{"id":515,"date":"2025-07-08T22:34:38","date_gmt":"2025-07-08T14:34:38","guid":{"rendered":"https:\/\/darcyjprojects.xyz\/?p=515"},"modified":"2026-01-01T15:00:15","modified_gmt":"2026-01-01T07:00:15","slug":"reverse-engineering-a-cheap-sht30-rs485-modbus-sensor","status":"publish","type":"post","link":"https:\/\/darcyjprojects.xyz\/index.php\/2025\/07\/08\/reverse-engineering-a-cheap-sht30-rs485-modbus-sensor\/","title":{"rendered":"Reverse Engineering a Cheap SHT30 RS485 Modbus Sensor’s Protocol"},"content":{"rendered":"
\n
\"\"
Figure 1. <\/strong>SHT30 RS485 Sensor “zts-3008-ws-n01”<\/figcaption><\/figure>\n<\/div>\n\n\n

Introduction<\/h2>\n\n\n\n

I recently picked up a very affordable SHT30 temperature and humidity sensor from AliExpress <\/a>to use with my STM32 RS485 Modbus embedded controller project. I chose this particular unit because it had a built-in DIN-rail mount, communicated via Modbus RTU over RS485, and was a great candidate for testing hybrid master\/slave communication on my controller.<\/p>\n\n\n\n

As you might expect with ultra-budget hardware, documentation was practically non-existent – and that turned out to be the main challenge.<\/p>\n\n\n\n

While digging around<\/a>, I came across a GitHub repository<\/a> linked in a YouTube video<\/a>, which referenced a similar model number that was printed on the sensor (zts-3008-ws-n01). That repo included a copy of the manufacturer\u2019s Windows configuration tool, which I used to successfully read and write the sensor\u2019s baud rate and slave ID.<\/p>\n\n\n\n

However, I’m not a big fan of using black-box software from an unknown source, so I decided to listen to the serial communications to work out what was going on behind the scenes.<\/p>\n\n\n\n

Reverse Engineering<\/h2>\n\n\n\n

I used a serial port sniffer<\/a> on Windows to capture communication between the configuration tool and the sensor. What I found was a simple 7-byte command protocol (not standard Modbus RTU) that wraps baud\/slave configuration into a minimal frame.<\/p>\n\n\n\n

\"\"
Figure 2. <\/strong>Serial communication captured between the manufacturers software and the sensor<\/figcaption><\/figure>\n\n\n\n

What I found<\/h2>\n\n\n\n

The device accepts a custom 7-byte frame that looks like:<\/p>\n\n\n\n