SAT messages

[visualapproach]

Interesting! When I start up in SAT mode, the first thing my HU says is this (HEX):
C0 1B 76 0 92 FF
C0 1B 76 1 3 FF
C0 1B 76 2 5 FF
C0 1D 76 80 0 FF FF FF
C3 1F 7C 0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C3 1F 7C 1 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C3 1F 7C 2 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C1 1B 7F 1 8 FF FF FF FF FF FF FF FF FF

(FF is when HU is waiting for an answer. Could you sniff what one should fill in here?)

After a short while following message repeats from the HU (It seems like a info-request)

C1 1B 7F 1 8 FF FF FF FF FF FF FF FF FF

After answering the HU with random stuff it says:

C5 19 73 4 4 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 20
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C2 1D 73 0 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

Do your device behave like this too?

[VincentGijsen]

I've uploaded a first version: https://github.com/VincentGijsen/melbus-sniffed-traffic/blob/master/melbus_bluetooth_pins_visualap.ino which fills out most of the FF's, its basically your version, with other commands .

I've also added the full-boot sequence (altered my serialnr),

[VincentGijsen]

it's rather messy, but i'll cleanup once the whole init works as expected

[visualapproach]

Awesome!

The illegal quoting you mentioned in the boot sequence, is that something iMIV sends or is it the arduino compiler? Guess I could test for the later ;-)

[VincentGijsen]

The full csv log is from the imiv so it's a fully correct boot sequence, up to sending text. The last commands are from pressing all the buttons in semi-ascending order. I'm not really sure what you mean by 'illegal quoting' though.

…

On 14 Aug 2017, at 12:38, visualapproach ***@***.***> wrote: Awesome! The illegal quoting you mentioned in the boot sequence, is that something iMIV sends or is it the arduino compiler? Guess I could test for the later ;-) — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[visualapproach]

I thought You wrote: "We can make this file beautiful and searchable if this error is corrected: Illegal quoting in line 311." in the .csv file. I didn't fully understand what it was about. But it's clear to me now, that github added that line :-D

[VincentGijsen]

Hahah indeed , I was looking at the file, at line 311.. there was a " but nothing else. Must have been your editor/viewer.

…

Sent from my iPhone

On 14 Aug 2017, at 14:42, visualapproach ***@***.***> wrote: You wrote "We can make this file beautiful and searchable if this error is corrected: Illegal quoting in line 311." in the .csv file. I didn't fully understand what it was about. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[VincentGijsen]

just a side-note on your initial data, the c5-FF (as in starting with it).. i've not seen thus far, perhaps a response to your random data. So I cannot provide you the resulting data ;) which HU are you using?

I could try to pose as the HU, and see if there is a response to your data, that would take some time (to cook up a master).

Maybe we can write a small proxy, to tunnel the data back and forth between your radio and the internet to my imiv. However timing will probably become a major issue, so it should proxy and cache results ;)

[visualapproach]

Check out the new branch on my page. Hope it helps you along because right now I'm stuck and out of steam. I accidentally made the display show "224" once but I can't reproduce it. I'm not sure if the new sendByteToMelbus2() works or not.

[VincentGijsen]

i've copied it, but no text as of yet, made some changes this evening tried it, no luck so far, made more changes, but didn't test them yet. I also added some background on the sniffing bits. Tomorrow i'll fireup my iron, and add a splitter to the arduio pins, so I can validate the timing of the master-clock and responses perhaps this is tricky, although it shouldn't. I can also send you the raw capturefile per mail, you just need the seleae-logic viewer (works without hw). Which is a great peace of software by the way

[visualapproach]

Ok its [email protected] if you wanna send some logs. I don't have that program but if its a free download I'll have a look at it.
When I was testing I noticed that the HU throwed an extra FF at me after the C_inits were filled in. If I didn't fill in anything there was 30 bytes of FF. Give it 30 bytes and it gives me another FF. Disturbing but might be a thing to examine more. It might be a sw bug but why does it work for other commands then?