Energienetze steiermark landis+gyr e450 HDLC DSLM decoding

I hope this info helps other people in Styria, Austria that want to read out their smart meters.

More info from the nework provider can be found by searching for "e-netze kundenschnittstelle" (https://www.e-netze.at/downloads-data/pdf.aspx?pdf=EN_Update%20Kundensc…). You will need to get your GUEK and GAK keys. I got mine by registering in the web portal and activating the customer interface

Every 10 seconds, data is given out via the M-Bus (RJ12 port, pins 3 and 4) at 2400 Baud, 8N1 or 8E1

For me it looks like this (332 bytes)
7EA08BCEFF0313EEE1E6E700E0400001000077DB084C475A6773D4CBB382010330000561F54E02DC841E962DCB834E5030BB5A9DEF7EAE7DC4ACC8691DD10A5848913723281FEB0A8D3916A244CBF0BFC432BC9F0BFD7379B1F61E215A4216E0489F0B485D1C46C90B9EB79A9C82EBC14973026109AAF02B73906CCF865203F91EF109C0740B081429CE97DC7E7EA08BCEFF0313EEE1E040000200007A40AAE72E241553FFE1C63669691B3C72A16688FA7467A4A48DA8EC7CF93AB3084CFEBADB37FFCDD17FEF2DBB7C754B80DD4FE56594BBA00A6A4149E39A6E6D36CEB94DAFC51F693CDEEF45377899D098FEAC9409129646872B2517294893BB827597F1886F4DD6CE2776FD7F54A1315256E9A708C02C07D12CE4D83D7E7EA030CEFF031386F8E0C0000300001FED3BFAE14A2D8DB53965CC242CAC9A49001D5FAF0E79CD03180410689CDD4780417E

It consists of 3 HDLC messages (each start and stop with 7E)
7EA08BCEFF0313EEE1E6E700E0400001000077DB084C475A6773D4CBB382010330000561F54E02DC841E962DCB834E5030BB5A9DEF7EAE7DC4ACC8691DD10A5848913723281FEB0A8D3916A244CBF0BFC432BC9F0BFD7379B1F61E215A4216E0489F0B485D1C46C90B9EB79A9C82EBC14973026109AAF02B73906CCF865203F91EF109C0740B081429CE97DC7E

7EA08BCEFF0313EEE1E040000200007A40AAE72E241553FFE1C63669691B3C72A16688FA7467A4A48DA8EC7CF93AB3084CFEBADB37FFCDD17FEF2DBB7C754B80DD4FE56594BBA00A6A4149E39A6E6D36CEB94DAFC51F693CDEEF45377899D098FEAC9409129646872B2517294893BB827597F1886F4DD6CE2776FD7F54A1315256E9A708C02C07D12CE4D83D7E

7EA030CEFF031386F8E0C0000300001FED3BFAE14A2D8DB53965CC242CAC9A49001D5FAF0E79CD03180410689CDD4780417E

Each containing a PDU block
DB084C475A6773D4CBB382010330000561F54E02DC841E962DCB834E5030BB5A9DEF7EAE7DC4ACC8691DD10A5848913723281FEB0A8D3916A244CBF0BFC432BC9F0BFD7379B1F61E215A4216E0489F0B485D1C46C90B9EB79A9C82EBC14973026109AAF02B73906CCF865203F91EF109C0740B081429CE

40AAE72E241553FFE1C63669691B3C72A16688FA7467A4A48DA8EC7CF93AB3084CFEBADB37FFCDD17FEF2DBB7C754B80DD4FE56594BBA00A6A4149E39A6E6D36CEB94DAFC51F693CDEEF45377899D098FEAC9409129646872B2517294893BB827597F1886F4DD6CE2776FD7F54A1315256E9A708C02C07D12CE4

ED3BFAE14A2D8DB53965CC242CAC9A49001D5FAF0E79CD03180410689CDD47

Putting these together we get the full PDU block
DB084C475A6773D4CBB382010330000561F54E02DC841E962DCB834E5030BB5A9DEF7EAE7DC4ACC8691DD10A5848913723281FEB0A8D3916A244CBF0BFC432BC9F0BFD7379B1F61E215A4216E0489F0B485D1C46C90B9EB79A9C82EBC14973026109AAF02B73906CCF865203F91EF109C0740B081429CE40AAE72E241553FFE1C63669691B3C72A16688FA7467A4A48DA8EC7CF93AB3084CFEBADB37FFCDD17FEF2DBB7C754B80DD4FE56594BBA00A6A4149E39A6E6D36CEB94DAFC51F693CDEEF45377899D098FEAC9409129646872B2517294893BB827597F1886F4DD6CE2776FD7F54A1315256E9A708C02C07D12CE4ED3BFAE14A2D8DB53965CC242CAC9A49001D5FAF0E79CD03180410689CDD47

in this example
4C475A6773D4CBB3 is the system title
0103 is the length. corresponds to 259 bytes after the "0103"
so it seems to be valid

this full PDU block can be deciphered in the Gurus DLMS Translator program tool
- enter your PDU block on the PDU tab
- enter your "system title", "block cipher key"(GUEK) and "authentication key"(GAK) on the ciphering tab
- go back to the PDU tab and click file->PDU to XML

XML data should be displayed

helpful website that explains PDU block structure
https://www.weigu.lu/tutorials/sensors2bus/04_encryption/index.html