Decoding fault in Huabao (JT808) protocol

sb_sthlm3 days ago

Hello

I'm slowly learning this awesome thing but I have one error that I think is related to a error of some sort in the decoder. Every hour when in hibernate the device sends a battery status message but the decoder seems to be having trouble reading it so it disconnects and connects the device every time. And also the time synchronization seems to be having problem.

From what I understand when the device is asking the server for something it expects a answer with the id of the question in it.
When the device requests server time (0109) the server responds with the time, but in the response it does not include the devices "question id" so the device asks 3 times total and then seems to give up.

Here are the logs.

2025-02-19 17:05:07  INFO: [T965f8a76: huabao > 95.193.14X.XX] 7e80010005035350409856000003940200009f7e
2025-02-19 17:10:07  INFO: [T965f8a76: huabao < 95.193.14X.XX] 7e0002000003535040985603951a7e
2025-02-19 17:10:07  INFO: [T965f8a76: huabao > 95.193.14X.XX] 7e80010005035350409856000003950002009e7e
2025-02-19 17:15:07  INFO: [T965f8a76: huabao < 95.193.14X.XX] 7e021000070353504098560396642502200115077d027e
2025-02-19 17:15:07  WARN: [T965f8a76] error - readerIndex(14) + length(100) exceeds writerIndex(22): UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 14, widx: 22, cap: 23) - IndexOutOfBoundsException (... < HuabaoProtocolDecoder:976 < *:291 < ExtendedObjectDecoder:73 < ... < WrapperContext:102 < ... < WrapperInboundHandler:56 < ...)
2025-02-19 17:15:07  INFO: [T965f8a76] disconnected
2025-02-19 17:15:07  INFO: Event id: 035350409856, time: 2025-02-19 17:15:07, type: deviceOffline, notifications: 0
2025-02-19 17:15:10  INFO: [T3369a3f9] connected
2025-02-19 17:15:10  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e0102000c03535040985603983033353335303430393835361c7e
2025-02-19 17:15:10  INFO: Event id: 035350409856, time: 2025-02-19 17:15:10, type: deviceOnline, notifications: 0
2025-02-19 17:15:10  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e8001000503535040985600000398010200927e
2025-02-19 17:15:10  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e10070004035350409856039940000000477e
2025-02-19 17:15:10  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e01090000035350409856039a1f7e
2025-02-19 17:15:10  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e81000007035350409856000007e90213110f0ae37e
2025-02-19 17:15:20  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e01090000035350409856039b1e7e
2025-02-19 17:15:20  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e81000007035350409856000007e90213110f14fd7e
2025-02-19 17:15:30  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e01090000035350409856039c197e
2025-02-19 17:15:30  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e81000007035350409856000007e90213110f1ef77e
2025-02-19 17:20:30  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e00020000035350409856039d127e
2025-02-19 17:20:30  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e800100050353504098560000039d000200967e
2025-02-19 17:25:32  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e00020000035350409856039e117e
2025-02-19 17:25:32  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e800100050353504098560000039e000200957e
2025-02-19 17:30:31  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e00020000035350409856039f107e
2025-02-19 17:30:31  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e800100050353504098560000039f000200947e
2025-02-19 17:35:32  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e0002000003535040985603a02f7e
2025-02-19 17:35:32  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e80010005035350409856000003a0000200ab7e
2025-02-19 17:40:32  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e0002000003535040985603a12e7e
2025-02-19 17:40:32  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e80010005035350409856000003a1000200aa7e
2025-02-19 17:45:32  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e0002000003535040985603a22d7e
2025-02-19 17:45:32  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e80010005035350409856000003a2000200a97e
2025-02-19 17:50:33  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e0002000003535040985603a32c7e
2025-02-19 17:50:33  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e80010005035350409856000003a3000200a87e
2025-02-19 17:55:34  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e0002000003535040985603a42b7e
2025-02-19 17:55:34  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e80010005035350409856000003a4000200af7e
2025-02-19 18:00:34  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e0002000003535040985603a52a7e
2025-02-19 18:00:34  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e80010005035350409856000003a5000200ae7e
2025-02-19 18:05:35  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e0002000003535040985603a6297e
2025-02-19 18:05:35  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e80010005035350409856000003a6000200ad7e
2025-02-19 18:10:35  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e0002000003535040985603a7287e
2025-02-19 18:10:35  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e80010005035350409856000003a7000200ac7e
2025-02-19 18:15:16  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e0210000703535040985603a864250220021516527e
2025-02-19 18:15:16  WARN: [T3369a3f9] error - readerIndex(14) + length(100) exceeds writerIndex(22): UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 14, widx: 22, cap: 22) - IndexOutOfBoundsException (... < HuabaoProtocolDecoder:976 < *:291 < ExtendedObjectDecoder:73 < ... < WrapperContext:102 < ... < WrapperInboundHandler:56 < ...)
2025-02-19 18:15:16  INFO: [T3369a3f9] disconnected
2025-02-19 18:15:16  INFO: Event id: 035350409856, time: 2025-02-19 18:15:16, type: deviceOffline, notifications: 0
2025-02-19 18:15:18  INFO: [T742b1766] connected
2025-02-19 18:15:18  INFO: [T742b1766: huabao < 95.193.14X.XX] 7e0102000c03535040985603a93033353335303430393835362d7e
2025-02-19 18:15:18  INFO: Event id: 035350409856, time: 2025-02-19 18:15:18, type: deviceOnline, notifications: 0

And here is the reason i think the device is looking for the "question id" in the answer:
https://files.imettax.com/products/protocols/JTT808_Protocol_Message_Examples.pdf

 "[7E]identification": 126,
 "[8100]Message ID": 33024,
 "[000f]Message body properties": 15{
 "[bit15~bit14]Reserved": 0,
 "[bit13]Subcontracting": false,
 "[bit10~bit12]Data encryption": "None", 
 "[bit0~bit9]Message body length": 15
 },
 "[070061952865]Terminal phone number": "070061952865",
 "[1A61]Message serial number": 6753,
 "[04FA00303730303631393532383635]Message body": {
 "[04FA]Answer the serial number": 1274,
 "[00]result": 0,
 "[303730303631393532383635]Authentication code": "070061952865"
 },
 "[B0]Check code": 176,
 "[7E]identification": 126
}

so the answer from the server should in this case be (* is used to mark it out):

2025-02-19 17:15:10  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e01090000035350409856*039a*1f7e
2025-02-19 17:15:10  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e81000007035350409856*039a*07e90213110f0ae37e

but it is, as you se in the logs:

2025-02-19 17:15:10  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e81000007035350409856*0000*07e90213110f0ae37e

This is as far as I have come to explore this and now I need help with the next step. It this a issue with my devices implementation of JT808 or is it the server decoding that needs to be updated/expanded?

Anton Tananaev2 days ago

We would need to check the protocol documentation, not examples.

sb_sthlm2 days ago

Here is one upload of the protocol: https://www.roadragon.com/uploads/JT808-protocol.pdf

If i read it correctly I can see in 8.6 Terminal registration response that it should respond with the "The serial number of the corresponding terminal registration message", as in my example.
It looks like its in all response-message I'v looked at in the protocol.

Anton Tananaev2 days ago

Here's the breakdown I've done manually:

Device to Server:

7e - header
0002 - message id
0000 - message body length
035350409856 - device id
039e - message serial number
11 - checksum
7e - footer

Server to Device:

7e - header
8001 - message id
0005 - message body length
035350409856 - device id
0000 - message serial number
039e - response serial number (matches message serial number)
0002 - response id (matches message id)
00 - result (success)
95 - checksum
7e - footer

As you can see, the response serial number matches the one from the device, so it is correct and valid response, according to the documentation.

sb_sthlm2 days ago

Yes, but its not the 8001 response I having trouble with, its the 8100 as in my example. But I realized I marked the wrong part. I marked the messege id, but actually the response id is missing complete. Or am I decoding the response wrong?

2025-02-19 17:15:10  INFO: [T3369a3f9: huabao < 95.193.14X.XX] 7e01090000035350409856*039a*1f7e
2025-02-19 17:15:10  INFO: [T3369a3f9: huabao > 95.193.14X.XX] 7e810000070353504098560000*07e90213110f0ae37e

Is not 039a supposed to be between the message serial number and the date?

7e		header
8100		message id
0007		body lenght
035350409856	device
0000		msg serial (why is it always 0?)
*039a*		response serial id should be here
07e9		2025		
02		02
13		19
11		17
0f		15
0a		10	(2025-02-19 17:15:10)
e3		checksum
7e		footer
Anton Tananaev2 days ago

But that's not what the device is getting stuck on. I'm looking at the log and it sends message 0002 in a loop, not 0109.

sb_sthlm2 days ago

The 0002 is the heartbeat and that is working. The decoder is getting stuck on the 0210 every hour and disconnects the device. I just copied in a full hour to show that its repeating.

When it then connects again right away it sends the request to synchronize the time with the server which is the 0109, it tries 3 times and then stops asking.
So there is two problems.

  1. The server seems to disconnect the device on 0210.
  2. When connected the device can´t grab the server time as the 8100 is not responding with the id from the request.

The main problem is no 1. No 2 is not a big deal really I got it working by just adding the timezone-attribute to the device instead.

sb_sthlm2 days ago

I just got the JT808 protocol from the manufacturer and it is a newer version i think: https://drive.google.com/file/d/130rs3VYKC7LxWBkRfjuXkzBRYJA7cYFP/view?usp=sharing

So maybe the 0210 is not supported yet in the decoder?

sb_sthlm2 days ago

I found the https://github.com/traccar/traccar/blob/master/src/main/java/org/traccar/protocol/HuabaoProtocolDecoder.java and i seems that the message codes are in there. But it seams to be crashing on the 0210.

As for the problem no 2.
In this newer version of the protocol it says that 0109 is supposed to receive a 8109 response. In my log it looks like the server is sending a 8100 response , but it is formatted as a 8109, so maybe that's why the device is not accepting it?

I'm really not good with coding, and never used Java so I'm way over my head and really appreciate the help :)

Anton Tananaev2 days ago

Why would it send heartbeat every 10 seconds? I think you're trying very hard to find some issue on the server side and ignoring some obvious issue with the device.

Anton Tananaev2 days ago

Actually I see it's every 5 minutes, but it still doesn't make sense why device doesn't report any other data when heartbeat is working.

Anton Tananaev2 days ago

In general there seems to be some messages that are not supported currently, so probably the decoder needs to be updated to handle those.

sb_sthlm2 days ago

The car is just parked. When moving it sends every 30 seconds and that is working as I should.

The function is that when the ACC is off it sends a heartbeat every five minutes and every hour it sends a status of the battery status.

Okey, so probably it’s a newer version of the protocol than what’s supported and that’s why the decoder gets an error and disconnects the device?

sb_sthlm2 days ago

As the messages seem to be in the decoder already, should I post a Issue on github so someone with more skills than me hopefully can update the decoder to support them fully?

Anton Tananaev2 days ago

There are three options:

  • Implement it yourself and send us a pull request
  • Submit a feature requests and wait for us to prioritize it
  • Sponsor the implementation