Decoded cmd 0x6E (HEX data for LCD pgm) and Module/0xE6 cmd key input bug & 0x1B conflict
CMD 0x6E, panel send it after entering programming section which contain saved HEX data, for example *5 user code programming/communications programming etc.
 ```
Byte2: bits 4-7: Digit 1	Byte2: bits 0-4: Digit 2
Byte3: bits 4-7: Digit 3	Byte3: bits 0-3: Digit 4
Byte4: bits 4-7: Digit 5	Byte4: bits 0-3: Digit 6
Byte5: bits 4-7: Digit 7	Byte5: bits 0-3: Digit 8
Byte6: probably CRC
2156.17: 01101110 0 00010000 00000000 00000000 00000000 01111110 [0x6E] Unknown data //100000
 2256.52: 01101110 0 00000001 00000000 00000000 00000000 01101111 [0x6E] Unknown data //010000
 2318.87: 01101110 0 00000000 00010000 00000000 00000000 01111110 [0x6E] Unknown data //001000
 2395.04: 01101110 0 00000000 00000001 00000000 00000000 01101111 [0x6E] Unknown data //000100
 2426.32: 01101110 0 00000000 00000000 00010000 00000000 01111110 [0x6E] Unknown data //000010
  127.57: 01101110 0 10101010 10101010 00000000 00000000 11000010 [0x6E] Unknown data //AAAA00
Entering section 301 (first phone number, 32 characters):
 1179.67: 01101110 0 11010000 11111111 11111111 11111111 00111011 [0x6E] Unknown data //D0FFFFFF
 1179.75: 11111111 1 10100101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //send by keypad after receiving and reading 8digits from 0x0A above. Decoded in Pull request
 1179.80: 01101110 0 11111111 11111111 11111111 11111111 01101010 [0x6E] Unknown data //FFFFFFFF
 1179.89: 11111111 1 10100101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //send by keypad after receiving and reading 8digits from 0x0A above. Decoded in Pull request
 1179.94: 01101110 0 11111111 11111111 11111111 11111111 01101010 [0x6E] Unknown data //FFFFFFFF
 1180.02: 11111111 1 10100101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //send by keypad after receiving and reading 8digits from 0x0A above. Decoded in Pull request
 1180.08: 01101110 0 11111111 11111111 11111111 11111111 01101010 [0x6E] Unknown data //FFFFFFFF
 1180.32: 00000101 0 10000001 11101101 10010001 11000111 10010001 11000111 10010001 11000111 [0x05] Partition 1: Ready Backlight - Input 32 digits | Partition 2: disabled | Partition 3: disabled | Partition 4: disabled
```


I noticed that sometimes when I input keys, I get "Unknown data" instead of partition and which key was pressed. The actual key data is on 0xE6 byte3, doesnt matter for which partition. Byte2 is 0xFF every time when 0xE6 cmd send keys.
```
 1328.46: 11111111 1 00000101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: 1 
 1179.61: 11111111 1 11111111 10100101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 1 on partition 1
 1055.41: 11111111 1 00001111 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x05] Partition 1 Key: 3 
 1142.07: 11111111 1 11111111 00001111 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 3 on partition 1
 1142.65: 11111111 1 00000000 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: 0 
 1056.31: 11111111 1 11111111 00000000 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 0 on partition 1
 2660.80: 11111111 1 11111111 11111111 11111111 11111111 11111111 11111111 00010110 11111111 [Module/0x05] Partition 3 Key: 5 
 2660.29: 11111111 1 11111111 00010110 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 5 partition 3
```
EDIT: It seems that CMDs 0x27, 0x2D and 0x3E also carries key data, it seems to be on Byte2 bits2+:
```
 6112.62: 00001010 0 10000000 10011110 00000000 00000000 00000000 00000000 00000000 00101000 [0x0A] Backlight - Enter * function code | Zone lights: none
 6112.72: 11100110 0 00100000 10000000 10011110 00000000 00000000 00000000 00000000 10000000 10100100 [0xE6.20] Status lights: Backlight - Enter * function code | Zone lights: none
 6112.82: 00000101 0 10000000 10011110 00010000 11000111 00010000 11000111 00010000 11000111 [0x05] Partition 1: Backlight - Enter * function code | Partition 2: disabled | Partition 3: disabled | Partition 4: disabled
 6112.83: 11111111 1 00010110 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x05] Partition 1 Key: 5 
 6112.91: 11111111 1 11111111 11111111 11111111 11111011 11111111 11111111 11111111 11111111 [Module/0x05] Keypad zone notification 
 6112.91: 00000101 0 10000000 10100101 00010000 11000111 00010000 11000111 00010000 11000111 [0x05] Partition 1: Backlight - Enter master code | Partition 2: disabled | Partition 3: disabled | Partition 4: disabled
 6113.01: 11010101 0 10101010 10101010 10101010 10101010 10101010 10101010 10101010 10101010 [0xD5] Keypad zone query
 6113.01: 11111111 1 11111111 11111111 11111111 11111111 11111111 11111111 11111111 00001111 [Module/0xD5] Keypad Slot 8: Zone open
 6113.09: 00100111 0 10000000 10100101 00010000 11000111 00100010 01000101 [0x27] Partition 1: Backlight - Enter master code | Partition 2: disabled | Zones 1-8 open: 2 6 
 6113.10: 11111111 1 00000101 11111111 11111111 11111111 11111111 11111111 [Module/0x27] Unknown data  //Should be Key: 1
 6113.18: 00101101 0 10000000 10100101 00010000 11000111 00000000 00101001 [0x2D] Partition 1: Backlight - Enter master code | Partition 2: disabled | Zones 9-16 open: none 
 6113.18: 11111111 1 00001010 11111111 11111111 11111111 11111111 11111111 [Module/0x2D] Unknown data //should be key: 2
 6113.24: 00110100 0 10000000 10100101 00010000 11000111 00000000 00110000 [0x34] Partition 1: Backlight - Enter master code | Partition 2: disabled | Zones 17-24 open: none 
 6113.32: 11111111 1 00001111 11111111 11111111 11111111 11111111 11111111 [Module/0x3E] Unknown data //should be key: 3
 6113.33: 00111110 0 10000000 10100101 00010000 11000111 00000000 00111010 [0x3E] Partition 1: Backlight - Enter master code | Partition 2: disabled | Zones 25-32 open: none 
 6113.39: 00100111 0 10000000 10100101 00010000 11000111 00100010 01000101 [0x27] Partition 1: Backlight - Enter master code | Partition 2: disabled | Zones 1-8 open: 2 6 
 6113.85: 11111111 1 00010001 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x05] Partition 1 Key: 4 
 6113.92: 01100100 0 00000110 01101010 [0x64] Partition 1 | Beep: 3 beeps
```

While we talk about unknown key data, I found some more, this one related to start of broadcasting keypad labels. After keypad send that key, all keypads on system became unresponsive and accepts label broadcasting information. Key output decoded in _PR_.
```
  446.54: 11111111 1 10010100 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //lcd5500 label broadcast announced, disables all keypads on system
  459.14: 11111111 1 01010011 01111001 01110011 01110100 01100101 01101101 00100000 00100000 00100000 00100000 00100000 00100000 00100000 00100000 [Module/0xA0] Unknown data //label broadcast finish
```


Noticed something weird after entering *1/*2 or *3 menu. Doesnt matter if *1/*2/*3 access code required is enabled/disabled in section [022]. It seems keypad send 0x75 key back to the panel (sometimes even few times in row). Included in _PR_.
```
 3019.19: 00000101 0 10000000 10100010 10010001 11000111 10010001 11000111 10010001 11000111 [0x05] Partition 1: Backlight - *3: Alarm memory | Partition 2: disabled | Partition 3: disabled | Partition 4: disabled
 3019.26: 11111111 1 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x05] Partition 1 Key: //key 0x75
 3019.34: 00001010 0 10000000 10100010 00000000 00000000 00000000 00000000 00000000 00101100 [0x0A] Backlight - *3: Alarm memory | Zone lights: none
 3019.43: 11100110 0 00100000 10000000 10100010 00000000 00000000 00000000 00000000 10000000 10101000 [0xE6.20] Status lights: Backlight - *3: Alarm memory | Zone lights: none
 3019.44: 11111111 1 11111111 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 0x75
 3019.51: 11111111 1 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //key 0x75
 3019.59: 11111111 1 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //key 0x75

 3080.60: 00001010 0 10000000 10100001 10001101 00000000 00000000 00000000 00000000 10111000 [0x0A] Backlight - *2: Trouble | Zone lights: 1 3 4 8 
 3080.67: 01011101 0 00010000 00000000 00000000 00000000 00000000 01101101 [0x5D] Partition 1 | Status lights flashing: Trouble | Zones 1-32 flashing: none
 3080.75: 11100110 0 00011000 00000001 00010000 00000000 00000000 00000000 00000000 00001111 [0xE6.18] Partition 1 | Status lights flashing: Trouble | Zones 33-64 flashing: none
 3080.83: 11111111 1 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0x0A] Partition 1 Key: //key 0x75

 3126.83: 10100101 0 00100000 01101010 01100001 10001010 01100110 00000000 10000000 [0xA5] 2020.10.19 01:34 | Partition 1 | *1: Zone bypass programming
 3126.92: 00001010 0 10000000 10100000 00000000 00000000 00000000 00000000 00000000 00101010 [0x0A] Backlight - *1: Zone bypass | Zone lights: none
 3127.01: 11100110 0 00100000 10000000 10100000 00000000 00000000 00000000 00000000 10000000 10100110 [0xE6.20] Status lights: Backlight - *1: Zone bypass | Zone lights: none
 3127.01: 11111111 1 11111111 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 0x75
 3127.18: 11111111 1 11111111 01110101 11111111 11111111 11111111 11111111 11111111 11111111 11111111 [Module/0xE6] Unknown data //key 0x75
 3127.44: 00000101 0 10000000 10100000 10010001 11000111 10010001 11000111 10010001 11000111 [0x05] Partition 1: Backlight - *1: 
```


0x1B cmd conflict: I have found that when keypad goes idle (after 30sec), it send 0x05 byte7 bit3 for "Keypad going idle notification" and in 0x1B cmd afterwards on byte4 it show on which partition keypad goes idle.
Probably that notifications are send because when keypad goes idle, it goes to partition assigned in [000] section so panel answers with [0x5D] or similar command which contains partion status. I didnt noticed anything keypad-slot related. 0x05 "Unknown notification" renamed in _PU_ to "Keypad idle notification" as it seems "Unknown" was only related for bit3.
```
cmd 0x05 byte7 bit3: Keypad going idle notification, 0x5D send afterwards
cmd 0x1B byte4 bits0-7: On which partition 1-8 keypad goes idle

 5056.11: 11111111 1 11111111 11111111 11111111 11111111 11111111 11110111 11111111 11111111 [Module/0x05] Unknown notification  //Keypad idle notification
 5056.19: 11111111 1 11111111 11111111 11111110 11111111 11111111 11111111 11111111 11111111 [Module/0x1B] Module tamper notification //Keypad on Partition 1 goes idle
 4823.37: 11111111 1 11111111 11111111 11111111 11111111 11111111 11110111 11111111 11111111 [Module/0x05] Unknown notification  //Keypad idle notification
 4823.45: 11111111 1 11111111 11111111 11111101 11111111 11111111 11111111 11111111 11111111 [Module/0x1B] Unknown data //Keypad on partition 2 goes idle
 5155.07: 11111111 1 11111111 11111111 11111111 11111111 11111111 11110111 11111111 11111111 [Module/0x05] Unknown notification  //Keypad idle notification
 5155.15: 11111111 1 11111111 11111111 11110111 11111111 11111111 11111111 11111111 11111111 [Module/0x1B] Wireless module battery notification //Keypad on partition 4 idle
```


Just for reference, when I enter *8 programming on pc1832 from partition other than 1 I constantly get unknown data stream from cmds 0xE6.21, 0x0F, 0xE6.01, 0xE6.02 (probably something similar as 0x0A cmd is for partion1):
```
11465.81: 11100110 0 00100001 10000010 11100100 00000000 00000000 00000000 00000000 10000000 11101101 [0xE6.21] Unknown data //constant stream when in *8 programming from partition 2
11465.98: 00001111 0 10000010 11100100 00000000 00000000 00000000 00000000 00000000 01110101 [0x0F] Unknown data //constant stream while being in *8 programming from partition 2
11547.26: 11100110 0 00000001 10000010 11100100 00000000 00000000 00000000 00000000 00000000 01001101 [0xE6.01] Unknown data //constant stream while being in *8 programming from partition 3
11547.34: 11100110 0 00000001 10000010 11100100 00000000 00000000 00000000 00000000 10000000 11001101 [0xE6.01] Unknown data //constant stream while being in *8 programming from partition 3
11633.13: 11100110 0 00000010 10000010 11100100 00000000 00000000 00000000 00000000 00000000 01001110 [0xE6.02] Unknown data //constant stream while being in *8 programming from partition 4
11633.21: 11100110 0 00000010 10000010 11100100 00000000 00000000 00000000 00000000 10000000 11001110 [0xE6.02] Unknown data //constant stream while being in *8 programming from partition 4
```

Found that 0xC3 command isn't just for keypad status but for dialer aswell. Byte2 bits 3 and 4, previously mark as unknown.
Each time when panel attempt to dial, 0xC3 byte2 is 0x18 and when dialer end calling byte2 is 0x10. Decoding included in _PR_.
```
 1461.47: 11000011 0 00010000 11111111 11010010 [0xC3] Unknown data //Dialer call ended
 1517.67: 11000011 0 00011000 11111111 11011010 [0xC3] Unknown data //Dialing attempt
```

I've also decoded 0x8D and partly 0x94 CMDs, which is used for communication with Wireless module expander. I'll open a seperate issue with log output and decoding for that to keep it clean from here - its already enough stuff included here.