gstar

You're right! The serial bus isn't encrypted!

I got inspired, and have plugged in my scope, and then an RS422 to serial adapter, and I'm getting XML encoded (weird) CAN messages, which I presume are the same as what's on the CAN bus exposed on some of the control box's ports. I'll get out the can analyser tomorrow and check.

Now the trick will be to reverse engineer this protocol. Here's a tiny sample:

  <U>setCAN 0201000000236000000000000 </U=ce><U>getCAN 1 </U=00><U>Ping</U=db> <U>ackCAN 1</U=aa><U>Ping</U=db> <U>setCAN </U=b2><U>getCAN 1 </U=00><U>Ping</U=db> <U>ackCAN 1</U=aa><U>Ping</U=db> <U>setCAN </U=b2><U>getCAN 1 </U=00><U>Ping</U=db> <U>ackCAN 1</U=aa><U>Ping</U=db> <U>setCAN </U=b2><U>getCAN 1 </U=00><U>Ping</U=db> <U>ackCAN 1</U=aa><U>Ping</U=db> <U>setCAN </U=b2><U>getCAN 1 </U=00><U>Ping</U=db> <U>ackCAN 1</U=aa><U>Ping</U=db>

Not always - if it's used as a bus, it's 2 wire.

I have something slightly different

1 is RS422 B

2 is RS422 A

3 & 5 - GND

4 & 6 - VCC

Not sure what 7 and 8 do.

Interesting! Yours is a different rev to mine, and a different chip. Can you post photos of both sides please?

No, sorry - I may be able to buzz one out of the a/c controller later on.

I do, have 2 spare USB-C to JST-SH adapters that suit the round advantage air circuit board if anyone wants one (Perth, Free). Email in profile.

It's an FT312D, which is a purpose-built android thingy that presents a serial port and allows the tablet to charge.

Speaking of sandgropers, I do understand Advantage Air are based in WA - so it's fairly likely they're reading this!

It 100% is designed so that you have to use their hardware.

Incidentally, if you root your tablet you can just change the build.MODEL to "MyAir5" and everything will work on a third party tablet.

OMFG; I am in Perth, I have the same system, the very same problem and solved it almost the same way and was in the process of writing it up.

The system uses RS422, with a base64 encoded AES key in the aaservice binary, and I was contemplating building an esp32 based open source implementation of the controller.

That's a crazy weird coincidence.

The UI looks incredible - was it closed source, and did it die with the company?

I think it's probably a great way to understand the culture of the hiring organisation and to see if your approach would work with theirs.

It'll probably be relatively unsuccessful at a bigger company with worse internal comms, with an HR function that's too far removed from the engineering team.

I'm sure you'll find a job that suits _you_ with this approach, though.

Grab must have absolutely incredible internal comms and leadership.