# Findings in trying to understand the Bodet Sound Protocol ## Alarm button Panel Small device that can send melodies and alarms to multicast address defined ## Example Stop Strings for all Zones ``` 4d454c 001a 0100 f9ff 5002 ffff ffff ffff ffff ffff ffff 0f00 2c 4d454c 001a 0100 0eff 5002 ffff ffff ffff ffff ffff ffff 0f01 39 4d454c 001a 0100 1fff 5002 ffff ffff ffff ffff ffff ffff 0f01 0a MEL LENGTH START SEQUENCE COMMAND ZONEINFO ??? CHECKSUM ``` ### Part 1, MEL Description : MEL Protocol identifier in ASCII (Probably Melody) Hex : `4d454c` ASCII : MEL ### Part 2, Length Description : Packet Byte Lengh in decimal Hex : `001a` DEC : `26` ### Part 3, Command Startpoint Description : Seemingly constant command identifier probably to identify the start of the instructions? Hex : `0100` ### Part 4, Sequence (is ff truly a buffer?) Description : Sequence number (little endian) that can wrap with two ff as buffer perhaps Hex : `f9ff` ### Part 5, Actual Command Description : Defines what action should be taken 5002 being stop. Hex : `5002` ### Part 6, Zone Info Description : String that seems to contains the zone (maybe other parts to but not sure) Hex : `ffffffffffffffffffffffff` ### Part 7, Mystery Description : No clue what this does maybe device ID or packet type Hex : `0f00` ### Part 8, Checksum byte Desciption : Most likely checksum which will be a pain to reverse engineer Hex : `2c` ## Example Melody String for all Zones ``` 4d454c 0021 0100 09ff 3001 ffff ffff ffff ffff ffff ffff 0f01 03 01 0118 0100 01 56 MEL LENGTH START SEQUENCE COMMAND ZONEINFO (6x4) ??? VOL3 TIMES? MELODY24 ??? ? CHECKSUM ``` 4d454c 0021 0100 09ff 3001 ffff ffff ffff ffff ffff ffff 0f01 03 01 0118 0100 01 56 ## Example Melody4 String for Zone 77 and 4x Repetition ``` 4d454c 0021 0100 0aff 3001 0000 0000 0000 0000 0010 0000 0001 04 04 0109 0100 01 5f MEL LENGTH START SEQUENCE COMMAND ZONEINFO ZONE 77 (6x4) ??? VOL TIMES? MELODY4 ??? ? CHECKSUM ``` 4d454c002101000aff30010000000000000000001000000001040401090100015f 4d454c0021010029ff3001800000000000000000000000000103010109010001ca ## Example Melody 4 String for Zone 77 and Infinite Repetition ``` 4d454c 0021 0100 0bff 3001 0000 0000 0000 0000 0010 0000 0001 04 00 0109 0100 01 58 MEL LENGTH START SEQUENCE COMMAND ZONEINFO ZONE 77 (6x4) ??? VOL INF MELODY4 ??? ? CHECKSUM ``` ## Example Melody 20 String for Zone 10, 20, 30, 40 and 50 2x Repetition ``` 4d454c 0021 0100 0fff 3001 0002 0820 8000 0200 0000 0000 0001 06 02 0114 0100 01 c5 MEL LENGTH START SEQUENCE COMMAND ZONEINFO ZONE 10,20,30,40,50 ??? VOL TIMES MELODY20 ??? ? CHECKSUM ``` ## Example Melody 8 String for Zone 8 and 3x Repetitions ``` 4d454c 0021 0100 10ff 3001 8000 0000 0000 0000 0000 0000 0001 08 03 0108 0100 01 d7 MEL LENGTH START SEQUENCE COMMAND ZONEINFO ZONE 8 (6x4) ??? VOL TIMES MELODY8 ??? ? CHECKSUM ``` ## Example Melody String for Zone 64 and Infinite Repetition ``` 4d454c 0021 0100 11ff 3001 0000 0000 0000 0080 0000 0000 0001 01 00 0110 0100 01 ec MEL LENGTH START SEQUENCE COMMAND ZONEINFO ZONE 64 (6x4) ??? VOL INF MELODY16 ??? ? CHECKSUM ``` I will stop writting everything now I am getting bored: Begining is basically always the same minus the sequence which inclines 4d454c 0021 0100 13ff 3001 8000 0000 0000 0000 0000 0000 0001 03 02 01 01 0100 01 df Melody, Zone 8, Volume 3, Repeat x2, Melody 1 4d454c 0021 0100 14ff 3001 0080 0000 0000 0000 0000 0000 0001 03 02 01 02 0100 01 dd Melody, Zone 16, Volume 3, Repeat x2, Melody 2 4d454c 0021 0100 15ff 3001 0000 0080 0000 0000 0000 0000 0001 03 02 01 03 0100 01 db Melody, Zone 32, Volume 3, Repeat x2, Melody 3 4d454c 0021 0100 1cff 3001 8000 0000 0000 0000 0000 0000 0001 03 00 01 08 0100 01 d9 Melody, Zone 8, Volume 3, Repeat Inf, Melody 8 4d454c 0021 0100 1dff 5001 0080 0000 0000 0000 0000 0000 0002 03 00 01 09 0100 01 bc Alarm, Zone 8, Volume 3, Repeat Inf, Melody 9 4d454c 0021 0100 1eff 3001 0000 0080 0000 0000 0000 0000 0001 03 01 01 0a 0100 01 dc Melody, Zone 8, Volume 3, Repeat Inf, Melody 10 Same Stop Signals on the 4 Panel buttons : 4d454c 001a 0100 24ff 5002 ffff ffff ffff ffff ffff ffff 0f 01 07 Stop Button 1 4d454c 001a 0100 25ff 5002 ffff ffff ffff ffff ffff ffff 0f 01 00 Stop Button 2 4d454c 001a 0100 26ff 5002 ffff ffff ffff ffff ffff ffff 0f 01 01 Stop Button 3 4d454c 001a 0100 27ff 5002 ffff ffff ffff ffff ffff ffff 0f 01 02 Stop Button 4 Same Meldy Signals on the 4 Different Panel buttons : 4d454c 0021 0100 28ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 d5 4d454c 0021 0100 29ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 ca 4d454c 0021 0100 2aff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 cb 4d454c 0021 0100 2bff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c8 Seems like there is no difference between different buttons. Same Melody Signals Pressed repeatedly to verify the sequence and maybe the checksum thingy 4d454c 0021 0100 2cff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c9 4d454c 0021 0100 2dff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 ce 4d454c 0021 0100 2eff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 cf 4d454c 0021 0100 2fff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 cc 4d454c 0021 0100 30ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 cd 4d454c 0021 0100 31ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c2 4d454c 0021 0100 32ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c3 4d454c 0021 0100 33ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c0 4d454c 0021 0100 34ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c1 4d454c 0021 0100 35ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c6 4d454c 0021 0100 36ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c7 4d454c 0021 0100 37ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c4 4d454c 0021 0100 38ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c5 4d454c 0021 0100 39ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 ba 4d454c 0021 0100 3aff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 bb 4d454c 0021 0100 3bff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 b8 4d454c 0021 0100 3cff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 b9 4d454c 0021 0100 3dff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 be 4d454c 0021 0100 3eff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 bf 4d454c 0021 0100 3fff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 bc So basically 4d454c 0021 0100 3fff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 has to somhow become bc