ANT+ is a wireless protocol specifically designed for use with sensors, and has similar functionality in some respects to Bluetooth Low Energy. It’s found a place among various bicycle equipment manufacturers, to connect smartwatches, cycle computers and electronic gear shifters. Of course, as soon as something becomes a defacto standard someone has to start coloring outside the lines. In this case, Shimano went off book with their DI2 groupset, leaving [kwakeham] with a reverse engineering job on his hands.
[kwakeham] gives us a great example of how to approach reverse engineering. Researching the Shimano hardware by its FCC ID shows that the device communicates using an NRF24AP2 chip, common in ANT+ devices. The Shimano device is then opened, and a logic analyser attached to various test points until the SPI interface between the transceiver and microcontroller is found. At this point, it’s a simple matter of putting the hardware through its paces and capturing data until the protocol can be pulled apart, piece by piece.
The work is documented on Github for anyone wishing to interface with the Shimano DI2 groupset. Reverse engineering is a powerful skill, that can teach you about everything from Pokemon to botnets. Video after the break.
Reverse Engineering Shimano Bike Electronics
Source: HackADay
