I caught a living ES400 and did a record on its logic states, as far as I had my process DIO0 of my record (yellow line) seems to be CAN low @250khz, DIO2 seems t be some kind of CAN hight but due to the fact that I can just set the threshold for all channels in common on my logic analyzer it can't interpret the CAN high 1 and 0 levels correctly because CAN High has different levels and I was running out of time for a second run because someone else was already ringing for the scooter
I had to upload my records outside the forum because they got too big to be uploaded here due to the high sample rates of 5Msamples/s. So here's the link:
https://www.file-upload.net/download-13 ... h.rar.html
It is compressed with Winrar, no PW and also includes pictures from the process. To open the record files use Waveforms that can be downloaded from Digilents website, it will run in demo mode without a piece of Digilents hardware attached but all decoder functions are available on the green little plus button even when the program sometimes is a pain in the *ss to use by zooming in and scroll left/right. I you need measuring cursors take the buttons in the upper right corner of the logic window. Have much fun with decoding, I'll use my next few days to build a data logger that can be installed inside a living ES400 to sniff the signal they're using to unlock the battery compartment when changing the battery as soon as I found out what protocol the board in the lock mechanism speaks And now let the race for the first unlocks begin If you got questions let me know.