Preserve the capture boundary and direction
Begin with an authorized capture and record transport direction, endpoint role, timestamp and TCP sequence context. Redact terminal identifiers, coordinates and business payloads while preserving byte length. A single TCP segment is not necessarily one application frame: one frame can span segments and one segment can carry multiple frames. Reassemble bytes by connection and sequence before looking for 0x7e boundaries.
Treat each delimiter pair as a candidate. Retain incomplete trailing bytes for the next stream chunk and account for capture loss and retransmission. A candidate should not enter field decoding until its escaped content, declared body length and checksum are internally consistent.
Unescape before checksum and field offsets
Remove the outer 0x7e delimiters and reverse reserved-byte escaping. Header, body and transmitted BCC are then visible in their logical byte sequence. Calculate XOR across the unescaped header and body, excluding the received BCC. Escaping happens after BCC generation for transmission, so checking the escaped wire bytes produces a different result whenever reserved values occur.
A BCC mismatch proves byte inconsistency but does not locate it. Compare the exact byte range on sender and receiver, inspect lost or duplicated TCP bytes and verify that delimiters and the received check byte were excluded. Save a known payload containing both 0x7e and 0x7d as an escape/checksum regression vector.
Let header attributes choose the layout
Read message ID and the two-byte body-property word first. Body length, encryption, subpackage and version flags determine the remaining common header. Legacy and version-flagged headers use different terminal-identifier widths, while subpackaging adds total-package and package-index fields. A fixed offset can therefore shift the body and still produce plausible-looking values.
Compare calculated header length plus declared body length with the logical bytes before BCC. If they differ, stop. Confirm the licensed edition and project profile rather than selecting whichever layout makes the sample fit. Preserve leading zeros in packed BCD identifiers and inspect protocol-version bytes explicitly.
Decode 0x0200 in layers
The 0x0200 base body is 28 bytes containing alarm, status, latitude, longitude, altitude, speed, direction and BCD time. Interpret coordinates with their scale and the hemisphere bits in status. Position validity, GNSS state and vehicle state provide necessary context; a numeric coordinate alone is not proof of a valid fix.
Bytes after the base body form optional extra-information records. Validate each ID-length-value boundary and stop on truncation. Name only IDs confirmed for the edition and vendor profile; retain unknown values as raw hex. Compare location time and state with a controlled terminal event rather than unrelated platform data.
Turn failures into regression samples
For each confirmed defect, keep a redacted input, expected boundary, decoded header, BCC and relevant body fields. Pair it with one deliberately damaged sample that fails for the intended reason. This prevents a later parser change from making a corrupt frame appear valid while preserving coverage across versions and optional layouts.
- Reassemble transport bytes before application framing.
- Unescape before calculating BCC or body offsets.
- Select header layout from flags and licensed edition.