I am doing an embedded Bluetooth project using RN-42 and Cerebot MX7cK (a microcontroller board using pic32).
The first step is that the microcontroller has to send "$$$" to let RN-42 go to command mode, and RN-42 will reply with "CMD".
I have successfully send "$$$" to RN-42 through UART. But I couldn't get any response from RN-42. It seems that the RN-42 just ignores my command, so it does not reply anything.
On the uer manual of RN-42, it says the flow control is disabled. But then it says flow control is enabled. I tried both way-with rts and cts enabled and disables. They behave the same way. In both way, I could send "$$$" to RN-42, but couldn't get any rely.
Related
I'm building an EMV relay to educate myself on the protocol, but have hit a roadblock with the GET PROCESSING OPTIONS (GPO) command. Both SELECT(PPSE) and SELECT(AID) pass through fine, but my connection to the card times-out when I transceive a GPO command.
This happens both with a PN532 chip on an Arduino and Terminal Emulation on Android using the inbuild NFC chip.
I thought that the card might have some anti-relay system that is detecting the latency added by my relay, however a Proxmark sniffing a real transaction also failed to record any command-response pairs after the GPO command was issued, however the payment went through so (presumably) more packets were sent.
What could happen to my Visa Debit card after the issuing of the GPO command that means the card both entirely fails to respond to ISO-14443 compliant chips, that also hides any further communication from a proxmark, while still enabling communication to a real payment terminal?
I recently aquired a Segway Ninebot ES2 electric scooter. I can connect to the scooter via Bluetooth LE and grab information such as battery status, current mileage, temperature, and so on. This is all done through an application.
On my Android device, I've successfully extraceted the HCI log file, which I imported into Wireshark. I can see all the requests and commands send back and forth between my phone and the scooter. However, the requests and responses are all garbage and I have no idea how to interpret them.
Example of a sent command (info says Sent Write Command, Handle: 0x000e (Nordic UART Service: Nordic UART Tx))
Example of the received value I got right after (info says Rcvd Handle Value Notification, Handle: 0x000b (Nordic UART Service: Nordic UART Rx))
How am I supposed to interpret these responses? If the battery status was 59%, I would expect it to return something like 0x3b (0x3b hex is 59 decimal). But honestly, I have no idea how this works. Maybe they're returning a bunch of data in a data type only their app knows how to interpret? Like JSON for web.
Here's an example from the nRF Connect for Mobile application, where I hit the down arrow on all the characteristics: https://i.imgur.com/hREDomP.jpg (large image)
And probably more important: How do I replicate a request or command in nRF Connect? I've tried sending a byte array that looks like 0x {02410011000d.....} (from the Write Command) in the application, but I have no idea how to read the response.
If someone is still interested, I did the same research for this scooter.
That's standart BLE communacation, device offers BLE "services" and "characteristics". Service can contain one or more characteristics, by which you communicate with device. Each charateristic can allow different types of interaction with it: writing into it, reading from it, subscribing to notifications (so you dont have to to manually read, it kinda pushes data to your app), and more (read here, for example)
Take a look at your wireshark screenshot: you can see Service UUID, Handle UUID (the characteristic), and handle ID. You can communicate with device via uuid or id, depending on your programming language or library (more about uuids).
In this particular scooter there are two characteristics, one allows writing into it, another - allows subscribing to it. Together, they act like RX and TX wires in UART: you write data into one and read from another. So, to begin communication with scooter you must establish connection to it, subscribe for notifications from one ch, and write data to another.
As for protocol: look again at she screenshots, "UART Tx" is the actual payload that was sent to scooter and "UART Rx" was the response. Yes, it's binary data, that only app would understand. Luckily, protocol has been reverse engineered and is well documented. In your example app requests serial number, and it's returned in response - "N2GWX...". In order to request battery percentage you must build another payload according to protocol.
I'm not sure if it's still relevant, but at least for those, who will be interested in the topic.
You can try the following to understand how to interpret response from the device.
An option to consider is to fetch manufacturer's mobile app (apk) either by adb or from sites like apkmirror, etc.
Then apply some reverse-eng tool like JADX.
If you're lucky and the code is somewhat readable, then search for smth that has to do with response (like ResponseParser) and try to find algo that is used to interpret the response.
However, the very first attemp should always be to search on github/google if smb did it already for your device, unless it's very niche.
I want to know that is there any specific command available by using which I can send the terminal a command and the terminal will start to communicate with the android device from the beginning of the transaction. Suppose, terminal is sending me the following APDU request when it first communicate with the android payment app: 00A404000E325041592E5359532E444446303100 . Then if I want to ask the terminal to send again this apdu request then what Should I send to the terminal in response to this apdu request. Like I want the following scenario:
terminal send apdu req to device : 00A404000E325041592E5359532E444446303100
device send some command to terminal : XX
then the terminal sending apdu req to the device : 00A404000E325041592E5359532E444446303100
what will be the value of XX ?
You can not do this my friend. There are some predefined steps for an EMV transactions defined by EMV. So to achieve the worldwide interoperability, the card and terminal both must behave in same manner as defined by EMV.
Here your wish is to indicate the terminal to resend the command that you want. Since terminal's flow is as per EMV it can't be done.
So if you want to restart your transaction then you have to physically remove the card from terminal. After power off only, terminal will again follow the same transaction flow. You can not alter the terminal flow by any how. Flow is following :
Application Selection
Initiate Processing Option
Read Application Data
Processing Restriction
Card Holder Verification
Offline Data Authentication
Terminal Risk Management
Terminal Action Analysis
Card Action Analysis 1
Online processing
Card Action Analysis 2
Completion
Issuer Scrip Processing
I have programmed a D-Link GSM modem on a windows machine to send and receive SMS, for testing I used Hyperterminal.
In windows the connection manager initiates the COMx ports, modem uses one unlisted COMx port through which I can send an SMS, and through a listed NMEA port I receive incoming SMS, calls like +CMTI: "ME", 11 or RING +CLIP: XXXXXXXXXXXX
I'm successfully interpreting the message and programming it to my requirements in windows. While trying the same in linux(Fedora), I see the modem initialises /dev/ttyUSB0 and /dev/ttyUSB1 as the two newly identified devices. I use minicom to set the device ports and communicate AT commands to the same.
In both the devices (/dev/ttyUSB0 and /dev/ttyUSB1) I'm not receiving unsolicited AT result code like +CMTI indication whenever I'm expecting a new SMS. FYI I've set the CNMI setting according to the manual and several other combinations.
A strange thing is that I'm able to see RING when I'm calling but not +CLIP: <callerinfo>. Similarly I'm not getting ++PSBEARER: XX, Y or +CMTI: "ME", XX
The only alternative solution is to poll the UNREAD messages at regular intervals, which is generally a bad design. Please tell me if I'm doing anything wrong with regards to the configuration, should I change some thing else apart from these?
RING is the only UR code you can assume that will always come without any specific configuration (just because this is such an old relic that it just behaves that way...). For all other UR codes, you must explicit enable each and every one of them, e.g. AT+CLIP=1, etc, otherwise they will not be enabled. And enabling those are per serial interface, e.g. running AT+CLIP=1 on /dev/ttyUSB0 will not make +CPLIP: ... be printed on /dev/ttyUSB1.
So when you get them on windows the connection manager, it must be because it has those included in it init strings. Minicom I think defaults to no init string or possibly just a very classical one like ATS0=0 E1Q0V1.
I want to a Java ME application that transfers any SMS received to a PC using bluetooth. The PC can then direct the Java ME application via bluetooth to send a response SMS. Is there library available for this architecture or I have to design it myself?
Is this approach correct or a better one exists? I want to use bluetooth as then I will not have dependency on the cable.
You'll need to create this yourself, however you'll find that you can't do what you want with J2ME.
J2ME can't access any old SMS that the handset receives, only ones sent to a specific port upon which the MIDlet is listening. So to get all the other SMSes, create a bluetooth serial/dial-up connection to your handset in the way I've described in this answer.
Create a PC client which repeatedly issues AT+CGML commands (as described in the AT command set document linked to in the answer above), to see when an SMS has been received. Use AT+CGMR to read and parse the message text. Then use AT+CGMS to sent a response. This can all be done over bluetooth.
It's better to use the serial connection to send a response, because a MIDlet cannot usually be triggered to open based on incoming bluetooth data.
Hope this helps.
You may have already achieved your task, anyway for the reference I think it is much better if you try using Gammu . I'm using it for the same task (Send / receive SMS through PC ) with a simple bat file I have written, works like a charm.
Anyway you don't need any J2me program for this.
Wammu takes care of making the connection to phone and sending AT commands.