Questions tagged [serial-communication]
Process of sending data one bit at a time, sequentially, over a communication channel or computer bus. Most of the computer systems, and especially embedded systems, have such communication port.
94
questions
0
votes
0
answers
20
views
Microchip ATSAME70Q21-CN unable to connect with JTAG or SWD
First time delving into hardware reverse engineering and can't seem to connect using JTAG nor SWD. I found two identical devices that I'm trying to understand how they work and see if I can extract ...
- 1
0
votes
0
answers
39
views
Reverse Engineering A RS-485 Steam Shower Protocol
Scenario:
A residential steam shower with a control box, touch pad display, and single input contact sensor on a half-duplex, RS-485 daisy chained network.
Goal:
Determine RS-485 based Link Layer from ...
0
votes
0
answers
59
views
embedded Linux, UART & JTAG disabled, how to access system?
So i have this device running embedded Linux, UART and JTAG interfaces are disabled by software. The device creates a WiFi hotspot and i know the password. By entering the devices IP adress i can ...
- 1
1
vote
0
answers
47
views
Reading/writing flash ROM connected to OMAP L138 without JTAG
I have a product that uses an OMAP L138 with a flash rom. There are a couple different models of this product available, but they all share the same hardware with the only difference being the ...
- 141
3
votes
1
answer
213
views
Reverse Engineer 16 Bit error checking byte calculation
Hello =) I am attempting to reverse engineer a communications protocol to some obsolete equipment. Communication happens on an RS485 line.
I have captured several exchanges and seem to have figured ...
- 151
3
votes
0
answers
302
views
How can I disable watchdog in U-boot using mw command
So I have DVR with 2*Hi3511RBC CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ) and when I enter U-boot (how do I know that I'm in U-boot ? ) well over UART I get following message
U-Boot 1.1.4 (...
- 515
2
votes
0
answers
46
views
Greenpacket OH-735 onboard header
I got myself a Greenpacket OH-735 LTE outdoor unit. On the outside it has a SIM slot and an ethernet interface. Access to the web interface is pretty restricted, not much to set and it is branded with ...
- 21
0
votes
0
answers
95
views
Reverse engineering what seems to be a checksum used for RS232 packets
I will try to be as concise as possible: the issue is, I'm trying to develop a custom application for a dielectric tester. I have access to the original program, which was made some 20 years ago or ...
- 1
1
vote
0
answers
390
views
Getting rid of a custom Shell on a LiteOS based outdoor camera
I started reversing this camera in order to get rid of the unwanted traffic it constantly does towards Chinese servers.
I have a serial access to it thanks to an obvious UART port (bottom left in the ...
- 141
1
vote
1
answer
100
views
ASUS RP-AC51 UART doesn't work with any common baud rate
I have an ASUS RP-AC51. It doesn't broadcast any WiFi network when powered on, the management interface cannot be accessed over Ethernet, and the reset button seemingly does nothing.
I decided to try ...
- 11
0
votes
1
answer
126
views
determine proprietary 16-bit floating-point format
Background / Introducion
CAN message Mercedes-Benz, cannot determine 16-bit data type for temperature.
7E 00 32 01 37 00
According to @rnd-ash (who has reverse engineered ACTIA Basic XS Monitor ...
- 113
1
vote
0
answers
115
views
Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly
I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login.
I get a prompt ...
- 263
1
vote
1
answer
67
views
How to capture control flow pins on emulated serial port?
I am reverse engineering how a CPS software package communicates to a radio device. I have the basics down, and want to trick the software into thinking COM1 is the radio, when in reality I want to ...
- 271
0
votes
1
answer
90
views
Strategies for Deciphering RS-232 Data
I'm working with an old irrigation controller that is connected to a PC via the DB9 serial port.
I was able to capture that data (tapped into the appropriate TX wire) on a separate laptop, but now I'm ...
- 101
1
vote
0
answers
331
views
Tapping into Ford SCP BUS
I'm looking to tap into the Ford SCP BUS to display text onto my dashboard on my '01 Jaguar S-Type.
This car has a two row screen that displays the odometer, average fuel consumption - amongst other ...
- 11
1
vote
1
answer
563
views
Is it possible to see the traffic on Virtual COM Port to reverse engineer how a device works?
I have a USB device that when connected into the computer ends up showing up as 4 Virtual COM ports in the device manager. As far as I know, two of these are never used. One of them is seldom used and ...
- 111
2
votes
1
answer
85
views
The Logic Of Incremental Data on Serial Communication Encoding
These are the serial communication reverse values.
I am trying to understand the logic behind this.
I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct.
I tried ...
2
votes
0
answers
26
views
LIN bus frame replacement
I am searching for a way to replace certain frames on a LIN bus network. My aim is to be able to intercept a frame in transmission, and change certain bits. Naturally, that involves recalculating the ...
- 31
2
votes
1
answer
918
views
Reverse UART communication protocol
I'm objective is to build a custom wifi module to be used on a Samsung AC AR24HSFSAWKN. I have such an official module SWL-B70F for which I'm trying to reverse engineer the communication with the main ...
- 141
1
vote
1
answer
1k
views
Wrong keyboard strokes sent to serial in putty
I am attempting to communicate to a device i have via the onboard rx/tx solder points i found on the board. I am doing this via an arduino uno.
The problem i am having is that when i connect to it ...
- 111
0
votes
1
answer
173
views
Can a UART port change baud rate at runtime?
I've been probing this CCTV DVR board trying to find a serial port to see if I can get console access to it. I found a set of 4 through holes with no headers that looked like a good candidate. I ...
- 113
0
votes
1
answer
51
views
How to determine commands sent over DC-37 port by software from 1992
Background
Since some time we've been in the possession of a greenhouse. It was build around 1990 and had an automated system for climate control. However most of the installation has been removed ...
- 103
1
vote
1
answer
132
views
t.amp Quadro 500 DSP - calculate checksum
I'm trying to decode the protocol to control the PA amp t.amp Quadro 500 DSP (also branded as FiveO AR4).
The serial interface is provided by an PL2303 interface, Baud 57600 8N1.
To set volume on ...
- 21
2
votes
1
answer
235
views
Reverse engineering 12-byte serial packets from doorbell
I'm trying to reverse engineer the protocol used by a fairly old video intercom. Using a UART logic analyser was able to guess the baud rate, data bits, start/stop bit. It idles at 14v and pulls to ...
- 23
2
votes
3
answers
215
views
Reverse Engineering RS232 protocol misterious last byte
I have an old water purifier system that consists of a PDA and a main board (I think the ic is a Renesas) that communicate by RS232, I need to know the protocol they use to communicate in order to ...
- 31
1
vote
2
answers
890
views
Can a secondary UART be used to access the MCU?
I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it.
The board is also lacking information like serial pins and the ...
- 11
3
votes
2
answers
356
views
Reverse engineering the IBM BSC (Bisync) protocol
I am trying to connect to an old piece of communication controller which use the IBM BSC synchronous protocol but I have problems to get the CRC right.
Background
The protocol itself is described ...
- 71
1
vote
1
answer
58
views
id the HW port and protocol
i have a vtech baby monitor and since i want to be aware of it while i'm playing in VR (PC, HTC vaive/Valve index) i still want to see if the baby starts crying.
on this monitor there is external ...
- 13
0
votes
0
answers
71
views
Checksum of an old serial devices
I've got an old devices which communicate through serial port. There's main device which send simple commands and then asked device responds. I've got almost all sorted out. The only thing left is the ...
- 1
4
votes
1
answer
208
views
What is an "mpi register base"?
For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a ...
- 41
2
votes
1
answer
3k
views
Help decoding this UART serial signal
I'm trying to break into a doorbell. It has a clearly labeled TX pin.
Here's the output from my Labrador oscilloscope/logic analyzer.. I can't get it to make any sense though. Any ideas? I have the ...
- 475
3
votes
1
answer
530
views
Help determining pinout for communications port
I have a Panasonic air conditioner that has a header on the mainboard that various optional (expensive) addon communications modules can connect into eg wifi
The unit is a Panasonic Split system from ...
- 31
8
votes
1
answer
4k
views
Identifying a toner chip and its communication protocol to re-program it
I need help identifying a chip and how to reset it from a new Brother's toner cartridge TN227 and TN223. This comes from the new Brother HL-L3230CDW laser printer.
There is currently no information on ...
- 81
1
vote
1
answer
3k
views
2byte checksum for serial traffic
I'm working on an RFID reader that has partial implementation with ISO/IEC 14443-4 although not specifically compliant. I can decode a lot of the strings and understand the command base but I have not ...
- 13
0
votes
0
answers
134
views
Reverse engineer 8 bit check sequence for old unkown protocol
I am using an old piece of hardware which uses an RS485 serial interface. I'm trying to simulate slave node data but I don't have any documentation on the protocol and unfortunately the hardware is ...
- 101
0
votes
1
answer
964
views
Reverse engineering checksum from RS-485 device
Attempting to reverse-engineer a checksum for a serial timing device that updates a display. Protocol is partly understood, however the checksum calculation specified does not produce the expected ...
- 101
3
votes
1
answer
2k
views
Sniffing serial Bluetooth traffic on Android
Related to UE Megaboom serial protocol: I am trying to get some insights on the serial protocol spoken by the UE Megaboom, which I suspect is how the app controls the advanced features of the speaker.
...
- 171
2
votes
1
answer
344
views
UE Megaboom serial protocol
I recently got a UE Megaboom Bluetooth speaker. Apart from various audio profiles, I noticed the speaker also exposes a Serial Port BT profile. I suspect this is the channel the app uses to control ...
- 171
2
votes
1
answer
493
views
Why can't I decode this UART signal?
I have a modem that I'm trying to get into. It's composed of two SoCs, both with UART headers. I was already successful trying to connect to the first SoC's UART, with my USB-to-UART CP2102 decoder ...
1
vote
0
answers
281
views
What is this RS-485 communication protocol/
I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a samsung heat pump.
Here are some hex commands I was able to sniff. Every message starts with 0x32 and ...
- 11
3
votes
1
answer
570
views
Decipher variable length serial protocol
I have an ebike consisting of a controller which regulates power to the motor and a smart LCD which can adjust max speed, power output, pedal assist sensitivity etc as well as displaying the current ...
- 33
1
vote
0
answers
63
views
How to make sense of this one pin serial communication
I am trying to reverse engineer a serial communication between to microcontrollers (1 device & 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and ...
- 111
0
votes
1
answer
436
views
Decoding serial data package
I have an assignment at work, to get information from Jenbacher generator and show values in new SCADA system. It has a B&R CP260 PLC with RS232 port and RS232 to RS485 converter. Currently it’s ...
- 1
1
vote
1
answer
424
views
Hex timestamp decode
I am trying to decode this hex timestamp:
5A24 B103 73AE --> 02/26/2018 15:45:44
5A24 FC03 83BC --> 02/26/2018 17:00:48
5A24 FE03 93E3 --> 02/26/2018 17:02:58
Data is coming from an old ...
- 133
5
votes
1
answer
2k
views
How to identify SWD (Serial Wire Debug) pinout?
When trying to access firmware, JTAG and SWD can be really helpful to the reverse engineer.
When looking at an unknown board/device tools such as JTAGEnum or JTAGulator are really helpful in ...
- 437
2
votes
0
answers
150
views
serial protocol patterns
I am reversing a serial 232 protocol and I found these pattern in the data.
E5 A7 CD 01 00
79 .. .. 40
00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
follows some recording and expected approx ...
- 133
1
vote
1
answer
1k
views
Finding JTAG/UART Connections
I need help identifying the UART or JTAG connections on this board.
I would like to dump the firmware using a pirate bus.
- 11
6
votes
3
answers
6k
views
Reverse engineering USB peripheral driver
I'm looking to reverse engineer a Windows driver for a printer I have here. I found out a bit about USB sniffing but I don't think Snoopy runs on Windows 7. I know the driver is on my computer ...
- 71
4
votes
0
answers
382
views
Trouble finding the right Checksum algorithm
After reading a lot of posts here and their solutions, Punching lines in CRC calculators for several days now. I can't seem to find on which Checksum this code is based.
Background
This is a data ...
5
votes
1
answer
1k
views
Need help with a USB gaming mouse
I have a Chinese USB gaming mouse (04d9:a070) which has 4 color modes and 4 light levels. I know for a fact that this mouse is capable for showing at least 5 different color so it must be an RGB led (...
- 53