Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[PureEnerLectrica]

Hi all,
I was wondering did somebody already tried to build the OBD2 to Serial cable to get your laptop connected to the MBB ?
I've followed the instructions here: https://zeromanual.com/wiki/How_to_build_a_cable_to_access_the_MBB
Used pin 5, 8 and 9, but nothing comes in on putty for the correct COM port and 38400 baud.. also tried changing TX and RX, same result..
I've seen the MBB software with my dealer, through the official cable, so I can confirm the software is still running and accessible through a serial connection.
But did they change the pins for the new cypher OS ?
anybody tried this ?

[BrianTRice@gmail.com]

I don't have a confirmed set of communications parameters for the SRF, but have like you seen it in use with official dealer harnesses.

I would like to document them when available, for sure, so please let us know if/when you discover them for all our benefits.

[PureEnerLectrica]

I succeeded to get in.. the pin's mentioned were correct, but the baudrate has to be 115200
then it works..
I saw the software running at the dealer, and wanted to play with the set accesory_configuration option to enable led indicators, but it failed..
I guess i have to login on the terminal but i don't have the password..
The zero diagnostics software logs in hidden with a button..

[BrianTRice@gmail.com]

Thanks! I've updated the page to reflect that:
https://zeromanual.com/wiki/How_to_build_a_cable_to_access_the_MBB

The zero diagnostics software logs in hidden with a button..

What do you mean about logs and a button?

The MBB even with only a basic login level should be able to show/print logs (use your terminal software's transcript-saving features to get them into a file).

[NetPro]

How odd:
The bike does not negotiate down the connection  speed.
I tried with several USB to serial adapters and terminal emulators but was not able to connect at the recommended speed in the instructions I read.
I tried every speed in the emulator slower but not faster, and gave up for the time being.
Will try now and see what happens.
All serial devices I have worked with in past connect fine at slower speed.

[Auriga]

I've never seen a device that produced anything but garbage at the wrong baud rate, Netpro must be working on something fancy. I think srf-fun is saying that he didn't see a password to get to a higher login level.

While I'm not sure about that, I can say that there are no decoded logs available at the default login level.

[BrianTRice@gmail.com]

I've never seen a device that produced anything but garbage at the wrong baud rate, Netpro must be working on something fancy. I think srf-fun is saying that he didn't see a password to get to a higher login level.

Oh, right. Yes, Zero bakes their passwords into the GUI-frontend tools for service technicians.

While I'm not sure about that, I can say that there are no decoded logs available at the default login level.

Okay, so we now have confirmed a limitation that Zero SR/F owners by design cannot decode log events from their own vehicles.

I think that's a fairly benign owner expectation that Zero must have made a decision about. There's a data ownership expectation and a right to repair expectation.


Honestly, I heard from a Zero engineer directly that they have exercised some decisions to deprive owners of decoded logs for "security" reasons, which I find dubious at best. If this is the case, I would assert that Zero is exercising poor judgement in weighing (1) the cost of owners misinterpreting logs, against (2) the benefit of more assured turnaround time in not waiting for Zero service HQ or a dealer to decode logs.

I will ask some professionals in this field about this topic and see what I can learn.

[Crissa]

Well, the more they have exposed, the easier it becomes to decode that one part that is secured.

That's how the heartbleed worm worked:  It would look for secure chunks in memory and with enough of them, you'd be able to decode them.  And the more secured chunks there were, the harder it is to do this sort of exploit.

With the SR/F talking over the air, that's kinda important.  You don't want to be able to inject bad packets and crash or hack the software.

-Crissa

[BrianTRice@gmail.com]

That is not reasonable speculation, Crissa, and I do not want anyone on this forum to get the wrong idea here.

First, the binary log files are already transmitted to the Zero mobile app over Bluetooth / BLE, which is known to be insecure.

The SR/F MBB console is accessed in the key-locked tank area via hardware pinned connection. That is the interface which it is surprising to learn that logs (decoded or not) are not accessible.

Likening this to heartbleed is really inappropriate. There's a command to access logs which reads from the internal persistent ring buffer store and emits a decoded version. If a memory overrun is possible, it will not be because one of the built-in functions of the firmware is invoked per documentation.

[Auriga]

@BrianTRice. BLE can be secure, it all deends on the implementation.

There is an eventlogdump command, but it does not decode logs. Just sprays the terminal with hex values. So it's safe to say either there is no on bike decoding or it requires a higher login level to access.

[Crissa]

People shouldn't speculate that they're choosing to secure the interface because they want to screw consumers, either.

-Crissa

I just used heartbleed decoding as an example of why to choose more encoding over less.

[BrianTRice@gmail.com]

I'm not speculating, I'm interviewing engineers and corroborating. I don't cite my sources out of confidentiality, but this has been corroborated; I just wanted the experience/perspective of an owner to confirm independently.

[PureEnerLectrica]

What do you mean about logs and a button?

Brian, what I meant is that the Zero diagnostics software the dealer is using has a GUI frontend with an embedded terminal emulator. This diagnostics software has a button for the dealer to login to a certain level (didn't check which one) through the terminal connection. It's hidden so you can't see the password it's using. Once logged in, you could change things. Things I can't without knowing the password..

I've never seen a device that produced anything but garbage at the wrong baud rate, Netpro must be working on something fancy. I think srf-fun is saying that he didn't see a password to get to a higher login level.

While I'm not sure about that, I can say that there are no decoded logs available at the default login level.

Auriga, I can confirm that I saw only garbage with a lower baudrate, nothing at all, not even the debug messages you see when turning the key..
Putting it on 115200 was the only way to get readable text, debug messages and menus..

About the logs I cannot confirm it yet as i didn't test that part, but it is in the menu, so i'm assuming it will be possible to just read them..
I'll test it out when i have time..
If you are talking about the logs in the attachment

[BrianTRice@gmail.com]

That would be very good to know, thank you. I certainly hope the MBB console can still decode log events with regular owner access.

[Auriga]

srf-fun, I tried all of those commands and didn't get decoded log messages. I concur on the baud rate though.