown protocol

I am using an old piece of hardware which uses an RS485 serial interface. I'm trying to simulate slave node data but I don't have any documentation on the protocol and unfortunately the hardware is ...
Moon Waxing's user avatar
0 votes
1 answer
1k views

Reverse engineering checksum from RS-485 device

Attempting to reverse-engineer a checksum for a serial timing device that updates a display. Protocol is partly understood, however the checksum calculation specified does not produce the expected ...
r a's user avatar
  • 101
3 votes
1 answer
2k views

Sniffing serial Bluetooth traffic on Android

Related to UE Megaboom serial protocol: I am trying to get some insights on the serial protocol spoken by the UE Megaboom, which I suspect is how the app controls the advanced features of the speaker. ...
user149408's user avatar
2 votes
1 answer
351 views

UE Megaboom serial protocol

I recently got a UE Megaboom Bluetooth speaker. Apart from various audio profiles, I noticed the speaker also exposes a Serial Port BT profile. I suspect this is the channel the app uses to control ...
user149408's user avatar
2 votes
1 answer
543 views

Why can't I decode this UART signal?

I have a modem that I'm trying to get into. It's composed of two SoCs, both with UART headers. I was already successful trying to connect to the first SoC's UART, with my USB-to-UART CP2102 decoder ...
Bernardo Donadio's user avatar
2 votes
1 answer
374 views

What is this RS-485 communication protocol/

I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a samsung heat pump. Here are some hex commands I was able to sniff. Every message starts with 0x32 and ...
Lagers's user avatar
  • 21
3 votes
1 answer
609 views

Decipher variable length serial protocol

I have an ebike consisting of a controller which regulates power to the motor and a smart LCD which can adjust max speed, power output, pedal assist sensitivity etc as well as displaying the current ...
Mike's user avatar
  • 33
1 vote
0 answers
63 views

How to make sense of this one pin serial communication

I am trying to reverse engineer a serial communication between to microcontrollers (1 device & 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and ...
Saren Tasciyan's user avatar
0 votes
1 answer
439 views

Decoding serial data package

I have an assignment at work, to get information from Jenbacher generator and show values in new SCADA system. It has a B&R CP260 PLC with RS232 port and RS232 to RS485 converter. Currently it’s ...
coddr's user avatar
  • 1
1 vote
1 answer
444 views

Hex timestamp decode

I am trying to decode this hex timestamp: 5A24 B103 73AE --> 02/26/2018 15:45:44 5A24 FC03 83BC --> 02/26/2018 17:00:48 5A24 FE03 93E3 --> 02/26/2018 17:02:58 Data is coming from an old ...
fparaggio's user avatar
  • 133
5 votes
1 answer
2k views

How to identify SWD (Serial Wire Debug) pinout?

When trying to access firmware, JTAG and SWD can be really helpful to the reverse engineer. When looking at an unknown board/device tools such as JTAGEnum or JTAGulator are really helpful in ...
pzirkind's user avatar
  • 437
2 votes
0 answers
152 views

serial protocol patterns

I am reversing a serial 232 protocol and I found these pattern in the data. E5 A7 CD 01 00 79 .. .. 40 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21 follows some recording and expected approx ...
fparaggio's user avatar
  • 133
1 vote
1 answer
2k views

Finding JTAG/UART Connections

I need help identifying the UART or JTAG connections on this board. I would like to dump the firmware using a pirate bus.
pi0's user avatar
  • 11