RECESSIM - User contributions [en]

Dump EEPROM

2025-03-16T21:25:03Z

L0scher: /* Identify the device */

A serial EEPROM is a small IC that stores data in a physically compact package. These are often used in electronic equipment and it's useful to dump the contents of such devices to do a thorough job of reverse engineering.

== Using a Raspberry Pi ==
Because many of these devices are 3.3V parts, it's often possible to dump the contents of such devices using nothing more than a Raspberry Pi, some micrograbbers and jumpers. As an example of this, we'll show the steps involved in using a Raspberry Pi Zero W to read the contents of the EEPROM in a L+G meter board.

== Identify the device ==
The EEPROM in the L+G Focus meter is an Atmel (formerly Adesto) [https://www.digikey.com/htmldatasheets/production/1309927/0/0/1/at45db081d-datasheet.html 45DB081D], which is an 8-megabit flash memory that has a [https://en.wikipedia.org/wiki/Serial_Peripheral_Interface SPI bus] interface. Since this part can be powered by 3.3V and the Raspberry Pi already has a SPI bus, all that's required is to connect the two.

Here is one way to do that:

{| class="wikitable"
|-
! Function !! EEPROM pin # !! Pi pin #
|-
| MOSI || 1 || 19
|-
| SCLK || 2 || 23
|-
| #RESET || 3 || VCC
|-
| #CS || 4 || 24
|-
| #WP || 5 || VCC
|-
| VCC || 6 || 17
|-
| GND || 7 || 25
|-
| MISO || 8 || 21
|}

'''Double check your wiring before powering up the Raspberry Pi!''' Failure do so can permanently damage either the Pi, your Pi power supply, the device to which you're connecting ''or all three.''

One additional connection is needed, which is to connect the microprocessor's #RESET line to a logic low to keep the processor in reset so that it does not interfere with the Pi reading the memory.

== Software ==

Once this is all done reading the EEPROM is as simple as executing this command on the Pi:

<code>flashrom --read dump.bin -p linux_spi:dev=/dev/spidev0.0,spispeed=10000</code>

The speed is specified in kHz, so this corresponds to 50MHz.

Advanced Metering Infrastructure

2025-03-16T21:24:13Z

L0scher: /* Firmware Extraction & Analysis */ added link to Dump EEPROM

Advanced Metering Infrastructure (AMI)<ref>https://en.wikipedia.org/wiki/Smart_meter#Advanced_Metering_Infrastructure</ref> refers to systems that measure, collect, and analyze energy usage, and communicate with metering devices such as electricity meters, gas meters, heat meters, and water meters, either on request or on a schedule.
[[File:LandisGyrResidentialMeter1.JPG|thumb|Landis+Gyr Residential Power Meter]]
There are various methods used to report power usage back to the utility including cellular, power-line and mesh networked power meters operating in the ISM bands<ref>https://en.wikipedia.org/wiki/ISM_band</ref>.

<youtube width="320" height="240">gYowTR3Dfdk</youtube>
==Electricity Metering Systems==
[[Itron Residential Meter]]

[[Landis+Gyr GridStream Protocol]]

[[Landis+Gyr Residential Meter]]

[[Landis+Gyr Commercial Meter]]

[[Landis+Gyr Collector]]

[[Landis+Gyr Integrated WanGate Radio (IWR)]]

[[Silver Spring Networks Protocol]]

[[Silver Spring Networks Access Point]]

[[Silver Spring Networks Relay]]

[[Sangamo FM2S]]

==Data Capture using Software Defined Radio==
[[gr-smart_meters Setup Guide]]

==Firmware Extraction & Analysis==
[[Extract Firmware - Landis+Gyr (M16C)]]

[[Extract Firmware - Landis+Gyr (ARM)]]

[[Ghidra Configuration - M16C Processor]]

[[Dump EEPROM]]

==Other==
[[Landis+Gyr DCW]]

==Schematics==
[https://github.com/BitBangingBytes/LandisGyr-FocusAXR_Schematics Landis+Gyr FocusAXR-SD Schematic]<references />

Dump EEPROM

2025-03-16T21:21:32Z

L0scher: Created page with "A serial EEPROM is a small IC that stores data in a physically compact package. These are often used in electronic equipment and it's useful to dump the contents of such devi..."

A serial EEPROM is a small IC that stores data in a physically compact package. These are often used in electronic equipment and it's useful to dump the contents of such devices to do a thorough job of reverse engineering.

== Using a Raspberry Pi ==
Because many of these devices are 3.3V parts, it's often possible to dump the contents of such devices using nothing more than a Raspberry Pi, some micrograbbers and jumpers. As an example of this, we'll show the steps involved in using a Raspberry Pi Zero W to read the contents of the EEPROM in a L+G meter board.

== Identify the device ==
The EEPROM in the L+G Focus meter is an Atmel (formerly Adesto) [https://www.digikey.com/htmldatasheets/production/1309927/0/0/1/at45db081d-datasheet.html 45DB081D], which is an 8-megabit flash memory that has a [https://en.wikipedia.org/wiki/Serial_Peripheral_Interface SPI bus] interface. Since this part can be powered by 3.3V and the Raspberry Pi already has a SPI bus, all that's required is to connect the two.

Here is one way to do that:

{| class="wikitable"
|-
! Function !! EEPROM pin # !! Pi pin #
|-
| MOSI || 1 || 19
|-
| SCLK || 2 || 23
|-
| #RESET || 3 || VCC
|-
| #CS || 4 || 24
|-
| #WP || 5 || VCC
|-
| VCC || 6 || 17
|-
| GND || 7 || 25
|-
| MISO || 8 || 21
|}

'''Double check your wiring before powering up the Raspberry Pi!''' Failure do so can permanently damage either the Pi, your Pi power supply, the device to which you're connecting ''or all three.''

One addition connection is needed, which is to connect the microprocessor's #RESET line to a logic low to keep the processor in reset so that it does not interfere with the Pi reading the memory.

== Software ==

Once this is all done reading the EEPROM is as simple as executing this command on the Pi:

<code>flashrom --read dump.bin -p linux_spi:dev=/dev/spidev0.0,spispeed=10000</code>

The speed is specified in kHz, so this corresponds to 50MHz.

Gr-smart meters Setup on other distros

2024-02-08T19:37:23Z

L0scher: added missing word

The [[Gr-smart meters Setup Guide]] describes how to build the gr-smart meters setup on Ubuntu. This page documents how to do so on other Linux distributions. Note that the patches applied (<code>pull_23</code> for <code>gr-pdu_utils</code> and <code>pull_9</code> for <code>gr-timing_utils</code>) apply pull requests that have not yet been accepted into the respective Sandia Labs repositories. If and when they are ever merged into the main line code, these patches will no longer be necessary. Also note that with these patches applied, it is no longer necessary to build or use the <code>gr-sandia_utils</code> code.

For each distribution below, what is shown is a container file (for use with Docker or Podman) that shows how to build the relevant modules within a container based on the relevant distro. This is done to both make it absolutely clear which steps need to be done and which order, and also to provide a convenient way to test and these recipes to other Linux distributions.

To run these commands on a real distribution (that is, not in a container), you can simply execute each "RUN" command exactly as it appears and then substitute `cd` commands for the "WORKDIR" lines (or use <code>pushd</code>/<code>popd</code> pairs as shown in the example below). You can ignore the "FROM" line. You will want to adjust the directories for your own computer. So for example, for Arch one could use the following commands:

<syntaxhighlight lang="bash">
mkdir FHSS_Utils
cd FHSS_Utils
pacman --noconfirm -Sy git make cmake gcc gnuradio boost doxygen graphviz pybind11
git clone https://github.com/sandialabs/gr-pdu_utils.git
git clone https://github.com/sandialabs/gr-timing_utils.git
git clone https://github.com/sandialabs/gr-fhss_utils.git
for fn in * ; do pushd $fn && git checkout maint-3.10 && popd ; done
pushd gr-pdu_utils
git fetch origin refs/pull/23/head:pull_23
git checkout pull_23
cmake -B build && cmake --build build -t install
popd
pushd gr-timing_utils
git fetch origin refs/pull/9/head:pull_9
git checkout pull_9
cmake -B build && cmake --build build -t install
popd
pushd gr-fhss_utils
RUN cmake -B build && cmake --build build -t install
popd
</syntaxhighlight>

Note too, that you may need to use <code>sudo</code> to install. If that's the case, you can replace this:
<syntaxhighlight lang="bash">
cmake -B build && cmake --build build -t install
</syntaxhighlight>
with this:
<syntaxhighlight lang="bash">
cmake -B build
cmake --build build
sudo cmake --build build -t install
</syntaxhighlight>

It's recommended to build an ordinary user and only use <code>sudo</code> for installing, as shown above. To speed up compiling on multicore machines, you can append <code>-j</code> to build commands as in <code>cmake --build build -j</code>.

These notes generally apply to all of the distributions listed below.

== Arch ==

<syntaxhighlight lang="docker">
FROM archlinux:base-20240101.0.204074
RUN mkdir -p /tmp/work
WORKDIR /tmp/work
RUN pacman --noconfirm -Sy git make cmake gcc gnuradio boost doxygen graphviz pybind11
RUN git clone https://github.com/sandialabs/gr-pdu_utils.git
RUN git clone https://github.com/sandialabs/gr-timing_utils.git
RUN git clone https://github.com/sandialabs/gr-fhss_utils.git
RUN for fn in * ; do pushd $fn && git checkout maint-3.10 && popd ; done
WORKDIR /tmp/work/gr-pdu_utils
RUN git fetch origin refs/pull/23/head:pull_23
RUN git checkout pull_23
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-timing_utils
RUN git fetch origin refs/pull/9/head:pull_9
RUN git checkout pull_9
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-fhss_utils
RUN cmake -B build && cmake --build build -t install
</syntaxhighlight>

Gr-smart meters Setup on other distros

2024-02-08T19:36:45Z

L0scher: reorganized structure of page to put only distro-specific things under each distro heading.

The [[Gr-smart meters Setup Guide]] describes how to build the gr-smart meters setup on Ubuntu. This page documents how to do so on other Linux distributions. Note that the patches applied (<code>pull_23</code> for <code>gr-pdu_utils</code> and <code>pull_9</code> for <code>gr-timing_utils</code>) apply pull requests that have not yet been accepted into the respective Sandia Labs repositories. If and when they are ever merged into the main line code, these patches will no longer be necessary. Also note that with these patches applied, it is no longer necessary to build or use the <code>gr-sandia_utils</code> code.

For each distribution below, what is shown is a container file (for use with Docker or Podman) that shows how to build the relevant modules within a container based on the relevant distro. This is done to both make it absolutely clear which steps need to be done and which order, and also to provide a convenient way to test and these recipes to other Linux distributions.

To run these commands on a real distribution (that is, not in a container), you can simply execute each "RUN" command exactly as it appears and then substitute `cd` commands for the "WORKDIR" lines (or use <code>pushd</code>/<code>popd</code> pairs as shown in the example below). You can ignore the "FROM" line. You will want to adjust the directories for your own computer. So for example, for Arch could use the following commands:

<syntaxhighlight lang="bash">
mkdir FHSS_Utils
cd FHSS_Utils
pacman --noconfirm -Sy git make cmake gcc gnuradio boost doxygen graphviz pybind11
git clone https://github.com/sandialabs/gr-pdu_utils.git
git clone https://github.com/sandialabs/gr-timing_utils.git
git clone https://github.com/sandialabs/gr-fhss_utils.git
for fn in * ; do pushd $fn && git checkout maint-3.10 && popd ; done
pushd gr-pdu_utils
git fetch origin refs/pull/23/head:pull_23
git checkout pull_23
cmake -B build && cmake --build build -t install
popd
pushd gr-timing_utils
git fetch origin refs/pull/9/head:pull_9
git checkout pull_9
cmake -B build && cmake --build build -t install
popd
pushd gr-fhss_utils
RUN cmake -B build && cmake --build build -t install
popd
</syntaxhighlight>

Note too, that you may need to use <code>sudo</code> to install. If that's the case, you can replace this:
<syntaxhighlight lang="bash">
cmake -B build && cmake --build build -t install
</syntaxhighlight>
with this:
<syntaxhighlight lang="bash">
cmake -B build
cmake --build build
sudo cmake --build build -t install
</syntaxhighlight>

It's recommended to build an ordinary user and only use <code>sudo</code> for installing, as shown above. To speed up compiling on multicore machines, you can append <code>-j</code> to build commands as in <code>cmake --build build -j</code>.

These notes generally apply to all of the distributions listed below.

== Arch ==

<syntaxhighlight lang="docker">
FROM archlinux:base-20240101.0.204074
RUN mkdir -p /tmp/work
WORKDIR /tmp/work
RUN pacman --noconfirm -Sy git make cmake gcc gnuradio boost doxygen graphviz pybind11
RUN git clone https://github.com/sandialabs/gr-pdu_utils.git
RUN git clone https://github.com/sandialabs/gr-timing_utils.git
RUN git clone https://github.com/sandialabs/gr-fhss_utils.git
RUN for fn in * ; do pushd $fn && git checkout maint-3.10 && popd ; done
WORKDIR /tmp/work/gr-pdu_utils
RUN git fetch origin refs/pull/23/head:pull_23
RUN git checkout pull_23
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-timing_utils
RUN git fetch origin refs/pull/9/head:pull_9
RUN git checkout pull_9
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-fhss_utils
RUN cmake -B build && cmake --build build -t install
</syntaxhighlight>

Gr-smart meters Setup on other distros

2024-02-08T19:31:14Z

L0scher: /* Arch */ added detail about the proper use of sudo if required.

The [[Gr-smart meters Setup Guide]] describes how to build the gr-smart meters setup on Ubuntu. This page documents how to do so on other Linux distributions. Note that the patches applied (<code>pull_23</code> for <code>gr-pdu_utils</code> and <code>pull_9</code> for <code>gr-timing_utils</code>) apply pull requests that have not yet been accepted into the respective Sandia Labs repositories. If and when they are ever merged into the main line code, these patches will no longer be necessary. Also note that with these patches applied, it is no longer necessary to build or use the <code>gr-sandia_utils</code> code.

== Arch ==
This is a container file (for use with Docker or Podman) that shows how to build the relevant modules under Arch Linux.

<syntaxhighlight lang="docker">
FROM archlinux:base-20240101.0.204074
RUN mkdir -p /tmp/work
WORKDIR /tmp/work
RUN pacman --noconfirm -Sy git make cmake gcc gnuradio boost doxygen graphviz pybind11
RUN git clone https://github.com/sandialabs/gr-pdu_utils.git
RUN git clone https://github.com/sandialabs/gr-timing_utils.git
RUN git clone https://github.com/sandialabs/gr-fhss_utils.git
RUN for fn in * ; do pushd $fn && git checkout maint-3.10 && popd ; done
WORKDIR /tmp/work/gr-pdu_utils
RUN git fetch origin refs/pull/23/head:pull_23
RUN git checkout pull_23
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-timing_utils
RUN git fetch origin refs/pull/9/head:pull_9
RUN git checkout pull_9
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-fhss_utils
RUN cmake -B build && cmake --build build -t install
</syntaxhighlight>

To run these commands on a real distribution (that is, not in a container), you can simply execute each "RUN" command exactly as it appears and then substitute `cd` commands for the "WORKDIR" lines (or use <code>pushd</code>/<code>popd</code> pairs as shown in the example below). You can ignore the "FROM" line. You will want to adjust the directories for your own computer. So for example, one could use the following commands:

<syntaxhighlight lang="bash">
mkdir FHSS_Utils
cd FHSS_Utils
pacman --noconfirm -Sy git make cmake gcc gnuradio boost doxygen graphviz pybind11
git clone https://github.com/sandialabs/gr-pdu_utils.git
git clone https://github.com/sandialabs/gr-timing_utils.git
git clone https://github.com/sandialabs/gr-fhss_utils.git
for fn in * ; do pushd $fn && git checkout maint-3.10 && popd ; done
pushd gr-pdu_utils
git fetch origin refs/pull/23/head:pull_23
git checkout pull_23
cmake -B build && cmake --build build -t install
popd
pushd gr-timing_utils
git fetch origin refs/pull/9/head:pull_9
git checkout pull_9
cmake -B build && cmake --build build -t install
popd
pushd gr-fhss_utils
RUN cmake -B build && cmake --build build -t install
popd
</syntaxhighlight>

Note too, that you may need to use <code>sudo</code> to install. If that's the case, you can replace this:
<syntaxhighlight lang="bash">
cmake -B build && cmake --build build -t install
</syntaxhighlight>
with this:
<syntaxhighlight lang="bash">
cmake -B build
cmake --build build
sudo cmake --build build -t install
</syntaxhighlight>

It's recommended to build an ordinary user and only use <code>sudo</code> for installing, as shown above. To speed up compiling on multicore machines, you can append <code>-j</code> to build commands as in <code>cmake --build build -j</code>.

Gr-smart meters Setup on other distros

2024-02-08T13:47:05Z

L0scher: /* Arch */ show equivalent bash commands

The [[Gr-smart meters Setup Guide]] describes how to build the gr-smart meters setup on Ubuntu. This page documents how to do so on other Linux distributions. Note that the patches applied (<code>pull_23</code> for <code>gr-pdu_utils</code> and <code>pull_9</code> for <code>gr-timing_utils</code>) apply pull requests that have not yet been accepted into the respective Sandia Labs repositories. If and when they are ever merged into the main line code, these patches will no longer be necessary. Also note that with these patches applied, it is no longer necessary to build or use the <code>gr-sandia_utils</code> code.

== Arch ==
This is a container file (for use with Docker or Podman) that shows how to build the relevant modules under Arch Linux.

<syntaxhighlight lang="docker">
FROM archlinux:base-20240101.0.204074
RUN mkdir -p /tmp/work
WORKDIR /tmp/work
RUN pacman --noconfirm -Sy git make cmake gcc gnuradio boost doxygen graphviz pybind11
RUN git clone https://github.com/sandialabs/gr-pdu_utils.git
RUN git clone https://github.com/sandialabs/gr-timing_utils.git
RUN git clone https://github.com/sandialabs/gr-fhss_utils.git
RUN for fn in * ; do pushd $fn && git checkout maint-3.10 && popd ; done
WORKDIR /tmp/work/gr-pdu_utils
RUN git fetch origin refs/pull/23/head:pull_23
RUN git checkout pull_23
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-timing_utils
RUN git fetch origin refs/pull/9/head:pull_9
RUN git checkout pull_9
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-fhss_utils
RUN cmake -B build && cmake --build build -t install
</syntaxhighlight>

To run these commands on a real distribution (that is, not in a container), you can simply execute each "RUN" command exactly as it appears and then substitute `cd` commands for the "WORKDIR" lines (or use <code>pushd</code>/<code>popd</code> pairs as shown in the example below). You can ignore the "FROM" line. You will want to adjust the directories for your own computer. So for example, one could use the following commands:

<syntaxhighlight lang="bash">
mkdir FHSS_Utils
cd FHSS_Utils
pacman --noconfirm -Sy git make cmake gcc gnuradio boost doxygen graphviz pybind11
git clone https://github.com/sandialabs/gr-pdu_utils.git
git clone https://github.com/sandialabs/gr-timing_utils.git
git clone https://github.com/sandialabs/gr-fhss_utils.git
for fn in * ; do pushd $fn && git checkout maint-3.10 && popd ; done
pushd gr-pdu_utils
git fetch origin refs/pull/23/head:pull_23
git checkout pull_23
cmake -B build && cmake --build build -t install
popd
pushd gr-timing_utils
git fetch origin refs/pull/9/head:pull_9
git checkout pull_9
cmake -B build && cmake --build build -t install
popd
pushd gr-fhss_utils
RUN cmake -B build && cmake --build build -t install
popd
</syntaxhighlight>

Gr-smart meters Setup on other distros

2024-02-08T13:40:45Z

L0scher: Add some notes about patches.

Gr-smart meters Setup Guide

2024-02-08T13:30:55Z

L0scher: /* Install Ubuntu 22.04 */ point to other distros page

The following install guide details the steps from a fresh Ubuntu 22.04 install to a fully running GNU Radio + USRP B200, HackRF, AirSpy and RTL-SDR frequency hopping spread spectrum setup needed to capture smart meter data.

'''This video shows the overall process but using a prior version of GNURadio. Instructions below are the latest.'''

<youtube width="320" height="240">fUK8tcFQwpo</youtube>

==Install Ubuntu 22.04==
There is nothing special about Ubuntu, it was chosen because it works well across different computers and has a familiar interface. Likely these instructions can be used as a rough guide for what is needed with other distro's. See also [[Gr-smart meters Setup on other distros]]

For now, this step is to install a base version of Ubuntu 20.04, mine was a minimal install. After finishing your install ensure you update everything.

<syntaxhighlight lang="bash">
sudo apt update
sudo apt upgrade
</syntaxhighlight>Also install the following<syntaxhighlight lang="bash">
sudo apt install libsndfile1-dev
</syntaxhighlight>

====For flavors other than Ubuntu or depending on your window environment you may need:====
<syntaxhighlight lang="bash">
add apt-get install -y gobject-introspection gir1.2-gtk-3.0
</syntaxhighlight>

==Install GNU Radio 3.10==
The version packaged with Ubuntu (3.10.1 as of 12-30-2022) works fine, has been tested up to 3.10.5<syntaxhighlight lang="bash">
sudo apt-get install gnuradio
</syntaxhighlight>

==SDR Hardware Support==

===All support is now native in GNURadio 3.10.===

*UHD can be used for Ettus USRP hardware
*Soapy Custom Source is used for HackRF, AirSpy, BladeRF and RTL-SDR

==Install Frequency Hopping Utilities==
If you already have GNU Radio and your SDR setup you should start here to install the Sandia Laboratories out of tree (OOT) modules. Four different OOT modules are needed.

#[https://github.com/sandialabs/gr-pdu_utils PDU Utilities]
#[https://github.com/sandialabs/gr-timing_utils Timing Utilities]
#[https://github.com/sandialabs/gr-sandia_utils Sandia Utilities]
#[https://github.com/sandialabs/gr-fhss_utils FHSS Utilities]

===Create a folder to organize them===
<syntaxhighlight lang="bash">
cd
mkdir FHSS_Utils
cd FHSS_Utils
</syntaxhighlight>

===Install PDU Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-pdu_utils.git
cd gr-pdu_utils/
git checkout maint-3.10
mkdir build
cd build
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

===Install Sandia Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-sandia_utils.git
cd gr-sandia_utils/
git checkout maint-3.10
mkdir build
cd build/
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

===Install Timing Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-timing_utils.git
cd gr-timing_utils/
git checkout maint-3.10
mkdir build
cd build
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

===Install FHSS Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-fhss_utils.git
cd gr-fhss_utils/
git checkout maint-3.10
mkdir build
cd build/
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

===Finish up===
Close all open terminal windows and then open a new one.

==Setup gr-smart_meters==
This contains the GridStream block that will be used to decode Landis+Gyr Smart Meter data along with pre-configured flowgraphs for USRP B200, HackRF and RTL-SDR and a script to decode GPS data transmitted in some cases.
===Install gr-smart_meters===
<syntaxhighlight lang="bash">
git clone https://github.com/BitBangingBytes/gr-smart_meters.git
cd gr-smart_meters/
git checkout main
mkdir build
cd build/
cmake ..
make -j8
sudo make install
sudo ldconfig
</syntaxhighlight>

=== Install python packages needed for Google Maps and Google Earth ===
<syntaxhighlight lang="bash">
pip install gmplot simplekml
</syntaxhighlight>

===Start GNU Radio from a terminal window===
<code>gnuradio-companion</code>
===Open flowgraph for your SDR===
In GNU Radio open a flowgraph and navigate to the gr-smart_meters/examples folder. If you have installed everything above you should be able to run it and see smart meter data!
==Determining your power providers CRC==
CRC check is set to false in the sample flowgraphs so you will see data but can't be sure there aren't any errors. Every power provider is assigned a unique CRC so neighboring smart meter systems do not interfere with each other. To determine this you need to capture at least 4 good packets and use reveng to reverse the CRC.
===Install reveng===
It's on sourceforge: https://reveng.sourceforge.io/
Documentation is at: https://reveng.sourceforge.io/readme.htm
Download the .zip in the latest releases folder: https://sourceforge.net/projects/reveng/files/2.1.1/
Follow instructions to make
===Provide reveng four good packets===
I find the easiest way to do this is to limit the '''Packet Type''' to 0x55 and '''Packet Length''' to 0x23. Edit the GridStream block and make those changes then run the flowgraph making sure '''CRC Enable''' is set to False.

You will get data that looks like this below.

<code>00FF2A55002330FFFFFFFFFFFF50CF5DD9E2C0B80065F5D1A483F0FBBC6F01001E6C043B517E90B286</code>

You need to remove the first 6 bytes and provide the rest as inputs to reveng, CRC isn't calculated on those bytes.

<code>00FF2A550023 <-- Discard | 30FFFFFFFFFFFF50CF5DD9E2C0B80065F5D1A483F0FBBC6F01001E6C043B517E90B286</code>

Now provide four samples to reveng

<code>./reveng -w 16 -s 30FFFFFFFFFFFF50CF5DD9E2C0B80065F5D1A483F0FBBC6F01001E6C043B517E90B286 30FFFFFFFFFFFF50CF2DD9E560560065F5D5A483F0C000650100176C033FF77E901766 30FFFFFFFFFFFF50CF95D9E5E01A0065F5D9A483F0515A0201001E6C042A177E90BDA4 30FFFFFFFFFFFF50CF8DD9E6A0F00065F5EBA483F0EBFD4A0100206C0433A97E90B04C</code>

You should get the following output below if you used this data to test

<code>width=16 poly=0x1021 init=0x5fd6 refin=false refout=false xorout=0x0000 check=0x139e residue=0x0000 name=(none)</code>

The init value is what you enter into the GridStream block, you can now enable the CRC and know you have correct data!

{{#widget:CRCprefix}}

Gr-smart meters Setup on other distros

2024-02-08T13:19:10Z

L0scher: /* Arch */ fixed formatting

The [[Gr-smart meters Setup Guide]] describes how to build the gr-smart meters setup on Ubuntu. This page documents how to do so on other Linux distributions.

== Arch ==
This is a container file (for use with Docker or Podman) that shows how to build the relevant modules under Arch Linux.

<syntaxhighlight lang="docker">
FROM archlinux:base-20240101.0.204074
RUN mkdir -p /tmp/work
WORKDIR /tmp/work
RUN pacman --noconfirm -Sy git make cmake gcc gnuradio boost doxygen graphviz pybind11
RUN git clone https://github.com/sandialabs/gr-pdu_utils.git
RUN git clone https://github.com/sandialabs/gr-timing_utils.git
RUN git clone https://github.com/sandialabs/gr-fhss_utils.git
RUN for fn in * ; do pushd $fn && git checkout maint-3.10 && popd ; done
WORKDIR /tmp/work/gr-pdu_utils
RUN git fetch origin refs/pull/23/head:pull_23
RUN git checkout pull_23
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-timing_utils
RUN git fetch origin refs/pull/9/head:pull_9
RUN git checkout pull_9
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-fhss_utils
RUN cmake -B build && cmake --build build -t install
</syntaxhighlight>

To run these commands on a real distribution (that is, not in a container), you can simply execute each "RUN" command exactly as it appears and then substitute `cd` commands for the "WORKDIR" lines. You can ignore the "FROM" line. You will want to adjust the directories for your own computer.

Gr-smart meters Setup on other distros

2024-02-08T13:17:20Z

L0scher: added instructions for how to build on Arch

The [[Gr-smart meters Setup Guide]] describes how to build the gr-smart meters setup on Ubuntu. This page documents how to do so on other Linux distributions.

== Arch ==
This is a container file (for use with Docker or Podman) that shows how to build the relevant modules under Arch Linux.

```
FROM archlinux:base-20240101.0.204074
RUN mkdir -p /tmp/work
WORKDIR /tmp/work
RUN pacman --noconfirm -Sy git make cmake gcc gnuradio boost doxygen graphviz pybind11
RUN git clone https://github.com/sandialabs/gr-pdu_utils.git
RUN git clone https://github.com/sandialabs/gr-timing_utils.git
RUN git clone https://github.com/sandialabs/gr-fhss_utils.git
RUN for fn in * ; do pushd $fn && git checkout maint-3.10 && popd ; done
WORKDIR /tmp/work/gr-pdu_utils
RUN git fetch origin refs/pull/23/head:pull_23
RUN git checkout pull_23
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-timing_utils
RUN git fetch origin refs/pull/9/head:pull_9
RUN git checkout pull_9
RUN cmake -B build && cmake --build build -t install
WORKDIR /tmp/work/gr-fhss_utils
RUN cmake -B build && cmake --build build -t install
```

To run these commands on a real distribution (that is, not in a container), you can simply execute each "RUN" command exactly as it appears and then substitute `cd` commands for the "WORKDIR" lines. You can ignore the "FROM" line. You will want to adjust the directories for your own computer.

Electronic Tools

2023-10-07T13:10:38Z

L0scher: corrected plural of radio

<templatestyles src="Template:Main_page/styles.css" />
[[File:Electronic Tools.jpeg|thumb|Oscilloscope and various multimeters]]
Multimeters, Function Generators, Oscilloscopes, Logic Analyzers, Spectrum Analyzers, Software Defined Radios and Open Source/Community Designed Tools. If you used it while reverse engineering, list it here!
==Tool Index==
<div style="clear: both;"></div>
<div id="tools_row1" class="mainpage_row">
<div class="mainpage_box">
<h3>[[File:OOjs UI icon viewCompact.png|link=|alt=|20x20px]] <span>Software Defined Radios</span></h3>
<div id="Electronic_Tools-SDR" title="Software Defined Radios" class="items">
[https://www.rtl-sdr.com/about-rtl-sdr/ RTL-SDR] - Very low cost (~$30) receiver operating from about 52MHz to 2200MHz.

[https://www.sdrplay.com/rsp1a/ SDRPlay RSP1a] - Medium cost (~$160) receiver operating from 100 Khz to 2000 MHZ. Device includes a lot of selectable filters (to cancel broadcast FM, WiFi interference, PC interference etc).

[https://greatscottgadgets.com/hackrf/one/ HackRF One] - Capable of transmission or reception of radio signals from 1 MHz to 6 GHz. Open source hardware platform that can be used as a USB peripheral or programmed for stand-alone operation. Cost ~$340

[https://www.ettus.com/all-products/ub200-kit/ Ettus Research USRP B200] - Universal Software Radio Peripheral with continuous frequency coverage from 70 MHz –6 GHz. Wider bandwidth and higher resolution ADC/DAC than the HackRF; cost with enclosure ~$875.
</div>
</div>

<div class="mainpage_box">
<h3>[[File:OOjs UI icon viewCompact.png|link=|alt=|20x20px]] <span>Debugging Tools</span></h3>
<div id="Debugging_Tools" title="Debugging Tools" class="items">
[[JTAGulator]] - open source hardware tool that assists in identifying OCD connections from test points, vias, or component pads on a target device.

[https://www.tincantools.com/product/flyswatter2/ FlySwatter2] - In-circuit JTAG debugger and programmer.
</div>
</div>
</div>
<div id="tools_row2" class="mainpage_row">
<div class="mainpage_box">
<h3>[[File:OOjs UI icon viewCompact.png|link=|alt=|20x20px]] <span>Test Enclosures</span></h3>
<div id="Test_Enclosures" title="Test Enclosures" class="items">
[[Ramsey STE-3000 Shielded Test Enclosure]] - Faraday cage for isolating RF signals
</div>
</div>
<div class="mainpage_box">
<h3>[[File:OOjs UI icon viewCompact.png|link=|alt=|20x20px]] <span>IC Decapsulating</span></h3>
<div id="IC_Decapsulating" title="IC Decapsulating" class="items">
[[B&G International Decapsulator Model 250]] - Acid etching decapsulation tool from the early 2000's
</div>
</div>
</div>

Mechanical Tools

2023-10-07T12:52:36Z

L0scher: /* USB microscopes */ Added several kinds of inexpensive magnification devices.

[[File:Mechanical Tools.jpeg|thumb|Lathe and drill press]]
Grinders, Drills, Lathes, Milling Machines, Welders and any other tools used to modify hardware. If you used it while reverse engineering, list it here!
==Tool Index==
<br />

==Essential tools and consumables for manipulating PCBAs (Printed Circuit Board Assemblies)==

===Soldering Irons===

====Knockoff JBC station with original JBC soldering tips====
Fix me: Photos and text

====Weller Station====
Fix me: Photos and text

===Tweezers===
Manipulating PCBAs often involves handling small and/or hot components while soldering. Most types of tweezers are made of some kind of steel, which can make them susceptible to get magnetized, which is not ideal if that is not done intentionally by using a magnetize tool. This accidental magnetization can be avoided by using tweezers made of titanium. The minimal set of tweezers should consist of following types:

====Straight, fine tweezers====

====Angled, fine tweezers====

====Straight, coarse tweezers with riffles====
This type of tweezers come in handy when something has to be gripped securely in order to be able to bend / shape them in a controlled manner. These tweezers have a thick metal parts that are not easily bend out of shape like the fine tweezers.

====Straight, self-holding tweezers====

===Scalpels===
There are many types of straight edged and round edged scalpels beside the ones listed below. The one mentioned here are the essential types needed to attach botch wires and sniffing wires to signal tracks covered by solder mask. The fixed connection between the handle and the blade of the disposable version makes this type of scalpel a little bit more precise than the scalpel handle with exchangeable blades. Naughty people even cut through pins of ICs with scalpels to remove ICs without the use of a heat-gun, but you didn't read that here, as that dulls a blade pretty quickly and should only be used in a pinch.

====Straight edged scalpels====
[[Image:ScalpelNo11.jpg|500px]]

The sharp tip of this type of scalpel makes it ideal to cut the conductor track without nicking nearby tracks. The blade #11 has a short, straight edge that gives good control over the cut.

====Round edged scalpels====
[[Image:ScalpelNo23.jpg|500px]]

The copper tracks on the top layer of a PCB are usually covered with a layer of (green) solder mask, which can be carefully scraped away from the portions of the track that are about to be soldered to say attach a wire. The round shape of the blade #23 (there are other blades with a rounded edge) allows the user to only remove the solder mask from the track of interest, which will make the soldering process later on very easy, since the remaining solder mask will prevent the solder to stick to the covered tracks. Exposing the other tracks by scraping too much solder mask away may result in a much more difficult soldering job.

===Soldering Flux===
Soldering flux is the magic ingredient for a soldering job with many functions that makes it a breeze. It cleans and de-greases the components, promotes wetting (makes solder stick to the components instead of balling up) and reduces oxidation. The "tacky" variety also helps to keep the component in place so the usual step of "tacking down" a component can be skipped with enough soldering skill.

===Soldering Fixtures / work piece holders===
====Soldering Fixtures for flat, smartphone sized PCBAs====
Fix me

====Work piece holders for PCBAs with large TH (through hole) components====

=====Panavise 333=====
Fix me

===Magnification devices===

==== Eye Loupe ====
A simple 7x eye loupe is a small, useful tool for examining small parts. There are single monocular loupes, or for a bit higher cost, head-mounted eyeglass style stereoscopic loupes which may or may not feature replaceable optics.

==== Headband magnifier ====
There are many kinds of head-mounted stereoscopic or single-element magnifying devices available. Some are equipped with LED lights, which is handy but not strictly necessary. The picture below shows one that was purchased from a discount tool store for less than US$10.
[[File:Headband magnifier.jpg|none|thumb|headband magnifier]]
<br />
====USB microscopes====
A microscope is handy for examining small parts or PCB traces. There are many inexpensive ones available. A stand is very useful as well for both precise positioning and to keep the camera steady.
[[File:USB microscope with stand.jpg|none|thumb|USB microscope with stand]]
<br />

==Advanced tools for manipulating PCBAs==

===Magnification devices===

====Stereoscopic microscope (analog)====

=====AmScope SM-4NTP=====
This stereo microscope has a lockable double arm boom stand and a magnification range of 7X to 45X (zoom) and is great for component level repairs / modifications. The boom stand allows to quickly change between the normal view onto the work piece in the soldering fixture and a side-view while holding the work piece in the hand without the need to touch the focus and magnifications settings. You just pull out the head over the edge of the table to have room to turn the work piece in the hand to be able to get a side-view of pin-less IC-packages or other things that are difficult to see in the normal view.

Fix me: add photos

====Stereoscopic microscope (digital)====
Fix me: add links and photos

=====The Stereo Ninja Project=====
Fix me: add links and photos

File:Headband magnifier.jpg

2023-10-07T12:42:25Z

L0scher:

headband magnifier

File:USB microscope with stand.jpg

2023-10-07T12:39:57Z

L0scher:

USB microscope with stand

Silver Spring Networks Protocol

2022-06-11T18:14:41Z

L0scher: Added more information about the Itron/SSN traffic

Data capture from a Silver Spring Networks smart meter that was initially powered on. The text is very wide so open the file in a text editor, it won't look right in the browser most likely.

'''Initial capture of data - small file'''

[https://wiki.recessim.com/w/images/2/24/Silver_Spring_Networks_Smart_Meter_00135005008C900A.txt Silver_Spring_Networks_Smart_Meter_00135005008C900A.txt]

'''170 samples sorted by "Mask" column, notice the data appears similar for each mask, need to figure out how it's being transformed.'''

[https://wiki.recessim.com/w/images/4/40/Silver_Spring_Networks_Extended_Parsed_02-22-2022_00135005008C900A.txt Silver_Spring_Networks_Extended_Parsed_02-22-2022_00135005008C900A.txt]
<br />

===Capturing Itron/SSN traffic===
In 2012 a permissive change was filed at the FCC to certify and document an RF mode not initially supported. Specifically, it uses 2-FSK over 64 channels from 902.4MHz to 927.6MHz (inclusive) and a data rate of 150kbps. This appears to be the predominantly used mode today among such devices. A summary of all modes of FCC ID SK9AMI7 are shown below.
{| class="wikitable"
|+
!Modulation
!Frequency range (MHz)
!Number of channels
!Channel separation (kHz)
!Data rates supported (kbps)
|-
|FSK
|902.25 - 927.75
|52
|500
|19.2
|-
|FSK
|902.25 - 927.75
|52
|500
|152.3
|-
|OOK
|909.6 - 921.8
|50
|200
|16.4
|-
|FSK
|902.4 - 927.6
|64
|400
|150.0
|}
The following capture file was created using this gnuradio file. It has the 64 channels explicitly listed within the Center Freq Estimation block. It uses a syncword of 0xAAAAAAAA (which is probably too short) and makes the assumption that data is transmitted most significant bit first, but this is an unverified guess. No checking is done of the packets, so there are very likely to be many packets with errors. In looking through this capture file, the majority of packets start with <syntaxhighlight>
aa aa aa aa aa aa aa aa de 9d 27 27 16 66 f0 6c
</syntaxhighlight>For that reason, it's likely that those packets are probably mostly correct, while the others should be viewed with suspicion.
<br />
[[File:Meter data capture.grc.txt|left|thumb|capture grc file (rename from txt to just .grc to run)]]

[[File:Raw itron packet dump.zip|left|thumb|Raw dump of an Itron/Silver Springs Networks network.]]
<br />
<br />

Silver Spring Networks Protocol

2022-06-11T17:52:39Z

L0scher: add grc file for capturing Itron data

File:Meter data capture.grc.txt

2022-06-11T17:50:20Z

L0scher:

Derived from fhss_detector_reference for capturing Itron meter network traffic

Silver Spring Networks Protocol

2022-06-11T17:38:30Z

L0scher: added zip file capture

File:Raw itron packet dump.zip

2022-06-11T16:57:17Z

L0scher:

This contains 2950 packets that were captured over the air on 11 June 2022. Many are likely to have errors or corruption.

Landis+Gyr GridStream Protocol

2021-05-07T20:47:55Z

L0scher: /* Packet Structure */ Added link to open source gpsdecode library

[[File:LandisGyrResidentialMeter1.JPG|thumb]]

==Protocol Analysis==
Analysis and decoding of the packets used on the Landis+Gyr GridStream mesh network.
<br />
===Packet Structure===

====Sync and Header====
----The sync word that the Landis+Gyr smart meters send is shown below, this can be used in GNU Radio or other tools to receive only packets transmitted by the meters. Note that at the start of the header we begin using start and stop bits. These must be stripped off of the rest of the data packet during processing.
{| class="wikitable"
|+Sync and Header
! colspan="6" |Sync
! colspan="3" |Header
|-
!0xAA
!0xAA
!0xAA
!0xAA
!0xAA
!0xA
!0x00
!0xFF
!0x2A
|-
|10101010
|10101010
|10101010
|10101010
|10101010
|1010
|0 '''00000000''' 1
|0 '''11111111''' 1
|0 '''00101010''' 1
|}
Using GNU Radio it was found that shortening the Sync requirements a bit and incorporating part of the header leads to the cleanest data for further downstream processing. The modified sync shown in 8 bit chunks is shown below.
{| class="wikitable"
|+Sync Word used with GNURadio
!0xAA
!0xAA
!0xAA
!0xAA
!0xA0
!0x05
!0xFF
|-
|10101010
|10101010
|10101010
|10101010
|10100000
|00000101
|11111111
|}
The final byte of the sync (0x2A) along with it's start and stop bits are discarded as part of the processing.
----<br />
====Type, Length and Sub Type====
----So far only two types of packets have been observed, a 0x55 and a 0xD5 packet. Multiple lengths and SubTypes of these are listed below.
{| class="wikitable"
|+
!
!Type
!Length
!SubType
!Packets Purpose
|-
!1
|0x55
|0x0023
|0x30
|Report up-time and other unknown data
|-
!2
|0x55
|0x0028
|0x30
|
|-
!3
|0xD5
|0x0011
|0x21
|
|-
!4
|0xD5
|0x0011
|0x22
|
|-
!5
|0xD5
|0x0011
|0x29
|
|-
!6
|0xD5
|0x0016
|0x21
|
|-
!8
|0xD5
|0x0016
|0x29
|
|-
!7
|0xD5
|0x0017
|0x21
|
|-
!9
|0xD5
|0x0017
|0x29
|
|-
!10
|0xD5
|0x001C
|0x21
|
|-
!11
|0xD5
|0x001C
|0x29
|
|-
!12
|0xD5
|0x001D
|0x29
|
|-
!13
|0xD5
|0x0047
|0x51
|
|-
!14
|0xD5
|0x00FD
|0xC0
|
|}
<br />
----<br />
====Data====
----Data varies per packet type but a common theme is the 0x55 packets appear to be broadcasts from the meters with only their own ID. 0xD5 packets usually contain two ID's and appear to be how data is routed across the network. Sometimes one of the meter ID's in a 0xD5 packet is FFFFFFFF which may be a broadcast packet. This was observed when packets were sent that appear to be updating the system time of the meters.
----<br />
====Checksum====
----
C++ source code below used to calculate the CRC, different energy providers use a different initial CRC value. Assume this is to segment traffic, unsure if Routers/Collectors are shared by different providers to return traffic or not.

<syntaxhighlight lang="c++">
uint16_t Landis_crc16 (uint16_t crc, const std::vector<uint8_t> &data, size_t size) {
// CoServ CRC = 0x45F8
// Oncor CRC = 0x5FD6
// Hard coded Poly 0x1021
uint16_t i = 0;
while (size--) {
crc ^= data[i] << 8;
i++;
for (unsigned k = 0; k < 8; k++)
crc = crc & 0x8000 ? (crc << 1) ^ 0x1021 : crc << 1;
}
return crc;
}
</syntaxhighlight>
----

===Captured Meter Data===
There have been two packet types observed thus far, a 0x55 and a 0xD5 packet.

*0x55 appears to be broadcasts from the meters and happen frequently. They have been observed multiple times per minute from a single meter.

*0xD5 appears to be a packet for transporting data across the mesh network. Each D5 packet will contain two meter ID's, Meter ID #1 and Meter ID #2. There are many 0xD5 packet length and types that have been observed, some are shown below.

----

====0x55 Meter Data====
The data below was captured from the same meter (F0EE36DB) and shows some of the values that can change with each transmission. Different meters have different fixed data and some of the data changes less frequently as well.
{| class="wikitable"
|+
0x55 Captured packets from Meter F0EE36DB (Oncor)
! rowspan="3" |Pkt
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="3" |Not part of CRC calc
! colspan="11" |Data
! colspan="2" |
|-
!Header
!Type
!Length
!SubType
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
!1
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''0C'''
|'''0001ECBF'''
|A483
|F0EE36DB
|0100
|213204
|'''384F'''
|7E80
|0896
|04
|-
!2
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''16'''
|'''0001ECC6'''
|A483
|F0EE36DB
|0100
|213204
|'''3AC5'''
|7E80
|F47E
|04
|-
!3
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''2A'''
|'''0001ED05'''
|A483
|F0EE36DB
|0100
|213204
|'''1207'''
|7E80
|A412
|04
|-
!4
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''34'''
|'''0001ED29'''
|A483
|F0EE36DB
|0100
|213204
|'''1FF9'''
|7E80
|D9C4
|04
|-
!5
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''38'''
|'''0001ED37'''
|A483
|F0EE36DB
|0100
|213204
|'''2571'''
|7E80
|963C
|04
|-
!6
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''42'''
|'''0001ED5C'''
|A483
|F0EE36DB
|0100
|213204
|'''33A9'''
|7E80
|8384
|04
|-
!7
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''4C'''
|'''0001ED60'''
|A483
|F0EE36DB
|0100
|213204
|'''354D'''
|7E80
|2CB6
|04
|-
!8
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''4E'''
|'''0001ED79'''
|A483
|F0EE36DB
|0100
|213204
|'''3F25'''
|7E80
|871A
|04
|-
!9
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''60'''
|'''0001EDA6'''
|A483
|F0EE36DB
|0100
|213204
|'''0F05'''
|7E80
|25C9
|04
|-
!10
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''6A'''
|'''0001EDCD'''
|A483
|F0EE36DB
|0100
|213204
|'''1E55'''
|7E80
|F33F
|04
|}
[[File:55 Packet Timing Analysis.png|thumb|600x600px|Field 15 Timing Analysis -Anonymous]]
Commentary on the data fields above, they have been grouped based on sample analysis but this could be wrong. If you see a new pattern not noticed before you may be correct.

*Field 5 - Never observed a packet with this length and subtype that wasn't all FF's

*Field 6 - WAN Address - Oncor uses GPS coordinates, CoServ uses LAN with padding of some kind. The open source [https://github.com/beroset/gpsdecode gpsdecode] library shows one way to translate between WAN Address and GPS coordinates.

*Field 7 - Increments some amount with each transmission and rolls over at 0xFF, always an even hex value

*Field 8 - Value in seconds since meter powered on, '''easy way to see last time the meter experienced a power outage.'''
*Field 10 - LAN Address, Meter ID that's listed on the sticker on the front

'''** NEW **'''

'''Field 13''' - Timing in hundredths of a second, counts from 0 to 167.99 (0x419F) seconds then rolls over to 0 again. Credit for this discovery goes to an anonymous reader who examined the dataset at the bottom of the page!!
{| class="wikitable"
|+0x55 Captured packets from Meter 5021D005 (Coserv)
! rowspan="3" |Pkt
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="3" |Not part of CRC calc
! colspan="11" |Data
! colspan="2" |
|-
!Header
!Type
!Length
!SubType
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
!1
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
!4
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|C0
|'''0003FC30'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|052E
|7E00
|09FC
|04
|-
!5
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|EA
|'''0003FC9F'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|3062
|7E00
|C69A
|04
|-
! colspan="17" |Power restored after an outage
|-
!6
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|06
|'''0000000F'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|26DA
|7E30
|90CE
|04
|-
!7
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|0E
|'''0000000F'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|26EF
|7E10
|2740
|04
|-
!8
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|20
|'''00000011'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|2801
|7E90
|8B23
|04
|-
!9
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|2C
|'''00000013'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|2883
|7E60
|1A1A
|04
|-
!10
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|54
|'''00000017'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|2A72
|7E80
|E3CD
|04
|}
----

====0xD5 Meter Data====
There appear to be multiple packet lengths and styles for the 0xD5 packet. Some samples shown below.
{| class="wikitable"
|+0xD5 Captured packets
! rowspan="3" |Pkt
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
|-
! colspan="3" |Not part of CRC calc
! colspan="7" |Data
! colspan="2" |
|-
!Header
!Type
!Length
!SubType
!Meter ID #1
!Meter ID #2
!Unknown
!Unknown
!Unknown
!Unknown
!Checksum
!Trailing
|-
|1
|00FF2A
|D5
|0016
|21
|F05FCB84
|F0FC4DB1
|E288
|0100
|273205
|00781930
|CB72
|00
|-
|2
|00FF2A
|D5
|0016
|21
|F0653657
|F03B9FFB
|7288
|0100
|1F3204
|2E241140
|B6B1
|00
|-
|3
|00FF2A
|D5
|0016
|21
|F0EF3BCE
|F03B9FFB
|6288
|0100
|1E3204
|23931730
|6DA6
|00
|-
|4
|00FF2A
|D5
|0016
|21
|F1419ADD
|F03B9FFB
|7C98
|0100
|1E3204
|332C1780
|BB3E
|00
|-
|5
|00FF2A
|D5
|0016
|21
|F07C5F0C
|F03B9FFB
|9A88
|0100
|1E3204
|018C1A80
|4FCF
|00
|}
<br />
{| class="wikitable"
|+0xD5 Packets where actual time along with uptime is observed
! rowspan="3" |Pkt
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
!17
|-
! colspan="3" |Not part of CRC calc
! colspan="12" |Data (Oncor Meter)
! colspan="2" |
|-
!Header
!Type
!Length
!SubType
!Meter ID1
!Meter ID2
!Counter
!Epoch Time
!Unknown
Reading?
!Uptime
!Unknown
!Unknown
!WAN Address
Meter ID2
!Meter ID2
!Unknown Data
!Checksum
!Trailing
|-
!1
|00FF2A
|D5
|0047
|51
|F0C00020
|F03B9FFB
|18
|'''60378AB1'''
|00033D56
|0006C31A
|A483
|0101
|50CFB5D9E400
|F03B9FFB
|000103240602030705070704000000 04C2 C000 204C 0401 FA 2030208180 2163 1900
|75F3
|00
|-
!2
|00FF2A
|D5
|0047
|51
|F10679DE
|F03B9FFB
|1E
|'''60378C72'''
|00023F96
|0006C4DB
|A483
|0101
|50CFB5D9E400
|F03B9FFB
|000103240602030705070704000000 0718 6800 204C 0401 FA 2030208180 0BF7 1D30
|CDB4
|00
|-
!3
|00FF2A
|D5
|0047
|51
|F159CD44
|F03B9FFB
|B4
|'''603A627C'''
|00028F50
|00099AE5
|A483
|0101
|50CFB5D9E400
|F03B9FFB
|000103240602020705070805000000 02A3 C800 1E6C 0401 D9 2030208180 226A 1A10
|7330
|00
|-
! colspan="4" |
! colspan="12" |Data (CoServ Meter)
! colspan="2" |
|-
!4
|00FF2A
|D5
|0047
|51
|F143250D
|5021D005
|1A
|'''603AD051'''
|000130D8
|000D10ED
|A403
|0101
|FE5021D00500
|5021D005
|000103200000000000000000000000 02C3 0800 0E20 0200 E3 20301F8180 22F0 1C40
|4FEB
|00
|-
!5
|00FF2A
|D5
|0047
|51
|F143248A
|5021D005
|64
|'''603AD09C'''
|000133C6
|000D1138
|A403
|0101
|FE5021D00500
|5021D005
|000103200000000000000000000000 0BA0 9000 0E20 0200 E3 20301F8180 4076 1150
|73A7
|00
|-
!6
|00FF2A
|D5
|0047
|51
|500F0DD6
|5021D005
|80
|'''603AD0D3'''
|000135EC
|000D116F
|A403
|0101
|FE5021D00500
|5021D005
|000103200000000000000000000000 01D8 A800 0E20 0200 E3 20301F8180 1412 2E40
|ADC1
|00
|}

*Epoch time calculator and explanation can be found [https://www.epochconverter.com/ here], first convert time from hex to decimal then input into converter.

<code>00FF2A D5 0016 21 F073B577 F062363D FA88 0100 1F6C04 14E93E70 CF80 04</code>

<code>00FF2A D5 0017 29 8073AEAC F0F28D56 1288 0100 1F3204 041CBB1930 2D2A 04</code>

<code>00FF2A D5 001B 21 F10679E2 8073CE7D F498 0100 106C02 0A15F9055F06571A80 37C5 00</code>

<code>00FF2A D5 001C 29 8073ADB3 8073CE7D 9088 0100 106C02 040A99CF055F3A4B1170 A696 04</code>

<code>00FF2A D5 0021 22 F05A1A60 8073CE7D D8010100106C020520301D81800A99CF055F3ADD1410 A560 04</code>

<code>00FF2A D5 0047 51 F05A4BCC F03D4CD7 5A 6032F37F 0001DA2E 00022BE9 A483 0101 50D075D9E2E0 F03D4CD7</code> <code>000103240403030806080801000000036EE8001F6C0401E9203020818018C22930 9294 00</code>
<references />

===Data captures===
'''''*Note: This file does not contain the trailing bytes shown in the captures above, it stops at the 16 bit Checksum.'''''

[https://wiki.recessim.com/w/images/d/d3/F03B9FFB.txt Oncor Meter - F03B9FFB - 48 hours capture]
{| class="wikitable"
|+Data Requests from SmartMeterTexas (F03B9FFB)
!Date
!Time
!Meter Read
!On Demand Energy Usage
|-
|03/01/2021
|14:31:08
|37641.426
|79.415
|-
|03/01/2021
|16:44:40
|37648.598
|37.441
|-
|03/01/2021
|22:14:01
|37658.906
|47.749
|-
|03/02/2021
|21:17:07
|37705.09
|44.071
|-
|03/02/2021
|21:22:58
|37705.234
|44.215
|}
This table lists Real-time data requests from [https://www.smartmetertexas.com/home SmartMeterTexas.com] which allows customers to request current meter readings. You will see 0xD5 packets in the data file closely linked to the times above. When the request is made on the website the meter generally responds within 10-15 seconds meaning the system can send a message to the mesh network, traverse across the meters and return fairly quickly.

===GPS Tagged Wardrive Files===
Format will likely change for the files as more is learned, currently the format is:
Meter_ID, Uptime(seconds), Uptime(days), GPS_Data($GPGGA)
[https://wiki.recessim.com/w/images/a/a6/Wardrive-NTX_to_Highland-Park-03-09-2021.csv Wardrive-NTX_to_Highland-Park-03-09-2021.csv]<br />