Tag Info

Accepted

HackRF One - Replay Attack on Garage Door does not work (12 DIP switches)

I believe both keyfobs send the same data which is 1111 0000 0100 Second keyfob is repeating signal 3 times. DIP encoding to signal would be byte by byte with swapped nibbles. 00001111 10 => 11 ...
• 186
Accepted

What Checksum/CRC algorithm in RF packet?

The checksum algorithm is simple indeed. It adds all the payload bytes modulo 0xFF and then adds 26. I wrote a script to test it: #!/usr/bin/python import binascii def checksum(data): payload =...
• 1,391

Modern tools for reversing binary network protocols

Check out Kaitai Struct. Basically you define a binary format in YAML, and it will generate code to deserialize the format. There is a github repo with quite a few existing definitions, including one ...
• 206
Accepted

How to calculate the checksum algorithm with data captures

The first byte starts as 0E is then 0F and then 10. This looks something like a sequential message id, not part of a checksum. The second byte has a pattern to it too and, taking into account the ...
• 2,558
Accepted

Deducing Protobuf Schema and Datatypes

I suspect these are IEEE doubles. For example, 0x3fd3333333333333 is 2.99999999999999988897769753748E-1, or around 0.3. I used this converter to check
• 36.8k
Accepted

Reverse engineer checksum algorithm

You seem to have the same air conditioner like the guy who asked this question. Add up bytes 0-11, xor with 0x55 to get byte 12. It could help if you stated the brand and model number of your AC unit,...
Accepted

What is the format of this time?

Converting the numbers to ASCII, we get: 0 ~ 9 = 0 ~ 9 (0x30 ~ 0x39) 10 ~ 35 = A ~ Z (0x41 ~ 0x5a) 36 ~ 61 = a ~ z (0x61 ~ 0x7a) It is encoded this way probably to make it human-readable.
• 466
Accepted

reversing ios notes file format

You are right about the 14th byte being the length on (some) short notes, like your file 4: 00000000 08 00 12 d6 02 08 00 10 00 1a cf 02 12 1b 54 68 ..............Th 00000010 69 73 20 6e 6f 74 65 ...
Accepted

DPFMate Keychain tool

Digital Keychain Photo viewer thingies are sensitive. For DPFMate: You need to use the cable that came with the thingy. The thingy has to be in "UPDATE" mode. It needs to be fully charged before use (...

Can't identify checksum type in unknown RS485 protocol

Found the solution: It is a XOR checksum with an initial key "5A" (not including the first four HEX values). 02 00 01 01 [01 00 00 02 40 00] 19 03 5A ^ 01 ^ 00 ^ 00 ^ 02 ^ 40 ^ 00 = 19
Accepted

Decipher variable length serial protocol

I understand your Arduino serves as a relay in the middle between the controller and the LCD. What you could do (not extremely exciting, but you did not mention whether you made similar experiments ...
• 1,974

NFC Tag reverse engineering failed by a non-responding tag

Some RFID cards indeed only provide their IDs. IDs are then matched to a database to say, decide if a door should be opened. It's really up to the card. The two ways I can think of to identify the ...
• 11.8k

Reverse UART communication protocol

From my question: It seems to work :) Is the message length more or less ;) See procedure bellow Still wondering if it's a "common/standard protocol"? Procedure I have removed the module ...
• 141

UE Megaboom serial protocol

If the device doesn’t respond to unsolicited traffic, it probably needs some specific commands to return results. You could try bruteforcing it by sending random data but it’s a chancy business. A ...
• 36.8k

Daikin A/C 4bit CRC/Checksum

Not sure why my last question was deleted.. anyway here is the answer - the bit order of the sum at the end is reversed.. uint8_t rev(uint8_t b) { b = (b & 0xF0) >> 4 | (b & 0x0F) &...
• 21

Is it possible to sniff an ATA Drive password?

This tutorial (NB: in Italian) covers recovering ATA passwords from the drive itself. Not for the faint of heart, and drive controller firmware dependent. You might also post on forum.hddguru.com as ...
• 878

Modern tools for reversing binary network protocols

Everyone would like a magic tool which makes it less tedious to reverse an unknown binary protocol. I hope we will see some things in the next 12 months which do this. Difficult Problem Previous ...
• 878
Accepted

Reverse Engineer an ultrasonic cartridge communication with the station to bypass remaining uses

I think its pretty obvious it is my first time doing this. Example: FB 05 01 03 86 00 8E BF FB: Opens comm 05 01 03: Cartridge model 86 00: The actual number. 86 = a, a = X/150, 00 = b, b = X%150, ...
• 41
1 vote

Reversing DALY BMS BLE protocol

You can check this Python library for reference. It doesn't work for all commands, but you'll have the basics. The Daly BMS (at least mine) uses this TTL-to-Bluetooth dongle. It will basically allows ...
• 11
1 vote

How to determine a type of binary serialization?

Without reverse engineering, it may be difficult to guess what are these data. However, you can harvest many packets then diff/observe them to determine the size of data filed, which data remain, ...
• 76
1 vote

On reverse engineering an udp protocol to control a drone

If you use an android app, you may use network debuggers such as https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture this also supports UDP This might be easier to use/retrieve ...
• 146
1 vote

Modern tools for reversing binary network protocols

It's may be worth checking out writing dissectors for Wireshark. This is a good tutorial using Lua.
• 947
1 vote

What checksum algorithm is this?

I think there may be some noise on the line. Lauren Labell has a tool to try and automate reversing checksums: https://github.com/laurenlabell/checksum_finder Here's what it generated: # start: 0 end:...
• 878
1 vote

Manufacturer interface on OCZ Agility 4 SSD

J5 looks like a UART connector and the JT_ pins are likely JTAG. UART should give you console access to manufacturing/diagnostic commands, and JTAG should allow you to the debug the code (firmware) ...
• 36.8k
1 vote

What's wrong with my mitm to support rr commands with gdbserver on IDA?

It turned out IDA sends first sends vCont;c and then vCont;s:1 for some weird reason in that particular instance. I fixed my mitm : const net=require("net") const process = require('process'); net....
• 475
1 vote

Checksum field within IR protocol

I don't have an actual answer but this grew too long to be a comment so I'm adding it down here. I'm sure you've noticed that the bit-patterns of that byte you're interested in aren't particularly ...
• 171
1 vote

How to monitor/reverse engineer RS485-connected display device traffic?

Rs485 just physical interface, your bms use some of logical protocol to communicate with management /reporting software. You can try to find well known protocol for 485 interface here: https://en....
1 vote

How to monitor/reverse engineer RS485-connected display device traffic?

Renogy just solved the entire problem for me. They finally finished up their own software. So instead of sniffing RS485 they now have a USB cable and software that gives finer control over their ...
• 329
1 vote

How to monitor/reverse engineer RS485-connected display device traffic?

I am working on the same thing, with a Renogy Commander. Upvote. It is very similar to scraping web sites, because a lot of it is text and graphics to draw the screen, then there are variables ...
• 329
1 vote

Methods for Reverse engineering proprietary protocol

This could be a self-clocking protocol like Manchester encoding. Also check the patent database for any patents from the companies involved; quite possibly there may be hints there.
• 36.8k

Only top scored, non community-wiki answers of a minimum length are eligible