AMS Michal

I did manage to make it work. The details are not yet clear though as it seems that the hub is calculating the checksum bits itself, and the port value only needs to include the other 12 bits.

This may be not so well hidden as the boost color sensor reports an output mode called "IR Tx" with the following specs: 90842b0e7cad Port 01, mode 7, name IR Tx 90842b0e7cad Port 01, mode 7, RAW min 0, max 65535 90842b0e7cad Port 01, mode 7, PCT min 0, max 100 90842b0e7cad Port 01, mode 7, SI min 0, max 65535 90842b0e7cad Port 01, mode 7, SI symbol N/A 90842b0e7cad Port 01, mode 7, Value 1 x 16bit, Decimal format 5.0 The value is 16bit which is exactly the PF IR code size. I will try it out once I have some spare time.

I looked for text contained in the firmware files (they are not compressed or encrypted), and found one thing mildly interesting. There seems to be a table of port modes for 'analog' devices. The position in the table seem to coincide with device ids for known analog components given in the LWP public documentation: 0x0001 Motor 0x0002 System Train Motor 0x0005 Button 0x0008 LED Light It is not certain if the devices which do not exist yet can be recognized by the firmware, but it may be worth checking if different resistances on the id lines would trick the firmware to report these devices. name value format raw min/max pct min/max unit min/max unit? mapping? 0 01000400 0.00 1023.00 0.00 100.00 0.00 1.00 00000000 00000000 1 LPF2-MMOTOR 01000400 -100.00 100.00 -100.00 100.00 -100.00 100.00 00000000 00001000 (Motor) 2 LPF2-TRAIN 01000400 -100.00 100.00 -100.00 100.00 -100.00 100.00 00000000 00001800 (System Train Motor) 3 LPF2-TURN 01000400 -100.00 100.00 -100.00 100.00 -100.00 100.00 00000000 00001000 4 LPF2-POWER 01000400 -100.00 100.00 -100.00 100.00 -100.00 100.00 00000000 00001800 5 LPF2-TOUCH 01000100 0.00 1.00 0.00 100.00 0.00 1.00 00000000 00100000 (Button) 6 LPF2-LMOTOR 01000400 -100.00 100.00 -100.00 100.00 -100.00 100.00 00000000 00001000 7 LPF2-XMOTOR 01000400 -100.00 100.00 -100.00 100.00 -100.00 100.00 00000000 00001000 8 LPF2-LIGHT 01000100 0.00 1.00 0.00 100.00 0.00 1.00 00000000 00001400 (LED Light) 9 LPF2-LIGHT1 01000100 -100.00 100.00 -100.00 100.00 0.00 2.00 00000000 00001400 10 LPF2-LIGHT2 01000100 0.00 1.00 0.00 100.00 0.00 1.00 00000000 00001400 11 LPF2-TPOINT 01000100 0.00 1.00 0.00 100.00 0.00 1.00 00000000 00001000 12 LPF2-EXPLOD 01000100 0.00 1.00 0.00 100.00 0.00 1.00 00000000 00001000 13 LPF2-3.PART 01000400 -100.00 100.00 -100.00 100.00 -100.00 100.00 00000000 00001000 14 LPF2-UART 01000400 0.00 1023.00 0.00 100.00 0.00 1.00 00000000 00000000 Based on the values I am guessing that all those devices except for the binary button are output only.