Reverse-engineered wire protocols, register maps, and bring-up notes for a handful of commercial devices I've had my hands on — mostly off-grid power gear and LTE modems. Each folder is a self-contained write-up: what the device is, how it talks, the field/register maps, the gotchas, and (where it helps) a small dependency-light reference implementation.
Everything here was captured off real hardware. Where a device's protocol is already documented elsewhere, I say so and credit it — the point of each write-up is the bit that wasn't public.
JuncTek KM105F / KM-F (WiFi + BLE battery monitor) — juntek-km105f/
The KM-F series coulomb counters (KM105F, KM110F, KM140F, KM160F) with built-in BLE and
WiFi. Nearly every JuncTek write-up online covers the older RS485 :R50= request/reply
models; this is the free-running BLE/WiFi ASCII-stream variant, which I couldn't find
documented anywhere. Covers the ESP32 GATT UUIDs, the :A= frame field map, the
XOR-with-password write checksum, the calibration command set (pulled from the vendor app),
and the SOC-derivation gotcha. Includes a tested Python parser.
SRNE ASP48100U200-H (48V hybrid solar inverter) — srne-asp/
MODBUS-over-Solarman-V5 (TCP:8899) for the SRNE ASP series (tested as 2× in parallel
split-phase). The base MODBUS map synthesises existing public sources (credited); the novel
parts are the ASP-vs-ASF version-counter trap (it reports V1.07 but supports ASF V1.7+
registers, so you can't gate features on the version number), ~39 undocumented probed
registers at 0xE100, the split-phase L2/L3 register interleaving, and a
parallel-inverter aggregation model.
Sierra Wireless EM7430 (MBIM LTE modem, on NanoPC-T6 Plus) — em7430-modem/
Bringing up a Sierra EM7430 (MDM9230, pure MBIM) on FriendlyWrt. The NanoPC-T6 vs
T6-Plus DTB/USB-hub trap, the SoftBank→GENERIC carrier-PRI fix via qmicli, the
ModemManager 1.24 sysfs-path proto gotcha, and — the reusable bit — pulling serving
band / cell / neighbour-cell data that ModemManager's D-Bus API can't expose, via QMI
over the mbim-proxy. Includes a Python module for EARFCN→frequency and
timing-advance→distance.
Teladin/Huiye TN700 (MDM9207 LTE module) — tn700-modem/
Reverse-engineering the TN700 module (as shipped in the Mio BT223 router). The
dual-VID USB quirk (the same module reports a different USB vendor ID per composition),
a firmware-grounded proof that host-driven QMI data is disabled by design on this modem
(NAS works, WDS/UIM don't — a reusable diagnostic for "QMI registers but won't dial"), the
composition-switch mechanics, and the option driver's two-level new_id bind quirk.
Note: part of the TN700 work is a security vulnerability under coordinated disclosure and is intentionally held back from this write-up until that process completes. See Security & disclosure.
Mio Corp BT223 (MT7628 OpenWrt router) — bt223-router/
Porting OpenWrt to the BT223 (MediaTek MT7628 + MT7610E). The flash map (with a
cpio initramfs hidden inside the kernel image), the GPIO map, and — the novel bit — a
full clean-room opcode map for the onboard ABOV housekeeping MCU reached over
bit-banged software-I²C. Plus two upstream-quality Linux findings: the usb-serial
two-level new_id bind quirk and an in-kernel mt7603 MCU-wedge recovery patch.
Small, standalone, dependency-free. Copy them, don't pip install them.
juntek-km105f/reference/kmf_parser.py— KM-F BLE/WiFi frame reassembler +:A=parser.em7430-modem/reference/earfcn_freq.py— EARFCN→downlink frequency, timing-advance→distance, neighbour-cell distance estimate.
One finding here is a live security vulnerability being handled under coordinated disclosure — reported to the vendor, with a standard 90-day window before the technical detail is published. Until that window closes, the affected write-up carries a redaction marker where the detail would go. I'll update it (and add the CVE) once disclosure completes.
If you're a vendor and think one of these write-ups concerns your product, open an issue or email me — I'm happy to coordinate.
The original mess of notes and thoughts has been cleaned up by an LLM. All of my opinions are my own, and all of the mistakes are its. :D
Corrections and "actually, someone documented this in 2019 over here" pointers are very welcome — open an issue.
Documentation under CC BY 4.0; reference code under MIT. See LICENSE.