Please bare with me with this introduction to the problem. Unfortunately title might be confusing, but it's hard to came up with proper one - let me show you why.
I'm trying to decode WM-Bus (Smart meters) frame. Here is how the situation looks like:
- I have:
- a watermeter
- device to read that meter (wm-bus <-> bluetooth)
- Android application which connects to that device via bluetooth.
- On PC I have a software which decodes received data (frame is encrypted, key is known to me).
Furthermore I disassembled Android Apk (source has not been obfuscated, passwords in plain text etc.), I've modified source code to log received frame (hopefully correct one, dalvik/smali), then I used adb logcat to get that data.
- I have a USB wm-bus dongle connected to my PC. Via virtual serial port I'm receiving the same data (at least I think so) which goes to the device in point 1.
Here's the frame from USB Dongle:
FF 64 44 01 06 81 32 20 00 05 07 7A CD 00 60 85 C1 03 5C D8 C9 86 9A 7D 55 49 DC 3A 4B 48 AC A4 BD 95 FE 4F BA 79 EE 01 55 D7 BC A8 9D B8 E1 33 33 56 58 75 BB 8B 2E FF 1E 4A F8 41 FB 82 FF 4B 46 C9 68 5A 56 37 5D BE 4B 05 6E BE 44 16 E2 59 D6 16 A7 73 C9 E1 7E FC CA 6B 3F 15 BF 3A 21 B5 28 6B 62 73 8C FD 96 FD 35 40 F5 71 23 91 B1 B6 A1
And here's the frame from the device:
C0 02 7B D0 6C 44 01 06 81 32 20 00 05 07 47 5A 7A CD 00 00 80 0F 15 02 AB 92 08 00 08 43 36 05 F4 F1 83 00 11 51 15 02 4B 01 40 1A 26 10 A1 00 00 00 CB CB 7B 1C A1 00 00 00 A1 00 00 00 A1 00 00 00 A1 00 39 2C 00 00 A1 00 00 00 A1 00 00 00 A2 00 00 00 A2 00 10 40 00 00 A2 00 00 00 A2 00 00 00 00 00 00 00 00 00 36 A5 00 00 A0 CF BC 11 02 FF FF FF FF FF FF FF FF FF 2D CA FF 79 F4 B5 C2
Some fragments are the same, for example:
44 01 06
20 00 05 07
7A CD 00
So... I'm getting two different frames for the exact the same transmission (that I'm sure of). I'm thinking that the problem might be:
- device is adding something to the frame
- I'm not reading raw data (despite the fact that the variable I'm reading from is called
Messing with the device (to somehow solder wires and intercept raw data from the chip) is out of question (it's pretty expensive piece of hardware, yet there's nothing fancy on board).
I was thinking of intercepting raw data which goes to my Android phone - and that's the question - can I do that pretty simple? I was trying to log that bluetooth data, but there's a lot of traffic going on. It would be nice to have something like Wireshark to look only into the data coming in.
Anyway - I'm open to other suggestions, thoughts...
Just to clarify: Firstly - watermeter is/has not a bluetooth device. It transmits data via wm-bus to the device (special device from the watermeter's manufacturer). That device then talks to the Android phone app via bluetooth. That app decrypt/decyphers the frame into useful data and saves it on the phone (sqlite). Later that data can be transfer onto PC.
Secondly - what I REALLY want to do is to be able to take a frame from the usb dongle (so not the official harware) and use some algorithms from decompiled Android app (read it as - make my own piece of software based on that one) to decrypt it. That's the ultimate goal. I'm just somewhere in the middle and I don't know exactly how to push forward.