Reverse engineer of APC UPS serial protocol

Question

I have a APC SMC1000-2UC UPS device that has a serial port to connection. The serial port protocol seems that is based on microlink protocol which has not documented. I monitored the communication of the UPC and PC witch UPS deriver has been initialed. I want to detect command of UPS such as shutdown command by a microcontroller-based device. Some information of "https://sites.google.com/site/klaasdc/apc-smartups-decode" site is compatible with things I observed. but calculation of frame checksum and Challenge string calculation don't pass. Data length of protocol has been set to 32 bytes, So each frame has 35 bytes.

[Msg ID | 32 byte data | 2 byte checksum]

Regarding calculation of challenge frame, the UPS send 0x65 frame ID then 0x68 frame ID, after that the PC response with 0x65 frame ID and UPS send confirmed frame by 0x65 frame ID. based on presented calculation, I think format or Position of Password_1, Header data and two bytes of that has been changed as the protocol has been configured to 32 bytes data. The following frame are a sample of this challenge:

Header frame: 0x00 0a206903fa27090001004000f802fe04fe0940fc1042fc1044fc20f80416fc10 32a6

UPS : 0x65 ffff00010000a0e80000 c0bbb4e1 000001040000001000000004000000000020 7350

UPS : 0x68 000000000000000000000008004c2943000000000966039a063b675601f30000 864f

PC : 0x65 0a 04 8afb65f1 bdf0

UPS : 0x65 ffff000100000eaf62d8 8afb65f1 000001040000001000000004000000000020 6227

How can I satisfy the challenge and checksum type? I try many type of checksum for that data but they not correct.

Answer 1

It may be a bit late, but have you looked at this:

https://github.com/klaasdc/apcups-serial-test

This looks like somebody got pretty far reverse engineering the MicroLink protocol, including the checksum part. The GitHub repo also contains a link to a web page with a protocol description.