I'm reversing a RS485 comunication. I have purchased a logical analyzer for reversing and sniffing the data packets. But i have a problem, don't knowing the exactly comunication parameters i can't "decrypt" the data passing over the bus. How i can reverse this?
I attach a screenshot about the analysis and the used comunication parameters.
Edit: I know that this data segment work at 250kbps and are a segment of varius packet each constructed by 38 bytes. These bytes are some ASCII characters.
UART data is sent with one active bit to start, and at least one inactive bit to stop.
Here:
It seems to be plain old 8,n,1 (8 data bits, no parity, one stop bit), sending 0x00. It could also be that stop is 2, or since data are always zero in the captured frames, parity is odd. Or even that it's transmitting a ninth bit and data are 0x100.
As for the packet, it looks all zeroes? Not exactly enough pixels in the view but it looks very regular regardless. You'll need some way to stimulate data out of the thing to make any progress decoding it. Sharing what the device is, would likely prove useful, and you may also consider reverse-engineering it, for various methods of attack: direct connections to data sources (ADCs, other comm channels, etc.), dumping the firmware (it might be locked, but there's a chance it's not, and there are ways to bypass the check) and reverse-engineering that, etc.
The second waveform is a packet (?), then, assuming it is common UART serial data format, and assuming it has protocols in good shape:
The very beginning of the packet has "flag" and "headers". In the middle somewhere has "payload". If the data are for sure ASCII; capture a few, expand the timing, find the patterns of '0' or '1' appearing at either the b[0] or b[7] (since it likely is 8 bits data stream). ASCII data is loaded in 7 bits, so the MSB likely be the same, unless it does "don't care". Start/stop bits can be resolved by a similar analisys. Please do the capture, and post.
