Programming, Electronics, RF

This blog has moved to a new location

2025-03-09T19:00:00+02:00

New location of this blog is
https://techcoderadio.blogspot.com

Tachographs and more

2025-03-09T18:39:00+02:00

Tachograph BT. Apps for those can be found e.g. from Google Play Store. In some systems the default key = (abbreviation of the device manufacturer name) + number string?!

BT device found near Gatsos.
Food for thought: https://www.pemicro.com/partners/index.cfm?manufacturer_id=12

DFU enabled devs there are many BT HW vendor update apps

ActiveGPS exe

2025-02-16T21:12:00+02:00

By using DetectItEasy found commands

&D
&J
&C01
&E
&F
&C33
&C67
&H
&I
&G
&H0020
&B
&E000000
&A

Map;http://www.adteknik.com/map.htm?lat=%lat%&lng=%lon%&r=%radius%
7686    00136945    00537b45    Section(1)['.data']    09    A    MyMap.txt
7687    00136957    00537b57    Section(1)['.data']    08    A    placemap
7688    00136960    00537b60    Section(1)['.data']    07    A    loggmap
7689    00136968    00537b68    Section(1)['.data']    07    A    map.txt
7690    00136978    00537b78    Section(1)['.data']    08    A    placemap
7691    00136981    00537b81    Section(1)['.data']    07    A    loggmap
7692    00136989    00537b89    Section(1)['.data']    15    A    http://www.topgear.no
7693    0013699f    00537b9f    Section(1)['.data']    16    A    http://www.adteknik.se
7694    001369b6    00537bb6    Section(1)['.data']    08    A    Map2.txt
7695    001369bf    00537bbf    Section(1)['.data']    07    A    Map.txt
7696    001369c8    00537bc8    Section(1)['.data']    16    A    Temp00000000.ActiveGPS
7697    001369df    00537bdf    Section(1)['.data']    0b    A    26 44 0D 0A
7698    001369eb    00537beb    Section(1)['.data']    0d    A    ActiveGPS.OUT
7699    00136a06    00537c06    Section(1)['.data']    14    A    _ActiveGps.ActiveGPS
7700    00136a21    00537c21    Section(1)['.data']    0a    A    .ActiveGPS
....

Inspecting with Wireshark (tcp port 20 || tcp port 21)

Some ActiveGPS PyMocking

2025-01-23T21:25:00+02:00

Far from complete. By using USB to serial converter + USB serial null modem adapter it is possbile to mimick more or less serial controlled devices without SW virtual serial ports. Wireshark used for analyzing USB serial traffic with ActiveGPS Windows software and my (really old) ActiveGPS device.

import serial

A = b'00'
B = b'06036F72AD18F8BF4B07DA01120B3215AF00'
C = b'0000'
D = b'00'
E = b'00'
J = [
     b'18F8BF4B07DA01120B3215AFFFFFFFFF',
     b'409CA961000050124EF175426C73AE41',
     b'14060D0907DB5B58421D474A4A00FFFF',
     b'FFFFFFF133FB33FB33FA33FA33FA33FA',
     b'33FA33FA33FA33FA33FA33FA33FA33FA',
     b'33FA33FFFFFFFFFFFFFFFFFFFFFFFFFF',
     b'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF',
     b'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000',
    ]

ser = serial.Serial('COM19', 9600, timeout=None)
print("...")
while True:
    s = ser.readline()
    if s[0:1] == b'\xff':
        s = s[1:]
    print('\r\nReceived ' + str(s))
    if s == b'&A\r\n':
        print('\tSent ' + str(A))
        ser.write(A)
    elif s == b'&B\r\n':
        print('\tSent ' + str(B))
        ser.write(B)
    elif s == b'&C01\r\n':
        print('\tSent ' + str(C))
        ser.write(C)
    elif s == b'&J\r\n':
        for i in J:
            print('\tSent ' + str(i))
            ser.write(i)
    elif s == '&E000000\r\n':
        print('\tSent ' + str(E))
        ser.write(E)
    elif s == '&D\r\n':
        print('\tSent ' + str(D))
        ser.write(D)
        break
    else:
        break
    ser.flush()
ser.close()
print("Port closed")

ActiveGPS firmware update process

2025-01-10T15:36:00+02:00

ActiveGPS MCU is PIC18F2455

&A   start op
&B   device info
&J    read EEPROM content

Read FLASH content
&E000000
&F
...
&F

Update firmware
&H0108
&G001 ... &G00B

Wireshark, export pcapng as plain text with data bytes

Frame 2178: 27 bytes on wire (216 bits), 27 bytes captured (216 bits) on interface \\.\USBPcap5, id 0

0000 1b 00 60 15 59 06 05 d4 ff ff 00 00 00 00 09 00 ..`.Y...........
0010 00 05 00 01 00 83 03 00 00 00 00 ...........

Frame 2179: 565 bytes on wire (4520 bits), 565 bytes captured (4520 bits) on interface \\.\USBPcap5, id 0

0000 1b 00 a0 58 bc 09 05 d4 ff ff 00 00 00 00 09 00 ...X............
0010 00 05 00 01 00 03 03 1a 02 00 00 26 47 30 30 30 ...........&G000
0020 30 30 30 30 30

Some Python code to extract &G blocks

i = 0
s = ""
f = open('agps-ptext2.txt', 'r')
fo = open("fwdata.hex", "w")
lines = f.readlines()
l = len(lines)
while True:
    s = str(lines[i]).strip()
    if s.find('565 bytes on wire') > -1:
        i = i + 3
        for p in range(35):
            s = str(lines[i]).strip()
            s = s.replace('.', '')
            s = s.replace('&G', '')
            fo.write(s[56:])
            i = i + 1
    else:
        i = i + 1
    if i >= l:
        break
fo.close()
f.close()
print("c")

Python: Inspecting ActiveGPS

2025-01-01T12:44:00+02:00

Python + PySerial: Inspecting AD-Teknik ActiveGPS

# show eeprom
import serial

ser = serial.Serial('COM6', 9600, timeout=4)
print("&A")
ser.write(b'&A\r\n')
b = ser.read(256)
print(b)
print("&B")
ser.write(b'&B\r\n')
b = ser.read(256)
print(b)
print("&J")
ser.write(b'&J\r\n')
b = ser.read(280)
print(b)
print("&D")
ser.write(b'&D\r\n')
b = ser.read(16)
print(b)
ser.close()

# show flash
import serial

ser = serial.Serial('COM6', 9600, timeout=4)
print("&A")
ser.write(b'&A\r\n')
b = ser.read(16)
print(b)

print("&B")
ser.write(b'&B\r\n')
b = ser.read(256)
print(b)

print("&F")
ser.write(b'&F\r\n')
b = ser.read(3072)
print(b)
ser.write(b'&F\r\n')
b = ser.read(3072)
print(b)
ser.write(b'&F\r\n')
b = ser.read(3072)
print(b)
ser.write(b'&F\r\n')
b = ser.read(3072)
print(b)
ser.write(b'&F\r\n')
b = ser.read(3072)
print(b)

print("&D")
ser.write(b'&D\r\n')
b = ser.read(8)
print(b)

ser.close()

Bt mesh/sbus devices in shopping centres

2024-12-08T13:25:00+02:00

TelinkSigMeshApp
https://wiki.telink-semi.cn/wiki/protocols/Bluetooth-Mesh/

A 5G outdoor gateway asking for pairing...

ZTE Install helper ...

PySpecSDR win

2024-12-01T16:51:00+02:00

https://github.com/xqtr/PySpecSDR

Windows 10
Python 3.12.7 - windows-curses does not work in Python 3.13

requirements.txt:
numpy>=1.20.0
scipy>=1.7.0
sounddevice>=0.4.1
SoapySDR>=0.8.0
pyrtlsdr>=0.2.91

Also have to install py modules setuptools & windows-curses
https://pypi.org/project/windows-curses/#files

Copy dll files librtlsdr and libusb-1.0 to e.g. folder where python.exe is located. Those files can be found e.g. from rtl_433
https://github.com/merbanan/rtl_433/releases

PySpecSDR does not start if run from Python IDLE (works from command line)
fd=_sys.__stdout__.fileno())
AttributeError: 'NoneType' object has no attribute 'fileno'

One workaround probably is modify windows-curses code
https://docs.python.org/3/library/shutil.html#shutil.get_terminal_size

To get rid of warning messages at PySpecSDR init when running it is comment out ''' ---- '''' comment block at the beginning of the code.

#!/usr/bin/python3
## ____        ____                  ____ ____ ____
##| _ \ _   _/ ___| _ __   ___ ___/ ___|| _ \| _ \
##| |_) | | | \___ \| '_ \ / _ \/ __\___ \| | | | |_) |
##| __/| |_| |___) | |_) | __/ (__ ___) | |_| | _ <
##|_|    \__, |____/| .__/ \___|\___|____/|____/|_| \_\
##       |___/      |_|
.....

Bearmock Python 3 and virtual serial port mods

2024-11-12T19:51:00+02:00

https://recon.cx/2013/slides/Recon2013-Gabriel%20Tremblay-Reversing%20P25%20Radios.pdf

Hardware used: USB to serial adapter (Aten UC-232A) + USB serial null modem adapter (S6618, cheap device from eBay). Probably it would be quite easy to write Arduino code and use two Arduinos connected with software serial.

I modified this code https://github.com/gabtremblay/Bearmock to run in Python 3 (3.13, pyserial 3.5) and without com0com software virtual serial port.

from time import sleep
from serial import Serial

__MODEL = 'BCD296D'
__PORT = 'COM21'
__SPEED = 9600
__TIMEOUT = 0 # non-blocking
__READ_SLEEP_SECS = 0
__OUT = 'decoded.s19'

__ACTIONS = {
    '\r': 'UNKNOWN COMMAND\r', # Empty, just reply
    '*SUM\r': 'CHECKSUM= DEADH\r', # Fake checksum
    '*SPD 1\r': 'SPEED 9600 bps\r',
    '*SPD 2\r': 'SPEED 19200 bps\r',
    '*SPD 3\r': 'SPEED 38400 bps\r',
    '*SPD 4\r': 'SPEED 57600 bps\r',
    '*SPD 5\r': 'SPEED 115200 bps\r',
    '*PGL 11000000000\r': 'OK\r',
    '*PGL 1000000000000000000\r': 'OK\r',
    '*PGL 1100000\r': 'OK\r',
    '*ULE\r': 'OK\r',
    '*PRG\r': 'OK\r',
    '*MDL\r': __MODEL + '\r',
    '*FDP\r': 'FDP 3.\r',
    '*REG\r': 'R 1\r',
    '*APP\r': 'Version 3.00.00\r',
    '*VER\r': 'Version 3.00.00\r',
    '*SCB 1\r': 'SCB 1\r',
    '*RTS F\r': 'RTS OFF\r',
    '*MOD 1\r': 'MODE 1\r',
    '*WWS N\r': 'WWS 0\r',
    '*SUM 1 0\r': 'CHECKSUM= C68FH\r',
    '*SUM 6 0\r': 'CHECKSUM= DEADH\r',
}

if __name__ == "__main__":
    try:
        port = Serial(__PORT, __SPEED, timeout=__TIMEOUT, bytesize=8, parity='N', stopbits=1)
    except Exception as ex:
        print(ex)
        exit()

    outfile = open(__OUT, 'wb')

    print("Reading port... " + __PORT)
    readbuf = ''
    while True:
        try:
            byte = port.read(1)
            if len(byte) > 0:
                #num = int(byte.encode('hex'), 16) Python 2!
                num = int.from_bytes(byte)
                #print str(num) + ' (' + chr(num) + ')'
                readbuf = ''.join([readbuf, chr(num)])
                if num == 13: # got a \r == EOL
                    if readbuf[0:2] == 'S8':
                        print("End of firmware (updater will crash ;)")
                        readbuf = readbuf.replace('\x0d', '\x0d\x0a')
                        outfile.write(readbuf.encode())
                        outfile.close()
                        port.close()
                        exit()
                    elif readbuf[0:2] == 'S0' or readbuf[0:2] == 'S2':
                        readbuf = readbuf.replace('\x0d', '\x0d\x0a')
                        outfile.write(readbuf.encode())
                    else:

                        print("Received command: ",)
                        print(readbuf)

                        action = __ACTIONS.get(readbuf.strip(''))
                        if not action:
                            print("No corresponding action found")
                        else:
                            print("Sending: " + action + "\n")
                            port.write(str.encode(__ACTIONS.get(readbuf.strip(' '))))
                            if readbuf[0:4] == '*SPD':
                                port.close()
                                if readbuf[0:6] == '*SPD 1':
                                    port.baudrate = 9600
                                elif readbuf[0:6] == '*SPD 2':
                                    port.baudrate = 19200
                                elif readbuf[0:6] == '*SPD 3':
                                    port.baudrate = 38400
                                elif readbuf[0:6] == '*SPD 4':
                                    port.baudrate = 57600
                                elif readbuf[0:6] == '*SPD 5':
                                    port.baudrate = 115200
                                port.open()

                    port.flush()
                    readbuf = ''

        except Exception as ex:
            print(ex)
            exit()

sleep(__READ_SLEEP_SECS)

port.close()
outfile.close()

A bit tuned actions ...

__ACTIONS = {
    '\r': 'UNKNOWN COMMAND\r', # Empty, just reply
    '*SUM\r': 'CHECKSUM= DEADH\r', # Fake checksum
    '*SPD 1\r': 'SPEED 9600 bps\r',
    '*SPD 2\r': 'SPEED 19200 bps\r',
    '*SPD 3\r': 'SPEED 38400 bps\r',
    '*SPD 4\r': 'SPEED 57600 bps\r',
    '*SPD 5\r': 'SPEED 115200 bps\r',
    '*PGL 11000000000\r': 'OK\r',
    '*PGL 1000000000000000000\r': 'OK\r',
    '*PGL 1100000\r': 'OK\r',
    '*PGL 110000000\r': 'OK\r',
    '*ULE\r': 'OK\r',
    '*PRG\r': 'OK\r',
    '*MDL\r': __MODEL + '\r',
    '*FDP\r': 'FDP 3.\r',
    '*REG\r': 'R 1\r',
    '*APP\r': 'Version 3.00.00\r',
    '*VER\r': 'Version 3.00.00\r',
    '*SCB 1\r': 'SCB 1\r',
    '*SCB 2\r': 'SCB 2\r',
    '*RTS F\r': 'RTS OFF\r',
    '*MOD 1\r': 'MODE 1\r',
    '*WWS N\r': 'WWS 0\r',
    '*SUM 1 0\r': 'CHECKSUM= C68FH\r',
    '*SUM 6 0\r': 'CHECKSUM= DEADH\r',
    '*RMV\r': 'OK\r',
    '*OFF\r': 'OK\r',
}

Blue locks and prts

2024-11-02T10:40:00+02:00

Open BT printers can be found occasionally

TMUtil Android app.

RFID + BT system

eSmartLock Android app. Bluetooth and NFC enabled. Free mode

NFC tools app or TagInfo app did not find any NFC devs.