ELV MAX!: dissecting the weekly program

How hard can it be to reverse-engineer a protocol? Very hard. Getting your hands on unencrypted protocol data is the first must-have I guess to have any success at all. From what has been discovered until now, the ELV MAX! protocol seems pretty straightforward; no signs of data obfuscation have been encountered yet. With those 2 conditions, it actually doesn’t have to be that hard to find out what all those bits & bytes mean. Lets take the weekly program as an example.

What is already known about the protocol, the program and what other facts can be useful:

  • Every day can have it’s own program;
  • A maximum of 13 ‘switching points’ can be defined per day;
  • The resolution of the time of a switching point is 5 minutes;
  • A week has 7 days;
  • Currently, only 17 and 21 degrees Celsius are used in the program;
  • I use only 4 different time values as switching point time in the program;
  • For storing temperature values, 6 bits are used and the temperature value is multiplied by 2 (everywhere I’ve seen so far).
I also know that the weekly program has to be inside here somewhere:
00h: D2 00 35 08 01 01 14 FF 49 45 51 30 31 30 39 31  |-.5.... IEQ01091
10h: 32 35 28 28 3D 09 07 28 03 30 0C FF 00 44 48 55  |25((=..(.0. .DHU
20h: 08 45 20 45 20 45 20 45 20 45 20 45 20 45 20 45  |.E E E E E E E E
30h: 20 45 20 45 20 45 20 44 48 55 08 45 20 45 20 45  | E E E DHU.E E E
40h: 20 45 20 45 20 45 20 45 20 45 20 45 20 45 20 45  | E E E E E E E E
50h: 20 44 48 54 6C 44 CC 55 14 45 20 45 20 45 20 45  | DHTlD¦U.E E E E
60h: 20 45 20 45 20 45 20 45 20 45 20 44 48 54 6C 44  | E E E E E DHTlD
70h: CC 55 14 45 20 45 20 45 20 45 20 45 20 45 20 45  |¦U.E E E E E E E
80h: 20 45 20 45 20 44 48 52 6C 44 CC 55 14 45 20 45  | E E DHRlD¦U.E E
90h: 20 45 20 45 20 45 20 45 20 45 20 45 20 45 20 44  | E E E E E E E D
A0h: 48 54 6C 44 CC 55 14 45 20 45 20 45 20 45 20 45  |HTlD¦U.E E E E E
B0h: 20 45 20 45 20 45 20 45 20 44 48 54 6C 44 CC 55  | E E E E DHTlD¦U
C0h: 14 45 20 45 20 45 20 45 20 45 20 45 20 45 20 45  |.E E E E E E E E
D0h: 20 45 20                                         | E

OK.. so where is the weekly program and how to read it? The first 2 lines have already been dissected partially, but from position 20h and further is unknown. I bet that’s the weekly program; what else would it be 😉

The first thing I notice is that the characters “DH” are repeated 7 times; ahh, 7 days. The interval between these “DH” bytes is constant; 26 bytes each time; ahh, 26/2 = 13; the number of switchpoints. I assume that the information for one switchpoint is stored into 2 bytes aka a word. Nice. Now let’s just take 2 consecutive bytes and see if we can derive a temperature and time value from it. Not an “E ” pair, cause the amount in which they occur makes me think they mean ‘undefined’ or something, cause I don’t have that many switching points in the program. Lets take a word just before an “E ” word, to stay word aligned (since every word seems to contain information for 1 switching point). That would be a “U.”, or in hex values: 55 14.

Some bit math now:

17 degrees Celsius will be stored as 34d = 22h = 100010b

21 degrees Celsius will be stored as 42d = 2Ah = 101010b

Time value 07:00 is (7*60)/5 times = 84 steps of 5 minutes; 84d = 54h = 1010100b

Time value 23:00 is (23*60)/5 times = 276 steps of 5 minutes; 276d = 114h = 100010100b

Etctera, for all time values used….

 

5514h = 0101010100010100b

Look, it fits!

5514 = 0101010100010100
        101010100010100

With this, I now know how to ‘read’ a switching point:

Assuming value = 5514h and using this Delphi code:

time := (value and $01FF) * 5;   // in minutes
hour:= time / 60;
minutes:=time mod 60;
temp:=(value shr 9) and $3F;

The outcome is 21 degrees and time 23:00 … Cool. And correct!

All that’s left to is now is write some code to verify everything. And do some additional research on the day sequence; does it start with Sunday, Monday, …? You know what; I think I already know that too – the first 2 days in the hex dump above have the least number of switching points: typically Saturday and Sunday, so the program starts with Saturday! 🙂

Another part of the protocol can be documented!

Tagged . Bookmark the permalink.

2 Responses to ELV MAX!: dissecting the weekly program

  1. coquelicot says:

    Hello
    A person work on a plugin vera2?
    Thank you for this work

Leave a Reply

Your email address will not be published. Required fields are marked *