h1. BCM4751protocol

This page contains data copied from [[BCM4751]].

h2. Post protocol switching - receiving

|_. Byte |_. content   |    |    |    |
|  1 | length 1        | fe | fe | fe |
|  2 | length 2        | 00 | 00 | 00 |
|  3 |                 | fd | fd | fd |
|  4 |                 | 40 | 0f | 0f |
|  5 |                 | 00 | ff | ff |
|  6 |_. sequence nr.  | 00 | 07 | 08 |
|  7 |                 | F1 | 06 | 06 | 
|  8 |                 | B1 | 06 | 06 | 
|  9 |                 | 12 | 00 | 00 |
| 10 |                 | 20 | 01 | 01 |
| 11 | checksum        | 67 | 54 | 1c |
| 12 | end marker      | fc | fc | fc |


h2. Post protocol switching - sending

|_. Byte |_. content   |    |
|  1 | length 1        | fe |
|  2 | length 2        | 00 |
|  3 |                 | fd |
|  4 |                 | 6f |
|  5 |                 | 3a |
|  6 |_. sequence nr.  | 01 |
|  7 |                 | 00 |
|  8 |                 | 00 |
|  9 |                 | 00 |
| 10 |                 | 00 |
| 11 | checksum        | 34 |
| 12 | end marker      | fc |


h3. more details about the bytes

* Byte 1-2 of 12: length
quite many bit/bytes for length, are there more details hidden?
<pre>
fe00 = 12bytes
fe01 = 16bytes
fe02 = 20bytes
fe03 = 24bytes
fe04 = 28bytes
fe05 = 32bytes
fe06 = 36bytes
fe07 = 40bytes
ff00 =  8bytes
</pre>
* Byte 6 of 12 seems to be a sequence number, if I do it right after booting the chip it starts with 01
* Byte 11 of 12: checksum 
* Byte 12 of 12: end marker contains fc


h3. sequence 0 receiving

<pre>
Ready to switch protocol!
Sending unknown bytes!
Read 12 bytes:
[0000]   FE 00 FD 40 00 00 F1 B1   12 20 67 FC               ........ ..g.
</pre>

h3. sequence 7,8 receiving, sending unknown string seq 01

<pre>
Sending this string:
"\xfe\x00\xfd\x6f\x3a\x01\x00\x00\x00\x00\x34\xfc"
many times makes some other string appear on the serial port, sequence 7,8.
</pre>