Reverse Engineering a Black-Box Serial Protocol

Question

I am currently writing an OS X driver for the NewTek LiveControl LC-11 as seen here.

newtek.com/addons/livecontrol.php

In the course of my reverse engineering I have found that it is using a serial to USB converter and that it communicates with hexadecimal output when a button is pushed or an analog value changes. Using this output I have been able to interpet every button, digital knob, and the analog slider, but am currently stuck on interpreting the two analog joysticks and controlling the backlight LEDs. Here is a table of the joysticks output values in various positions.

(Sorry that I couldn't embed the image but stack overflow won't let me since I just registered.)

         Left   Center  Right  
Top     ^529DC  ^587FF  ^5D6DA  
Center  ^50883  ^58181  ^5F280  
Bottom  ^51E2F  ^57C00  ^5BC1F  

or

http://i28.tinypic.com/217vbr.png

I think that the '^' is some kind of marker (some of the other buttons have codes that start with '~' and some of the release events have no marker at all other than a '\r' from the message before. I have been able to interpret no pattern in these markings at all but I don't think it is necessarily important.) and I know that each joystick has it's own unique range of output values. If anyone can shed some light on this mystery it would be greatly appreciated. :D

Answer 1

Interesting puzzle!

The first (hex) digit is always 5. Let's ignore that one. (Maybe it's the joystick's identifier?)

The second and third are low in the left column (29, 08, 1E). They're halfway the range in the middle column (87, 81, 7C). And they're large in the right column (D6, F2, BC). So this must be the X coordinate.

The last two digits in the top row are large (DC, FF, DA). The last two in the middle row are halfway the range (83, 81, 80). The last two in the bottom row are low (2F, 00, 1F). So that's clearly the Y coordinate. Judging from the way the outer two values are away from the extremes, I'm guessing that the joystick moves around in a circle (as opposed to a square)?

Long story short, the format seems to be:

^5xxyy

Here, xx is one byte (written in hex notation) describing the X position, with left being 0, centre being 80 and right being FF. Similarly, yy is the Y position, bottom being 0, centre being 80 and top being FF.

Answer 2

It looks like the packet starts with two bytes: ^5 followed by four hexadecimal digits representing two bytes. Like this:

^5   left/right   up/down

Look at the numbers in isolation:

Centered top and bottom:

left:    ^5   08(8)    dont_care
center:  ^5   81(129)  dont_care
right:   ^5   F2(242)  dont_care

Centered left and right:

top:     ^5 dont_care  FF(255)
center:  ^5 dont_care  81(129)
bottom:  ^5 dont_care  00(0)

So this means that ideally, the joysticks should have a value of 0 for extreme left or bottom and a value of 255(0xFF) for extreme top or right.

Of course, physically the joystick looks to be offset to the right and up by one bit (129 instead of 128) and can't reach maximum values for left and right (8 and 242 instead of 0 and 255).