7 votes
Accepted

HackRF One - Replay Attack on Garage Door does not work (12 DIP switches)

I believe both keyfobs send the same data which is 1111 0000 0100 Second keyfob is repeating signal 3 times. DIP encoding to signal would be byte by byte with swapped nibbles. 00001111 10 => 11 ...
  • 186
6 votes
Accepted

What Checksum/CRC algorithm in RF packet?

The checksum algorithm is simple indeed. It adds all the payload bytes modulo 0xFF and then adds 26. I wrote a script to test it: #!/usr/bin/python import binascii def checksum(data): payload =...
4 votes
Accepted

Identifying protocol in a pcap file?

Is it possible to identify a protocol in a pcap file? Yes, but this appears to be a proprietary protocol over TCP/IP. The first four bytes of every message is a 32-bit big-endian value that ...
4 votes

Router's serial port only outputs garbage

If this is data, then there should be a common clock, with the raising/falling edge signals all on individual ticks of that clock. I scaled the bottom half of your scope output by 500% horizontally, ...
3 votes
Accepted

Deducing Protobuf Schema and Datatypes

I suspect these are IEEE doubles. For example, 0x3fd3333333333333 is 2.99999999999999988897769753748E-1, or around 0.3. I used this converter to check
  • 35.1k
3 votes
Accepted

Reverse engineer checksum algorithm

You seem to have the same air conditioner like the guy who asked this question. Add up bytes 0-11, xor with 0x55 to get byte 12. It could help if you stated the brand and model number of your AC unit,...
3 votes

Router's serial port only outputs garbage

Your signal is very degraded: your rise and fall times are too slow relative to the bit rate. If the signal really looks as your scope plot shows, and this is not just a measurement issue, then it's ...
  • 131
3 votes
Accepted

What checksum algorithm is this network protocol using?

Got it! The algorithm is a CRC with the following parameters, stored in those two bytes as a big-endian short: Polynomial: 0x2e97 Xor In Value: 0 Xor Out Value: 0 Reflect Input: True Reflect Out: ...
  • 41
3 votes

Decrypt SSL/TLS traffic from a Java web applet

You don't really need another tool if you know how to use wireshark. Wireshark will let you extract the TCP part of a stream, which is exactly what you'll get using any kind of proxy or network bridge ...
3 votes
Accepted

How to analyze packets?

It may be the case that it's CBC-encrypted data, with the first field being a nonce. Or one of many other possibilities. Either way, as Guntram said in his comment above, you'd need to reverse ...
3 votes
Accepted

How to calculate the checksum algorithm with data captures

The first byte starts as 0E is then 0F and then 10. This looks something like a sequential message id, not part of a checksum. The second byte has a pattern to it too and, taking into account the ...
  • 2,249
3 votes

Modern tools for reversing binary network protocols

Check out Kaitai Struct. Basically you define a binary format in YAML, and it will generate code to deserialize the format. There is a github repo with quite a few existing definitions, including one ...
  • 176
2 votes
Accepted

Books/tutorial on reversing protocol

The Malware Analysis Tutorial 1 on Dr Fu's Security Blog involves running a piece of malware inside a Windows VM and capturing its network traffic using wireshark in a Linux VM set up for the purpose. ...
  • 1,960
2 votes

Reverse engineer DB25 protocol

In addition to Guntram Blohm's answer, I would spend time looking up the data sheets for the ICs on the board. Your pictures are too blurry to read part numbers. The data sheet will usually contain ...
2 votes
Accepted

How to identify HTML5 geolocation protocol of a browser?

For Firefox (i.e. Gecko) and Chrome (i.e. Blink) you can just look in the source code: Searching the Firefox codebase for getCurrentPosition yields the source file nsGeolocation.cpp. As you see in ...
  • 136
2 votes
Accepted

Calculating check sum of m-bus data frame

just one sample is never sufficient to answer a checksum query you need a bunch of samples to corelate and find patterns so looking at the linked pdf it seems it is clear enough skip the start and ...
  • 15.2k
2 votes
Accepted

Understanding decoding communications over interfaces

A comment in your previous question pointed out that your hydrometer likely uses the M-Bus or Meter-Bus protocol, and your fields in question are all thoroughly explained in the documentation of said ...
2 votes

Daikin A/C 4bit CRC/Checksum

Not sure why my last question was deleted.. anyway here is the answer - the bit order of the sum at the end is reversed.. uint8_t rev(uint8_t b) { b = (b & 0xF0) >> 4 | (b & 0x0F) &...
  • 21
2 votes

Understanding a messengers protocol encryption

Just as an example, consider the source code for AES at https://polarssl.org/aes-source-code. This has various tables, one of which is the Forward S-Box, FSb - which should be the same in all AES ...
2 votes
Accepted

DPFMate Keychain tool

Digital Keychain Photo viewer thingies are sensitive. For DPFMate: You need to use the cable that came with the thingy. The thingy has to be in "UPDATE" mode. It needs to be fully charged before use (...
2 votes

NFC Tag reverse engineering failed by a non-responding tag

Some RFID cards indeed only provide their IDs. IDs are then matched to a database to say, decide if a door should be opened. It's really up to the card. The two ways I can think of to identify the ...
  • 11.4k
2 votes
Accepted

What is the format of this time?

Converting the numbers to ASCII, we get: 0 ~ 9 = 0 ~ 9 (0x30 ~ 0x39) 10 ~ 35 = A ~ Z (0x41 ~ 0x5a) 36 ~ 61 = a ~ z (0x61 ~ 0x7a) It is encoded this way probably to make it human-readable.
  • 446
2 votes
Accepted

reversing ios notes file format

You are right about the 14th byte being the length on (some) short notes, like your file 4: 00000000 08 00 12 d6 02 08 00 10 00 1a cf 02 12 1b 54 68 ..............Th 00000010 69 73 20 6e 6f 74 65 ...
2 votes
Accepted

Decipher variable length serial protocol

I understand your Arduino serves as a relay in the middle between the controller and the LCD. What you could do (not extremely exciting, but you did not mention whether you made similar experiments ...
  • 1,814
2 votes

Can't identify checksum type in unknown RS485 protocol

Found the solution: It is a XOR checksum with an initial key "5A" (not including the first four HEX values). 02 00 01 01 [01 00 00 02 40 00] 19 03 5A ^ 01 ^ 00 ^ 00 ^ 02 ^ 40 ^ 00 = 19
2 votes

UE Megaboom serial protocol

If the device doesn’t respond to unsolicited traffic, it probably needs some specific commands to return results. You could try bruteforcing it by sending random data but it’s a chancy business. A ...
  • 35.1k
2 votes

Modern tools for reversing binary network protocols

Everyone would like a magic tool which makes it less tedious to reverse an unknown binary protocol. I hope we will see some things in the next 12 months which do this. Difficult Problem Previous ...
2 votes

Is it possible to sniff an ATA Drive password?

This tutorial (NB: in Italian) covers recovering ATA passwords from the drive itself. Not for the faint of heart, and drive controller firmware dependent. You might also post on forum.hddguru.com as ...
1 vote

Methods for Reverse engineering proprietary protocol

This could be a self-clocking protocol like Manchester encoding. Also check the patent database for any patents from the companies involved; quite possibly there may be hints there.
  • 35.1k
1 vote

How to monitor/reverse engineer RS485-connected display device traffic?

Rs485 just physical interface, your bms use some of logical protocol to communicate with management /reporting software. You can try to find well known protocol for 485 interface here: https://en....

Only top scored, non community-wiki answers of a minimum length are eligible