Interceptor

standing-desk-interceptor

I wanted to intercept the communication between my Flexispot E5B standing desk buttons. This is the progress on the project. It should work on any other flexispot desk as well, as i suspect they use the same button interface with nearly the same protocol. But this needs testing!

RJ45 Pins

Using SWIM

The SWIM Debug interface is on the RJ45 Port, but not possible to use, due to set Read Protection, which can only be disabled by overwriting the Chip itself.

Protocol

Every Command starts with 0x9b and ends with 0x9d. The second byte is the length of the Message with the Endbyte included. It seems like the Byte after the length is some kind of messagetype, because it stays constant for button presses, height configuration and different messages.

The checksum is a CRC16 Modbus Checksum (07 12 06 06 7d results in 0x38b7) over the Length+Type+Payload

Button presses

A button press has the message type 0x02 and can be used as a fixed command. The checksum is steady and doesn't have to be recalculated.

Those are the known commands from the button controller to the motor controller with their respective button names.

Height

(Credit goes to mikrocontroller forum https://www.mikrocontroller.net/topic/493524)

The height has the MessageType 0x12 and the payload is a simple 7 Segment display output.

As an example we look at the height answer: 9b 07 12 06 06 7d 38 b7 9d which represents 116

If we convert this to a regular 7 Segment Display:

Converting each byte to is binary representation and mapping each bit to a segment, we can generate the following table:

Mapping this to the example above we can display the number 116 as a 7-Segment output. (don't want to include pictures, just believe me or try it out)

Unkown MessageTypes

We don't know about the MessageTypes 0x11, 0x13, 0x15. They are send by the motorcontroller. They seem to be constant across different tables and don't bear any payload.