Reverse engineering communication protocols - Page 1
Forum section: electronics / beginners

author: regiscruzbr
author_rank: Newbie
timestamp: December 09, 2017, 06:49:54 pm
content: Hello peopleI'm looking for any kind of information about reverse engineering communication protocols. I mean, tutorials, softwares, tips, first steps and more...I've never done it before and I already checked some articles, videos, blogs and I got to the conclusion that it's a tough task, but I need to start from somewhere, right?Here is the thing, I have this nice 1800VA UPS (Uninterruptible Power Source) for a long time, I really like it, never had any problem with it besides replace the battery after couple of years. It have a RS232 and USB interface for monitoring, it's a cool feature that allows the UPS turn off devices like computer, for example, before the battery goes out of power.Now I don't need it for the primary task anymore. So I'm thinking about reuse it to work as a power backup for my NAS (Network Attached Storage), my router and my cable modem, just it. But here is the problem, my NAS have a shutdown sequence like any regular computer and I can't just cut the power from it.So, my UPS need to tell my NAS to shut itself down (using the RS232 link) before it goes out of power. But they use different communication protocols, so I'm thinking about decode the UPS protocol using an Arduino for example to translate the commands to my NAS.But first, I need reverse engineering the communication protocol from my UPS that by the way, looks like it is a proprietary one based on my research. I don't think about turn it into a product, I just want to solve my problem.I have experience with electronics, so no problems for probing signals or make changes on the circuit. I do have some documentation, schematics and data from the logic analyser that I extracted from the device, if anybody interested.Thanks everyone.Reginaldo Cruz

author: regiscruzbr
author_rank: Newbie
timestamp: December 09, 2017, 10:33:06 pm
content: If anybody with experience on my problem wants to help... Here is what I have done so far.My UPS is an SMS µNW NET WINNER 1800BIFX.LinktranslatedLinkEsq_Nobreak_T09234-01_Net_Winner_Expert_1800-2000.pdfThis schematic can be easily found on the internet, I just Google the PCB part number.LinkCY7C63723.pdfThis is the IC responsible for the USB interface, it is the CY7C63723, just a Ps2 to USB converter from Cypress, between the microcontroller and the CY7C63723 is just a regular bidirectional synchronous serial protocol, like an old keyboard or mouse, passing through a photocoupler. I used these lines to probed de communication between the UPS and the computer.LinkMessage Serial EN.pngIn this image is my first attempt to analyze the communication between the UPS and the computer, I used a logic analyzer to collect the data.Each frame has a short description of the UPS status at the time I extracted the data, note that I tried different situations to analyze how the bytes changed, but I did not succeed in the interpretation. I'm afraid that those data are encrypted. The communication is not continuous, they are 18 byte frames that repeat every second. These are the data from the UPS to PC, the pc data was disconnected from the logic analyzer.LinkMessage temperature.pngThis is more interesting, I replaced the LM19 (IC5 see schematic) temperature sensor with a variable power supply and so I was able to simulate the temperature change in the MOSFETs heatsink to monitor the data. To my surprise, only 2 bytes were changed and the remaining ones remained intact. The temperature is the one being displayed on the PC.LinkMessage EN.pngHere I associate the logical analyzer data with a print screen of the app interface. I changed the input voltage of the UPS and apparently managed to identify the bytes responsible for transmitting the AC input voltage and the output voltage. I noticed that the last byte always changed whenever any other byte also changed, I believe this is the checksum byte.LinkNetwork UPS Tools - Driver blazer_ser for SMS BrazilLinkDriver Blaser_ser DocumentationLinkThe Network UPS Tools repositoryThe above links are from an open source driver that apparently allows this UPS to communicate with computers running Linux. As I do not understand much about Linux I was lost, but I believe it is my best find so far. I am still reading and trying to understand the documentation, but to no success.Linkmanual APC UPS.pdfLinkProtocolo Megatec UPS.pdfJust for reference, the USA manufacture APC use an open source protocol on their products, looks like it is not the same protocol.ThanksReginaldo Cruz

author: paulca
author_rank: Super Contributor
timestamp: December 10, 2017, 08:25:31 am
content: Linux is the OS running on Raspberry PIs which comes out-of-the-box capable of running NUTS.I'd have a crack at one of these and then modify it when you get it working. Not all of it will be needed to talk to the UPS, some is added guilding.http://wynandbooysen.com/raspberry-pi-ups-server-using-nut.htmlhttps://melgrubb.com/2016/12/11/rphs-v2-ups/