Difference between revisions of "Landis+Gyr GridStream Protocol"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
VisualWikitext
Line 79: Line 79:
 
|
 
|
 
!SubType
 
!SubType
−
!Unknown<ref>test</ref>
+
!Unknown
 
!Unknown
 
!Unknown
 
!Unknown
 
!Unknown
Line 96: Line 96:
 
|-
 
|-
 
|Packet #1
 
|Packet #1
−
|<code>00FF2A</code>
+
|00FF2A
−
|<code>55</code>
+
|55
−
|<code>0023</code>
+
|0023
 
!
 
!
−
|<code>30</code>
+
|30
−
|<code>FFFFFFFFFFFF</code>
+
|FFFFFFFFFFFF
−
|<code>50</code>
+
|50
−
|<code>CF8DD9E2</code>
+
|CF8DD9E2
−
|<code>C0</code>
+
|C0
−
|<code>'''0C'''</code>
+
|'''0C'''
−
|<code>'''0001ECBF'''</code>
+
|'''0001ECBF'''
−
|<code>A483</code>
+
|A483
−
|<code>F0EE36DB</code>
+
|F0EE36DB
−
|<code>0100</code>
+
|0100
−
|<code>2132</code>
+
|2132
−
|<code>'''04384F'''</code>
+
|'''04384F'''
−
|<code>7E80</code>
+
|7E80
 
! rowspan="10" |
 
! rowspan="10" |
−
|<code>0896</code>
+
|0896
−
|<code>04</code>
+
|04
 
|-
 
|-
 
|Packet #2
 
|Packet #2
−
|<code>00FF2A</code>
+
|00FF2A
−
|<code>55</code>
+
|55
−
|<code>0023</code>
+
|0023
 
!
 
!
−
|<code>30</code>
+
|30
−
|<code>FFFFFFFFFFFF</code>
+
|FFFFFFFFFFFF
−
|<code>50</code>
+
|50
−
|<code>CF8DD9E2</code>
+
|CF8DD9E2
−
|<code>C0</code>
+
|C0
−
|<code>'''16'''</code>
+
|'''16'''
−
|<code>'''0001ECC6'''</code>
+
|'''0001ECC6'''
−
|<code>A483</code>
+
|A483
−
|<code>F0EE36DB</code>
+
|F0EE36DB
−
|<code>0100</code>
+
|0100
−
|<code>2132</code>
+
|2132
−
|<code>'''043AC5'''</code>
+
|'''043AC5'''
−
|<code>7E80</code>
+
|7E80
−
|<code>F47E</code>
+
|F47E
−
|<code>04</code>
+
|04
 
|-
 
|-
 
|Packet #3
 
|Packet #3
−
|<code>00FF2A</code>
+
|00FF2A
−
|<code>55</code>
+
|55
−
|<code>0023</code>
+
|0023
 
!
 
!
−
|<code>30</code>
+
|30
−
|<code>FFFFFFFFFFFF</code>
+
|FFFFFFFFFFFF
−
|<code>50</code>
+
|50
−
|<code>CF8DD9E2</code>
+
|CF8DD9E2
−
|<code>C0</code>
+
|C0
−
|<code>'''2A'''</code>
+
|'''2A'''
−
|<code>'''0001ED05'''</code>
+
|'''0001ED05'''
−
|<code>A483</code>
+
|A483
−
|<code>F0EE36DB</code>
+
|F0EE36DB
−
|<code>0100</code>
+
|0100
−
|<code>2132</code>
+
|2132
−
|<code>'''041207'''</code>
+
|'''041207'''
−
|<code>7E80</code>
+
|7E80
−
|<code>A412</code>
+
|A412
−
|<code>04</code>
+
|04
 
|-
 
|-
 
|Packet #4
 
|Packet #4
−
|<code>00FF2A</code>
+
|00FF2A
−
|<code>55</code>
+
|55
−
|<code>0023</code>
+
|0023
 
!
 
!
−
|<code>30</code>
+
|30
−
|<code>FFFFFFFFFFFF</code>
+
|FFFFFFFFFFFF
−
|<code>50</code>
+
|50
−
|<code>CF8DD9E2</code>
+
|CF8DD9E2
−
|<code>C0</code>
+
|C0
−
|<code>'''34'''</code>
+
|'''34'''
−
|<code>'''0001ED29'''</code>
+
|'''0001ED29'''
−
|<code>A483</code>
+
|A483
−
|<code>F0EE36DB</code>
+
|F0EE36DB
−
|<code>0100</code>
+
|0100
−
|<code>2132</code>
+
|2132
−
|<code>'''041FF9'''</code>
+
|'''041FF9'''
−
|<code>7E80</code>
+
|7E80
−
|<code>D9C4</code>
+
|D9C4
−
|<code>04</code>
+
|04
 
|-
 
|-
 
|Packet #5
 
|Packet #5
−
|<code>00FF2A</code>
+
|00FF2A
−
|<code>55</code>
+
|55
−
|<code>0023</code>
+
|0023
 
!
 
!
−
|<code>30</code>
+
|30
−
|<code>FFFFFFFFFFFF</code>
+
|FFFFFFFFFFFF
−
|<code>50</code>
+
|50
−
|<code>CF8DD9E2</code>
+
|CF8DD9E2
−
|<code>C0</code>
+
|C0
−
|<code>'''38'''</code>
+
|'''38'''
−
|<code>'''0001ED37'''</code>
+
|'''0001ED37'''
−
|<code>A483</code>
+
|A483
−
|<code>F0EE36DB</code>
+
|F0EE36DB
−
|<code>0100</code>
+
|0100
−
|<code>2132</code>
+
|2132
−
|<code>'''042571'''</code>
+
|'''042571'''
−
|<code>7E80</code>
+
|7E80
−
|<code>963C</code>
+
|963C
−
|<code>04</code>
+
|04
 
|-
 
|-
 
|Packet #6
 
|Packet #6
−
|<code>00FF2A</code>
+
|00FF2A
−
|<code>55</code>
+
|55
−
|<code>0023</code>
+
|0023
 
!
 
!
−
|<code>30</code>
+
|30
−
|<code>FFFFFFFFFFFF</code>
+
|FFFFFFFFFFFF
−
|<code>50</code>
+
|50
−
|<code>CF8DD9E2</code>
+
|CF8DD9E2
−
|<code>C0</code>
+
|C0
−
|<code>'''42'''</code>
+
|'''42'''
−
|<code>'''0001ED5C'''</code>
+
|'''0001ED5C'''
−
|<code>A483</code>
+
|A483
−
|<code>F0EE36DB</code>
+
|F0EE36DB
−
|<code>0100</code>
+
|0100
−
|<code>2132</code>
+
|2132
−
|<code>'''0433A9'''</code>
+
|'''0433A9'''
−
|<code>7E80</code>
+
|7E80
−
|<code>8384</code>
+
|8384
−
|<code>04</code>
+
|04
 
|-
 
|-
 
|Packet #7
 
|Packet #7
−
|<code>00FF2A</code>
+
|00FF2A
−
|<code>55</code>
+
|55
−
|<code>0023</code>
+
|0023
 
!
 
!
−
|<code>30</code>
+
|30
−
|<code>FFFFFFFFFFFF</code>
+
|FFFFFFFFFFFF
−
|<code>50</code>
+
|50
−
|<code>CF8DD9E2</code>
+
|CF8DD9E2
−
|<code>C0</code>
+
|C0
−
|<code>'''4C'''</code>
+
|'''4C'''
−
|<code>'''0001ED60'''</code>
+
|'''0001ED60'''
−
|<code>A483</code>
+
|A483
−
|<code>F0EE36DB</code>
+
|F0EE36DB
−
|<code>0100</code>
+
|0100
−
|<code>2132</code>
+
|2132
−
|<code>'''04354D'''</code>
+
|'''04354D'''
−
|<code>7E80</code>
+
|7E80
−
|<code>2CB6</code>
+
|2CB6
−
|<code>04</code>
+
|04
 
|-
 
|-
 
|Packet #8
 
|Packet #8
−
|<code>00FF2A</code>
+
|00FF2A
−
|<code>55</code>
+
|55
−
|<code>0023</code>
+
|0023
 
!
 
!
−
|<code>30</code>
+
|30
−
|<code>FFFFFFFFFFFF</code>
+
|FFFFFFFFFFFF
−
|<code>50</code>
+
|50
−
|<code>CF8DD9E2</code>
+
|CF8DD9E2
−
|<code>C0</code>
+
|C0
−
|<code>'''4E'''</code>
+
|'''4E'''
−
|<code>'''0001ED79'''</code>
+
|'''0001ED79'''
−
|<code>A483</code>
+
|A483
−
|<code>F0EE36DB</code>
+
|F0EE36DB
−
|<code>0100</code>
+
|0100
−
|<code>2132</code>
+
|2132
−
|<code>'''043F25'''</code>
+
|'''043F25'''
−
|<code>7E80</code>
+
|7E80
−
|<code>871A</code>
+
|871A
−
|<code>04</code>
+
|04
 
|-
 
|-
 
|Packet #9
 
|Packet #9
−
|<code>00FF2A</code>
+
|00FF2A
−
|<code>55</code>
+
|55
−
|<code>0023</code>
+
|0023
 
!
 
!
−
|<code>30</code>
+
|30
−
|<code>FFFFFFFFFFFF</code>
+
|FFFFFFFFFFFF
−
|<code>50</code>
+
|50
−
|<code>CF8DD9E2</code>
+
|CF8DD9E2
−
|<code>C0</code>
+
|C0
−
|<code>'''60'''</code>
+
|'''60'''
−
|<code>'''0001EDA6'''</code>
+
|'''0001EDA6'''
−
|<code>A483</code>
+
|A483
−
|<code>F0EE36DB</code>
+
|F0EE36DB
−
|<code>0100</code>
+
|0100
−
|<code>2132</code>
+
|2132
−
|<code>'''040F05'''</code>
+
|'''040F05'''
−
|<code>7E80</code>
+
|7E80
−
|<code>25C9</code>
+
|25C9
−
|<code>04</code>
+
|04
 
|-
 
|-
 
|Packet #10
 
|Packet #10
−
|<code>00FF2A</code>
+
|00FF2A
−
|<code>55</code>
+
|55
−
|<code>0023</code>
+
|0023
 
!
 
!
−
|<code>30</code>
+
|30
−
|<code>FFFFFFFFFFFF</code>
+
|FFFFFFFFFFFF
−
|<code>50</code>
+
|50
−
|<code>CF8DD9E2</code>
+
|CF8DD9E2
−
|<code>C0</code>
+
|C0
−
|<code>'''6A'''</code>
+
|'''6A'''
−
|<code>'''0001EDCD'''</code>
+
|'''0001EDCD'''
−
|<code>A483</code>
+
|A483
−
|<code>F0EE36DB</code>
+
|F0EE36DB
−
|<code>0100</code>
+
|0100
−
|<code>2132</code>
+
|2132
−
|<code>'''041E55'''</code>
+
|'''041E55'''
−
|<code>7E80</code>
+
|7E80
−
|<code>F33F</code>
+
|F33F
−
|<code>04</code>
+
|04
 
|}
 
|}
 
1) Header = 0x00FF2A
 
1) Header = 0x00FF2A

Revision as of 23:25, 5 March 2021


  • LandisGyrResidentialMeter2.JPG
  • LandisGyrResidentialMeter3.JPG
  • LandisGyrResidentialMeter1.JPG

Reverse Engineering and Analysis

Packet Structure

Sync Word

0xAA     0xAA     0xAA     0xAA     0xA0     0x05     0xFF

10101010 10101010 10101010 10101010 10100000 00000101 11111111  Sync Word (no start/stop bits)

PDU align syncword: 0xAAAAAAAAAAA005FF but I use one less 0xAA at the start 0xAA.AA.AA.AA.A0.05.FF

0xAA     0xAA     0xAA     0xAA     0xAA     0xA        0x00         0xFF     |     0x2A

10101010 10101010 10101010 10101010 10101010 1010   0 00000000 1 0 11111111 1 | 0 00101010 1       Sync Word (no start/stop bits)

Start and Stop Bits

Header

Type, Length and Sub Type

Data

Checksum


Captured Meter Data

There have been two packet types observed thus far, a 0x55 and a 0xD5 packet.

  • 0x55 appears to be broadcasts from the meters and happen frequently. They have been observed multiple times per minute from a single meter.
  • 0xD5 appears to be a packet for transporting data across the mesh network. Each D5 packet will contain two meter ID's, Meter ID #1 and Meter ID #2. There are many 0xD5 packet length and types that have been observed, some are shown below.

0x55 Meter Data

The data below was captured from the same meter (F0EE36DB) and shows some of the values that can change with each transmission. Different meters have different fixed data and some of the data changes less frequently as well.

0x55 Captured packets from Meter F0EE36DB
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Not part of CRC calc Data
Header Type Length SubType Unknown Unknown Unknown Unknown Counter Uptime (seconds) Unknown Meter ID Unknown Unknown Unknown Unknown CRC Trailing
Packet #1 00FF2A 55 0023 30 FFFFFFFFFFFF 50 CF8DD9E2 C0 0C 0001ECBF A483 F0EE36DB 0100 2132 04384F 7E80 0896 04
Packet #2 00FF2A 55 0023 30 FFFFFFFFFFFF 50 CF8DD9E2 C0 16 0001ECC6 A483 F0EE36DB 0100 2132 043AC5 7E80 F47E 04
Packet #3 00FF2A 55 0023 30 FFFFFFFFFFFF 50 CF8DD9E2 C0 2A 0001ED05 A483 F0EE36DB 0100 2132 041207 7E80 A412 04
Packet #4 00FF2A 55 0023 30 FFFFFFFFFFFF 50 CF8DD9E2 C0 34 0001ED29 A483 F0EE36DB 0100 2132 041FF9 7E80 D9C4 04
Packet #5 00FF2A 55 0023 30 FFFFFFFFFFFF 50 CF8DD9E2 C0 38 0001ED37 A483 F0EE36DB 0100 2132 042571 7E80 963C 04
Packet #6 00FF2A 55 0023 30 FFFFFFFFFFFF 50 CF8DD9E2 C0 42 0001ED5C A483 F0EE36DB 0100 2132 0433A9 7E80 8384 04
Packet #7 00FF2A 55 0023 30 FFFFFFFFFFFF 50 CF8DD9E2 C0 4C 0001ED60 A483 F0EE36DB 0100 2132 04354D 7E80 2CB6 04
Packet #8 00FF2A 55 0023 30 FFFFFFFFFFFF 50 CF8DD9E2 C0 4E 0001ED79 A483 F0EE36DB 0100 2132 043F25 7E80 871A 04
Packet #9 00FF2A 55 0023 30 FFFFFFFFFFFF 50 CF8DD9E2 C0 60 0001EDA6 A483 F0EE36DB 0100 2132 040F05 7E80 25C9 04
Packet #10 00FF2A 55 0023 30 FFFFFFFFFFFF 50 CF8DD9E2 C0 6A 0001EDCD A483 F0EE36DB 0100 2132 041E55 7E80 F33F 04

1) Header = 0x00FF2A

2) Packet Type = 0x55

3) Packet Length = 0x0023

4) SubType = 0x30

5) Unknown = FFFFFFFFFFFF (Empty Data Slot?)

6) Unknown = 0x50

7) Unknown = CF8DD9E2 (Appears to either be location identifier or duplicate meter ID in some cases)

8) Unknown = C0

9) Counter = 02 (Increments some amount with each transmission and rolls over at 0xFF)

10) Uptime = 0x0001ECA3 (Value in seconds since meter powered on, easy way to see last time there was an outage!)

11) Unknown Identifier #5 = 0xA483

12) Meter ID = 0xF0EE36DB

13) Unknown = 0x0100

14) Unknown = 0x2132

15) Unknown = 0x042D19

16) Unknown = 0x7E80

17) Checksum = 0xF154

18) Trailing byte = 0x04

0xD5 Meter Data

There appear to be multiple packet lengths and styles for the 0xD5 packet. There are some samples below showing

0xD5 Captured packet
Header Type Length SubType Meter ID #1 Meter ID #2 Unknown Unknown Unknown Unknown CRC Trailing
Packet #1 00FF2A D5 0016 21 F05FCB84 F0FC4DB1 E288 0100 273205 00781930 CB72 00

1) Header = 0x00FF2A

2) Packet Type = 0xD5

3) Packet Length = 0x0016

4) Unknown Identifier #1 = 0x21

5) Meter ID #1 = F05FCB84

6) Meter ID #2 = F0FC4DB1

7) Unknown Identifier #2 = 0xE288

8) Unknown Identifier #3 = 0x0100

9) Unknown Data #1 = 0x273205

10) Unknown Data #2 = 0x00781930

11) Checksum = 0xCB72

12) Trailing byte = 0x00


00FF2A D5 0016 21 F073B577 F062363D FA88 0100 1F6C04 14E93E70 CF80 04

00FF2A D5 0017 29 8073AEAC F0F28D56 1288 0100 1F3204 041CBB1930 2D2A 04

00FF2A D5 001B 21 F10679E2 8073CE7D F498 0100 106C02 0A15F9055F06571A80 37C5 00

00FF2A D5 001C 29 8073ADB3 8073CE7D 9088 0100 106C02 040A99CF055F3A4B1170 A696 04

00FF2A D5 0021 22 F05A1A60 8073CE7D D8010100106C020520301D81800A99CF055F3ADD1410 A560 04

00FF2A D5 0047 51 F05A4BCC F03D4CD7 5A6032F37F0001DA2E00022BE9 A483 010150D075D9E2E0 F03D4CD7 000103240403030806080801000000036EE8001F6C0401E9203020818018C22930 9294 00

Retrieved from "https://wiki.recessim.com/w/index.php?title=Landis%2BGyr_GridStream_Protocol&oldid=1329"