Red RM Mini 3 does not work

[tota-5]

The different (I don't know if it's new or not) RM Mini colored red does not work with broadlink component.

I used broadlink_cli to try to get it into learning mode and got the following:

AttributeError: device instance has no attribute 'enter_learning'

In home assistant, the commands just don't execute in the device, altho the buttons goes from on to off normally.

The firmware on this is 44057 Model: RM mini 3 FCC ID: 2ACDZ-RMMINI3-RM

On intelligent home center app from broadlink, the devices work as intended. It has no firmware upgrades available for it. On e-control app, it shows as unrecognized device, but shows.

Using broadlink manager gives the following:

It seems that even tho it's looks like exactly the same model, it operates differently and has a different model number and api to authenticate and recieve learn and send signals.

[felipediel]

Okay, we are getting close. Here's what I've found so far by analyzing the data you gave me:

Device type 0x5F36 needs different values for 0x24 and 0x25 in data packets. The other models respond to 0x2A and 0x27, respectively, but this model needs 0x36 and 0x5F.

Here is a possible solution, which may be incomplete, but it is at least half the way.

Would you mind helping me test it?

Steps:

1. Download and run the file.
2. Wait 5 seconds.
3. If you see the learning light on the remote, capture a code.
4. Send me the file debug.txt.

[elafargue]

Here is what this test script discovers on my network (2 "0x5F36" there, both having the same issue). Hope this helps!

I had to update the rm_5f36 init method to:

class rm_5f36(device):
    def __init__(self, host, mac, devtype):
        device.__init__(self, host, mac, devtype)
        self.type = "RM Mini 3"

debug.txt

[felipediel]

Nope, not even close. Sorry guys, that was the only part of the message that I was able to access. From 0x38 onwards it is encrypted and I don't have the primary key. We need to extract it somehow, so that we can replicate the data in the API. I'll let you know if I succeed.

[dennisadvani]

Hey @felipediel, Thanks for looking into it. Yes, I'm using my Wifi APs to stream the data to wireshark via port 5555 hence the discrepancy. I wasn't able to capture the Wifi to Wifi traffic any other way. I'll be able to test your new code in a couple of hours, thanks!

[felipediel]

@dennisadvani No need to test, it doesn't work. But thanks anyway.

[Siytek]

Nope, not even close. At least now we know that those hexa are probably related to encryption and doesn't need to be changed (they were different because the keys were different).

Sorry guys, that was the only part of the message that I was able to access. From 0x33 onwards it is encrypted and I don't have the primary key. We need to extract it somehow, so that we can replicate the data in the API. I'll let you know if I succeed.

@felipediel great work and seems like good progress. Thank you! Would the expect the key to change hands during the handshake? If so, can we just extract it with Wireshark?

[dennisadvani]

Hey @felipediel, In case you need to verify the payload when you crack the encryption, the code I was sending in the successful send from Broadlink app to v44057 unit in the wireshark capture was: 26001c000c0b09160b0916140a0b161315150b0a0b09141616090a160a000d05000000000000000000000000 Base64: b'JgAcAAwLCRYLCRYUCgsWExUVCwoLCRQWFgkKFgoADQUAAAAAAAAAAAAAAAA='

[Stefos13]

I am having a problem as well. My broadlink rm mini 3 (firmware v55) i have it as a switch , see code, it works with climate component i have set up but i see the following logs:

Setup of switch platform broadlink is taking over 10 seconds.
8:31 PM __main__.py (WARNING)

Failed to connect to device
8:31 PM components/broadlink/switch.py (ERROR)

- platform: broadlink host: 192.168.1.4 mac: "C8:F7:42:17:53:DD" timeout: 30 type: rm_mini

Any ideas how to fix that? I can connect to the device from Broadlink manager on my Windows computer and in general it works fine in my HA i just want to get rid of these warning/error from my logs

[felipediel]

@Stefos13 v55 is supported. Make sure the device is connected to the local network and the IP address is correct.

[Stefos13]

@Stefos13 v55 is supported. Make sure the device is connected to the local network and the IP address is correct.

It is connected. As i said, i can connect to the device from my windows laptop using broadlink manager. I can also connect to the device through the android device I have and also the climate component in HA it uses the broadlink just fine so i can send commands from HA. I can also ping it without any problems. That's why is confusing for me..

[felipediel]

@Stefos13 That's weird. I can have a look later. Would you mind opening a new issue as it is a different problem? In the meantime, you can try the remote platform. It is best suited for learning and sending commands (if you don't want a switch).

[felipediel]

@Stefos13 Just out of curiosity, are you using more than one Broadlink platform? Perhaps this is the problem. When this integration was developed, it was not expected that there would be multiple platforms operating together (and controlling the same device). So maybe one authentication is blocking the other.

We definitely need some refactoring to better integrate the platforms and make this integration behave as a unit, but as we have more urgent problems this will have to be postponed.

[Stefos13]

@Stefos13 That's weird. I can have a look later. Would you mind opening a new issue as it is a different problem? In the meantime, you can try the remote platform. It is best suited for learning and sending commands (if you don't want a switch).

Once I'm have time i will open one.. I tried remote as well and i'm getting the same error.

@Stefos13 Just out of curiosity, are you using more than one Broadlink platform? Perhaps this is the problem. When this integration was developed, it was not expected that there would be multiple platforms operating together (and controlling the same device). So maybe one authentication is blocking the other.

We definitely need a refactoring to better integrate the platforms and make this integration behave as a unit, but as we have more urgent problems this will have to be postponed.

No, I have only one Broadlink RM Mini 3, nothing else.

[felipediel]

@Stefos13 I meant a platform, like 'switch', 'cover' and 'remote'. Are you using more than one? Or maybe some custom component? How are you controlling the climate?

[felipediel]

Now, back to 0x5F36. Yesterday I developed a module to completely hack the Broadlink protocol. Heavy artillery. I managed to intercept the key and decrypt all communication. Now I just have to analyze the data and modify the API. As soon as I finish it, I'll put it here for testing.

[Stefos13]

@Stefos13 I meant a platform, like 'switch', 'cover' and 'remote'. Are you using more than one? Or maybe some custom component? How are you controlling the climate?

No, i have only that one.. I'm just using it for my climate component to control my AC. I don't recall settting it up for anything else.

I am using SmartIR to controll my AC. I have set up a switch for the broadlink RM, and In my climate config i had to setup the "controller_data" with the IP from the broadlink RM. Do you think that setting up a switch and also providing the IP of the broadlink for the climate data_controller is trying to connect twice?

[felipediel]

@Stefos13 Yes, that is definitely the problem. Choose one for now, but don't waste too much time on it. I am developing a much better climate control component, which is compatible with this integration. Coming soon.

[Stefos13]

@Stefos13 Yes, that is definitely the problem. Choose one for now, but don't waste too much time on it. I am developing a much better climate control component, which is compatible with this integration. Coming soon.

I just removed the climate component and i left only the switch but i got the same error so i don't think that this is the problem.

I will check again all my configuration files to see if i have antyhing else and if not i will open another issue.

[Siytek]

Now, back to 0x5F36. Yesterday I developed a module to completely hack the Broadlink protocol. Heavy artillery. I managed to intercept the key and decrypt all communication. Now I just have to analyze the data and modify the API. As soon as I finish it, I'll put it here for testing.

Great news @felipediel, happy to be one of the test pilots once it’s ready

[luisfosoares]

Now, back to 0x5F36. Yesterday I developed a module to completely hack the Broadlink protocol. Heavy artillery. I managed to intercept the key and decrypt all communication. Now I just have to analyze the data and modify the API. As soon as I finish it, I'll put it here for testing.

Great news @felipediel, happy to be one of the test pilots once it’s ready

Same here! lets figure this out!

[Stefos13]

Just an update. Somewhere in one of my yaml files there was one configuration for broadlink platform, which also had wrong IP, removed it and no more annoying warnings..

[felipediel]

I have already identified the problem with 0x5f36. There is a communication failure due to a poor implementation of the QUIC protocol in the API. There is no Python module to handle the legacy version of this protocol, so I am studying its documentation to reimplement it. It will be a lot of work, don't hold your breath.

[elafargue]

Are there known ways to downgrade the Broadlink firmware on those units? That would be a way to work around this issue...

[felipediel]

This can be done in the official app, but honestly, I don't recommend you to try it. Changing the firmware is an invasive operation. If something goes wrong, you may end up bricking the device. This firmware is ok, we can work with it. I'm working on a solution that will be simpler for you, I just need some time.

[dlavrantonis]

I also got an RM Mini 3 with -unfortunately- 44057 firmware installed in it. Following QuadrifoglioVerde's workaround i am able to successfully register the device in HA, but the learning service fails to capture any IR code.

When starting the learn command service, i observe the following:

1) i get back a 2020-02-21 14:24:32 ERROR (MainThread) [homeassistant.components.broadlink.remote] Failed to learn 'Turn on/television': no signal received

2) No red light on the device flashes (i've read somewhere that it shall)

3) Using a python debugger, i see that the device responds to the "enter_learning" command with the hex below. Not sure what it means - the response isn't verified anywhere in the code.

4) I start pushing the button of the remote and keep watching what happens in the IDE. There is some sort of polling towards the device via the "check_data" api, Multiple responses come, all mapped to an 65531 error. Not sure again what it means - googling didnt help.

5) Not sure that it matters - the device isnt recognized by the Broadling Manager, i get back a: Found device : Unknown [192.168.2.163] Writing compatible device not detected!

Any ideas? Using Is the workaround of QuadrifoglioVerde, has anyone managed to successfully use the learning service? Is the interface to the device somewhere documented?

EnterLearning response: b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb7\xd3\xfb\xff*'\xee\x03L\xa7$\xdf\xa7z\x9ay\x01\x00\x00\x00\xaf\xbe\x00\x00\xce\xf1\x15\x05\xf3R\xbfk\x7fSb\xb9,\xbb\xbd"

[tsdaemon]

Hi,

Kindly ask for updates on this topic. I am trying to integrate HA and Broadlink RM-Pro using the latest version of the ihc. I am going to try using older app versions, could it a workaround? Thanks.

[tsdaemon]

No luck using broadlink CLI so far. But I was able to find a fair workaround for now:

1. Reset the remote.
2. Remove all devices from ihc, remove ihc.
3. Install the eControl app
4. Use it only to authenticate the remote in my WiFi
5. Use broadlink-mqtt to learn and replay codes. Works well with my RF devices, some problems with IR TV remote, but it might be just glitches.

[luisfosoares]

@tsdaemon can you please provide more details ? which firmware are you in? is your device 0x5f36?

[umarbutler]

Hi, any updates on a solution for @dlavrantonis issue? I have the same firmware (v44057) and have been unable to connect my RM Mini 3 to HA as well as Broadlink Manager (keep getting the error 'Writing compatible device not detected!'). I have tried configuring the device to connect to Wi-Fi via both the IHC and Broadlink apps (using both AP and Bluetooth modes), to no avail.

[felipediel]

Hi guys. Sorry for the delay.

I just solved some problems with the encryption algorithm. Would you mind helping me test a possible solution?

Steps:

1. Download and run this file.
2. Wait 5 seconds.
3. If you see the learning light on the remote, capture a code.
4. A file called debug.txt will be created.
5. Send me the file.

[felipediel]

@Siytek would you mind helping with this test? Even if this solution does not work completely, with your debug data I will be able to obtain your device key and decrypt the Wireshark captures you sent to us.

[nickollasaranha]

@felipediel here it is, hope it helps. No lights for me.

debug.txt

23:51:46,783 root INFO Broadlink API Debug 23:51:46,783 __main__ DEBUG Starting discovery... 23:51:46,788 __main__ DEBUG [Request] bytearray(b'\x00\x00\x00\x00\x00\x00\x00\x00\xfb\xff\xff\xff\xe4\x073\x17\x14\x02\x19\x02\x00\x00\x00\x00\xc0\xa8V I\xc2\x00\x00\xfc\xc6\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00') 23:51:46,894 __main__ DEBUG [Response] bytearray(b'\x00\x00\x00\x00\x00\x00\x00\x00\xfb\xff\xff\xff\xe4\x073\x17\x14\x02\x19\x02\x00\x00\x00\x00\xc0\xa8V I\xc2\x00\x00\xa4\xd4\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x006_$V\xa8\xc0X%{\xa7\xdf$\xe6\x99\xba\xe8\x83\xbd\xe9\x81\xa5\xe6\x8e\xa7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x01') 23:51:51,788 __main__ DEBUG [Device 0] 23:51:51,788 __main__ DEBUG Host: ('192.168.86.36', 80) 23:51:51,788 __main__ DEBUG Mac: 58257ba7df24 23:51:51,788 __main__ DEBUG Type: 0x5f36 23:51:51,788 __main__ DEBUG Starting authentication... 23:51:51,788 __main__ DEBUG [Request] bytearray(b'Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x006\xf7\x00\x00*\'e\x00_\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xa1\xc4\x00\x00E4R\xe7\xf9.\xda\x95\x83D\x93\x085\xef\x9am\xfbi-\xc3p\xb9\x04C\xac\\\xd6?\xbbS\xad\xfa\x08\x81L\xa7\xf8\xcfAq\x002\x8eW\x0c;\x86\xc9M\x05p\x84I\xa3\x89\xe2\x9a\xe1\x04T6\xa0[\xdd\xdc\x02\xc1a\xaf\x13%\xe8~\x19\xb0\xf7\xd1\xce\x06\x8dB\xe2\xd6\xde\x8d\xd8\xe9\xca"I\x08\x81[s\xbe&') 23:51:51,799 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00c\xca\xff\xff*'\xe9\x03_\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xaf\xbe\x00\x00", ('192.168.86.36', 80)) 23:51:51,799 __main__ DEBUG Authentication error. 23:51:51,799 __main__ DEBUG Entering learning mode... 23:51:51,799 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00w\xd8\x00\x00*\'j\x00`\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb2\xbf\x00\x00\xe8o\xednHl\x04N\x89\xf2\xe9\xa0\xca\x9c\x00$\x8f\xd6DcB\x83.J\xc8\xda\xf8\xe6\x97\x97Q\x01") 23:51:51,810 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00g\xca\xf9\xff*'\xee\x03`\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb2\xbf\x00\x00", ('192.168.86.36', 80)) 23:51:51,810 __main__ DEBUG Checking for data... 23:51:51,810 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xca\xd4\x00\x00*\'j\x00a\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00:\x01\x13s\x00\xdcq- \xb6\x13_\x84\xdd\xe1}Og\x0c\xd8%\xdaQh\x97\x1c\xa6\xb6\xaaN\'\x1e") 23:51:51,818 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00i\xca\xf9\xff*'\xee\x03a\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00", ('192.168.86.36', 80)) 23:51:52,819 __main__ DEBUG Checking for data... 23:51:52,819 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xcb\xd4\x00\x00*\'j\x00b\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00:\x01\x13s\x00\xdcq- \xb6\x13_\x84\xdd\xe1}Og\x0c\xd8%\xdaQh\x97\x1c\xa6\xb6\xaaN\'\x1e") 23:51:52,828 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00j\xca\xf9\xff*'\xee\x03b\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00", ('192.168.86.36', 80)) 23:51:53,828 __main__ DEBUG Checking for data... 23:51:53,828 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xcc\xd4\x00\x00*\'j\x00c\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00:\x01\x13s\x00\xdcq- \xb6\x13_\x84\xdd\xe1}Og\x0c\xd8%\xdaQh\x97\x1c\xa6\xb6\xaaN\'\x1e") 23:51:53,842 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00k\xca\xf9\xff*'\xee\x03c\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00", ('192.168.86.36', 80)) 23:51:54,842 __main__ DEBUG Checking for data... 23:51:54,842 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xcd\xd4\x00\x00*\'j\x00d\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00:\x01\x13s\x00\xdcq- \xb6\x13_\x84\xdd\xe1}Og\x0c\xd8%\xdaQh\x97\x1c\xa6\xb6\xaaN\'\x1e") 23:51:54,852 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\xca\xf9\xff*'\xee\x03d\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00", ('192.168.86.36', 80)) 23:51:55,853 __main__ DEBUG Checking for data... 23:51:55,853 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xce\xd4\x00\x00*\'j\x00e\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00:\x01\x13s\x00\xdcq- \xb6\x13_\x84\xdd\xe1}Og\x0c\xd8%\xdaQh\x97\x1c\xa6\xb6\xaaN\'\x1e") 23:51:55,877 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00m\xca\xf9\xff*'\xee\x03e\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00", ('192.168.86.36', 80)) 23:51:56,877 __main__ DEBUG Checking for data... 23:51:56,877 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xcf\xd4\x00\x00*\'j\x00f\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00:\x01\x13s\x00\xdcq- \xb6\x13_\x84\xdd\xe1}Og\x0c\xd8%\xdaQh\x97\x1c\xa6\xb6\xaaN\'\x1e") 23:51:56,885 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00n\xca\xf9\xff*'\xee\x03f\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00", ('192.168.86.36', 80)) 23:51:57,885 __main__ DEBUG Checking for data... 23:51:57,885 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd0\xd4\x00\x00*\'j\x00g\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00:\x01\x13s\x00\xdcq- \xb6\x13_\x84\xdd\xe1}Og\x0c\xd8%\xdaQh\x97\x1c\xa6\xb6\xaaN\'\x1e") 23:51:57,894 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o\xca\xf9\xff*'\xee\x03g\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00", ('192.168.86.36', 80)) 23:51:58,895 __main__ DEBUG Checking for data... 23:51:58,895 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd1\xd4\x00\x00*\'j\x00h\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00:\x01\x13s\x00\xdcq- \xb6\x13_\x84\xdd\xe1}Og\x0c\xd8%\xdaQh\x97\x1c\xa6\xb6\xaaN\'\x1e") 23:51:58,904 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\xca\xf9\xff*'\xee\x03h\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00", ('192.168.86.36', 80)) 23:51:59,905 __main__ DEBUG Checking for data... 23:51:59,905 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd2\xd4\x00\x00*\'j\x00i\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00:\x01\x13s\x00\xdcq- \xb6\x13_\x84\xdd\xe1}Og\x0c\xd8%\xdaQh\x97\x1c\xa6\xb6\xaaN\'\x1e") 23:51:59,928 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00q\xca\xf9\xff*'\xee\x03i\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00", ('192.168.86.36', 80)) 23:52:00,928 __main__ DEBUG Checking for data... 23:52:00,928 __main__ DEBUG [Request] bytearray(b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd3\xd4\x00\x00*\'j\x00j\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00:\x01\x13s\x00\xdcq- \xb6\x13_\x84\xdd\xe1}Og\x0c\xd8%\xdaQh\x97\x1c\xa6\xb6\xaaN\'\x1e") 23:52:00,938 __main__ DEBUG [Response] (b"Z\xa5\xaaUZ\xa5\xaaU\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00r\xca\xf9\xff*'\xee\x03j\x0fX%{\xa7\xdf$\x00\x00\x00\x00\xb3\xbf\x00\x00", ('192.168.86.36', 80)) 23:52:01,938 __main__ DEBUG Failed to learn: no code received.

[tideteam]

@felipediel I shared my experience. My rm mini3 is v44061 buy from china jd.com SDK version show: China. Broadlink Manager doesn't work, home-assistant too. But After I upgrade HA from 0.993 to 1.05x. It works very well.

I have another device, rm pro plus. This device buy from taobao, SDK version show Japan and version is v052 It could be scanned by Broadlink Manager. I could only use rm pro plus to learn the code and assign it to rm mini3

[felipediel]

@nickollasaranha I just fixed a silly mistake I made in the previous file. Would you mind downloading the new file and trying again? Everyone is invited to test. I think we are close to the solution.

[felipediel]

@tideteam Thanks for the report.

[turlubullu]

@felipediel

debug.txt

Ni lights for me neither.

Thank you for your devotion !

[luisfosoares]

@felipediel I will try it later! Thanks for your dedication lets finish this 👍

[dennisadvani]

Hey @felipediel,

Thanks again for your efforts and persistence. The learning light came up for the v55 but with the 44057 firmware, learning light didn't come on. debug.txt

[Siytek]

@Siytek would you mind helping with this test? Even if this solution does not work completely, with your debug data I will be able to obtain your device key and decrypt the Wireshark captures you sent to us.

Yes sure thing @felipediel sorry for the delay, think it’s different time zones and only just saw the messages here. Will take a look as soon as I’m back from work later.

[jhonathas]

@felipediel

Thank you for your persistence and for helping us!

It didn't work for me either. The light did not come on.

My Broadlink was not found on the network. I only kept what has a problem connected ... On IHC works normally.

debug.txt

[felipediel]

Hi guys. Thanks for the debug data. There's definetly a padding problem on encryption. Let's try ANSIX923 for CBC mode padding.

Steps:

1. Download and run this file.
2. Wait 5 seconds.
3. If you see the learning light on the remote, capture a code.
4. A file called debug.txt will be created.
5. Send me the file.

[felipediel]

@jhonathas I think your firewall is blocking discovery on your computer, but this is another problem

[nickollasaranha]

@felipediel still no lights on this latest file.

debug.txt

[felipediel]

@nickollasaranha Thanks!

Okay, at least now we know exactly where the problem is. We need to find out which CBC mode padding algorithm is being used by Broadlink. It is neither PKCS7 nor ANSIX923, although it looks a bit like this. No more tests for now. I will keep you informed.

[nickollasaranha]

@felipediel thanks for your effort. Let me know if you need any help with tests :)

[chemelli74]

@Siytek my device is 0x2737, also is visible as PID in broadlink app (if is configured in cloud)

New (latest) Broadlink app for iOS shows PID 3727 for me.

Simone

[luisfosoares]

Same here, no light sadly debug.txt

[felipediel]

@Siytek Your debug.txt would still be interesting for me to decrypt your Wireshark captures and analyze how the device is controlled by the official app. This is the file I need you to run. Sorry for the insistence, but your captures are really good and decrypting them is the best chance we have.

[bbreton09]

debug.txt from test_solution3.py

debug.txt from broadlink_debug.py

No blink led for me.

@felipediel do you want an SSH access to a RPI ?

[felipediel]

@bbreton09 I don't think it would be useful at this point. Captures need to be made in Wireshark while controlling the device with the official app running on an Android emulator. It's a very tricky step that has already been completed by @Siytek, I just need to intercept his device key to decrypt the communication. But thanks for your promptness.