Update on the Keypad LCD sniffer:
I was able to decode the lcd display on a full message keypad by soldering wires to the lcd data lines. It uses a HD44780 protocol in 4 bit mode. Therefore to interface the complete lcd you need E, RW, RS, DB4, DB5, DB6, DB7. However since I am not concerned about when the keypad is reading or attempting to read from the lcds ddram yet, R/W can be ignored. I originally thought of using the R/W pin to actively read the ddram but my concern would be if you read at the same time the keypad wrote there would be a conflict or you would miss the data. If the keypad makes use of the busy flag to check before it writes it could still be possible, but for now its safer to just passively sniff the data.
This is what the signal looks like under a logic analyzer. You can see the built in HD44780 decoder, is reading “\x80System is \xC0Ready to Arm”. RW = white, RS = purple, E = brown, DB4-7 = red/orange/yellow/blue. The \x80 and \xC0 codes are likely internal register instructions to clear the screen and drop to the next line as the RS line is low when that data is written.
I then modifed some HD44780 decoder code in Arduino IDE to have an ESP32 sniff the data and print it to the Serial Output.
Here is two outputs from my ESP32 showing Ready to Arm and a Zone fault by opening the deck door.
Getting the data into Home Assistant is the next task to figure out, but at least this shows you can remotely access the keypad display’s information to create a virtual display in software.
Here is another screenshot of my serial monitor after adding a bit of code to format the output to mimmick a 16x2 display.
