Fix struct.error crashes on Conext SW 4024 / MPPT 60 150 (shorter fast-packet payloads) - #4
Open
kaanow wants to merge 1 commit into
Open
Fix struct.error crashes on Conext SW 4024 / MPPT 60 150 (shorter fast-packet payloads)#4kaanow wants to merge 1 commit into
kaanow wants to merge 1 commit into
Conversation
…processors A Conext SW 4024 + MPPT 60 150 site sends shorter fast-packet payloads than the XW+ / MPPT 80 600 generation this code was developed against: PGN XW+/80600 SW4024/60150 BattSts2 41 36 DcSrcSts2 27 21 ChgSts 20 17 AcStsRms 55/83 78 Every processor used fixed-size struct.unpack, so ALL of them raise struct.error on such a site. The field layouts are prefix-stable (verified: battery V decodes at the same offsets and matches the site's InsightHome Modbus registers at r=+0.98), so switch to struct.unpack_from with minimum- length guards, and branch AcStsRms on the association id (0x13 gen / 0x33 loads / 0x43 grid, per the existing comments) instead of the exact payload length. The extra grid block past byte 55 is only read when present. Tested on 59k reassembled payloads from a live SW 4024 + MPPT 60 150 bus (no exceptions, sensible values) and against the full-length sample payloads in this file's comments (unchanged results). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem
Running berrybms against a Conext SW 4024 + MPPT 60 150 site crashes in every fast-packet processor: this device generation sends shorter payloads than the XW+ / MPPT 80 600 the code was developed on, and the fixed-size
struct.unpackcalls raisestruct.error.Observed payload lengths (from a live capture corpus, ~59k reassembled messages):
The fix
The field layouts are prefix-stable — the older devices just send fewer trailing bytes. (Verified: battery voltage decodes at your documented offsets on the SW 4024 and matches the same site's InsightHome Modbus registers at r = +0.98.) So:
struct.unpack_from+ a minimum-length guard;processAcStsRmson the association id (0x13 gen / 0x33 loads / 0x43 grid — per your own comments) instead of the exact payload length, and only read the extra grid block past byte 55 when it's present.Testing
Two related findings from the same site that may interest you, documented in our fork's findings notes:
assocvalues you identified empirically match the official XantrexXB_eAC_SRC_ID/XB_eDC_SRC_IDenums leaked in the Freedom SW-RVC DGN Reference Guide (976-0452-01-01): 0x03=HOUSE_BAT_BANK1, 0x13=GEN1, 0x15=SOLAR_ARRAY1, 0x33=AC_LOAD1, 0x43=GRID1.(Independent of #3, which fixes >16-frame reassembly; the two can merge in either order.)