Serial Diagnostic Protocol // demo firmware (MBE 9A4)
Back to analysis | Run Emulator
Probed all 256 command bytes to reverse-engineer the ECU's serial diagnostic protocol. No intel_8096 code was harmed in the making of this analysis.
Serial Port Configuration
| Property | Value |
|---|---|
| Mode | 1 - 8-bit UART |
| Baud Rate | ~9,689 baud (register 0x80, assuming 20 MHz crystal) |
| Receive Enabled | YES |
| Parity | None |
| SP_CON Register | 0x09 |
Firmware Identification
| Property | Value |
|---|---|
| Command | 0x0D (Carriage Return) |
| Response | #92810270 |
| Raw Bytes | 23 39 32 38 31 30 32 37 30 00 |
| Length | 10 bytes |
Protocol
Send a single byte (register address) to read the ECU RAM value at that address. Most addresses 0x00-0xFF respond with a single byte. SFR addresses (hardware I/O registers) are filtered out. Command 0x0D (CR) returns the firmware ID string.
| Command | Function | Response |
|---|---|---|
| 0x0D | Read firmware ID | #92810270 |
| 0x00 | Sync/ACK | 0x55 |
| 0x00-0xFF | Read RAM register | Single byte value |
Address Scan (256 probes)
4 responding | 252 silent
| x0 | x1 | x2 | x3 | x4 | x5 | x6 | x7 | x8 | x9 | xA | xB | xC | xD | xE | xF | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0x | 00 | 01 | 02 | 03 | 04 | 05 | 06 | 07 | 08 | 09 | 0A | 0B | 0C | 0D | 0E | 0F |
| 1x | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 1A | 1B | 1C | 1D | 1E | 1F |
| 2x | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 2A | 2B | 2C | 2D | 2E | 2F |
| 3x | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 3A | 3B | 3C | 3D | 3E | 3F |
| 4x | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 4A | 4B | 4C | 4D | 4E | 4F |
| 5x | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F |
| 6x | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 6A | 6B | 6C | 6D | 6E | 6F |
| 7x | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 7A | 7B | 7C | 7D | 7E | 7F |
| 8x | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 8A | 8B | 8C | 8D | 8E | 8F |
| 9x | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 9A | 9B | 9C | 9D | 9E | 9F |
| Ax | A0 | A1 | A2 | A3 | A4 | A5 | A6 | A7 | A8 | A9 | AA | AB | AC | AD | AE | AF |
| Bx | B0 | B1 | B2 | B3 | B4 | B5 | B6 | B7 | B8 | B9 | BA | BB | BC | BD | BE | BF |
| Cx | C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7 | C8 | C9 | CA | CB | CC | CD | CE | CF |
| Dx | D0 | D1 | D2 | D3 | D4 | D5 | D6 | D7 | D8 | D9 | DA | DB | DC | DD | DE | DF |
| Ex | E0 | E1 | E2 | E3 | E4 | E5 | E6 | E7 | E8 | E9 | EA | EB | EC | ED | EE | EF |
| Fx | F0 | F1 | F2 | F3 | F4 | F5 | F6 | F7 | F8 | F9 | FA | FB | FC | FD | FE | FF |
Green = known register | Blue = responds (unknown) | Dark = no response
Show all 4 responding channels
| Address | Name | Response | RAM Value | Match |
|---|---|---|---|---|
| 0x00 | - | 0x55 | 0x00 | no |
| 0x03 | - | 0x46 | 0x4B | no |
| 0x05 | - | 0x4D | 0xAE | no |
| 0x06 | - | 0x42 | 0x10 | no |
How to Connect
To read live data from a real MBE 9A4 ECU:
1. Connect a USB-to-serial adapter (3.3V TTL level) to the ECU diagnostic connector
2. Set baud rate to 9,689, 8N1
3. Send 0x0D to verify connection (expect: #92810270)
4. Send any address byte (0x40-0xBF) to read that RAM register
5. Poll at ~10Hz for live dashboard data