9
\$\begingroup\$

I'm trying to reverse engineer a communication line between two components. However for debugging I'm connecting to only one of them, powering it up and looking at the signal. I have no experience with this so I'm really stumbling around with some basic knowledge and having once or twice used an oscilloscope 15y ago.

To guide myself, I opened the device to see the PCB, which seems to indicate that the physical layer is RS485 (it says RS485 on the board right next to the connector!). There's 4 wires: one ground, one 5V and an A and B labeled wires.

enter image description here

A nearby component on the PCB is this thing which I believe is a System-on-a-Chip? Googling for "sh6mdbt40" and it seems to support SPI, I2C and UART for serial communication. As far as I can understand from some googling, UART is the only one of those that would work over RS485, so I've been assuming that the communication is probably UART over RS485. (I don't really know what I'm doing or if what I'm saying makes any sense)

enter image description here

I bought an oscilloscope and connected to it. The voltage seems to be 5V and the signal lines are inverse of each other when I look at lines A and B. However from reading about UART, I assume the waveform would be shorter (1 start bit, up to 8 data bits, 1 parity bits, up to 2 stop bits) than what I'm seeing. As in, there would be maybe up to 12 changes of "state" in the waveform. But I'm counting ~64 edges.

enter image description here

I believe the smallest features are 25µs wide (I measured ~75µs across 3 small features).

enter image description here enter image description here

Does this mean a baud rate of 40,000?

It seems like the message is about 5ms wide:

enter image description here

And that messages are sent every 120ms:

enter image description here

How should I approach this problem? Is there a sort of basic set of facts I'm missing, and a decision tree I could use, to guide my discovery here? What does this waveform looks like it would be?

\$\endgroup\$
6
  • 2
    \$\begingroup\$ You'd only expect a shorter waveform if the device sent 1 byte at a time with a delay in between. From the looks of it, it sends 15-20 bytes with a string of multiple 0x77 or 0xEE bytes in the middle. Is your scope not capable of decoding UART signals for you? \$\endgroup\$
    – brhans
    Commented Oct 11, 2022 at 7:52
  • \$\begingroup\$ A logic analyzer would be ideal for this task. They tend to find protocols automatically and if not, allows you to test lots of settings until the decoded data makes sense. \$\endgroup\$
    – winny
    Commented Oct 11, 2022 at 8:41
  • \$\begingroup\$ You can couple RS485-B via 10-47 uF capacitor to an RS232 RX input and watch the communication with a PC terminal program, GND connection assumed. 38400 baud should match. \$\endgroup\$
    – Jens
    Commented Oct 11, 2022 at 19:06
  • \$\begingroup\$ @brhans it is capable but I'm not super knowledgeable about using the tool properly. \$\endgroup\$
    – AntoineG
    Commented Oct 11, 2022 at 20:03
  • \$\begingroup\$ Similarly I have a logic analyzer like @winny suggested but haven't attempted to use it yet. \$\endgroup\$
    – AntoineG
    Commented Oct 11, 2022 at 20:03

2 Answers 2

Reset to default
12
\$\begingroup\$

You have done excellent reverse-engineering.

Everything does point out to RS-485 physical interface with UART protocol and the bit rate is likely just standard 38400 bps based on the measurements of 3 shortest periods being 77.2 us.

The data frame could be 8N1 so 1 start, 8 data and 1 stop bit, but the few ms burst just contains a packet of multiple bytes, and after the packet the bus is idle until next packet. But, there could be parity bits or multiple stop bits, or just small pauses between UART frames.

\$\endgroup\$
8
\$\begingroup\$

Since the FCC authorisation code is marked on the device, you can look it up on the FCC database.

If you enter the first 3 characters (SH6) as the grantee code, you get a list of devices from that manufacturer, which includes yours.

If you look at the 'detail' for your device, it includes a user manual.

\$\endgroup\$
2
  • 2
    \$\begingroup\$ How does that help? Any manufacturer can use that module in any product and write software for it to run any protocol over UART. \$\endgroup\$
    – Justme
    Commented Oct 11, 2022 at 11:07
  • 5
    \$\begingroup\$ The user manual has a lot of useful information; the module is based on the nRF581822, and there is Bluetooth profile information, and a full pinout, which could be used to directly monitor the UART Tx and Rx lines, and check their relationship to the external interface. When reverse-engineering, the more documentation you can find, the better. \$\endgroup\$
    – jayben
    Commented Oct 11, 2022 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.