Who wants to learn more about KIB?

[Suburbazine]

So I took the opportunity to relieve a junkyard of one of the rare, impossible to acquire KIB interfaces that might actually demystify their system functions a bit. It does not disappoint! Far from being the mysterious black box that KIB would prefer everyone believe it to be, it has some rather humble and wonderfully accessible internals:


It's a fun little Raspberry Pi 3 running bone-stock Raspbian Lite!

KIB has a nicely designed daughter board for V-bus and power conversion. It also has CANbus connections but I'm not sure on the capabilities yet:


Due to the wonderful engineers at KIB who secretly support open systems, I obtained root access with extreme ease! What's more, it natively gives me a realtime log of ANY V-bus activity (and internal server logging) along with clearly described addressing:


More to come as I figure out how to start bending the Heartland addressing to line up with Newmar's stuff and eventually figure out how to redesign the web UI for remote control. Looks like they wrote it all in Visual Studio. First step will be to entirely liberate the unit from needing to interface with KIB for remote control. Depending on how obfuscated things are this might be an impossible or very complicated task though.

 

[Rich W.]

Staying tuned…this is way above my skill level but interesting anyway

 

[Suburbazine]

Things learned in first 30 minutes:

HVAC control schema is universal, fully works for Newmar
Some lighting commands are universal (global on/off)
Tank levels are universal (missing pump control)

 

[SteveMA]

most interested

 

[Kitesquid]

I too am VERY interested!

I am very glad Suburbazine has taken this on as I am not a programmer but would love to have a way to control my KIB system from my android phone!!!!!

 

[MemoriesByTheMile]

Following…

 

[JRW-NAW]

Following

 

[Neemer]

Lost af.

 

[Knobs]

Due to the wonderful engineers at KIB who secretly support open systems,

Is this another way of saying...

Due to the unethical engineers at KIB who leak their employers proprietary information...?

 

[Suburbazine]

Is this another way of saying...

Due to the unethical engineers at KIB who leak their employers proprietary information...?

No, it's because KIB is so proprietary there's nobody to go "hey, that looks like an insecure way of doing things." This is almost certainly part of why they made this module so impossibly hard to acquire if you weren't a Heartland owner.

At least their Azure implementation doesn't seem to have any glaring holes so far.

 

[Jim]

Well, it's over my head as well. But interesting for sure.

 

[Suburbazine]

Well, it's over my head as well. But interesting for sure.

In simpler words, if you picked up one of these from a junkyard you could just plug it into your existing KIB based coach (Super Star, Dutch Star, etc) and have immediately usable functions to some extent. It wouldn't be too far to call it the $50 alternative to a Micro-Air thermostat, as it can interface with the KIB touchscreen from anywhere in the coach.

 

[Suburbazine]

Lots of traffic happening on KIB-Net, think most of it is generated by the KIB-Touch panel though. Looks like it rings out both tank and HVAC settings every 3 seconds or so under the "StVV" tag. Light pads are tagged under "StRU", "SwVU" and "SwSV". There's an immense amount of setting confirmation happening, every action has an echo on the bus. (I think Flyboy had found some items that didn't echo, though?). GENI is the KIB-NET daughterboard ID.

Bus log snippet:

2023-03-09 14:39:28.579 GENI RECEIVED: StVV 3 50 322 300
2023-03-09 14:39:28.579 StVV 3 50 322 300
2023-03-09 14:39:32.834 GENI SENT: SwVU 0 0 4000000
2023-03-09 14:39:32.877 GENI RECEIVED: $SwSV 0 0 4000000
2023-03-09 14:39:32.894 GENI SENT: SwVU 0
2023-03-09 14:39:32.916 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:32.987 GENI RECEIVED: StVV 1 50 349 300
2023-03-09 14:39:32.988 StVV 1 50 349 300
2023-03-09 14:39:33.391 GENI RECEIVED: StVV 1 50 333 300
2023-03-09 14:39:33.392 StVV 1 50 333 300
2023-03-09 14:39:33.392 StVV 3 50 322 300
2023-03-09 14:39:33.660 GENI RECEIVED: StVV 3 50 322 300
2023-03-09 14:39:33.676 GENI RECEIVED: StVV 3 50 322 300
2023-03-09 14:39:33.676 StVV 3 50 322 300
2023-03-09 14:39:33.687 GENI RECEIVED: StVV 0 0 0 300
2023-03-09 14:39:33.687 StVV 0 0 0 300
2023-03-09 14:39:33.933 GENI SENT: PgMap 0 160
2023-03-09 14:39:33.967 GENI RECEIVED: PgMap 0 0160
2023-03-09 14:39:33.984 Preparing to change the home page.
2023-03-09 14:39:33.985 Setting home page to 352
2023-03-09 14:39:34.039 GENI SENT: StRU 0
2023-03-09 14:39:34.061 GENI RECEIVED: $
2023-03-09 14:39:35.010 GENI SENT: SwVU 0 0 4000000
2023-03-09 14:39:35.042 GENI RECEIVED: $
2023-03-09 14:39:35.053 GENI RECEIVED: $SwSV 0 0 4000000
2023-03-09 14:39:35.114 GENI SENT: SwVU 0
2023-03-09 14:39:35.138 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:35.162 GENI RECEIVED: StVV 19 452 120 b06 ff17 ff03 ff09 ff04
2023-03-09 14:39:35.163 StVV 19 452 120 b06 ff17 ff03 ff09 ff04
2023-03-09 14:39:35.174 GENI SENT: SwVU 0 0 4000000
2023-03-09 14:39:35.218 GENI RECEIVED: $SwSV 0 0 4000000
2023-03-09 14:39:35.535 GENI SENT: SwVU 0
2023-03-09 14:39:35.557 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:35.937 GENI SENT: SwVU 0 0 8000000
2023-03-09 14:39:35.980 GENI RECEIVED: $SwSV 0 0 8000000
2023-03-09 14:39:36.314 GENI SENT: SwVU 0
2023-03-09 14:39:36.339 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:37.574 GENI SENT: SwVU 0 0 8000000
2023-03-09 14:39:37.619 GENI RECEIVED: $SwSV 0 0 8000000
2023-03-09 14:39:37.638 GENI SENT: SwVU 0
2023-03-09 14:39:37.669 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:38.743 GENI RECEIVED: StVV 3 50 322 300
2023-03-09 14:39:38.747 StVV 3 50 322 300
2023-03-09 14:39:40.102 GENI RECEIVED: StVV 1 50 333 300
2023-03-09 14:39:40.103 StVV 1 50 333 300
2023-03-09 14:39:41.174 GENI SENT: SwVU 0 0 8000000
2023-03-09 14:39:41.216 GENI RECEIVED: $SwSV 0 0 8000000
2023-03-09 14:39:41.534 GENI SENT: SwVU 0
2023-03-09 14:39:41.556 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:42.854 GENI SENT: SwVU 0 0 4000000
2023-03-09 14:39:42.899 GENI RECEIVED: $SwSV 0 0 4000000
2023-03-09 14:39:42.974 GENI SENT: SwVU 0
2023-03-09 14:39:42.998 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:43.338 GENI SENT: SwVU 0 0 4000000
2023-03-09 14:39:43.380 GENI RECEIVED: $SwSV 0 0 4000000
2023-03-09 14:39:43.827 GENI RECEIVED: StVV 3 50 322 300
2023-03-09 14:39:43.832 StVV 3 50 322 300
2023-03-09 14:39:44.114 GENI SENT: SwVU 0
2023-03-09 14:39:44.139 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:44.504 GENI SENT: SwVU 0 0 4000000
2023-03-09 14:39:44.549 GENI RECEIVED: $SwSV 0 0 4000000
2023-03-09 14:39:44.564 GENI SENT: SwVU 0
2023-03-09 14:39:44.588 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:44.624 GENI SENT: SwVU 0 0 4000000
2023-03-09 14:39:44.669 GENI RECEIVED: $SwSV 0 0 4000000
2023-03-09 14:39:44.984 GENI SENT: SwVU 0
2023-03-09 14:39:45.007 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:45.404 GENI SENT: SwVU 0 0 4000000
2023-03-09 14:39:45.448 GENI RECEIVED: $SwSV 0 0 4000000
2023-03-09 14:39:45.467 GENI SENT: SwVU 0
2023-03-09 14:39:45.490 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:45.524 GENI SENT: SwVU 0 0 4000000
2023-03-09 14:39:45.567 GENI RECEIVED: $SwSV 0 0 4000000
2023-03-09 14:39:45.584 GENI SENT: SwVU 0
2023-03-09 14:39:45.607 GENI RECEIVED: $SwSV 0
2023-03-09 14:39:46.020 GENI SENT: SwVU 2
2023-03-09 14:39:46.043 GENI RECEIVED: $SwSV 2
2023-03-09 14:39:46.065 GENI SENT: SwVU 0
2023-03-09 14:39:47.216 GENI RECEIVED: $StVV 1 50 333 300

Some tag translations:

COMMAND_PING = "j 50 01 ";
RETURN_NEWLINE = "\r\n";
SWITCH_STATUS_PWM_IBRIDGE = "SwPV";
SWITCH_STATUS_IBRIDGE = "SwSV";
STATUS_VALUES_IBRIDGE = "StVV";
SWITCH_STATUS_REQUEST = "SwVU";
SWITCH_PWM_REQUEST = "SwPU";
SWITCH_FAULT_IBRIDGE = "SwFV";
PAGE_TIMER_RESPONSE = "PgTimer";
LOCKOUT_TIMER_RESPONSE = "TLock";
WIDGET_ENABLE_BYTE_RESPONSE = "WEbyte";
PASSCODE_RESPONSE = "PCode";
FLOAD_RESPONSE = "fload";
DEVICE_PIN_IBRIDGE = "BTuid";
DEVICE_NAME_IBRIDGE = "BTssid";
PAGE_MAP_IBRIDGE = "PgMap";

I have obtained live V-bus monitoring via SSH, still working on command injection though:

 

[Jim]

Quick question, did you say that this can all be monitored from a cell phone?

 

[Suburbazine]

Quick question, did you say that this can all be monitored from a cell phone?

The user-facing side can be monitored from a cell phone, if you either have bluetooth connection to the module, or if you have connected the module to wifi. For Newmar, you'll at least have access to HVAC and Tank controls if you have a model with a KIB-Touch instead of Silverleaf.

 

[Jim]

OK, more specifically, can I monitor the temps inside the coach from a restaurant across town?

 

[Suburbazine]

OK, more specifically, can I monitor the temps inside the coach from a restaurant across town?

Yes. Granted, your phone app will think you are connecting to a Heartland trailer and you'll have an account at KIB that says you're the owner of said trailer

But if you have a London Aire you should be Silverleaf based, right? Not sure this will be very beneficial to you if KIB isn't already interfaced with the AC via the touch panel.

 

[flyboy013]

@Suburbazine Thanks for the heads up. Now that’s a good find! Did you already make a copy of the sdcard for backup purposes?

If I recall there’s a “keepalive” sent on the network about every 3 seconds. Curious if it’s called something different. Content is hex BE 21 C3.

Let me know if I can be of assistance.

 

[Suburbazine]

@Suburbazine Thanks for the heads up. Now that’s a good find! Did you already make a copy of the sdcard for backup purposes?

If I recall there’s a “keepalive” sent on the network about every 3 seconds. Curious if it’s called something different. Content is hex BE 21 C3.

Let me know if I can be of assistance.

Yes, I have 2 versions backup actually - one from 4/22 and one from 1/23. It had an update as soon as I connected to it.

Fun discovery - Heartland owners who boondock in the wilderness without internet access... Lose remote control over Bluetooth. KIB has made the remote control app 100% dependent on their Azure server to function. Getting the interface free of such limitations is my main goal.

 

[flyboy013]

Oh the questions!! What does the daughter card look like? I assume it’s a HAT plugged into the 40 pin GPIO header? Do you know what pins it uses. Does it make sense to reverse engineer the HAT? build a compatible one? I already have a KIB remote solution, but willing to assist here. Actually let me know if you want to chat on the phone. Lots of questions. Can provide lots of insight.