ModbusTCP: Reverse engineering without having any documents of client(master)

Question

Concept

we have a ship simulator(client) and Modbus controller(Server). Our goal is to develop an emulator(like controller) on my PC. But we have no information about the client(simulator).

Progress

• Firstly we checked the actual outputs from the controller(server). There are 7 different variables like engine telegraph, rudder angle and so no.
• Secondly, I checked the register numbers of the controller, which store command values. It was from 0 to 7.

Polling server with Modpoll software installed server:

• I checked the register type. It was a holding register

• I wrote a script to develop a Server like a controller with pymodbus Server. I can not only write specific values on the holding register from 0 to 7, but also there are proper handshake and responses to the simulator(client)

Problem

• Client sends a request for reading with register numbers from 256. It means that my Server responds with zero values not with the command values written on the registers from 0 to 7. But the problem is that the simulator(client) shows the changes of the parameters on its Graphical user interface.

Screen shot from wireshark - it shows that clinet(simulator) sends a request with register nuumber from 246:

• Client sends a request not only for reading but also for writing and the writing request overwrite the values written by Server (PC).

Question

1. how is it possible that the simulator receives the command signal by requesting different register numbers? client must send a request with register numbers from 0 to receive command signals.

2. I cannot understand why the client writes first before reading values from Server. This read request overwrites the values written by Server (pc). The Server (controller or pc) is to send a command signal to the simulator. I have no idea why the simulator first writes some values on sever and read it.

Please advise on this issue.

Best regards Byeon seongsu.