Public projects Protocolos industriales (BMS)
Infra crítica · Embedded systems · RF
Protocolos industriales (BMS)
Reverse engineering of the undocumented protocol of a building control system, starting from a broken air conditioner.
It all starts with a broken air-conditioning unit. Pulling the thread reveals a smart-building control protocol (BMS) with no public documentation.
The work reconstructs that protocol from the oscilloscope: the RS-485 bus is captured with an Arduino sniffer, the Manchester encoding of the commands is identified and the orders are replayed. Control is then integrated into a generic thermostat through a kernel driver (Industrial IO).
The talk ended with a turn towards radio side channels —including FM RDS— to send commands. It was presented at RootedCON 2020 as «Protocolos industriales, carreteras comarcales».
Where I've presented it
Protocolos industriales, carreteras comarcalesProgram (archived)
Video