emporia-vue-local / emporia-vue2-reversing

MIT License
53 stars 12 forks source link

Emporia Smart Plug support #6

Open Riebart opened 2 years ago

Riebart commented 2 years ago

QUESTION: Does anyone know of any sources for similar reverse engineering efforts for the Emporia smart plugs?

Background

So, I've ordered a Vue 2 main unit, and managed to get through pulling the flash contents and working through the NVS. Thanks for the great work!

I've also ordered (they arrive later this week) the smart plugs though, as I've got a few hot spots that are on otherwise pretty broad circuits (e.g., my home office setup is on the same circuit as every light and plug on our second floor... 🤦‍♂️), and I'd like to use them for both monitoring and control.

My gut is suggesting to me that internally they are probably very, very similar since their features compared to a full unit seem very similar (so I'm expecting a similar ES32 with almost identical firmware, and a single current loop, with a relay).

My end goal, I think, is to replace the certificates in the flash (that are almost certainly the AWS IOT Core CA certs) with custom certs, and MITM the traffic to get the best of both worlds (on-prem data retention, with cloud connectivity for control), but I'm not there yet (the certs are in some mutant format I haven't put much time into deciphering).

flaviut commented 2 years ago

Not a chance. Sorry. It just doesn't make sense to put the high-end parts needed to handle 20 channels in a cheap wall thing.

Here's a teardown: https://blog.horner.tj/emporia-smart-plugs-tasmota/. Looks like it's a white-label product. It uses a BL0937 for power monitoring. It's also impossible to take apart cleanly.

I would return them and replace them with the Sonoff S31, which is easy to disassemble and flash with ESPHome or Tasmota.