Melbourne BG SCS Train Timetable 
21Aug/1810
INTERLINK – Reverse-Engineering the Protocol
I've recently been playing with INTERLINK. Firstly, it was between two real machines, but then I managed to get DOSbox to talk to another DOSbox instance and a real physical PC. From here, there was a thought... why need DOSbox to host the INTERLINK server when I could possibly emulate the conversation and then create an app that'd work on all versions of Windows (or other OS') and then allow easier serial transfers to older equipment.
This post will be a work in progress for quite a while. I'll be updating it as I find time to work through the 'conversation' between the hosts... I might also spend a little time on reversing the actual source of INTERLINK itself.
Snooping in on the Conversation
As per the previous post, I created a quick .NET app to listen in to the serial conversation. This was done via the help of Eltima's Virtual Serial Port Driver. A pair of virtual ports was created and DOSbox was hooked onto one side. From here, I hooked my app onto the other side of the virtual pair and then into the real physical port. A real computer was then hooked onto the end of that port. You could also use two DOSbox instances here, along with two pairs of virtual ports.
You can download the source of my serial snooping app here.
The Conversation
This is where it now gets a LOT harder. Below shows the client (green/left) talking to the DOSbox server (blue/right). From the conversation, the client works out what drives are shared: A: and C: to D: and E:.
| A: and C: | A:, C: and D: |
|---|---|
|
0xAA
Hello?
Hi!
0x00
0x55
0xFF
0x5A
0x11
0x80
0x7B
0x02 0x00 0x00 0x5D 0x03
0x80
0x81
0x7A
0x22 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x01 0x01 0x00 0x00 0x01 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xD9 0x73 0x50 0x42 0xAA 0x8D 0x75 0x72 0x1F 0x12
0x81
0x02
0xFD
0x02
0x04 0x82
0x79
0x21 0x00 0x00 0x00 0x00 0x00 0x00 0x0A 0x01 0x01 0x00 0x01 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xF7 0x0C 0x71 0xEA 0xB0 0x04
0x82
0x03
0x83
0x78
0x24 0x01 0x01 0x00 0x16 0x06 0x03 0x03 0xFF 0xFF 0xFF 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0x95 0x6E
0x83
0x00
0x80
0x7B
0x57 0x01 0x0A 0x16 0x06 0x06 0xFF 0xFF 0xFF 0x00 0x02 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xC2 0x08 0xC2 0x08 0xC2 0x08 0x42 0x28 0x42 0x28 0x42 0x28 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xF2 0x73
0x80
0x01
0x81
0x7A
0x02 0x1C 0x00 0x1B 0x1D
0x81
0x02
0x82
0x79
0x17 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xD5 0x2F
0x82
0x03
0x83
0x78
0x02 0x1C 0x02 0x3B 0x5F
0x83
0x00
0x80
0x7B
0x17 0x28 0x32 0x36 0x38 0x4D 0x62 0x29 0x00 0x00 0x00 0x4D 0x53 0x2D 0x44 0x4F 0x53 0x5F 0x36 0x00 0x00 0x00 0x00 0x00 0xCA 0xC7
0x80
0x01
Other side receives drive D:\ 0xFC
Ping
Pong
0xFC
0xFC
Ping
Pong
0xFC
0xFC
Ping
Pong
0xFC
|
0xAA
Hello?
Hi!
0x00
0x55
0xFF
0x5A
0x11
0x80
0x7B
0x02 0x00 0x00 0x5D 0x03
0x80
0x81
0x7A
0x22 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x01 0x01 0x00 0x00 0x01 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xD9 0x73 0x50 0x42 0xAA 0x8D 0x75 0x72 0x1F 0x12
0x81
0x02
0xFD
0x02
0x04 0x82
0x79
0x21 0x00 0x00 0x00 0x00 0x00 0x00 0x0A 0x01 0x01 0x00 0x01 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xD9 0x73 0x50 0x42 0xAA 0x8D 0x75 0x72 0x28 0xD6
0x82
0x03
0x83
0x78
0x24 0x01 0x01 0x00 0x16 0x06 0x03 0x03 0xFF 0xFF 0xFF 0x00 0x02 0x03 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0x77 0xE9
0x83
0x00
0x80
0x7B
0x57 0x01 0x0A 0x16 0x06 0x07 0xFF 0xFF 0xFF 0x00 0x02 0x03 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xFE 0xC2 0x08 0xC2 0x08 0xC2 0x08 0xC2 0x08 0x42 0x28 0x42 0x28 0x42 0x28 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xF4 0x61
0x80
0x01
0x81
0x7A
0x02 0x1C 0x00 0x1B 0x1D
0x81
0x02
0x82
0x79
0x17 0x00 0x35 0x33 0x36 0x4D 0x62 0x29 0x00 0x00 0x00 0x00 0x53 0x2D 0x44 0x4F 0x53 0x5F 0x36 0x00 0x00 0x00 0x00 0x00 0x00 0x23
0x82
0x03
0x83
0x78
0x02 0x1C 0x02 0x3B 0x5F
0x83
0x00
0x80
0x7B
0x17 0x28 0x32 0x36 0x38 0x4D 0x62 0x29 0x00 0x00 0x00 0x4D 0x53 0x2D 0x44 0x4F 0x53 0x5F 0x36 0x00 0x00 0x00 0x00 0x00 0xCA 0xC7
0x80
0x01
0x81
0x7A
0x02 0x1C 0x03 0x2B 0x7E
0x81
0x02
0x82
0x79
0x17 0x28 0x35 0x33 0x36 0x4D 0x62 0x29 0x00 0x00 0x00 0x00 0x53 0x2D 0x44 0x4F 0x53 0x5F 0x36 0x00 0x00 0x00 0x00 0x00 0x78 0xF4
0x82
0x03
0xFE
Ping
Pong
0xFE
0xFE
Ping
Pong
0xFE
0xFE
Ping
Pong
0xFE
|
The grey boxes are my annotations for what I believe is occurring. More will be added as I work it all out.
Random Photos
Search
Tags
6029
A-Train
AirBNB
Amiga
Amiga 1200
Apple
Arduino
Australia
c#
C64
Code / Electronics
Compaq Deskpro
DCC
Europe
Freight
Hawksburn
Japan
JR East
JR West
Layout
Melbourne
N Scale
Osaka
Parallel Port
Prototypes
Quadra 950
SCSI
serial
Shin-Osaka Station
Shinkansen
Shin Osaka
SL
Sony
South Yarra
Spain
Suita
Tokyo
Travel
Twilight Express
UX
UX490N
V/Line
Vaio
Victoria
x86
Ads
Links - Click for details
- Abandoned Rails (Japan)
- AIRLINE (Shinkansen Photography)
- Akihabara Station
- annexpressのブログ
- Australian Model Railway Magazine
- ＤＣＣ普及協会ホームページ (Japanese DCC)
- Dead Section (Japanese Track Diagrams)
- Delicious Things (Japanese N Scale DCC)
- Densha Wotorou
- Digital Direct for Windows (DCC Server)
- Don's Dream World – AMAZING N Scale Japanese Layout
- Hatena::Diary
- Japanese N-Scale Modeling Forum
- JR Chiisai
- Kaz-T's blog レインボーライン (Rainbow Line)
- LED Resitance Calculator
- Masioka
- Poppondetta Blog
- RailFan Magazine, Japan
- Railmind
- Railway Travelers' Room
- Serenity Valley
- Shashinka Ichiban
- Shuzuku
- Sumida Crossing
- The next station is…
- Tomix N Gauge Track and Japanese N Gauge Trains
- TT Forums (Transport Tycoon Deluxe)
- 名鉄尾西線の貨物列車 (Nagoya: Meitetsu Freight)
- 日本型Nゲージ DCC改造例のご紹介 (Okiraku DCC)
- 泰 茅 轍 道 (Taichi Railway)
- 箱庭登山鉄道製作記 (Hakone-Tozan Layout Blog)
Archive
- November 2024
- September 2024
- August 2024
- July 2024
- June 2024
- May 2024
- April 2024
- March 2024
- February 2024
- December 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- December 2022
- November 2022
- October 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- November 2021
- September 2021
- August 2021
- July 2021
- May 2021
- March 2021
- February 2021
- January 2021
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- May 2020
- April 2020
- March 2020
- January 2020
- December 2019
- November 2019
- October 2019
- September 2019
- August 2019
- July 2019
- June 2019
- April 2019
- March 2019
- February 2019
- January 2019
- December 2018
- November 2018
- October 2018
- September 2018
- August 2018
- July 2018
- June 2018
- May 2018
- April 2018
- March 2018
- January 2018
- December 2017
- November 2017
- October 2017
- September 2017
- August 2017
- July 2017
- June 2017
- May 2017
- March 2017
- February 2017
- January 2017
- December 2016
- November 2016
- October 2016
- September 2016
- August 2016
- July 2016
- June 2016
- May 2016
- February 2016
- November 2015
- October 2015
- September 2015
- August 2015
- July 2015
- June 2015
- May 2015
- April 2015
- March 2015
- February 2015
- January 2015
- December 2014
- November 2014
- August 2014
- July 2014
- May 2014
- April 2014
- March 2014
- December 2013
- November 2013
- October 2013
- June 2013
- August 2012
- April 2012
- March 2012
- February 2012
- November 2011
- October 2011
- September 2011
- July 2011
- June 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- October 2010
- September 2010
- August 2010
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- August 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- July 2008
May 1st, 2022 - 07:52
I can see an Arduino based Interlink server on the horizon if you could somehow emulate the data packets. Keep up with this interesting project!
May 1st, 2022 - 16:47
That’s an awesome idea. I think it’d be easier searching for the source code tho! Disassembling/snooping traffic will take way too long.
May 5th, 2022 - 07:31
Yeah, I agree. Have you tried snooping output from the command for “INTERSVR.EXE /RCOPY”
This uses some kind of serial comms to copy the INTERSVR.EXE and INTERLNK.EXE through a NULL modem cable to another computer. The receiving computer needs the command “MODE COM1:2400,N,8,1,P” to receive these files. I’m not too skilled at reverse engineering 16-bit DOS executables and your efforts, so far, is the only low level info I have found on the net for the interlink programs.
April 6th, 2023 - 02:53
Any progress in reversing so far?
April 6th, 2023 - 10:44
Unfortunately not. It’d nearly be something to throw at AI nowadays. Plug in a Co-Pilot that can learn the lingo.
April 6th, 2023 - 11:51
See if you manage to get on hold this one:
https://www.scientific.net/AMR.1037.435
February 14th, 2024 - 22:39
Have a look at this: https://github.com/sarahemm/ruby-interlnk
August 2nd, 2024 - 08:11
Very nice! Someone was bound to reverse it eventually.
August 2nd, 2024 - 04:58
wink wink, nudge nudge…
https://github.com/verner002/ms-dos-6.0/tree/master/c6ers/interlnk
August 2nd, 2024 - 08:12
Oh woah! The whole DOS 6.0 source code? Assembler? Very nice… It’d still be cool to spin up a windows client.