0

I have an IoT device, which communicates with a cloud server via UDP. The device receives a command to turn on/off every couple of seconds based on a cloud schedule.

I believe the chip inside the device is similar to an arduino pro mini. It has an external serial to wifi bridge which "opens" the UDP connection to the server.

Commands from server:

CMD22246A00M10C239S004!9S1$
CMD22246A00M10C239S280!WM0$
CMD22246A00M10C075S960!X2I$
CMD22246A00M10C239S520!ME5$
CMD22246A00M10C075S811!EPJ$

I will explain the data a bit in case that helps.

  • Time in these packets is 22:46
  • The first 2 stands for Wednesday (0 being Monday)
  • A00 basically means turn off (supply 0 amps) - This changes to A10 when it is allowed to turn on
  • M10 is the maximum configured amps the devices should be allowed to pass through
  • CXXX I have no idea about
  • SXXX I have no idea about
  • And the 3 alphanumerics between the ! and $ seem to be a checksum. The letters are always uppercase.

The device reports data back to the cloud similarly with a 3 alphanumeric checksum at the end

I have tried "injecting" command data into the device via a separate UDP server but they are all have no effect unless I replay valid ones from the server.

I have tried various online tools and checksum/crc calculators but cannot seem to find any matches.

Thanks in advance.

Update

I have just started to notice that similar packets have a very similar "checksum" at the end. Here is a link to all my data from every Wednesday at 23:46, sorted alphabetically which gives the best string matches when starting left. I have started to notice that data that is "+1" to its neighbour, might have the checksum be +1 in the first character of the checksum.

Full data set here: https://pastebin.com/n6LgrDfh
Same data but split with symbols removed: https://pastebin.com/Q8q4ANEE

I have split these examples and removed the symbols for easier reading:

CMD22346A10M10 C075 S274 FZD
CMD22346A10M10 C075 S275 EZD
CMD22346A10M10 C075 S276 DZD
CMD22346A10M10 C075 S277 CZD

CMD22346A10M10 C073 S515 P60
CMD22346A10M10 C073 S516 Q60
CMD22346A10M10 C073 S517 J60

Update 2

There are never any letter O in the check characters.

Jesserockz
  • 1
  • 3
  • If you look at many messages, what is the largest letter in the third position of the check? – Mark Adler Aug 21 '20 at 16:08
  • Thanks for the reply, largest is Z, so it looks like it's using all the alphabet and numbers. I thought maybe it might be a version of base36. Just updated with more data and some findings. – Jesserockz Aug 21 '20 at 20:53

0 Answers0