Polaris Ficht Fuel Injector data encoding, EMM reading/writing

[UnityRacing]

DW will do injector swaps also. Reads the same .dat file from the floppy disc.

[K447]

Posts moved to a separate thread to maintain the focus.

[UnityRacing]

Good news, I was able to collect some data tonight.
First off, EVDiagnostics WILL communicate with our EMMs - but only if you install the updates to 1.2.1.3 - anything lower or higher will NOT communicate, or work at all.
I used Serial Port Monitor to capture the traffic between the laptop and the EMM. Interesting note here, it will not run on X64 bit machines, nor will it work right with a USB to Serial port adapter dongle. HAS to be a "real" serial port otherwise the monitor picks up all the junk data between the PC and the adapter. Program also has to be run "As Administrator" by right clicking on the icon first.

I'd like to upload all my raw data collected thus far. I created about a dozen different text files and named them based on what I clicked on in the program to generate the data. The files cannot be saved as ANSI/ASCII and they have to be saved in UNICODE. Still a .txt file though. If someone has some hosting site with an account, that would be helpful and I can email the files to you since I cannot attach .txt here.

I could really use some help deciphering all this as it's a lot to take in. I'm willing to share whatever I have - software/data/knowledge to pull this together.

As a side note - I have tried to attack this from different angles. Using DW hit a wall. As someone else had said (Keith?) DW will not let you reuse an injector dat file. I know the newer versions of EVDiag can as I have seen that online. Hell the newer versions let you directly scan the injector data into the program using a hand scanner. Unfortunately the newer version balk at our engine family of 30002 and stop communicating.
I've even tried to use IDA Pro and OllyDbg to try and pick out where the registers or arguments are in the program (DW, go.exe, and EVDiag) that call the injector data from the .dat file. Debugging didn't get me far, and one of the programs, DW IIRC had debug counter measure in place to prevent or at least make more difficult the ability to reverse engineer the program. I'm really a novice at reverse engineering software anyway, so the failures could very well be on me. The only thing I have not tried is loading up in Visual Basic 6 and seeing where we stand. This might have some good info, but I am having a hard time getting it to run on my x64 Win7 machine.

I'm pretty confident that Ghost wrote a Visual Basic "app" that takes the raw data and sends it to the EMM. That's not so hard to do, but figuring out *what* to send is. At least we are on the right path now, and have some raw dumps.

[UnityRacing]

Had a thought.... I think that copying all the data from one EMM to another includes the injector data as well. I'm going to try to write all data to another EMM and verify the coefficients moved with it. Once that has been verified, it will just be a matter of playing with the writes by sending code with one or two bytes changed, then going back in and looking to see what exactly changed. This way I can 'map' out what data belongs to what values in the EMM. It would make sense to use this method, as Ghost has the ability to change runtime hours, engine serial number, etc. - something none of the commercial programs let you do.

Here is a paste of the output I got when I saved the EMM data to disk. This would be the first half of transferring all data to another EMM. Still need to do and capture the "write".
Ignore the funky symbols, that's just the program trying to auto convert the UNICODE to plain text. Sometimes it works, as in "30002" (Engine family), and "Virage Twin" (My current test EMM).
'Request' is the EVDiag sending data to the EMM, 'Answer' is what the EMM replies back with.


SECOND CLICK OF "Collect EMM data from DONOR to a disk file" TO FOLLOW


Request: 1/20/2015 7:26:21 PM.34164 (+134.2850 seconds)
01 05 00 02 08 .....
Answer: 1/20/2015 7:26:21 PM.35664 (+0.0156 seconds)
01 05 33 30 30 30 32 FB ..30002û
Request: 1/20/2015 7:26:21 PM.35664 (+0.0000 seconds)
01 05 00 02 08 .....
Answer: 1/20/2015 7:26:21 PM.37264 (+0.0156 seconds)
01 05 33 30 30 30 32 FB ..30002û
Request: 1/20/2015 7:26:21 PM.37264 (+0.0000 seconds)
01 10 00 6E 7F ...n
Answer: 1/20/2015 7:26:21 PM.38764 (+0.0156 seconds)
01 10 56 69 72 61 67 65 20 54 77 69 6E 20 20 20 ..Virage Twin
20 00 B1 .±
Request: 1/20/2015 7:26:21 PM.40364 (+0.0000 seconds)
01 10 00 6E 7F ...n
Answer: 1/20/2015 7:26:21 PM.41964 (+0.0156 seconds)
01 10 56 69 72 61 67 65 20 54 77 69 6E 20 20 20 ..Virage Twin
20 00 B1 .±
Request: 1/20/2015 7:26:21 PM.43464 (+0.0000 seconds)
01 04 00 70 75 ...pu
Answer: 1/20/2015 7:26:21 PM.46564 (+0.0312 seconds)
01 04 00 98 96 7F B2 ...˜–²
Request: 1/20/2015 7:26:21 PM.46564 (+0.0000 seconds)
01 02 00 5A 5D ...Z]
Answer: 1/20/2015 7:26:21 PM.48164 (+0.0156 seconds)
01 02 00 25 28 ...%(
Request: 1/20/2015 7:26:21 PM.48164 (+0.0000 seconds)
01 01 00 5B 5D ...[]
Answer: 1/20/2015 7:26:21 PM.49764 (+0.0156 seconds)
01 01 2F 31 ../1
Request: 1/20/2015 7:26:21 PM.49764 (+0.0000 seconds)
01 01 00 5C 5E ...\^
Answer: 1/20/2015 7:26:21 PM.51264 (+0.0156 seconds)
01 01 00 02 ....
Request: 1/20/2015 7:26:21 PM.52864 (+0.0156 seconds)
01 20 00 5D 7E . .]~
Answer: 1/20/2015 7:26:21 PM.54364 (+0.0156 seconds)
01 20 FF FF FF FF FF FF FF FF FF FF FF FF FF FF . ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
FF FF 01 ÿÿ.
Request: 1/20/2015 7:26:21 PM.57564 (+0.0000 seconds)
01 20 00 6B 8C . .kŒ
Answer: 1/20/2015 7:26:21 PM.59064 (+0.0156 seconds)
01 20 FF FF FF FF FF FF FF FF FF FF FF FF FF FF . ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
FF FF 01 ÿÿ.
Request: 1/20/2015 7:26:21 PM.62164 (+0.0000 seconds)
01 02 00 4E 51 ...NQ
Answer: 1/20/2015 7:26:21 PM.63764 (+0.0156 seconds)
01 02 09 7E 8A ...~Š
Request: 1/20/2015 7:26:21 PM.63764 (+0.0000 seconds)
01 02 00 0C 0F .....
Answer: 1/20/2015 7:26:21 PM.65364 (+0.0156 seconds)
01 02 FF FF 01 ..ÿÿ.
Request: 1/20/2015 7:26:21 PM.66864 (+0.0156 seconds)
01 20 00 57 78 . .Wx
Answer: 1/20/2015 7:26:21 PM.68464 (+0.0156 seconds)
01 20 00 00 00 00 00 00 00 00 00 00 00 00 00 10 . ..............
10 00 00 00 00 00 00 00 00 00 00 00 00 00 80 11 ..............€.
00 00 D2 ..Ò
Request: 1/20/2015 7:26:21 PM.71564 (+0.0000 seconds)
01 20 00 58 79 . .Xy
Answer: 1/20/2015 7:26:21 PM.73164 (+0.0156 seconds)
01 20 1B 58 00 00 01 B8 00 00 00 14 00 C8 05 A0 . .X...¸.....È.
04 B2 00 00 00 00 04 B2 00 00 00 00 00 00 00 00 .².....²........
00 00 3A ..:
Request: 1/20/2015 7:26:21 PM.76264 (+0.0000 seconds)
01 02 00 51 54 ...QT
Answer: 1/20/2015 7:26:21 PM.77764 (+0.0156 seconds)
01 02 00 00 03 .....
Request: 1/20/2015 7:26:21 PM.77764 (+0.0000 seconds)
01 02 00 53 56 ...SV
Answer: 1/20/2015 7:26:21 PM.79364 (+0.0156 seconds)
01 02 00 00 03 .....
Request: 1/20/2015 7:26:21 PM.79364 (+0.0000 seconds)
01 02 00 55 58 ...UX
Answer: 1/20/2015 7:26:21 PM.80964 (+0.0156 seconds)
01 02 00 00 03 .....
Request: 1/20/2015 7:26:21 PM.80964 (+0.0000 seconds)
01 06 00 A1 A8 ...¡¨
Answer: 1/20/2015 7:26:21 PM.82464 (+0.0156 seconds)
01 06 04 C8 3C 01 E2 AC 9E ...È<.⬞
Request: 1/20/2015 7:26:21 PM.84064 (+0.0000 seconds)
01 06 00 A2 A9 ...¢©
Answer: 1/20/2015 7:26:21 PM.85564 (+0.0156 seconds)
01 06 04 C8 3C 01 E2 AC 9E ...È<.⬞
Request: 1/20/2015 7:26:21 PM.85564 (+0.0000 seconds)
01 06 00 A3 AA ...£ª
Answer: 1/20/2015 7:26:21 PM.87164 (+0.0156 seconds)
01 06 03 8B 0C 00 5F F6 F6 ...‹.._öö
Request: 1/20/2015 7:26:21 PM.88764 (+0.0000 seconds)
01 06 00 A4 AB ...¤«
Answer: 1/20/2015 7:26:21 PM.90264 (+0.0156 seconds)
01 06 00 00 00 00 00 00 07 .........
Request: 1/20/2015 7:26:21 PM.90264 (+0.0000 seconds)
01 06 00 A5 AC ...¥¬
Answer: 1/20/2015 7:26:22 PM.91864 (+0.0156 seconds)
01 06 00 00 00 00 00 00 07 .........
Request: 1/20/2015 7:26:22 PM.93364 (+0.0000 seconds)
01 06 00 A6 AD ...¦­
Answer: 1/20/2015 7:26:22 PM.94964 (+0.0156 seconds)
01 06 00 00 00 00 00 00 07 .........
Request: 1/20/2015 7:26:22 PM.96564 (+0.0000 seconds)
01 01 00 91 93 ...‘“
Answer: 1/20/2015 7:26:22 PM.98064 (+0.0156 seconds)
01 01 00 02 ....
Request: 1/20/2015 7:26:22 PM.98064 (+0.0000 seconds)
01 01 00 92 94 ...’”
Answer: 1/20/2015 7:26:22 PM.99664 (+0.0156 seconds)
01 01 00 02 ....
Request: 1/20/2015 7:26:22 PM.99664 (+0.0000 seconds)
01 01 00 93 95 ...“•
Answer: 1/20/2015 7:26:22 PM.01164 (+0.0156 seconds)
01 01 FF 01 ..ÿ.
Request: 1/20/2015 7:26:22 PM.01164 (+0.0000 seconds)
01 01 00 94 96 ...”–
Answer: 1/20/2015 7:26:22 PM.02764 (+0.0156 seconds)
01 01 00 02 ....
Request: 1/20/2015 7:26:22 PM.02764 (+0.0000 seconds)
01 01 00 95 97 ...•—
Answer: 1/20/2015 7:26:22 PM.04364 (+0.0156 seconds)
01 01 00 02 ....
Request: 1/20/2015 7:26:22 PM.04364 (+0.0000 seconds)
01 01 00 96 98 ...–˜
Answer: 1/20/2015 7:26:22 PM.05864 (+0.0156 seconds)
01 01 21 23 ..!#
Request: 1/20/2015 7:26:22 PM.10564 (+0.0000 seconds)
01 10 00 AB BC ...«¼
Answer: 1/20/2015 7:26:22 PM.12164 (+0.0156 seconds)
01 10 00 00 06 70 00 00 04 5C 00 00 02 A5 00 01 .....p...\...¥..
1D D5 81 .Õ�
Request: 1/20/2015 7:26:22 PM.13664 (+0.0000 seconds)
01 10 00 AC BD ...¬½
Answer: 1/20/2015 7:26:22 PM.15264 (+0.0156 seconds)
01 10 00 00 06 70 00 00 04 5C 00 00 02 A5 00 00 .....p...\...¥..
5A 85 6D Z…m
Request: 1/20/2015 7:26:22 PM.16764 (+0.0000 seconds)
01 10 00 AD BE ...­¾
Answer: 1/20/2015 7:26:22 PM.18364 (+0.0156 seconds)
01 10 00 00 0D 14 00 00 0A 32 00 00 04 1D 00 00 .........2......
51 7C 5C Q|\
Request: 1/20/2015 7:26:22 PM.19964 (+0.0000 seconds)
01 10 00 AE BF ...®¿
Answer: 1/20/2015 7:26:22 PM.21464 (+0.0156 seconds)
01 10 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 ........ÿÿ......
00 00 0F ...
Request: 1/20/2015 7:26:22 PM.23064 (+0.0000 seconds)
01 10 00 AF C0 ...¯À
Answer: 1/20/2015 7:26:22 PM.24564 (+0.0156 seconds)
01 10 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 ........ÿÿ......
00 00 0F ...
Request: 1/20/2015 7:26:22 PM.27764 (+0.0156 seconds)
01 10 00 B0 C1 ...°Á
Answer: 1/20/2015 7:26:22 PM.29264 (+0.0156 seconds)
01 10 3A 98 3A 98 40 74 40 74 40 74 40 74 40 74 ..:˜:˜@t@t@t@t@t
40 74 ED @tí

[UnityRacing]

Made some progress decoding the data today. Not done yet my eyes are tired.

My injector data if you want to follow along:

Serial # - 03134040123564
A-1648
B-1116
C-677
D-23173

(Both injectors are same in the EMM, some dumbass got ahold of it before me)


SECOND CLICK OF "Collect EMM data from DONOR to a disk file" TO FOLLOW


Request: 1/20/2015 7:26:21 PM.34164 (+134.2850 seconds)
01 05 00 02 08 .....
Answer: 1/20/2015 7:26:21 PM.35664 (+0.0156 seconds)
01 05 33 30 30 30 32 FB ..30002û
Request: 1/20/2015 7:26:21 PM.35664 (+0.0000 seconds)
01 05 00 02 08 .....
Answer: 1/20/2015 7:26:21 PM.37264 (+0.0156 seconds)
01 05 33 30 30 30 32 FB ..30002û
Request: 1/20/2015 7:26:21 PM.37264 (+0.0000 seconds)
01 10 00 6E 7F ...n
Answer: 1/20/2015 7:26:21 PM.38764 (+0.0156 seconds)
01 10 56 69 72 61 67 65 20 54 77 69 6E 20 20 20 ..Virage Twin
20 00 B1 .±
Request: 1/20/2015 7:26:21 PM.40364 (+0.0000 seconds)
01 10 00 6E 7F ...n
Answer: 1/20/2015 7:26:21 PM.41964 (+0.0156 seconds)
01 10 56 69 72 61 67 65 20 54 77 69 6E 20 20 20 ..Virage Twin
20 00 B1 .±
Request: 1/20/2015 7:26:21 PM.43464 (+0.0000 seconds)
01 04 00 70 75 ...pu
Answer: 1/20/2015 7:26:21 PM.46564 (+0.0312 seconds)
01 04 00 98 96 7F B2 ...˜–²
Request: 1/20/2015 7:26:21 PM.46564 (+0.0000 seconds)
01 02 00 5A 5D ...Z] request for hours
Answer: 1/20/2015 7:26:21 PM.48164 (+0.0156 seconds)
01 02 00 25 28 ...%(25 (37 hours in hex)
Request: 1/20/2015 7:26:21 PM.48164 (+0.0000 seconds)
01 01 00 5B 5D ...[] request for minutes
Answer: 1/20/2015 7:26:21 PM.49764 (+0.0156 seconds)
01 01 2F 31 ../1 2F (47 hours in hex)
Request: 1/20/2015 7:26:21 PM.49764 (+0.0000 seconds)
01 01 00 5C 5E ...\^
Answer: 1/20/2015 7:26:21 PM.51264 (+0.0156 seconds)
01 01 00 02 ....
Request: 1/20/2015 7:26:21 PM.52864 (+0.0156 seconds)
01 20 00 5D 7E . .]~
Answer: 1/20/2015 7:26:21 PM.54364 (+0.0156 seconds)
01 20 FF FF FF FF FF FF FF FF FF FF FF FF FF FF . ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
FF FF 01 ÿÿ.
Request: 1/20/2015 7:26:21 PM.57564 (+0.0000 seconds)
01 20 00 6B 8C . .kŒ
Answer: 1/20/2015 7:26:21 PM.59064 (+0.0156 seconds)
01 20 FF FF FF FF FF FF FF FF FF FF FF FF FF FF . ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
FF FF 01 ÿÿ.
Request: 1/20/2015 7:26:21 PM.62164 (+0.0000 seconds)
01 02 00 4E 51 ...NQ crank offset
Answer: 1/20/2015 7:26:21 PM.63764 (+0.0156 seconds)
01 02 09 7E 8A ...~Š
Request: 1/20/2015 7:26:21 PM.63764 (+0.0000 seconds)
01 02 00 0C 0F ..... break-in hours
Answer: 1/20/2015 7:26:21 PM.65364 (+0.0156 seconds)
01 02 FF FF 01 ..ÿÿ.
Request: 1/20/2015 7:26:21 PM.66864 (+0.0156 seconds)
01 20 00 57 78 . .Wx rpm profile first
Answer: 1/20/2015 7:26:21 PM.68464 (+0.0156 seconds)
01 20 00 00 00 00 00 00 00 00 00 00 00 00 00 10 . ..............
10 00 00 00 00 00 00 00 00 00 00 00 00 00 80 11 ..............€.
00 00 D2 ..Ò
Request: 1/20/2015 7:26:21 PM.71564 (+0.0000 seconds)
01 20 00 58 79 . .Xy rpm profile second
Answer: 1/20/2015 7:26:21 PM.73164 (+0.0156 seconds)
01 20 1B 58 00 00 01 B8 00 00 00 14 00 C8 05 A0 . .X...¸.....È.
04 B2 00 00 00 00 04 B2 00 00 00 00 00 00 00 00 .².....²........
00 00 3A ..:
Request: 1/20/2015 7:26:21 PM.76264 (+0.0000 seconds)
01 02 00 51 54 ...QT max rpm
Answer: 1/20/2015 7:26:21 PM.77764 (+0.0156 seconds)
01 02 00 00 03 .....
Request: 1/20/2015 7:26:21 PM.77764 (+0.0000 seconds)
01 02 00 53 56 ...SV max engine temp
Answer: 1/20/2015 7:26:21 PM.79364 (+0.0156 seconds)
01 02 00 00 03 .....
Request: 1/20/2015 7:26:21 PM.79364 (+0.0000 seconds)
01 02 00 55 58 ...UX max emm temp
Answer: 1/20/2015 7:26:21 PM.80964 (+0.0156 seconds)
01 02 00 00 03 .....
Request: 1/20/2015 7:26:21 PM.80964 (+0.0000 seconds)
01 06 00 A1 A8 ...¡¨ injector serial number 1
Answer: 1/20/2015 7:26:21 PM.82464 (+0.0156 seconds)
01 06 04 C8 3C 01 E2 AC 9E ...È<.⬞ 04C83C= first half of serial(313404) / 01E2AC= second half serial(123564)
Request: 1/20/2015 7:26:21 PM.84064 (+0.0000 seconds)
01 06 00 A2 A9 ...¢© injector serial number 2
Answer: 1/20/2015 7:26:21 PM.85564 (+0.0156 seconds)
01 06 04 C8 3C 01 E2 AC 9E ...È<.⬞ 04C83C= first half of serial(313404) / 01E2AC= second half serial(123564)
Request: 1/20/2015 7:26:21 PM.85564 (+0.0000 seconds)
01 06 00 A3 AA ...£ª injector serial number 3
Answer: 1/20/2015 7:26:21 PM.87164 (+0.0156 seconds)
01 06 03 8B 0C 00 5F F6 F6 ...‹.._öö 038B0C= first half of serial(232204) / 005FF6= second half serial(0024566)
Request: 1/20/2015 7:26:21 PM.88764 (+0.0000 seconds)
01 06 00 A4 AB ...¤«
Answer: 1/20/2015 7:26:21 PM.90264 (+0.0156 seconds)
01 06 00 00 00 00 00 00 07 ......... inj 1
Request: 1/20/2015 7:26:21 PM.90264 (+0.0000 seconds)
01 06 00 A5 AC ...¥¬
Answer: 1/20/2015 7:26:22 PM.91864 (+0.0156 seconds)
01 06 00 00 00 00 00 00 07 ......... inj 2
Request: 1/20/2015 7:26:22 PM.93364 (+0.0000 seconds)
01 06 00 A6 AD ...¦­
Answer: 1/20/2015 7:26:22 PM.94964 (+0.0156 seconds)
01 06 00 00 00 00 00 00 07 ......... inj 3
Request: 1/20/2015 7:26:22 PM.96564 (+0.0000 seconds)
01 01 00 91 93 ...‘“
Answer: 1/20/2015 7:26:22 PM.98064 (+0.0156 seconds)
01 01 00 02 .... inj1
Request: 1/20/2015 7:26:22 PM.98064 (+0.0000 seconds)
01 01 00 92 94 ...’”
Answer: 1/20/2015 7:26:22 PM.99664 (+0.0156 seconds)
01 01 00 02 .... inj2
Request: 1/20/2015 7:26:22 PM.99664 (+0.0000 seconds)
01 01 00 93 95 ...“•
Answer: 1/20/2015 7:26:22 PM.01164 (+0.0156 seconds)
01 01 FF 01 ..ÿ. inj3
Request: 1/20/2015 7:26:22 PM.01164 (+0.0000 seconds)
01 01 00 94 96 ...”–
Answer: 1/20/2015 7:26:22 PM.02764 (+0.0156 seconds)
01 01 00 02 .... inj 1
Request: 1/20/2015 7:26:22 PM.02764 (+0.0000 seconds)
01 01 00 95 97 ...•—
Answer: 1/20/2015 7:26:22 PM.04364 (+0.0156 seconds)
01 01 00 02 .... inj 2
Request: 1/20/2015 7:26:22 PM.04364 (+0.0000 seconds)
01 01 00 96 98 ...–˜
Answer: 1/20/2015 7:26:22 PM.05864 (+0.0156 seconds)
01 01 21 23 ..!# inj 3
Request: 1/20/2015 7:26:22 PM.10564 (+0.0000 seconds)
01 10 00 AB BC ...«¼
Answer: 1/20/2015 7:26:22 PM.12164 (+0.0156 seconds)
01 10 00 00 06 70 00 00 04 5C 00 00 02 A5 00 01 .....p...\...¥.. Injector 1 coefficients 0670=1648 045C=1116 02A5=677
1D D5 81 .Õ�
Request: 1/20/2015 7:26:22 PM.13664 (+0.0000 seconds)
01 10 00 AC BD ...¬½
Answer: 1/20/2015 7:26:22 PM.15264 (+0.0156 seconds)
01 10 00 00 06 70 00 00 04 5C 00 00 02 A5 00 00 .....p...\...¥.. Injector 2 coefficients 0670=1648 045C=1116 02A5=677 5A85=23173
5A 85 6D Z…m
Request: 1/20/2015 7:26:22 PM.16764 (+0.0000 seconds)
01 10 00 AD BE ...­¾
Answer: 1/20/2015 7:26:22 PM.18364 (+0.0156 seconds)
01 10 00 00 0D 14 00 00 0A 32 00 00 04 1D 00 00 .........2...... Injector 3 coefficients
51 7C 5C Q|\
Request: 1/20/2015 7:26:22 PM.19964 (+0.0000 seconds)
01 10 00 AE BF ...®¿
Answer: 1/20/2015 7:26:22 PM.21464 (+0.0156 seconds)
01 10 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 ........ÿÿ...... Injector1?
00 00 0F ...
Request: 1/20/2015 7:26:22 PM.23064 (+0.0000 seconds)
01 10 00 AF C0 ...¯À
Answer: 1/20/2015 7:26:22 PM.24564 (+0.0156 seconds)
01 10 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 ........ÿÿ...... Injector2?
00 00 0F ...
Request: 1/20/2015 7:26:22 PM.27764 (+0.0156 seconds)
01 10 00 B0 C1 ...°Á
Answer: 1/20/2015 7:26:22 PM.29264 (+0.0156 seconds)
01 10 3A 98 3A 98 40 74 40 74 40 74 40 74 40 74 ..:˜:˜@t@t@t@t@t Injector3?
40 74 ED @tí

[UnityRacing]

I also suspect that the "01" preceding each line is a "read" request. I'm thinking a "write" request will be an "02" or similar.

[K447]

I also suspect that the "01" preceding each line is a "read" request. I'm thinking a "write" request will be an "02" or similar.

Following along with interest, I am.

Been a few years since I last reverse engineered a serial protocol.

[UnityRacing]

Figured out what the last bit is. A checksum for the previous bits.

01 10 00 00 0D 14 00 00 0A 32 00 00 04 1D 00 00 51 7C 5C

Take the first 17 bits and convert each hex code into a decimal number, add up all the decimal numbers. Then take the 18th bit and convert to decimal. Add this decimal number to the other decimal number you got from the total of all the first 17 bits. Take that total and convert from decimal to hex and the last 2 digits displayed are your checksum bits. BOOM!

Example of above-
1 + 16 +13 + 20 + 10 + 50 + 4 + 29 + 81 = 224
7C = 124 in decimal

So 224+124 = 348

348 as a decimal into hex = 15C

Last 2 digits are "5C" = your checksum.

[K447]

... the first 17 bits ...
... take the 18th bit and convert to decimal...

I think you meant byte, not bit, no?

[UnityRacing]

Yes you are right. Too much thinking all day at work with IP address and subnets, then to come home and sort this out. I'm a bit fried.

Hope I'm on the road to paying you back for that .dat file bro