15
I downloaded the EZ-ZONE Configurator and reverse engineered it to see how it works.
The serial data you're seeing is actually the BACnet MS/TP (master-slave/token-passing) protocol. You can find the Wireshark protocl decoder for it here. However, to save you the time, I'll help you get to the meat of calculating those check bytes.
In BACnet parlance, 55 ...
11
It's a big-endian CRC16 (polynomial 0x8005) of the data from the byte following the 0x82 up to and including the byte before the CRC.
For example, for your last RX frame:
82 00 00 00 ff 00 00 00 01 01 4c 4f 0c 6a 83
The CRC16 of {0x00,0x00,0x00,0xff,0x00,0x00,0x00,0x01,0x01,0x4c,0x4f} is 0x0c6a.
To find out this CRC algorithm, I assumed that 0x82 was a '...
10
As Jason Geffner said its a DIN 45326 connector.
As far as I know they're normally used in audio, but here is a pin out while used for serial.
Next step would be using an Oscilloscope to determine the baud rate (and voltage). Often the oscilloscope software has some build in tools for automatically determining the baud rate. If not, you simple divide 1 by ...
9
Frying your board:
Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a board:
static electricity. Every instruction to insert a PCI card in your computer comes with a warning about that, and there is a reason. However, i found ...
8
I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already).
Single pin touching with a probe can blow up your HW.
And I do not mean the obvious static charge or what so ever from the common reasons. With nowadays chips some pins runs on very specific voltage ranges and even a high impedance ...
8
You know that 72 will be in the data each time. Lets convert that to hex which is 48. We can see that clearly in each packet.
It's preceded by 3 0 bytes presumable because it's written out as a 32 bit int (for some reason).
preceding that we can see a 00 00 01 c9 lets convert that in its entirety to decimal: That turns out to be 457 10 times more than what ...
7
The key is getting getting a megaton of samples, so that the analysis has something to feed on. It really helps if you can stick the samples in a database table or dictionary that can be queried interactively, e.g. from some sort of script shell. Python should work admirably but I don't have much experience with it, as I've been using Visual FoxPro for ...
6
My guess:
DL20I000000V80050300DE076A0012000400AF002400FF030300DE0700000000010003000000B883
^^ ^ ^ ^^^^
|| Addr Data CRC16
|` Length
` Data tag
D for data
L20 for 0x20 or 32 hex bytes, or 64 hex digits
I000000 the address (note ...
5
I figured it out! Some of the comments on this web site made me go back and think harder - actually to think differently.
I thought that I should post the analysis that I did on these messages to try to determine the CRC algorighm.
My analysis is based on a paper written by Greg Ewing http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-...
5
import sys
import os
if(len(sys.argv) != 2):
sys.exit("usage %s 0xdead" % os.path.basename(sys.argv[0]))
if((sys.argv[1].startswith("0x")!=True) or (len(sys.argv[1])!=6 )):
sys.exit("0x prefixed hexinput must be in range 0x0000 to 0xffff padded to 4 digits")
indate = int(sys.argv[1],16)
year = str(((indate & 0xfe00) >> 9) + 2000)...
4
If this is data, then there should be a common clock, with the raising/falling edge signals all on individual ticks of that clock.
I scaled the bottom half of your scope output by 500% horizontally, and had gimp overlay a grid on it, playing with the width and shift of the grid until i found something that looks like it could be the clock (click the image ...
4
my understanding of USB is very low at best (even if I do develop some simple USB devices for a living) so read this with major prejudice...
Your driver class and configuration must match the USB (mouse) device
I do not know how your USB mouse is programmed but interface must be the same (CDC class can have more interfaces) and if not match then the USB ...
3
Your signal is very degraded: your rise and fall times are too slow relative to the bit rate. If the signal really looks as your scope plot shows, and this is not just a measurement issue, then it's no surprise that you cannot get coherent data out of it. Serial port signals should have very clean and well-defined rise and fall times relative to the baud ...
3
If I was doing this, in the absence of any other information at all, the first thing I would do is connect the sub to its console, and then cut open the cable and hook up a logic analyser or even just use a CRO to see what is happening on each of the 15 lines, and try and identify:
Whether a line is even being used
If it is simply just power (3v3, 5 or even ...
3
You may want to perform Automatic baud rate detection
There are a couple of projects on github that implement these such as BAUD RATE RS232 DETECTOR EXAMPLE for atmega8
You may also want to use RS232enum that uses Arduino to try to enumerate all serial lines (RX/TX).
3
This question seems simpler than you might expect.
Since as OP noted, the code is irrelevant to validation mechanism used in the discussed system, I shall ignore it. It is indeed irrelevant as will be shown below.
as the first byte in each message indeed looks like a preamble, we'll ignore it. Our goal is to recover the function which, when applied to the ...
3
If you have known data and a known CRC, and an unknown value (like the initial CRC value or the final XOR value), you can always loop through all possible values and find those that give you the answer you want. It might not be practical for 32-bit CRCs, but for 8- and 16-bit CRCs it shouldn't take too long to run.
You'll need at least two sets of known ...
3
SOLUTION
I got help from a guy named Peter. He gave me a piece of test code in C. The CRC algorithm looked pretty similar to the ones I already tried. But what was important was that he pointed out that the first sample message most likely had a bit error.
#include <stdio.h>
int crc16(unsigned char *ptr, int count)
{
unsigned int crc;
char i;...
2
In addition to Guntram Blohm's answer, I would spend time looking up the data sheets for the ICs on the board. Your pictures are too blurry to read part numbers. The data sheet will usually contain information about what the part does and example circuits along with pinouts. Tracing pins from known pins on ICs to the pins on the connector will go a long ...
2
A comment in your previous question pointed out that your hydrometer likely uses the M-Bus or Meter-Bus protocol, and your fields in question are all thoroughly explained in the documentation of said protocol (PDF)
The C-Field is the control field and defines what function is being performed (page 23 of the above PDF). It is an 8-bit value where the lowest ...
2
It is quite possible the master device requires keypad to answer within a specific time window. Adding a man-in-the-middle violates these conditions.
To analyze data direction, you can try connecting a small value resistor (100 — 1k) in series in the line between the devices. Connect an oscilloscope to the line. Signal voltage level will be slightly ...
2
I would hardly call this an answer, but I can't comment yet..
You need additional data.
Have you tried opening the outdoor unit and examining the board that you're communicating with? you might find it has some debug interfaces (serial or something else). It might provide additional information - debug prints when a command is received for example.
...
2
Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a DLL. If that were not the case you'd be looking for a .sys file of some kind.
Microsoft has come up with a number of "simplified" driver models over the years....
2
In the second picture on the bottom there is an nonpupulated connector, whose pins are labeled RX and TX. Thats at least one of maybe more uart interfaces.
You should additionaly check the traces on the pcb between that connector and the main micro controller. It might be that the nonpopulated pads at R1 need to be shortened to have a connection.
2
I understand your Arduino serves as a relay in the middle between the controller and the LCD. What you could do (not extremely exciting, but you did not mention whether you made similar experiments already, and I hope I understood your situation well):
Modification of single bits. If you visually observe the display and connect a switch at your Arduino ...
2
If the device doesn’t respond to unsolicited traffic, it probably needs some specific commands to return results. You could try bruteforcing it by sending random data but it’s a chancy business.
A more likely approach is to sniff the traffic from the official app or at least try to analyze it statically.
2
According to this StackOverflow answer, Android has a setting in Developer Options from 4.4 onwards. You first need to enable Developer Settings (if you have not done so already), then enable “Enable Bluetooth HCI snoop log”.
I have not tried this myself yet, but according to the information I could find:
Communication should be logged to a file called /...
2
The protocol spec clearly does not apply to your device, so don't bother trying to use its checksum calculation. However it may be similar enough to provide some clues to the actual protocol.
The protocol should include some method of synchronizing the serial data stream. In the (incorrect) spec this could be done using the high nibbles (8,9,A,B) that all ...
2
It is a CRC-A checksum. 16bits.
Preface: From my research this is the crc for that standard.
Its calculated from start of packet up to checksum
https://crccalc.com
Put 8209 and check the result: 3C1D. This is byte swapped due to endian. Probably why you didn't find it.
Let me know if you need help, be happy to help code it.
Here is a c++ ...
2
Every UART packets contains a start bit what is always 0 and 1 or 2 stop bit(s) what is/are always 1. If you check the middle of your trace there are single 1 bits with some spaces between them. Every single bits are stop bit and after every stop bits a new start bit begins. These are the borders of a packet. If you draw some rectangles with the same width ...
Only top voted, non community-wiki answers of a minimum length are eligible
