Open brucekinsey opened 1 month ago
Hi! Sorry I didn't see this until now when I was reviewing my emails. Idk what's up with GitHub and not sending me notifications through firebase.
Anyways, how this integration works is by sending raw binary data to the http devices to control other devices on the Bluetooth LE mesh.
The cloud API is used only to get what devices have been added to your account and some basic info about them. The API data will help a bit, but until I can see what the cync app sends to the cloud to control the thermostat and how the thermostat is responding to the cloud, I won't be able to add support for it.
ATM, doing a debug session is quite technical. Socat is limited due to it not differentiating messages from each device to the cloud. So what you want to do is, set up a socat session for only the thermostat and the cync app on your phone.
If you are using unbound as your DNS server, you can do "selective" DNS spoofing to only hijack the thermostat and your phone based on their static IP. That way, only the thermostat, app and cloud will be logged in socat. If you do network wide DNS spoofing, all cync devices will be logged in socat and it will be very hard to pick out and follow what data we need.
The other option is to do network wide DNS spoofing but disconnect all other http cync devices from the network or remove power from them, so only the thermostat,l and your phone will be proxied through socat to the cloud.
Are you comfortable setting up a debug session to do that? How do you manage DNS on your network?
I am working on a debugging script that will do this all without socat and make it much easier to send me debug logs, but the DNS spoofing will always be required.
No worries, I'd gotten a tad busy w/ IRL stuff since I submitted.
Yeah, I'm good to do that. I'll do network wide DNS spoofing, since the thermostat is the only http Cync device I've got. The others are just the thermostat sensor buttons, but those are BLE only.
Once I've setup a socat session and have it working as intended, what datapoints should I start generating? Is there a way to insert what's been done on either the app or the device, besides denoting times and chunking out the logs by the timestamps?
Reason I ask is b/c there's a lot of potential data to send and receive via the app:
I've only debugged bulbs and led controllers so far without much extra info. My best advice would be to see how the data flows. More than likely you'll need to inject a comment I to the logs saying what command you sent and how the device responded using timestamps.
A huge pita, but I don't really see any other way.
I figured as much, but wasn't sure.
I'll work on this over the next couple of weeks. Hopefully I'll get some time in the next few days to run down the basic stats and settings for it. Any specifics on uploading the logs or info I need to sanitize before doing so?
When the device or cync app first connects to the cloud API, it will send your access code and some other unknown data. It would be good to sanitize that. I can't recall if any other sensitive data is passed during an active session, but I don't think so.
I'll be starting work soon on a python script that will do what socat does, just in a way that will make debugging devices much easier. It's been a bit since I had to debug the raw data between cloud and devices, but I may be doing it soon to try and get more reliable functionality out of cync-lan. Im sure there is more data in there, just need to make sense of it and decode.
Is your feature request related to a problem? Please describe. Currently, thermostats aren't supported. I've auth'd the Cync API and would love to at least pull the current stats of my thermostat and the thermostat buttons.
Describe the solution you'd like To help. I'll provide any data I can and try testing it out.
I'm moderately skilled in coding, so looking through and understanding the smali isn't super difficult. I'm just not familiar with the networking and packet crafting portions.
Describe alternatives you've considered There aren't any that I'm aware of.
Additional context It's defined as a "ThermostatGen1", from the unpacked apk's "/smali/com/gelighting/cbygekit/product/DeviceType$ThermostatGen1.smali"
If it's of any help here's the api data I've gathered on it (some data sanitized obv).
The user endpoint provides:
[ { "subscribe_date": "2024-07-31T21:53:39.62Z", "is_active": true, "role": 0, "last_login": "", "active_code": "active_code", "active_date": "2024-07-31T21:53:39.59Z", "groups": "", "mcu_version": 0, "firmware_version": 0, "source": 5, "mac": "96A743204038", "product_id": "1607d2ad150cb2001607d2ad150cb201", "access_key": access_key, "name": "Name", "authorize_code": "auth_code", "id": id, "is_online": false }, { "subscribe_date": "2024-08-01T01:56:30.447Z", "is_active": true, "role": 0, "last_login": "2024-10-17T14:47:02.148Z", "firmware_mod": "1", "active_code": "active_code", "active_date": "2024-07-31T22:11:52.530Z", "groups": "", "mcu_version": 28, "firmware_version": 12118, "source": 1, "mac": "786DEBCE1F83", "mcu_mod": "1", "product_id": "1607d4c03a0800011607d4c03a08de0b", "access_key": 777, "name": "786DEBCE1F83", "authorize_code": "auth_code", "id": 285763815, "is_online": true, "sn": "786DEBCE1F83" } ]
The device property endpoint provides:
{ "musicShows": [], "bulbsArray": [ { "hvacSystem": { "changeoverMode": 0, "auxHeatStages": 1, "auxFurnaceType": 1, "stages": 1, "furnaceType": 1, "type": 2, "powerLines": 1 }, "occupancyDeactivationPeriod": 0, "lightRingBrightness": 0, "displayName": "Thermostat", "loadSelection": 255, "showOnHome": false, "lightRingColor": 0, "mac": "786DEBCE1F84", "ambientLightEnable": false, "temperatureUnit": "F", "firmwareVersion": "1.2.118", "occupancySensitivity": 0, "occupancyEnable": false, "followTheSun": false, "deviceType": 224, "wifiDisconnectIndicatorEnable": false, "fadeOff": 0, "switchID": 285763815, "wifiSsid": "wifi_iot", "allowOTAUpdates": false, "deviceID": dev_id, "commissionedDate": "2024-08-01T01:56:30Z", "fadeOn": 0, "defaultBrightness": 0, "wifiMac": "786DEBCE1F83", "lightRingMode": 0, "ambientLightSensitivity": 0, "simpleModeEnabled": false, "occupancyTimeoutPeriod": 0, "thermostatSensors": [ { "pin": "025572", "name": "Living Room", "type": "savant" }, { "pin": "044604", "name": "Bedroom Sensor", "type": "savant" }, { "pin": "022724", "name": "Thermostat sensor 3", "type": "savant" } ] } ], "lightShows": [], "admin": { "emailAddress": "email", "lastUseDate": "2024-07-31T17:53:39.157Z", "userID": user_id, "createDate": "2024-07-31T17:53:39.157Z", "username": "My Name" }, "groupsArray": [], "lastUseDate": "2024-07-31T17:53:39.158Z", "version": "1.0", "autoOtaEnabled": true, "system": { "app": { "build": "14325", "name": "Cync", "bundleID": "com.ge.cbyge1", "version": "6.16.1" }, "ltk": "can_provide_don't_know_if_obfuscation_needed", "timeInfo": { "sunrise": "7:00:00 PM", "sunset": "7:03:58 PM", "timeZone": "America/New_York" }, "platform": { "os": "iOS", "machine": "N/A", "model": "iPhone", "localizedModel": "iPhone", "version": "18.1" } }, "standaloneDevicesArray": [], "geoLocation": { "zipCode": "zip", "latitude": lat "longitude": long }, "sceneArray": [], "schedules": [], "multiColorSchemes": [], "createDate": "2024-07-31T17:53:39.158Z" }