Author Topic: WMR-89 hacking -> station now supported by Meteobridge  (Read 10440 times)

0 Members and 1 Guest are viewing this topic.

Offline docbee

  • Forecaster
  • *****
  • Posts: 643
    • smartbedded
WMR-89 hacking -> station now supported by Meteobridge
« on: October 09, 2015, 01:48:18 PM »
While I have done analysis of protocols of former Oregon Scientific stations the new WMR-89 seems to be a bit different. While WMR-100/200/300 they always had a USB hid protocol implemented, the WMR-98 gets connected on my PC by a USB serial port with 9600 baud. The used drivers are from Silicon Labs known for their CP210x drivers. When I patch a Linux CP210x driver to accept vendor 0x0fed, product 0xca0a my Linux also opens up a USB serial port for this (/dev/ttyUSBx). So far so good.

My assumption was that sniffing the protocol when the PC programs talks to the WMR-89 might give more insight soon, but this looks strange. My Beagle USB protocol analyzer shows lots of errors when sniffing the communication. Sending out the bytes "0xd1 0x00" and "0xb6 0x00" which seem to request data from the station remain unheard, no data stream coming back.

May be I am on a false trip here, but this looks a bit like something else is needed to be done (bit banging with RTS, DTR, etc lines?). Anybody of you who has gathered more insight on this station's protocol?
« Last Edit: January 11, 2018, 10:40:42 AM by docbee »
founder of smartbedded.com - home of meteohub, meteoplug, meteobridge, meteostick

Offline aweatherguy

  • Senior Contributor
  • ****
  • Posts: 284
    • Weather Station Data Logger
Re: WMR-89 hacking
« Reply #1 on: October 14, 2015, 01:24:12 AM »
Not sure I understand exactly. Do you mean to say that when a PC program is successfully obtaining data from the WMR89 that you cannot see anything going from the WMR89 back to the PC with the Beagle analyzer?

Offline docbee

  • Forecaster
  • *****
  • Posts: 643
    • smartbedded
Re: WMR-89 hacking
« Reply #2 on: October 14, 2015, 08:58:41 AM »
I see tons of connection errors and filtering these out I see some packets that might have meaning.
imitating these send-out packets from Linux I don't get any response from the WMR-89.

My (may be false) judgement on this is, that there is going on some side band communication
with RS232 status lines, which could explain the errors. La Crosse is known to do these kind of things,
may be Oregon Scientific also decided to go that way for any reason. But as said, this is
momentarily just an impression I have and I would be interested to get feedback from
others in the forum who also tried to identify a polling schema in the WMR-89 communication.

Am I really the only one looking at this?  :shock:
founder of smartbedded.com - home of meteohub, meteoplug, meteobridge, meteostick

Offline aweatherguy

  • Senior Contributor
  • ****
  • Posts: 284
    • Weather Station Data Logger
Re: WMR-89 hacking
« Reply #3 on: October 14, 2015, 04:11:33 PM »
You are obviously the first one doing this who has taken the time to post on this forum. This is a relatively new product and I suspect you'll see more as time goes by. I wouldn't mind having a look for myself, but am busy with other things at the moment and don't feel like dropping the cash on a WMR89 just to get decodes.

I would certainly be interested in anything you learn and might be able to offer some insights but it sounds like you've got a decent handle on things right now. Can you get a wireshark capture of this traffic? That way others could look at it at least.

Offline KC8HPS

  • Member
  • *
  • Posts: 5
Re: WMR-89 hacking
« Reply #4 on: November 01, 2015, 12:04:52 AM »
 I just purchased this particular weather station and I find that it doesn't hook up to any weather software for reporting citizens weather observation this is really sad .
 Unlike other Oregon  Scientific weather stations this one does not appear to be as useful as the others ..   If anyone figures out how to decode its data and make it usable in some existing software that would be very helpful sadly I don't have the brains to do this . 😕

Bryan

Offline aweatherguy

  • Senior Contributor
  • ****
  • Posts: 284
    • Weather Station Data Logger
Re: WMR-89 hacking
« Reply #5 on: November 01, 2015, 04:51:40 AM »
I could probably help docbee with the decoding if he can share come data captures...but since I don't have the hardware here that's about all I could do for now...

Offline docbee

  • Forecaster
  • *****
  • Posts: 643
    • smartbedded
Re: WMR-89 hacking
« Reply #6 on: November 01, 2015, 05:03:24 AM »
As written before I don't get a proper data stream recorded. That is the main problem,
not interpreting the communication, which I was able to decode for many other stations.

Anybody out there who succeeds in sniffing the traffic?
founder of smartbedded.com - home of meteohub, meteoplug, meteobridge, meteostick

Offline KC8HPS

  • Member
  • *
  • Posts: 5
Re: WMR-89 hacking
« Reply #7 on: November 01, 2015, 10:44:37 AM »
I received the war 89 as a gift. The giver called Ogegon Scu and ask if it would work they said yes. I think the person didn't know what they were talking about.
If you can tell me how to capture the data stream I am willing to try it.
The unit reports to its software just fine via USB cable so I know the unit is working as designed.
Do you just need the data file that it produces?

Thanks, Bryan
P.s. The wireless sensors seem to be pretty much standard with the other machines, so my guess is that they cross ver from model to model.

Offline johnmn

  • Member
  • *
  • Posts: 29
Re: WMR-89 hacking
« Reply #8 on: November 10, 2015, 01:31:05 AM »
I needed another WMR88 to set up another station. Then I discovered the situation with the new 'upgrade', the WMR89. So I had to get a WMR200 which is overkill for this situation.
(Desperately getting away from Anywhere Weather using Meteobridge and WU.)

Clearly OS have decided to make things harder for 3rd parties by getting rid of the nice entry level to uploading.

Rather than using Beagle to analyse the USB data stream, is there software that would allow you to hook into the post driver serial stream? I mean, there must be a virtual COM port, which could be monitored.

(I haven't analysed serial comms since it was really serial comms!)

Offline aweatherguy

  • Senior Contributor
  • ****
  • Posts: 284
    • Weather Station Data Logger
Re: WMR-89 hacking
« Reply #9 on: November 18, 2015, 09:42:46 PM »
In my experience, on Windows 7 Wireshark works fine; probably fine on Linux too but that's just a guess. You must get the USP Pcap tool also; Run USB Pcap to capture the traffic into a "pcap" file, then analyze the file with Wireshark.

There is a bit of learning curve with USB Pcap learning how to spot your device in the list of USB devices attached to the computer. The other thing to be wary of is that after you have USB Pcap running, it is wise to disconnect then reconnect the device so that the USB enumeration traffic is captured -- this helps Wireshark with the protocol decoding.

Offline KC8HPS

  • Member
  • *
  • Posts: 5
Re: WMR-89 hacking
« Reply #10 on: December 19, 2015, 03:31:37 AM »
Hey all,

I tried Pcap  and have not been able to capture any data, that I know of. Ugh
I'm guessing I don't know what I'm looking at.
If I succeed in getting data would one of you tell me how to send it to you?

Bryan

Offline aweatherguy

  • Senior Contributor
  • ****
  • Posts: 284
    • Weather Station Data Logger
Re: WMR-89 hacking
« Reply #11 on: December 30, 2015, 12:45:05 AM »
Well, let's just start with getting the data. Then we can figure out how to send it around.

Are you running "USBPcapCMD.exe"? It is a console window -- not a normal GUI application.

Are you getting a list of USB devices and figuring out which one is the WMR88?

If none of this sounds familiar try reading this web page tutorial:

http://desowin.org/usbpcap/tour.html

Offline rickettm

  • Member
  • *
  • Posts: 2
Re: WMR-89 hacking
« Reply #12 on: February 07, 2016, 10:40:23 AM »
Did anyone get any further with this?

I've got a WMR-89 now, and have been trying to get the data out.

The good news is that the windows software that comes with the station writes ".bin" files for the last 7 days, one per day, containing hourly weather data - these are reasonably straight forward to decode (I've got a bit of code for reading these)

I've captured some data with USB PCAP, but not got very far making much sense of it.  As others have seen there's a fair amount of invalid data going on, but there's also some USB_BULK  packets containing chunks of 100 bytes that look a bit like some of the data in the bin files.

I guess next I need to capture some data and then compare to the corresponding file and see if anything matches up... but then what?

Offline KC8HPS

  • Member
  • *
  • Posts: 5
Re: WMR-89 hacking
« Reply #13 on: February 07, 2016, 12:14:56 PM »
Rick,
I'm glad you are getting some data. I'm so clueless on how this all works.
If you come up with anything please keep us posted here thanks.

Bryan
P.s. Do you have a download link to the wmr89 original software? I lost my copy.

Offline aweatherguy

  • Senior Contributor
  • ****
  • Posts: 284
    • Weather Station Data Logger
Re: WMR-89 hacking
« Reply #14 on: February 11, 2016, 12:26:55 AM »
Rick,

Do the USB PCAP captures include device enumeration? I'd like to see some of those if you can figure out how to post them. If not, send me a PM and I'll give you an e-mail address.

Offline rickettm

  • Member
  • *
  • Posts: 2
Re: WMR-89 hacking
« Reply #15 on: February 13, 2016, 05:25:44 AM »

P.s. Do you have a download link to the wmr89 original software? I lost my copy.

Its linked from here: http://weather.oregonscientific.com/support.asp

Offline KC8HPS

  • Member
  • *
  • Posts: 5
Re: WMR-89 hacking
« Reply #16 on: February 13, 2016, 01:05:10 PM »
Thanks Rick.

Offline marunio

  • Member
  • *
  • Posts: 7
Re: WMR-89 hacking
« Reply #17 on: January 09, 2018, 06:30:31 PM »
I have decided to update this thread as it might be useful for people wanting to capture data from WMR89A.
After spending some time on deciphering the captured dataflow between WMR89 and a PC using Serial Port Monitor here are my observations:
-the baudrate used is 128000
-d100 (hex) requests current data (as noted in thread starting post)
-b600 requests logged data dump
-each received data block starts with f2f2 marker followed by data block type:
   b0-date/time, b1-rain, b2-wind, b4-pressure, b5-temp/humidity
-data block type byte is followed by block length byte

I was able to write a short program in Python to continuously log WMR89 data on Raspberry Pi into a csv file.

I hope this helps someone. 
« Last Edit: January 09, 2018, 06:32:37 PM by marunio »

Offline docbee

  • Forecaster
  • *****
  • Posts: 643
    • smartbedded
Re: WMR-89 hacking
« Reply #18 on: January 09, 2018, 07:23:51 PM »
very interesting. Thanks for sharing.

How did you tell the device driver for the CP2101 to do this non-standard baud rate? In Linux I just se the list of standard baud rates, like:
            B9600
            B19200
            B38400
            B57600
            B115200
            B230400
« Last Edit: January 09, 2018, 07:36:10 PM by docbee »
founder of smartbedded.com - home of meteohub, meteoplug, meteobridge, meteostick

Offline marunio

  • Member
  • *
  • Posts: 7
Re: WMR-89 hacking
« Reply #19 on: January 09, 2018, 08:06:38 PM »
Right.
I also thought this might be a stumbling block.
Since my focus was to develop logging app in Python I just asked Pyserial to open the port with this non-standard speed and it worked :)
Somehow Pyserial figures this out....


Offline docbee

  • Forecaster
  • *****
  • Posts: 643
    • smartbedded
Re: WMR-89 hacking
« Reply #20 on: January 10, 2018, 01:45:57 AM »
For Linux I will have to modify the CP210x kernel driver to map one of the non-used standard speeds (like 50 baud) to the 128.000. I will give it a try the next days.
founder of smartbedded.com - home of meteohub, meteoplug, meteobridge, meteostick

Offline docbee

  • Forecaster
  • *****
  • Posts: 643
    • smartbedded
Re: WMR-89 hacking
« Reply #21 on: January 10, 2018, 04:32:17 AM »
First data coming in :-)

Data stream stops after a while. Do you send polling request again and again or how do you keep data flowing in?
founder of smartbedded.com - home of meteohub, meteoplug, meteobridge, meteostick

Offline marunio

  • Member
  • *
  • Posts: 7
Re: WMR-89 hacking
« Reply #22 on: January 10, 2018, 06:32:24 AM »
Nice!
I keep prodding for data every 0.5s providing the receiving buffer is empty.
The device has its own timing for submitting data.
Pressure for example comes out every 15min, while others might be a few times within a minute.

Offline docbee

  • Forecaster
  • *****
  • Posts: 643
    • smartbedded
Re: WMR-89 hacking
« Reply #23 on: January 10, 2018, 10:11:07 AM »
First experimental implementation into Meteobridge is ready for testing. The baud rate information was the missing building block. The rest is very straight forward. Finding out forecast values and low battery signals will need some more inspection, but for now we can live without ;-)

http://meteobridge.com/wiki/index.php/Forum
founder of smartbedded.com - home of meteohub, meteoplug, meteobridge, meteostick

Offline marunio

  • Member
  • *
  • Posts: 7
Re: WMR-89 hacking
« Reply #24 on: January 10, 2018, 10:18:41 AM »
Awesome!
Do I get a discount ? :grin: