DSC Neo - How to decode?

[ArduinoQ97]

Hi everyone.
I have a DSC Neo setup at my place and I'd like to help with decoding and developing the keybusinterface for DSC Neo.
What are the steps required in order to accomplish this?
Do I need any hardware (logic analyzer, oscilloscope, etc.)? or can the hardware mentioned in the original post be used to read the data?

Thanks :)

[ArduinoQ97]

@ColinNg @Elektrik1 @uberflyx @Dilbert66

[Dilbert66]

Since it's encrypted I highly doubt it's worth trying to decode the key bus itself since the decoding keys and algorithm are locked away in the firmware. Without knowing those, it's pointless. Your best bet IMHO is to analyze the PCLINK2 serial bus with a cheap logic analyzer and see how it communicates with the attached communicator. Perhaps that is not encrypted. Who knows. Since that's a serial bus, you would be able to get more info out of it. There are two serial ports on that system. PCLINK and PCLINK2. From what I gather the PCLINK2 interface might be the more useful of the two.

[ArduinoQ97]

Thanks for the reply @Dilbert66.
Just a question, are you sure all the messages with wired keypads are encrypted?
if you can see this link, page 5, about HS2016 saying it is not encrypted.
I am not sure what this document talking about. It said it is about Central Station but it checked the control panel connectivity and also keypads and others.
How can we confirm it is encrypted?
I was assuming that it is only encrypted for the wireless accessories.

[Dilbert66]

Those communicate via the PCLINK2 serial interface and not the ECP Bus which is why I was pointing you in that direction. The firmware here interfaces via the ECP bus and simulates a keypad. Communicators and their cousins use PCLINK instead.

Edit, honestly there isnt really any documenatation on the NEO ECP databus so perhaps there is something that can be decoded there. I don't know. If you want to build and connect the DSC interface to it and see what you glean from it. That would be a start. What I do know is that the NEO does not work with any older keypads or other ECP bus peripheral so it is different. I don't have access to one so I really can't say.

A good start at least would be to connect a cheap logic analyzer and using Pulseview or Saelea software, collect some samples of the data and clock lines. Post them here and then we can try analyzing the traffic on it. It would also be helpful to collect traces when you are entering commands on the panel keypad to see if those can be captured and decoded as well.

Using a logic analyzer is necessary for tasks like this.

[ArduinoQ97]

Thanks @Dilbert66.
I will do and share the data here