FCSP RS485 port access Success!

[cjueden]

Interesting that there is a USB port on the FCSP which is not apparently mentioned in any documentation that I have seen yet from Ford or SunRun.

I did not find any mention of the P3 debug connection pins either. They do say TX RX and COM on the circuit board so clearly for simple serial 2-way communications for debugging something, probably used by techs for testing and/or repair situations. Does not seem to be involved in normal operation communications with the HIS or the Truck.

I Googled the usb port on the Ford Charge Station Pro and while others have asked about it, nothing pops up about how it could be used, to update software/firmware for example.

Yes the Blue 80 is very similar right down to the rotary micro-switch for setting the max current, it is likely that the FCSP is a modification of that design or visa versa.

May need to snoop out the communications in a working HIS from someone who has one?

To unlock the bidirectionality.

I can confirm that the usb port on the FCSP supports a usb=>ethernet adapter to get ethernet access to the device. But can't get it to connect to the FordPass App. I ran a reset on the FCSP from the Charge Station Pro app and then attempted to run the setup with just the ethernet connection. I'm able to see the FCSP in the Charge Station Pro app while connected to the same network via wifi, but when entering the password It just fails and wants me to connect to it's AP. I'm now convinced this is a Blue 80A varient.

Running nmap on ethernet shows the same ports exposed as on the wifi.

While I have an ethernet connection I tried to access the local webpage on port 80/443 of the FCSP and got some type of Django debug log output webpage that looks like this

Some things I found these things interesting

And when trying to access the /accounts/login/ url suffix I get this

I tried to access these urls but get kicked back to the root page.


Note: I did not add these stars under password
I've attached the file if anyone's interested or know more about Django to dig through. It looks like you're not allowed to upload HTML files so just remove the .txt and it will open in a browser.




Seeing the "root" username I'm running hydra on the FCSP with that username. Currently at 11,xxx tries with no luck.

This data is going to have different formats for different register values. Here is a document which I believe is the valid modbus register mapping. It seems to match up with your testing.

Note that you are starting at 0 and they are starting at 1, so there is an offset you need to account for.

Good eye on that one and I'm playing around with the different data types to see what takes but I'm just guessing. The FCSP does start it's index at 0 not sure why. But I've had success with almost every address with the 0 index. I can add the yaml I'm using for ESPHOME if anyone is interested in trying.
Some of the addresses in your attachment do work but some don't. I'm also referencing THIS document also with the same mixed success.

If anyone is has any ideas/suggests/requests I'm all ears!

Sponsored