Reverse engineering

The analysis this project is built on: the A/C’s RS-485 protocol, the stock dongle’s firmware, and how an A/C advertises which features it has. Read this if you want to port the work to another Hisense unit, or to check the claims rather than take them on trust.

---

Table of contents

• Hardware
• The vendor firmware's Matter interface
• RS-485 A/C protocol (the bus reference)
• Cloud endpoints and firewalling
• The community tables: where the payload map started
• Firmware update paths and custom-firmware feasibility
• Impersonating the cloud: feasibility
• Stock command builders: what the vendor module puts in a 0x65 frame
• Stock firmware: initialisation and A/C-bus communication
• Device type and model capabilities
• Stock firmware: how a received bus frame is accepted or rejected
• Stock firmware feature map
• Open questions