W-MBUS protocol reading in APATOR water meters - encryption and documentation

The discussion focuses on reading W-MBUS (Wireless M-Bus) protocol data from Polish water meters, particularly those manufactured by APATOR. Users report significant variability in frame lengths and note that APATOR employs AES-128 encryption (AES CBC mode) on most or all data fields, except for frame headers and CRC. The AES key for new overlays is often set to 16 zero bytes by default, but suppliers typically do not share encryption keys or detailed protocol documentation, citing security and anti-tampering concerns. Physical access and interference with the overlay hardware may allow key extraction, but this is complex and legally sensitive. Some users have reverse-engineered parts of the frame structure, identifying standard W-MBUS fields (SOF, length, CField, MField, AField, CIField) and manufacturer-specific data blocks containing encrypted consumption and status information. Tools used include ADEUNIS USB WMBUS dongles, RTL-SDR receivers, and software such as Inkasent PC3 and open-source projects like wmbusmeters on GitHub. The SPIRIT1 and CC1101 radio chips are commonly found in overlays. Other manufacturers like BMeters provide OMS-compliant frames, which are easier to interpret. Attempts to read APATOR meters with alternative radio modules (e.g., RFM22, RFM69) and LoRaWAN networks are ongoing. Some users develop custom software APIs in Python and C for frame decoding. Overall, the community faces challenges due to encryption, proprietary data formats, and limited manufacturer cooperation, but progress is made through reverse engineering and open-source tools.
Summary generated by the language model.