So if you’ve read the previous you’ll know we were a little stuck. After a break and re-reading a few bits AND a chat with a developer we have progress. I’m not decoding the Protobuf yet, I may not even do that as I now have a potential solution, but as we left it we didnt know WHAT we were looking at. So let’s go back to that handshake…

0x94 0x3C 0x00 0x06 0x18 0xA7 0xF8 0xCE 0xE3 0x02

We already have bytes 0 – 3 so 0x18 Should be our ID. Looking for this in the source wasnt getting anywhere fast. I had at this point read up on Protobuff including how VarINTs work and found all manner of conflicting info. After a dev told me exactly what was going on it clicked. Looking at this page we can see that the tag isnt a simple number. I has read this twice and failed to register it.

So our feild ID is indeed 0x18. Referring to that page we can see that we need to do a few things first. Firstly we need to look at MSB and see if it’s set. if it is, the next byte is going to contain more bits, in our case it isnt. The web page above explains how this works and how VarINTs work.
So in binary we have 0001 1000
We need to lop the MSB off then, this gives us 001 1000. I’m not 100% sure for the tag this is strictly needed.
Now, the bit I failed to register/ The tag contains a “wire” type. This defines what the data actually is, again, the linked page explains this. our “wire” type is 0, which is a VarINT. Now we shift the whole lot right three bytes, this gives us 0011 which is 3.

Looking at mesh.pb.h this corresponds to Radio_want_config_id which makes perfect sense. The reply of 0x1A also makes sense:

0x1A = 0001 1010
This decodes as wire type “LEN” which imnplies the packet contains more data and tag FromRadio_my_info, basically what we asked for.

So we can start working out what we are dealing with now. The missing bit was the from/to radio packets which gives us a context to use the definitions in the source code. Let’s add a decoder for the tag in and see what happens…