Checksum of the protocol

[imval]

Hi,
You did a great job finding the values of all the fields and thanks for putting them on Github in public!
It helped me a lot.
However, I have an issue with the checksum, did you ever figure out the checksum for the protocol?

[klotztech]

Hi imval, very glad it helped you :)
I've actually never come around to building something with the reverse engineered protocol. Will integrate some readouts in my ebike controller soon, hopefully...

Looking at the decompiled app source code, in class AtyMain (which is where they transmit commands afaik): https://github.com/FastDeath/VBMS/blob/5253c73dd7f125286c00a53a3b242d7c6cc2a611/com/lecheng/hello/ant_bms/AtyMain.java#L365-L379 It seems like they're always sending 0 as checksum (for some reason?!)
Edit: They're actually calculating it via byte addition on line 375

Have you tried that? Would love to get some feedback for future reference 😃

[imval]

I also saw that bit, but this seems to be the checksum to send the data to the BMS.
What I'm looking for is the checksum on the received message, the one the BMS replies when you send 0x5A5A00000000
I'm also using it on an Ebike and it's a very noisy environment thus the checksum is quite important, almost 20% of my packages are garbage at high current.
I've been trying several checksums using dumped packets and a C program.

[klotztech]

I haven't got any way of testing it at the moment, but this seems like the code that computes and checks the checksum on the incoming data:
https://github.com/FastDeath/VBMS/blob/5253c73dd7f125286c00a53a3b242d7c6cc2a611/com/lecheng/hello/ant_bms/BcService.java#L277-L286
It first sums up all the bytes at offsets 4 to 137 (int add_140) then compares that value with the 16 bit integer at offset 138-139 (int add_140_1).
I can try to recreate it, if you send me some packet dumps.

[imval]

Oh great! I didn't see that bit!
And now that I review my code as well, I made a little mistake about the last bit so it might explain my weird results.

I love that they do a for loop and inside check the j2 >3 ... why not just start at 4 🤷‍♂️

[klotztech]

Maybe also make sure to use big endian byte order (as it seems). I've added some info to the wiki:
https://github.com/FastDeath/VBMS/wiki/Serial-protocol/3575857b1a08ad5815699077855696f6c6f4fdf1

To mitigate signal interference, what I did was to cut up some decent USB cables since they're sheathed pretty well and carry the necessary wires for the TTL serial connection (twisted data pair). I use a USB 3.0 cable for the additional conductors (1-wire temperature sensors)