19
You may capture the traffic with packet sniffer to capture all the communications of client\server application, or You may use reverse proxy to intercept and alter data in real time.
In simple words, network sniffers allow You to see data flow between client and server, analyse it and reverse the protocol communications
Reverse proxy intercept communication ...
15
I downloaded the EZ-ZONE Configurator and reverse engineered it to see how it works.
The serial data you're seeing is actually the BACnet MS/TP (master-slave/token-passing) protocol. You can find the Wireshark protocl decoder for it here. However, to save you the time, I'll help you get to the meat of calculating those check bytes.
In BACnet parlance, 55 ...
11
It's a big-endian CRC16 (polynomial 0x8005) of the data from the byte following the 0x82 up to and including the byte before the CRC.
For example, for your last RX frame:
82 00 00 00 ff 00 00 00 01 01 4c 4f 0c 6a 83
The CRC16 of {0x00,0x00,0x00,0xff,0x00,0x00,0x00,0x01,0x01,0x4c,0x4f} is 0x0c6a.
To find out this CRC algorithm, I assumed that 0x82 was a '...
10
As Jason Geffner said its a DIN 45326 connector.
As far as I know they're normally used in audio, but here is a pin out while used for serial.
Next step would be using an Oscilloscope to determine the baud rate (and voltage). Often the oscilloscope software has some build in tools for automatically determining the baud rate. If not, you simple divide 1 by ...
9
Frying your board:
Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a board:
static electricity. Every instruction to insert a PCI card in your computer comes with a warning about that, and there is a reason. However, i found ...
8
If you have an oscilloscope, it should be pretty easy to determine at least the baud rate. Then you just need to play with the parity and stop bits.
If you don't have it, there's no real way around bruteforce. However, usually you don't have to try all combinations.
probably at least 90% embedded devices I've seen use 115200-8-N-1 (115200 baud, 8 data bits,...
8
You know that 72 will be in the data each time. Lets convert that to hex which is 48. We can see that clearly in each packet.
It's preceded by 3 0 bytes presumable because it's written out as a 32 bit int (for some reason).
preceding that we can see a 00 00 01 c9 lets convert that in its entirety to decimal: That turns out to be 457 10 times more than what ...
8
I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already).
Single pin touching with a probe can blow up your HW.
And I do not mean the obvious static charge or what so ever from the common reasons. With nowadays chips some pins runs on very specific voltage ranges and even a high impedance ...
7
The key is getting getting a megaton of samples, so that the analysis has something to feed on. It really helps if you can stick the samples in a database table or dictionary that can be queried interactively, e.g. from some sort of script shell. Python should work admirably but I don't have much experience with it, as I've been using Visual FoxPro for ...
7
There are a couple of ways that come to mind. The first would be to use a network packet analyzer on the actual client running the application. Some well known packet analyzers are Wireshark, tcpdump, and even Microsoft Network Monitor.
Another alternative would be to intercept the traffic via man-in-the-middle (M. The easiest way to do this (if you control ...
6
My guess:
DL20I000000V80050300DE076A0012000400AF002400FF030300DE0700000000010003000000B883
^^ ^ ^ ^^^^
|| Addr Data CRC16
|` Length
` Data tag
D for data
L20 for 0x20 or 32 hex bytes, or 64 hex digits
I000000 the address (note ...
5
I figured it out! Some of the comments on this web site made me go back and think harder - actually to think differently.
I thought that I should post the analysis that I did on these messages to try to determine the CRC algorighm.
My analysis is based on a paper written by Greg Ewing http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-...
5
If the network traffic is in "plain text" (not encrypted) then a network sniffer such as Wireshark is ideal.
If the network traffic is encrypted via SSL but you have the private key (or if the client application does not validate the server's public key) then you can use a proxy such as Burp.
If the network traffic is encrypted via SSL and you don't have ...
5
Just before posting this answer I realized he's asking how to do this on windows and my answers is for Mac. I'm posting it regardless because I believe it might be useful for others trying to perform the same thing but then using a Mac
If you're using a Mac, then it's really easy by the combination of a Remote Virtual Interface (rvi) and Wireshark. Note ...
5
import sys
import os
if(len(sys.argv) != 2):
sys.exit("usage %s 0xdead" % os.path.basename(sys.argv[0]))
if((sys.argv[1].startswith("0x")!=True) or (len(sys.argv[1])!=6 )):
sys.exit("0x prefixed hexinput must be in range 0x0000 to 0xffff padded to 4 digits")
indate = int(sys.argv[1],16)
year = str(((indate & 0xfe00) >> 9) + 2000)...
4
If this is data, then there should be a common clock, with the raising/falling edge signals all on individual ticks of that clock.
I scaled the bottom half of your scope output by 500% horizontally, and had gimp overlay a grid on it, playing with the width and shift of the grid until i found something that looks like it could be the clock (click the image ...
4
A simple logic analyzer, such as the Saleae is invaluable for finding simple transmit serial pins. Receive serial pins are harder due to them being silent.
Are you sure that this is RS232 and not just serial? It's pretty rare to see RS232 on embedded systems unless they're industrial. RS232 goes way above TTL levels.
4
Another option that's pointed out in the comments above by @CallMeV is to use hooking. On Windows you may look at using EasyHook.
4
my understanding of USB is very low at best (even if I do develop some simple USB devices for a living) so read this with major prejudice...
Your driver class and configuration must match the USB (mouse) device
I do not know how your USB mouse is programmed but interface must be the same (CDC class can have more interfaces) and if not match then the USB ...
3
If I was doing this, in the absence of any other information at all, the first thing I would do is connect the sub to its console, and then cut open the cable and hook up a logic analyser or even just use a CRO to see what is happening on each of the 15 lines, and try and identify:
Whether a line is even being used
If it is simply just power (3v3, 5 or even ...
3
You may want to perform Automatic baud rate detection
There are a couple of projects on github that implement these such as BAUD RATE RS232 DETECTOR EXAMPLE for atmega8
You may also want to use RS232enum that uses Arduino to try to enumerate all serial lines (RX/TX).
3
Your signal is very degraded: your rise and fall times are too slow relative to the bit rate. If the signal really looks as your scope plot shows, and this is not just a measurement issue, then it's no surprise that you cannot get coherent data out of it. Serial port signals should have very clean and well-defined rise and fall times relative to the baud ...
3
This question seems simpler than you might expect.
Since as OP noted, the code is irrelevant to validation mechanism used in the discussed system, I shall ignore it. It is indeed irrelevant as will be shown below.
as the first byte in each message indeed looks like a preamble, we'll ignore it. Our goal is to recover the function which, when applied to the ...
3
If you have known data and a known CRC, and an unknown value (like the initial CRC value or the final XOR value), you can always loop through all possible values and find those that give you the answer you want. It might not be practical for 32-bit CRCs, but for 8- and 16-bit CRCs it shouldn't take too long to run.
You'll need at least two sets of known ...
3
SOLUTION
I got help from a guy named Peter. He gave me a piece of test code in C. The CRC algorithm looked pretty similar to the ones I already tried. But what was important was that he pointed out that the first sample message most likely had a bit error.
#include <stdio.h>
int crc16(unsigned char *ptr, int count)
{
unsigned int crc;
char i;...
2
In addition to Guntram Blohm's answer, I would spend time looking up the data sheets for the ICs on the board. Your pictures are too blurry to read part numbers. The data sheet will usually contain information about what the part does and example circuits along with pinouts. Tracing pins from known pins on ICs to the pins on the connector will go a long ...
2
A comment in your previous question pointed out that your hydrometer likely uses the M-Bus or Meter-Bus protocol, and your fields in question are all thoroughly explained in the documentation of said protocol (PDF)
The C-Field is the control field and defines what function is being performed (page 23 of the above PDF). It is an 8-bit value where the lowest ...
2
I would hardly call this an answer, but I can't comment yet..
You need additional data.
Have you tried opening the outdoor unit and examining the board that you're communicating with? you might find it has some debug interfaces (serial or something else). It might provide additional information - debug prints when a command is received for example.
...
2
It is quite possible the master device requires keypad to answer within a specific time window. Adding a man-in-the-middle violates these conditions.
To analyze data direction, you can try connecting a small value resistor (100 — 1k) in series in the line between the devices. Connect an oscilloscope to the line. Signal voltage level will be slightly ...
2
Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a DLL. If that were not the case you'd be looking for a .sys file of some kind.
Microsoft has come up with a number of "simplified" driver models over the years....
Only top voted, non community-wiki answers of a minimum length are eligible
