Identifying Blocked Commands

[matthewmcneill]

I have set up grottproxy with cmdblock = true. This is working as designed. I'm starting to see some blocked commands in the logs.

Can we get any more information about them? Can we use all the dictionary structures to unpack the data-packets and understand what they are trying to do?

Here's an example:

	 - Growatt packet received:
		  <socket.socket fd=4, family=2, type=1, proto=0, laddr=('172.30.33.3', 58128), raddr=('47.91.67.66', 5279)>
	 - Growatt command block checking started
	 - Grott: Record blocked:  0135
	 - Growatt data decrypted V2
		 0bff0006043d013558474436434c4d41375800000000000000000000000000000000000000004
		 b544d3044413330313200000000000000000000000000000000000000001809150b0c24047530
		 75ac0dae4b544d30444133303132000000000000000000000000000000000000000000008ca00
		 0008ca0000054600000546000008ca000008fc000011c60000100000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000100080000001800090016000f00250027000000000001000000
		 00000000000000000000000000000000000000000075ad7629000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 006400000000006400000000000000000000003c0000271000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000762a76a60000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000076a77723000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 0000000000000000000000000000064000a000a00000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 00000000000000000000000000000000000000000000000000000000000000000000000000000
		 000000000000000000000000008f2d

M

[johanmeijer]

There are not a lot of commands that growatt uses. It is al about inverter and datalogger register settings.

The commands are 05/06 (inverter register read/write) and 18/19 (datalogger register write/read).

Grott identify these as T0nnn06 (0106 in dialogue above) or t0nnn18 (0118) records.

I made a start with documenting it in: https://github.com/johanmeijer/grott/blob/Master/documentatie/registers.md

The inverter registers are documented in general in the Modbus documentation as 03 holding registers.
As far as I know the datalogger registers are not documented.

The 0135 record you see above is not a command. It is information (data) sent from the inverter/datalogger to growatt. At this moment it is an unknown record for Grott and that why it is blocked. It seems some kind of data/initialisation record. In the record it refers to the devices 5XGD6CLMA7 (probably your datalogger) and KTM0DA3012 (your inverter?).

[matthewmcneill]

Ah. Very interesting, thanks for taking the time to look at it. You are correct the inverter is KTM0DA3012 and my data logger is XGD6CLMA7 (no '5' in front of it though). What I notice is that there are quite a lot of these and the packets are the same, except an incrementing counter in the first few bytes.

Great work on Grott!

M