03/20/2019 at 11:26 •
The device im trying to hack is the "Digital Gateway" used to attach sensors to a "Hach SC200". On the main PCB of the SC200 I found 2 RS485 chips ADM3483ARZ which confirms my initial thoughts on the physical layer.
I have no futher info on the actual gateway as its a solid epoxy block and these devices are NOT CHEAP so destructive hacking is not an option.
The through the gateway we get temperature and PH/ORP readings among other setup config testing infos. There is a complete modbus map available for the gateway/sensor which a normal user would use while talking to it THROUGH the SC200 which has an additional Optional modbus card (which i have).
The manual is on the link above and it includes the modbus register map.
Now to be clear: the gateway does not speak in modbus to the sc200.
Im trying to AVOID using the SC200 and talk to the gateway directly.
03/11/2019 at 21:57 •
As clearly seen by the log, the pattern repeats, changing only where the "Data" should be. there are 2 parameters being logged by this sensor.
I thought this was straight modbus since the device already supports modbus, and the physical layer seems to be 485, but its not.
I thought it might be CAN over 485, but its not.
I thought it could be Profibus but you guessed it... its not.