search

taligentx / dscKeybusInterface

An Arduino/esp8266/esp32 library to directly interface with DSC security systems.
GNU General Public License v3.0
497 stars 125 forks source link

Decoded cmd 0x6E (HEX data for LCD pgm) and Module/0xE6 cmd key input bug & 0x1B conflict #184

Closed kricon closed 3 years ago

kricon commented 3 years ago

CMD 0x6E, panel send it after entering programming section which contain saved HEX data, for example *5 user code programming/communications programming etc.

Byte2: bits 4-7: Digit 1    Byte2: bits 0-4: Digit 2
Byte3: bits 4-7: Digit 3    Byte3: bits 0-3: Digit 4
Byte4: bits 4-7: Digit 5    Byte4: bits 0-3: Digit 6
Byte5: bits 4-7: Digit 7    Byte5: bits 0-3: Digit 8
Byte6: probably CRC
2156.17: 01101110 0 00010000 00000000 00000000 00000000 01111110 [0x6E] Unknown data //100000
 2256.52: 01101110 0 00000001 00000000 00000000 00000000 01101111 [0x6E] Unknown data //010000
 2318.87: 01101110 0 00000000 00010000 00000000 00000000 01111110 [0x6E] Unknown data //001000
 2395.04: 01101110 0 00000000 00000001 00000000 00000000 01101111 [0x6E] Unknown data //000100
 2426.32: 01101110 0 00000000 00000000 00010000 00000000 01111110 [0x6E] Unknown data //000010
  127.57: 01101110 0 10101010 10101010 00000000 00000000 11000010 [0x6E] Unknown data //AAAA00
Entering section 301 (first phone number, 32 characters):
 1179.67: 01101110 0 11010000 11111111 11111111 11111111 00111011 [0x6E] Unknown data //D0FFFFFF
 1179.75: 11111111 1 10100101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //send by keypad after receiving and reading 8digits from 0x0A above. Decoded in Pull request
 1179.80: 01101110 0 11111111 11111111 11111111 11111111 01101010 [0x6E] Unknown data //FFFFFFFF
 1179.89: 11111111 1 10100101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //send by keypad after receiving and reading 8digits from 0x0A above. Decoded in Pull request
 1179.94: 01101110 0 11111111 11111111 11111111 11111111 01101010 [0x6E] Unknown data //FFFFFFFF
 1180.02: 11111111 1 10100101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //send by keypad after receiving and reading 8digits from 0x0A above. Decoded in Pull request
 1180.08: 01101110 0 11111111 11111111 11111111 11111111 01101010 [0x6E] Unknown data //FFFFFFFF
 1180.32: 00000101 0 10000001 11101101 10010001 11000111 10010001 11000111 10010001 11000111 [0x05] Partition 1: Ready Backlight - Input 32 digits | Partition 2: disabled | Partition 3: disabled | Partition 4: disabled

I noticed that sometimes when I input keys, I get "Unknown data" instead of partition and which key was pressed. The actual key data is on 0xE6 byte3, doesnt matter for which partition. Byte2 is 0xFF every time when 0xE6 cmd send keys.

 1328.46: 11111111 1 00000101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: 1 
 1179.61: 11111111 1 11111111 10100101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 1 on partition 1
 1055.41: 11111111 1 00001111 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x05] Partition 1 Key: 3 
 1142.07: 11111111 1 11111111 00001111 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 3 on partition 1
 1142.65: 11111111 1 00000000 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: 0 
 1056.31: 11111111 1 11111111 00000000 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 0 on partition 1
 2660.80: 11111111 1 11111111 11111111 11111111 11111111 11111111 11111111 00010110 11111111 [Module/0x05] Partition 3 Key: 5 
 2660.29: 11111111 1 11111111 00010110 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 5 partition 3

EDIT: It seems that CMDs 0x27, 0x2D and 0x3E also carries key data, it seems to be on Byte2 bits2+:

 6112.62: 00001010 0 10000000 10011110 00000000 00000000 00000000 00000000 00000000 00101000 [0x0A] Backlight - Enter * function code | Zone lights: none
 6112.72: 11100110 0 00100000 10000000 10011110 00000000 00000000 00000000 00000000 10000000 10100100 [0xE6.20] Status lights: Backlight - Enter * function code | Zone lights: none
 6112.82: 00000101 0 10000000 10011110 00010000 11000111 00010000 11000111 00010000 11000111 [0x05] Partition 1: Backlight - Enter * function code | Partition 2: disabled | Partition 3: disabled | Partition 4: disabled
 6112.83: 11111111 1 00010110 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x05] Partition 1 Key: 5 
 6112.91: 11111111 1 11111111 11111111 11111111 11111011 11111111 11111111 11111111 11111111 [Module/0x05] Keypad zone notification 
 6112.91: 00000101 0 10000000 10100101 00010000 11000111 00010000 11000111 00010000 11000111 [0x05] Partition 1: Backlight - Enter master code | Partition 2: disabled | Partition 3: disabled | Partition 4: disabled
 6113.01: 11010101 0 10101010 10101010 10101010 10101010 10101010 10101010 10101010 10101010 [0xD5] Keypad zone query
 6113.01: 11111111 1 11111111 11111111 11111111 11111111 11111111 11111111 11111111 00001111 [Module/0xD5] Keypad Slot 8: Zone open
 6113.09: 00100111 0 10000000 10100101 00010000 11000111 00100010 01000101 [0x27] Partition 1: Backlight - Enter master code | Partition 2: disabled | Zones 1-8 open: 2 6 
 6113.10: 11111111 1 00000101 11111111 11111111 11111111 11111111 11111111 [Module/0x27] Unknown data  //Should be Key: 1
 6113.18: 00101101 0 10000000 10100101 00010000 11000111 00000000 00101001 [0x2D] Partition 1: Backlight - Enter master code | Partition 2: disabled | Zones 9-16 open: none 
 6113.18: 11111111 1 00001010 11111111 11111111 11111111 11111111 11111111 [Module/0x2D] Unknown data //should be key: 2
 6113.24: 00110100 0 10000000 10100101 00010000 11000111 00000000 00110000 [0x34] Partition 1: Backlight - Enter master code | Partition 2: disabled | Zones 17-24 open: none 
 6113.32: 11111111 1 00001111 11111111 11111111 11111111 11111111 11111111 [Module/0x3E] Unknown data //should be key: 3
 6113.33: 00111110 0 10000000 10100101 00010000 11000111 00000000 00111010 [0x3E] Partition 1: Backlight - Enter master code | Partition 2: disabled | Zones 25-32 open: none 
 6113.39: 00100111 0 10000000 10100101 00010000 11000111 00100010 01000101 [0x27] Partition 1: Backlight - Enter master code | Partition 2: disabled | Zones 1-8 open: 2 6 
 6113.85: 11111111 1 00010001 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x05] Partition 1 Key: 4 
 6113.92: 01100100 0 00000110 01101010 [0x64] Partition 1 | Beep: 3 beeps

While we talk about unknown key data, I found some more, this one related to start of broadcasting keypad labels. After keypad send that key, all keypads on system became unresponsive and accepts label broadcasting information. Key output decoded in PR.

  446.54: 11111111 1 10010100 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //lcd5500 label broadcast announced, disables all keypads on system
  459.14: 11111111 1 01010011 01111001 01110011 01110100 01100101 01101101 00100000 00100000 00100000 00100000 00100000 00100000 00100000 00100000 [Module/0xA0] Unknown data //label broadcast finish

Noticed something weird after entering 1/2 or 3 menu. Doesnt matter if 1/2/3 access code required is enabled/disabled in section [022]. It seems keypad send 0x75 key back to the panel (sometimes even few times in row). Included in PR.

 3019.19: 00000101 0 10000000 10100010 10010001 11000111 10010001 11000111 10010001 11000111 [0x05] Partition 1: Backlight - *3: Alarm memory | Partition 2: disabled | Partition 3: disabled | Partition 4: disabled
 3019.26: 11111111 1 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x05] Partition 1 Key: //key 0x75
 3019.34: 00001010 0 10000000 10100010 00000000 00000000 00000000 00000000 00000000 00101100 [0x0A] Backlight - *3: Alarm memory | Zone lights: none
 3019.43: 11100110 0 00100000 10000000 10100010 00000000 00000000 00000000 00000000 10000000 10101000 [0xE6.20] Status lights: Backlight - *3: Alarm memory | Zone lights: none
 3019.44: 11111111 1 11111111 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 0x75
 3019.51: 11111111 1 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //key 0x75
 3019.59: 11111111 1 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //key 0x75

 3080.60: 00001010 0 10000000 10100001 10001101 00000000 00000000 00000000 00000000 10111000 [0x0A] Backlight - *2: Trouble | Zone lights: 1 3 4 8 
 3080.67: 01011101 0 00010000 00000000 00000000 00000000 00000000 01101101 [0x5D] Partition 1 | Status lights flashing: Trouble | Zones 1-32 flashing: none
 3080.75: 11100110 0 00011000 00000001 00010000 00000000 00000000 00000000 00000000 00001111 [0xE6.18] Partition 1 | Status lights flashing: Trouble | Zones 33-64 flashing: none
 3080.83: 11111111 1 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //key 0x75

 3126.83: 10100101 0 00100000 01101010 01100001 10001010 01100110 00000000 10000000 [0xA5] 2020.10.19 01:34 | Partition 1 | *1: Zone bypass programming
 3126.92: 00001010 0 10000000 10100000 00000000 00000000 00000000 00000000 00000000 00101010 [0x0A] Backlight - *1: Zone bypass | Zone lights: none
 3127.01: 11100110 0 00100000 10000000 10100000 00000000 00000000 00000000 00000000 10000000 10100110 [0xE6.20] Status lights: Backlight - *1: Zone bypass | Zone lights: none
 3127.01: 11111111 1 11111111 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 0x75
 3127.18: 11111111 1 11111111 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 0x75
 3127.44: 00000101 0 10000000 10100000 10010001 11000111 10010001 11000111 10010001 11000111 [0x05] Partition 1: Backlight - *1:

0x1B cmd conflict: I have found that when keypad goes idle (after 30sec), it send 0x05 byte7 bit3 for "Keypad going idle notification" and in 0x1B cmd afterwards on byte4 it show on which partition keypad goes idle. Probably that notifications are send because when keypad goes idle, it goes to partition assigned in [000] section so panel answers with [0x5D] or similar command which contains partion status. I didnt noticed anything keypad-slot related. 0x05 "Unknown notification" renamed in PU to "Keypad idle notification" as it seems "Unknown" was only related for bit3.

cmd 0x05 byte7 bit3: Keypad going idle notification, 0x5D send afterwards
cmd 0x1B byte4 bits0-7: On which partition 1-8 keypad goes idle

 5056.11: 11111111 1 11111111 11111111 11111111 11111111 11111111 11110111 11111111 11111111 [Module/0x05] Unknown notification  //Keypad idle notification
 5056.19: 11111111 1 11111111 11111111 11111110 11111111 11111111 11111111 11111111 11111111 [Module/0x1B] Module tamper notification //Keypad on Partition 1 goes idle
 4823.37: 11111111 1 11111111 11111111 11111111 11111111 11111111 11110111 11111111 11111111 [Module/0x05] Unknown notification  //Keypad idle notification
 4823.45: 11111111 1 11111111 11111111 11111101 11111111 11111111 11111111 11111111 11111111 [Module/0x1B] Unknown data //Keypad on partition 2 goes idle
 5155.07: 11111111 1 11111111 11111111 11111111 11111111 11111111 11110111 11111111 11111111 [Module/0x05] Unknown notification  //Keypad idle notification
 5155.15: 11111111 1 11111111 11111111 11110111 11111111 11111111 11111111 11111111 11111111 [Module/0x1B] Wireless module battery notification //Keypad on partition 4 idle

Just for reference, when I enter *8 programming on pc1832 from partition other than 1 I constantly get unknown data stream from cmds 0xE6.21, 0x0F, 0xE6.01, 0xE6.02 (probably something similar as 0x0A cmd is for partion1):

11465.81: 11100110 0 00100001 10000010 11100100 00000000 00000000 00000000 00000000 10000000 11101101 [0xE6.21] Unknown data //constant stream when in *8 programming from partition 2
11465.98: 00001111 0 10000010 11100100 00000000 00000000 00000000 00000000 00000000 01110101 [0x0F] Unknown data //constant stream while being in *8 programming from partition 2
11547.26: 11100110 0 00000001 10000010 11100100 00000000 00000000 00000000 00000000 00000000 01001101 [0xE6.01] Unknown data //constant stream while being in *8 programming from partition 3
11547.34: 11100110 0 00000001 10000010 11100100 00000000 00000000 00000000 00000000 10000000 11001101 [0xE6.01] Unknown data //constant stream while being in *8 programming from partition 3
11633.13: 11100110 0 00000010 10000010 11100100 00000000 00000000 00000000 00000000 00000000 01001110 [0xE6.02] Unknown data //constant stream while being in *8 programming from partition 4
11633.21: 11100110 0 00000010 10000010 11100100 00000000 00000000 00000000 00000000 10000000 11001110 [0xE6.02] Unknown data //constant stream while being in *8 programming from partition 4

Found that 0xC3 command isn't just for keypad status but for dialer aswell. Byte2 bits 3 and 4, previously mark as unknown. Each time when panel attempt to dial, 0xC3 byte2 is 0x18 and when dialer end calling byte2 is 0x10. Decoding included in PR.

 1461.47: 11000011 0 00010000 11111111 11010010 [0xC3] Unknown data //Dialer call ended
 1517.67: 11000011 0 00011000 11111111 11011010 [0xC3] Unknown data //Dialing attempt

I've also decoded 0x8D and partly 0x94 CMDs, which is used for communication with Wireless module expander. I'll open a seperate issue with log output and decoding for that to keep it clean from here - its already enough stuff included here.

taligentx commented 3 years ago

CMD 0x6E, panel send it after entering programming section which contain saved HEX data, for example *5 user code programming/communications programming etc.

Added!

I noticed that sometimes when I input keys, I get "Unknown data" instead of partition and which key was pressed. The actual key data is on 0xE6 byte3, doesnt matter for which partition. Byte2 is 0xFF every time when 0xE6 cmd send keys

EDIT: It seems that CMDs 0x27, 0x2D and 0x3E also carries key data, it seems to be on Byte2 bits2+:

I've added keypad keys decoding for the 0xE6 commands in programming and also fixed a bug where the panel command that the module data is sent with could be wrong. Good catch with the keys on 0x27, 0x2D, and 0x3E, I didn't come across this previously but was able to verify that partition 1 and 2 keys can be sent during these commands.

0x1B cmd conflict: I have found that when keypad goes idle (after 30sec), it send 0x05 byte7 bit3 for "Keypad going idle notification" and in 0x1B cmd afterwards on byte4 it show on which partition keypad goes idle.

Looks good, I've split out the 0x1B decoding for byte 4 to indicate the keypad partition.

Just for reference, when I enter *8 programming on pc1832 from partition other than 1 I constantly get unknown data stream from cmds 0xE6.21, 0x0F, 0xE6.01, 0xE6.02 (probably something similar as 0x0A cmd is for partion1):

I've added a check for redundant data in partition 2 installer programming, but partitions 3-8 will still flood messages because of the way that the 0xE6.01-0xE6.06 commands alternate the same command for different ranges zone lights. It would eat up memory for all sketches just to improve the view in KeybusReader so for now I'll leave it as is. 0xE6.01-0xE6.06 are at least getting decoded now.

Thanks for all this!

kricon commented 3 years ago

When panel is requesting 3 digit code input, decimal data send/received on 0x6E and 0x70 cmds is on Byte2 for all 3 numbers (0-255). That's the only case I saw where data isn't send/received as hex. I've made Pull Request fixing this, so after entering [005] section for system times instead 1E000000 you'll get 030 like it's displayed on LCD screen.

Nice to have keypad keys decoded for other commands too, It was confusing me for some time. Thanks! I'll report if I saw key send on any other cmd.

EDIT: Pull request with fix for 0x6E/0x70 3-digit decimal input got merged so I'm closing this issue as all from here got included and fixed - there is no need to keep issue open.