0
\$\begingroup\$

I get an unkown string when activating an UART-communication protocol of two devices I can't name here. That string is different everytime the devices are pared. The communication protocol acts as described here:

  1. The master device (dev A) sends a random looking string, containing 19 bytes total, where 3 bytes are start- or stopbytes (they are present in every random string). This random string is send everytime around 10ms-20ms.
  2. When the slave device (dev B) is connected with dev A, it looks like dev B decode this string and sends another random looking string back. Dev B only sends a random string when connected to dev A.
  3. If that random string got received by dev A, it starts a communication routine where - i think - dev B configures some registers of dev A. Unlike the previous mentioned strings, these strings are not encoded and don't look random either. They don't look random because they are periodic (the same (ASCII) value returns every round and looks like an adress with a set-value after it, in the same string).

Here are some specs: Physical: USART Packet Protocol: UNKOWN Baudrate: 38400 bps Voltage lvl min/max: 0/3,3 V

Here are some examples of random-looking strings I've gathered with a terminal program, connected with a USB to TTL cable:

Example 1 - some of the random looking strings of dev A --> dev B (ASCII): 1. AóôD/À¿êf¬—s6Єž 2. AóôA/‘¿ŠfÕ—6(„Ð 3. Aóô[/ž¿<0>f—¦6„¹

Note: the first 4 bytes return as the same value every random string (Aóô), startbytes maybe?

Example 2 - some of the random-looking strings of dev A --> B (HEX):

  1. 0x02, 0x41, 0xF3, 0xD7, 0x51, 0xBE, 0xA1, 0x82, 0xF0, 0xB9, 0x8C, 0x9B, 0x87, 0x6B, 0x88, 0x2D, 0xB1, 0x1C, 0x00

  2. 0x02, 0x41, 0xF3, 0xEC, 0xA7, 0x9B, 0x03, 0xFB, 0xC0, 0xE3, 0x93, 0x29, 0x7B, 0x7D, 0x64, 0x20, 0xF6, 0x67, 0x46

  3. 0x02, 0x41, 0xF3, 0x95, 0x0E, 0xC2, 0x57, 0x6B, 0xFC, 0x23, 0xB1, 0x8B, 0xF6, 0x6C, 0x9B, 0x4F, 0xB3, 0x88, 0x6F

Note: the first 3 bytes return in every random string (0x02, 0x41, 0xF3). Note: this value differs from the ASCII value, maybe the ASCII value isn't known in the lookup table of the terminal I use, but I'm not sure.

Example 3 - some of the random looking strings of dev B --> A (ASCII):

  1. Aóô[/ž¿<0>f—¦6„¹

  2. AóôA/‘¿ŠfÕ—6(„Ð

Example 4 - some of the random looking strings of dev B --> A (HEX):

  1. 0x02, 0x41, 0xF3, 0xE3, 0xDA, 0xD2, 0xF1, 0x4C, 0xCD, 0x72, 0x18, 0xCA, 0xFD, 0x51, 0x70, 0xFE, 0x08, 0x1C, 0x7B

  2. 0x02, 0x41, 0xF3, 0x34, 0x3F, 0x59, 0x32, 0xC1, 0x47, 0x07, 0xF3, 0x1E, 0x94, 0xD1, 0x2F, 0x5E, 0xC5, 0x04, 0x6A, 0x00

Note: every string "answer" ends with a NULL value.

I already tried to program my STM32F407 microcontroller so that it reads the random-looking strings from dev B while the output of dev A is connected with the input of dev B. Then to send these strings to dev A. It works, but i can't find a pattern so I can reproduce the signal without dev B.

The communication is needed so a function of dev A can be activated. I need to reproduce the signals ascending from dev B with a microcontroller, so dev B wouldn't be nessecarly to activate a function of dev A.

\$\endgroup\$
  • 3
    \$\begingroup\$ You're better off waiting for us to migrate questions, rather than deleting and cross-posting. \$\endgroup\$ – Peter K. Apr 20 '18 at 15:32
  • 1
    \$\begingroup\$ If you can't name the devices, there's not much we're going to be able to do. The "random looking strings" sound like some sort of challenge-response (zero-knowledge proof) type of authentication protocol. If you don't know the protocol, or the secret data, there's not much you can do to break it without a lot of effort. \$\endgroup\$ – Dave Tweed Apr 20 '18 at 16:19
  • \$\begingroup\$ Peter K. I'm sorry I cross-post the question, I thought it was quicker to get my answer that way. It wasn't my intention to harm someone if I did. Dave Tweed the zero-knowledge could be it. I only can't imagine why someone would want this protocol only with the authentication and not the whole communication (when going safe). To bad I have no information about the protocol or secret data. What I can do however, is to send some known strings with the microcontroller to dev B and analyse its response. Is this recommended? Is there something else I could do maybe? I am open for options \$\endgroup\$ – Raymond de Hooge Apr 21 '18 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.