Retallack Family Wiki

User Tools

Site Tools

Trace:
surepet

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
Last revisionBoth sides next revision
surepet [2021/02/02 07:45] – created marksurepet [2021/02/02 12:07] – [Protocol Sniff] mark
Line 2: Line 2:
  
 The SurePet Feeder uses a 802.15.4 based protocol called MiWi P2P. This is a protocol that is made by Microchip. The SurePet Feeder uses a 802.15.4 based protocol called MiWi P2P. This is a protocol that is made by Microchip.
 +
 +
 +
 +====== Research ======
 +
 +The following link shows someone who has captured some of the P2P frames and has mapped them to a spec:
 +
 +https://github.com/alextoft/sureflap/issues/8#issuecomment-698580972
 +
 +{{https://user-images.githubusercontent.com/6843129/94198812-25cf4680-feb8-11ea-9cf8-75e8a6516f92.png}}
 +
 +From the following link, it appears that the beacon is transmitted on channel 15:
 +
 +https://github.com/Koenkk/zigbee2mqtt/issues/3261#issue-591745054
 +
 +{{https://user-images.githubusercontent.com/6843129/78118319-24d8c300-7407-11ea-93b5-406c375d5ade.png}}
 +
 +
 +====== Protocol Sniff ======
 +
 +Ideally we would use the Zena sniffer, however I seem to of bricked it. 
 +
 +{{https://www.microchip.com/_ImagedCopy/AC182015-371507036.png}}
 +
 +The Zena software allows for protocol decode of the MiWi P2P protocol. 
 +
 +So instead for now we are using a UZBee+.
 +
 +{{https://www.digchip.com/prod/photo/1128071-UZBEEPLUS.jpg?100}}
 +
 +
 +After creating a simple sniffer tool, when the "setup" button on the SurePet device is pressed, the following packet is received:
 +
 +b'+PDAI=1343C832FFFFFFFF6E2A02C0F9D5B370072FECE8\r\n'
 +
 +The MAC address is printed on the bottom of the device, This matches the above packet.
 +
 +1343C832FFFFFFFF6E2A02C0F9D5B370072FECE8
 +
 +13=Length
 +
 +So
 +
 +43C832FFFFFFFF6E2A02C0F9D5B370072FECE8
 +
 +6E2A02C0F9D5B370=Mac (reversed)
 +
 +
 +The P2P protocol is documented in the following document:
 +
 +https://ww1.microchip.com/downloads/en/DeviceDoc/00001204C.pdf
 +
 +
 +So the full payload decodes as:
 +
 +
 +  * 43C8=Frame Control
 +  * 32=Sequence Number
 +  * FFFF=Destination PAN ID
 +  * FFFF=Destination Address
 +  * Source PAN ID (0 bytes)
 +  * 6E2A02C0F9D5B370=Source Address
 +  * 072F=Payload
 +  * ECE8=Frame Check
 +
 +
 +And the Frame Control:
 +
 +43C8=
 +
 +
 +
 +Test 1:
 +
 +16
 +
 +
 +CC01
 +00
 +FFFF
 +70B3D5F9C0022A6E
 +70B3D5F9C0022AD4BE
 +
 +
 +  * CC01=Frame Control
 +  * 00=Sequence Number
 +  * FFFF=Destination PAN ID
 +  * 70B3D5F9C0022A6E=Destination Address
 +  * Source PAN ID (0 bytes)
 +  * 70B3D5F9C0022AD4=Source Address
 +  * 072F=Payload
 +  * ECE8=Frame Check
 +
 +
 +
 +
 +
 +
  
  
  
  
surepet.txt · Last modified: 2021/02/02 19:12 by mark