buxtronix
Client registration / de-register protocol discussion
Opened this issue to discuss and figure out the process for registering new clients (and the inverse).
First thing I discovered...a client can 'deregister' itself by writing the value 0x01 to the register 0x15.
I learnt this by sniffing the OEM client and selecting the 'cancel vin registration' option which set this register. Repeated it in phev2mqtt and it also deregistered that client.
I successfully registered my app to my "car simulator" - so there is nothing special about the registration. Next step is to check if any of the responses from the car is needed, and which registers are always set by the app.
I connected phev2mqtt (using an unregistered mac address) to my car when it was in registration mode, and whilst it was then able to do the usual fetch of registers, etc, once the car was out of registration mode, it was no longer able to communicate.
So there is something the app sends to the car to trigger registration, but I've not yet figured it out.
Do you have a PCAP or other dump of what the app sent to your simulator? There's a lot of chatter to a real car, so perhaps the sim will only show whats necessary.
The following packets are needed to register:
> car to app
< app to car
> 6F060003011563F1
< F604010300FE //ACK
> 6F170006004A4D465844474732574A5A3030303438340101F2
< F60401060001 //ACK
> 6F170015034A4D465844474732574A5A303030343834010104
< F60401150010 //ACK
> 6F04002A009D
< F604012A0025 //ACK
< F6040010010B
> 6F0401100084
Only one is initiated by the app F6040010010B - an update to register 0x10 with the value 0x01. As soon as this is acked, the app shows that the registration was successful.
The app does not validate all of the data, so the following dialog also results in a successful registration:
> car to app
< app to car
> 6F06000300000078
< F604010300FE
> 6F170006002D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D01008A
< F60401060001
> 6F170015032E2E2E2E2E2E2E2E2E2E2E2E2E2E2E2E2E0100AD
< F60401150010
> 6F04002A009D
< F604012A0025
< F6040010010B
> 6F0401100084
After looking at #11 my next step is trying to register with 0x4e (MY14).
I sniffed registration between the car and app last night and also saw register 0x10 being set. I'll try to register a new Mac today with phev2mqtt to confirm, and also reconfirm 0x15 as unregister. If so, I'll add these as commands.
Well that was easy. 0x10 registers and 0x15 unregisters. I implemented this in the phev2mqtt client and tested thoroughly against my MY18. Uploaded the code which implements this and updated READMEs.
Is this the same for a MY14?
Sadly I cannot register as MY14, but I can switch to MY14 after registering as MY18. So I can confirm, that unregister is also sending 0x01 to register 0x15. I can also confirm that the commands for climate are different.
I managed to also get a basic car emulator going, I will include it here soon once I have it as a cobra command. Did not try MY14 though. Registration using MY18 with the packets you described works well.
While doing so, I went down the rabbit hole of "Vehicle Settings" and can easily change many settings by a single register 0x0f. I just need to try and work out the full structure of the data in 0x16 - I created a new issue to work on this https://github.com/buxtronix/phev2mqtt/issues/21