My intial goal was to get into the data bus and try to replicate a TELE – CONNECT with opensource hardware.
The Brains of The SP-402
Surprisingly like most other smart enable automobile security systems, this one is running on a NXP LPC1224FBD64. It has a total of five relays, and a ST 24C02RP EEPROM. The SP-402 comes pre-configured at a baud rate of 115200 so according to the manual changing it to 9600 wasn’t hard although I don’t think it will matter since the arduino can do either both rates.
So far I haven’t been able to sniff any data coming from the data port. My speculation of why that might be is due to the nature of this security system. No data flows out unless an authorized device is physically present on the port. What I would need in order to further reverse engineer this would be the actual TELE – CONNECT product. Upon obtaining a TELE – CONNECT device, one would just use a logic analyzer (a Xprotolab Plain Oscilloscope would work great like shown here) to sniff data bidirectionally. Unfortunately since I do not have the device on hand, further progress has stalled for the moment.