search

dnandha / miauth

Authenticate and interact with Xiaomi devices over BLE
GNU Affero General Public License v3.0
28 stars 10 forks source link

Handle Value Notification (UART) decode logic not working #10

Open letoth opened 2 years ago

letoth commented 2 years ago

First of all fantastic job you made with miauth! it works with Xiaomi HOTO smart kitchen scale too :) However after successful state 5, the scale sends notifications which I am not able to decode anyhow..... tried your UART decode logic, but it does not work :(

Could you please have a quick look, and you might be able to guess how to decode the values ? see the attached log

hoto1.log

dnandha commented 2 years ago

@letoth That's awesome. Thanks for testing miauth with your device!

The UART log you got from the HOTO device looks quite rudimentary: First two bytes simply count up the packet number (iterator), the rest is the encoded message using the iterator as salt - maybe a checksum in the end.

Without having any knowledge about the device, my guess is that it could be possible to decrypt the traffic when you change the decrypt_uart function to something like this (removing header and shifting the arrays):

def decrypt_uart(key, iv, msg):
        it = msg[:3]
        ct = msg[3:-2]
        ...

If this doesn't work, further investigation would be required. Without the device that is not possible for me.

arjan-kuiper commented 1 year ago

@letoth were you able to decode the notification at this point?

letoth commented 1 year ago

@arjan-kuiper > no :( but if you could, I would appreciate some hint :)