16 votes
Accepted

RS-485 Checksum Reverse Engineering (Watlow EZ-Zone PM)

I downloaded the EZ-ZONE Configurator and reverse engineered it to see how it works. The serial data you're seeing is actually the BACnet MS/TP (master-slave/token-passing) protocol. You can find the ...
user avatar
12 votes
Accepted

Finding out checksum algorithm

It's a big-endian CRC16 (polynomial 0x8005) of the data from the byte following the 0x82 up to and including the byte before the CRC. For example, for your last RX frame: 82 00 00 00 ff 00 00 00 01 ...
user avatar
  • 881
9 votes
Accepted

Thought I found serial port - broke embedded device instead! Help?

Frying your board: Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a ...
user avatar
8 votes

Thought I found serial port - broke embedded device instead! Help?

I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already). Single pin touching with a probe can blow up your HW. And I do not mean the ...
user avatar
  • 1,374
8 votes
Accepted

Decoding serial data

You know that 72 will be in the data each time. Lets convert that to hex which is 48. We can see that clearly in each packet. It's preceded by 3 0 bytes presumable because it's written out as a 32 ...
user avatar
8 votes
Accepted

I really struggled to figure it out, now can anyone help me reverse engineer this checksum?

The key is getting getting a megaton of samples, so that the analysis has something to feed on. It really helps if you can stick the samples in a database table or dictionary that can be queried ...
user avatar
  • 1,960
6 votes

Determining CRC algorithm (16 bit?) over RS-232

I figured it out! Some of the comments on this web site made me go back and think harder - actually to think differently. I thought that I should post the analysis that I did on these messages to try ...
user avatar
5 votes
Accepted

Hex timestamp decode

import sys import os if(len(sys.argv) != 2): sys.exit("usage %s 0xdead" % os.path.basename(sys.argv[0])) if((sys.argv[1].startswith("0x")!=True) or (len(sys.argv[1])!=6 )): sys.exit("0x ...
user avatar
  • 15k
4 votes

Router's serial port only outputs garbage

If this is data, then there should be a common clock, with the raising/falling edge signals all on individual ticks of that clock. I scaled the bottom half of your scope output by 500% horizontally, ...
user avatar
4 votes
Accepted

Reverse engineering serial communication CRC algorithm

This question seems simpler than you might expect. Since as OP noted, the code is irrelevant to validation mechanism used in the discussed system, I shall ignore it. It is indeed irrelevant as will ...
user avatar
  • 11.4k
4 votes
Accepted

Need help with a USB gaming mouse

my understanding of USB is very low at best (even if I do develop some simple USB devices for a living) so read this with major prejudice... Your driver class and configuration must match the USB (...
user avatar
  • 1,374
4 votes

Reverse engineering the IBM BSC (Bisync) protocol

If you have known data and a known CRC, and an unknown value (like the initial CRC value or the final XOR value), you can always loop through all possible values and find those that give you the ...
user avatar
4 votes
Accepted

Reverse engineering the IBM BSC (Bisync) protocol

SOLUTION I got help from a guy named Peter. He gave me a piece of test code in C. The CRC algorithm looked pretty similar to the ones I already tried. But what was important was that he pointed out ...
user avatar
3 votes

Router's serial port only outputs garbage

Your signal is very degraded: your rise and fall times are too slow relative to the bit rate. If the signal really looks as your scope plot shows, and this is not just a measurement issue, then it's ...
user avatar
  • 131
3 votes

Decoding proprietary 485 comms

I would hardly call this an answer, but I can't comment yet.. You need additional data. Have you tried opening the outdoor unit and examining the board that you're communicating with? you might find ...
user avatar
  • 151
3 votes

Reverse engineering USB peripheral driver

Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a ...
3 votes
Accepted

2byte checksum for serial traffic

It is a CRC-A checksum. 16bits. Preface: From my research this is the crc for that standard. Its calculated from start of packet up to checksum https://crccalc.com Put 8209 and check the result: ...
user avatar
  • 178
2 votes

Reverse engineer DB25 protocol

In addition to Guntram Blohm's answer, I would spend time looking up the data sheets for the ICs on the board. Your pictures are too blurry to read part numbers. The data sheet will usually contain ...
user avatar
2 votes
Accepted

Understanding decoding communications over interfaces

A comment in your previous question pointed out that your hydrometer likely uses the M-Bus or Meter-Bus protocol, and your fields in question are all thoroughly explained in the documentation of said ...
user avatar
2 votes

Anti-theft system rs485 keypad

It is quite possible the master device requires keypad to answer within a specific time window. Adding a man-in-the-middle violates these conditions. To analyze data direction, you can try connecting ...
user avatar
2 votes

Decoding proprietary 485 comms

I managed to decode the protocol on XYE connection. My findings are here https://codeberg.org/xye/xye The XYE connection is the bus between a central controller and the indoor units. The bus from the ...
user avatar
  • 21
2 votes

Finding JTAG/UART Connections

In the second picture on the bottom there is an nonpupulated connector, whose pins are labeled RX and TX. Thats at least one of maybe more uart interfaces. You should additionaly check the traces on ...
user avatar
2 votes
Accepted

Decipher variable length serial protocol

I understand your Arduino serves as a relay in the middle between the controller and the LCD. What you could do (not extremely exciting, but you did not mention whether you made similar experiments ...
user avatar
  • 1,814
2 votes

Why can't I decode this UART signal?

Answering my own question: just figured out that the board that the CP2102 decoder was mounted on had a LED wired to the RXD line. It happens that this board was poorly designed, and this LED was set ...
user avatar
2 votes

UE Megaboom serial protocol

If the device doesn’t respond to unsolicited traffic, it probably needs some specific commands to return results. You could try bruteforcing it by sending random data but it’s a chancy business. A ...
user avatar
  • 34.9k
2 votes

Sniffing serial Bluetooth traffic on Android

According to this StackOverflow answer, Android has a setting in Developer Options from 4.4 onwards. You first need to enable Developer Settings (if you have not done so already), then enable “Enable ...
user avatar
2 votes

Reverse engineering checksum from RS-485 device

The protocol spec clearly does not apply to your device, so don't bother trying to use its checksum calculation. However it may be similar enough to provide some clues to the actual protocol. The ...
user avatar
2 votes

Help decoding this UART serial signal

Every UART packets contains a start bit what is always 0 and 1 or 2 stop bit(s) what is/are always 1. If you check the middle of your trace there are single 1 bits with some spaces between them. Every ...
user avatar
2 votes
Accepted

Reverse engineering 12-byte serial packets from doorbell

Based on how you have laid it out, you look to have it mostly mapped out correctly, The preamble (control device wake up) would be a general broadcast message to all units on the data bus, (The pull ...
user avatar
  • 136
2 votes

Wrong keyboard strokes sent to serial in putty

You have probably tried already but other baud rates? 9600, 1200, 2400, 57600 Seems like 8,N,1 is common? 8 DATA, No parity, and 1 STOP bit Maybe helpful? https://stackoverflow.com/questions/...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible