I have a master & slaves setup in which the slaves only respond when spoken too.  I can snoop & record an existing master/slaves conversation.  I have an extra slave device that I would like to have my own conversation with, but have so far failed miserably.  I suspect that each device has its own unique ID, but have no idea what my extra slave devices ID is.What I know from a logic analyzer & days worth of studying:messages start with 0x10prior to message end is a 2 byte CRC-16/MCRF4XX, little endian (thanks: reveng!)messages end with 0x1003Suspicions:first byte is a message type identifier, I've observed ~12 unique message types based on this.  Each message 'type' based on this has the same length.second byte might ??? be a destination device id ???.  Based on this suspicion I took the first 20 unique messages, inserted 255 different ID's into this byte, and sent each of them (correctly packetized with start + data + crc + end) - it did not respond to any of them.Data sample from the bus during startup, I removed the start, crc & end bytes:0xff0203000104000x095100000xff01030002ffff0xff020300013c030x010000000x350d00000xff01030002ffff0xff0203000202000x02007400...big packet with lots of text from a slave A...0x340d7400...big packet with lots of text from a/the master?...0xff0103000100000xff0203000108000x095100000xff01030003ffff0xff0203000302000x02007400...big packet with lots of text from a slave A...  (exactly the same as prior 2 big packets)0x340d7400...big packet with lots of text from the master or yet a third slave?... (exactly the same as prior 2 big packets)0x09520400000000800xff0103000100000xff020300011010000x095100000xff01030004ffff0xff0203000402000x02007400...big packet with lots of text from a slave B...0x340d7400...big packet with lots of text from the master or yet a third slave?...0x09520400000000800xff0103000100000xff0203000120000x095100000xff01030005ffff0xff0203000502000x02007400...big packet with lots of text from a slave B...  (exactly the same as prior 2 big packets)0x340d7400...big packet with lots of text from the master or yet a third slave?... (exactly the same as prior 2 big packets)0x09520400000000800xff0103000100000xff0203000104000x095100000xff01030002ffff0xff0203000202000x0952040000000080
Reversing serial RS485 half duplex bus protocol understanding
hardware;serial communication;protocol