-
Notifications
You must be signed in to change notification settings - Fork 3
/
M365_FW_Update_Protocol
20 lines (18 loc) · 1.04 KB
/
M365_FW_Update_Protocol
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
Commands are being sent the usual way with the nice prefix 0x55 0xAA, but with a weird Read/Write value.
Instead of 0x1 (read) or 0x3 (write), firmware updates expects 07,08,09 and 0xA:
Hdr L D RW C p Chk
55 AA 04 20 03 70 01 00 67 FF # Enter firmware update mode(?)
55 AA 03 20 01 B2 04 25 FF # Firmware Update Block Status Register(?)
55 AA 06 20 07 00 A8 65 00 00 C5 FE # Begin transmission(?)
55 AA 82 20 08 00 D0 21 00 ... # Actual firmware bytes (ends with checksum) - REPEAT every 128 bytes (or last chunk less) of firmware
55 AA 2A 20 08 CB E8 03 ... # Last chunk of firmware, in this case size 0x2A (ends with checksum)
55 AA 06 20 09 00 23 65 D8 FF 71 FD # End transmission(?)
55 AA 02 20 0A 00 D3 FF # Save new firmware(?)
55 AA 03 20 01 B0 20 0B FF # Get error if any
Hdr - Header
L - Length of message
D - Direction (0x20 - from Master to Scooter)
RW - Read/Write byte
C - Command
p - Command Parameter
Chk - Checksum: [msg_byte_1 + msg_byte_2 + ... msg_last_byte] ^ 0xFFFF