research/README.md


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147


Findings in trying to understand the Bodet Sound Protocol
Alarm button Panel
Small device that can send melodies and alarms to multicast address defined
Example Stop Strings for all Zones
4d454c 001a    0100  f9ff      5002    ffff ffff ffff ffff ffff ffff 0f00 2c
4d454c 001a    0100  0eff      5002    ffff ffff ffff ffff ffff ffff 0f01 39
4d454c 001a    0100  1fff      5002    ffff ffff ffff ffff ffff ffff 0f01 0a
MEL    LENGTH  START SEQUENCE  COMMAND ZONEINFO                      ???  CHECKSUM


Part 1, MEL
Description : MEL Protocol identifier in ASCII (Probably Melody)
Hex : 4d454c
ASCII : MEL
Part 2, Length
Description : Packet Byte Lengh in decimal
Hex : 001a
DEC : 26
Part 3, Command Startpoint
Description : Seemingly constant command identifier probably to identify the start of the instructions?
Hex : 0100
Part 4, Sequence (is ff truly a buffer?)
Description : Sequence number (little endian) that can wrap with two ff as buffer perhaps
Hex : f9ff
Part 5, Actual Command
Description : Defines what action should be taken 5002 being stop.
Hex : 5002
Part 6, Zone Info
Description : String that seems to contains the zone (maybe other parts to but not sure)
Hex : ffffffffffffffffffffffff
Part 7, Mystery
Description : No clue what this does maybe device ID or packet type
Hex : 0f00
Part 8, Checksum byte
Desciption : Most likely checksum which will be a pain to reverse engineer
Hex : 2c
Example Melody String for all Zones
4d454c 0021   0100  09ff     3001    ffff ffff ffff ffff ffff ffff 0f01 03   01       0118      0100 01 56
MEL    LENGTH START SEQUENCE COMMAND ZONEINFO (6x4)                ???  VOL3 TIMES?   MELODY24  ???  ?  CHECKSUM


4d454c 0021 0100 09ff 3001 ffff ffff ffff ffff ffff ffff 0f01 03 01 0118 0100 01 56
Example Melody4 String for Zone 77 and 4x Repetition
4d454c 0021   0100  0aff     3001    0000 0000 0000 0000 0010 0000 0001 04   04       0109    0100 01 5f
MEL    LENGTH START SEQUENCE COMMAND ZONEINFO ZONE 77 (6x4)        ???  VOL  TIMES?   MELODY4 ???  ?  CHECKSUM


4d454c002101000aff30010000000000000000001000000001040401090100015f
4d454c0021010029ff3001800000000000000000000000000103010109010001ca
Example Melody 4 String for Zone 77 and Infinite Repetition
4d454c 0021   0100  0bff     3001    0000 0000 0000 0000 0010 0000 0001 04   00      0109     0100 01 58
MEL    LENGTH START SEQUENCE COMMAND ZONEINFO ZONE 77 (6x4)        ???  VOL  INF  MELODY4  ???  ?  CHECKSUM


Example Melody 20 String for Zone 10, 20, 30, 40 and 50 2x Repetition
4d454c 0021   0100  0fff     3001    0002 0820 8000 0200 0000 0000 0001 06   02      0114      0100 01 c5
MEL    LENGTH START SEQUENCE COMMAND ZONEINFO ZONE 10,20,30,40,50  ???  VOL  TIMES   MELODY20  ???  ?  CHECKSUM


Example Melody 8 String for Zone 8 and 3x Repetitions
4d454c 0021   0100  10ff     3001    8000 0000 0000 0000 0000 0000 0001 08   03      0108      0100 01 d7
MEL    LENGTH START SEQUENCE COMMAND ZONEINFO ZONE 8 (6x4)         ???  VOL  TIMES   MELODY8   ???  ?  CHECKSUM


Example Melody String for Zone 64 and Infinite Repetition
4d454c 0021   0100  11ff     3001    0000 0000 0000 0080 0000 0000 0001 01    00     0110      0100 01 ec
MEL    LENGTH START SEQUENCE COMMAND ZONEINFO ZONE 64 (6x4)        ???  VOL   INF    MELODY16  ???  ?  CHECKSUM


I will stop writting everything now I am getting bored:
Begining is basically always the same minus the sequence which inclines
4d454c 0021 0100 13ff 3001 8000 0000 0000 0000 0000 0000 0001 03 02 01 01 0100 01 df
Melody, Zone 8, Volume 3, Repeat x2, Melody 1
4d454c 0021 0100 14ff 3001 0080 0000 0000 0000 0000 0000 0001 03 02 01 02 0100 01 dd
Melody, Zone 16, Volume 3, Repeat x2, Melody 2
4d454c 0021 0100 15ff 3001 0000 0080 0000 0000 0000 0000 0001 03 02 01 03 0100 01 db
Melody, Zone 32, Volume 3, Repeat x2, Melody 3
4d454c 0021 0100 1cff 3001 8000 0000 0000 0000 0000 0000 0001 03 00 01 08 0100 01 d9
Melody, Zone 8, Volume 3, Repeat Inf, Melody 8
4d454c 0021 0100 1dff 5001 0080 0000 0000 0000 0000 0000 0002 03 00 01 09 0100 01 bc
Alarm,  Zone 8, Volume 3, Repeat Inf, Melody 9
4d454c 0021 0100 1eff 3001 0000 0080 0000 0000 0000 0000 0001 03 01 01 0a 0100 01 dc
Melody, Zone 8, Volume 3, Repeat Inf, Melody 10
Same Stop Signals on the 4 Panel buttons :
4d454c 001a 0100 24ff 5002 ffff ffff ffff ffff ffff ffff 0f 01 07
Stop Button 1
4d454c 001a 0100 25ff 5002 ffff ffff ffff ffff ffff ffff 0f 01 00
Stop Button 2
4d454c 001a 0100 26ff 5002 ffff ffff ffff ffff ffff ffff 0f 01 01
Stop Button 3
4d454c 001a 0100 27ff 5002 ffff ffff ffff ffff ffff ffff 0f 01 02
Stop Button 4
Same Meldy Signals on the 4 Different Panel buttons :
4d454c 0021 0100 28ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 d5
4d454c 0021 0100 29ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 ca
4d454c 0021 0100 2aff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 cb
4d454c 0021 0100 2bff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c8
Seems like there is no difference between different buttons.
Same Melody Signals Pressed repeatedly to verify the sequence and maybe the checksum thingy
4d454c 0021 0100 2cff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c9
4d454c 0021 0100 2dff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 ce
4d454c 0021 0100 2eff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 cf
4d454c 0021 0100 2fff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 cc
4d454c 0021 0100 30ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 cd
4d454c 0021 0100 31ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c2
4d454c 0021 0100 32ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c3
4d454c 0021 0100 33ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c0
4d454c 0021 0100 34ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c1
4d454c 0021 0100 35ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c6
4d454c 0021 0100 36ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c7
4d454c 0021 0100 37ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c4
4d454c 0021 0100 38ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 c5
4d454c 0021 0100 39ff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 ba
4d454c 0021 0100 3aff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 bb
4d454c 0021 0100 3bff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 b8
4d454c 0021 0100 3cff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 b9
4d454c 0021 0100 3dff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 be
4d454c 0021 0100 3eff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 bf
4d454c 0021 0100 3fff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01 bc
So basically 4d454c 0021 0100 3fff 3001 8000 0000 0000 0000 0000 0000 0001 03 01 01 09 0100 01
has to somhow become bc