Support for Wi-Fi sensor messages

doug-hoffman commented 2 years ago

The protocol for Venstar Wi-Fi sensors is undocumented. Let's try to figure it out, so we can decode/encode them.

What I've identified so far

The sensors broadcast their data to the local network (255.255.255.255) and multicast to the all hosts group (224.0.0.1) on UDP port 5001. Updates are sent every minute for mini Wi-Fi sensors set to "remote", every two minutes for the original Wi-Fi sensors set to "remote", and every 20 seconds for "supply" and "return".

Messages appear to be a series of TLVs, with the length being unspecified for some types.

Type	State		Type	Unit ID	Type	Length	Identifier		Type	Firmware Version		Type	Length	Name	Type	Sensor Type	Type	Temperature	Type	Battery
08	2a	d202590a2908fe2e	10	05	1a	0c	656339663064393431356636	20032803	30	0138	01	42	06	4f6666696365	48	03	50	7b	58	29	122c643066536e397762666c3435624834666546714144426f4256744466516456703842386f616a4d334c33343d

Type: 08 = State, 10 = Unit ID, 1a = Identifier, 30 = Firmware version, 42 = Name, 48 = Sensor Type, 50 = Temperature, 58 = Battery State: 2a = Normal, 2b = Ready to link (button pressed) Unit ID: 00 to 13 Identifier: Only MAC address observed Sensor type: 01 = Outdoor, 02 = Return, 03 = Remote, 04 = Supply Temperature: 00 = -40.0°C to ff = 87.5°C, in 0.5° steps. Temperature increases at a rate no faster than 1.5°/update and decreases at 0.5°/update.

Sample messages

First line is when the message was received, for an understanding of timing. Second is the message in hex. Third is the message in ascii with non-printable characters replaced by a period.

Messages sent by sensors during normal operation

``` 2021-11-06 08:56:52.273645 082ad202590a2908f42e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c356242302f796467507872336d644b554c4d7a504c4f7350527a65384f65545244613975306d456a486d6f3d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,5bB0/ydgPxr3mdKULMzPLOsPRze8OeTRDa9u0mEjHmo= 2021-11-06 08:57:01.498718 082ad2025f0a2f08bdca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c5139633959707a634f52586170326b4950447435455a486b3165336f6b5865434b382f6a7072585269524d3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,Q9c9YpzcORXap2kIPDt5EZHk1e3okXeCK8/jprXRiRM= 2021-11-06 08:57:02.932190 082ad202600a3008bcc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804508b015864122c414f313855307279633069575472745a54343072716b44486b6f4b597a4a683045784b6459692f654d37413d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,AO18U0ryc0iWTrtZT40rqkDHkoKYzJh0ExKdYi/eM7A= 2021-11-06 08:57:05.912636 082ad2025e0a2e08b14010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c574d5068576b7652794455316f59595936484474664b5142764c754e4a4c3948376a4c4d33773749394e513d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,WMPhWkvRyDU1oYYY6HDtfKQBvLuNJL9H7jLM3w7I9NQ= 2021-11-06 08:57:10.009835 082ad202620a3208f9c60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c524833357731506f3357567a6630656964755464444e394d354f523369414356564866535768496f6c48513d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,RH35w1Po3WVzf0eiduTdDN9M5OR3iACVVHfSWhIolHQ= 2021-11-06 08:57:10.828285 082ad2025e0a2e08ac4010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c4f6f55566f2f62317249494f364979653963755477776a6d707877424871494f57704243396269667134493d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,OoUVo/b1rIIO6Iye9cuTwwjmpxwBHqIOWpBC9bifq4I= 2021-11-06 08:57:16.505114 082ad2025e0a2e08a6d80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507b5833122c386864364455686d664f2b6a6b31506e7a334c70434e6f44535774575a3275517250424c754e35744a52733d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P{X3.,8hd6DUhmfO+jk1Pnz3LpCNoDSWtWZ2uQrPBLuN5tJRs= 2021-11-06 08:57:24.502644 082ad202600a3008c7d80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507b5820122c5154794745484b6b33746956544c72684d32465470412f50742b68487136555741576a766f4e55754d73343d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P{X .,QTyGEHKk3tiVTLrhM2FTpA/Pt+hHq6UWAWjvoNUuMs4= 2021-11-06 08:57:25.413231 082ad202600a3008ea0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582d122c39567874366f6d696b74656a306971356f37635a322f5a38625372635136662f726153724a6e5a54664d593d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X-.,9Vxt6omiktej0iq5o7cZ2/Z8bSrcQ6f/raSrJnZTfMY= 2021-11-06 08:57:26.421120 082ad2025f0a2f08beca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c4f72485a597166443451494f773841764a6a416276796d4f69314976564c6d4c34553673554a71765a66633d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,OrHZYqfD4QIOw8AvJjAbvymOi1IvVLmL4U6sUJqvZfc= 2021-11-06 08:57:27.487416 082ad202600a3008bdc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804508b015864122c656b53536a38344c557a5638597172586e48576c4a712b38326c412b52477937334d57574f4f55497851513d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,ekSSj84LUzV8YqrXnHWlJq+82lA+RGy73MWWOOUIxQQ= 2021-11-06 08:57:31.801574 082ad2025a0a2a08990510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c767968642f422f767936684d612b416a754a526d684c63755a72504a6167616b645a5a674a495849316d773d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,vyhd/B/vy6hMa+AjuJRmhLcuZrPJagakdZZgJIXI1mw= 2021-11-06 08:57:47.529351 082ad202590a2908f52e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c556c724b622b6264564c41726d506b414d4473504330785a684665446b734351454c5863616b4f6f5733633d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,UlrKb+bdVLArmPkAMDsPC0xZhFeDksCQELXcakOoW3c= 2021-11-06 08:57:48.207560 082ad2025f0a2f08bfca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c75616b5961523634775356524e3737306756756e6361456638544138675865324c4a73696839672b6f4d553d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,uakYaR64wSVRN770gVuncaEf8TA8gXe2LJsih9g+oMU= 2021-11-06 08:57:49.071664 082ad202600a3008bec40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804508f015864122c316d7a666c2b77742b32327651614666504a756b557645304c6a447250686e41703453494469374d3664553d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,1mzfl+wt+22vQaFfPJukUvE0LjDrPhnAp4SIDi7M6dU= 2021-11-06 08:58:01.076149 082ad2025e0a2e08b24010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c414c487366454338474b58714c6f5a32313443765a7a45533549762f59654b41384c6f4e34394f497751303d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,ALHsfEC8GKXqLoZ214CvZzES5Iv/YeKA8LoN49OIwQ0= 2021-11-06 08:58:05.157292 082ad202620a3208fac60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c6539496b4d714a4a666e4565674836305354547a4c49476a447434694e46676a4550565358377447434f513d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,e9IkMqJJfnEegH60STTzLIGjDt4iNFgjEPVSX7tGCOQ= 2021-11-06 08:58:05.981605 082ad2025e0a2e08ad4010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c47636d616971614357507231346468463841784f6c5544526849755a3250795a4c716c4a64416c715445303d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,GcmaiqaCWPr14dhF8AxOlUDRhIuZ2PyZLqlJdAlqTE0= 2021-11-06 08:58:09.549607 082ad2025f0a2f08c0ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c45364231592f6653794c6a327533314f37446e6b6d45464544637130596e566f70495354446643415652513d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,E6B1Y/fSyLj2u31O7DnkmEFEDcq0YnVopISTDfCAVRQ= 2021-11-06 08:58:11.895550 082ad2025e0a2e08a7d80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507b5833122c77595a2b35783173755341346c547a742f4c414e317556675155524a3252556d742b41505068394e3138453d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P{X3.,wYZ+5x1suSA4lTzt/LAN1uVgQURJ2RUmt+APPh9N18E= 2021-11-06 08:58:15.147704 082ad202600a3008bfc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c7948045093015864122c594644764b5a737a43744472703858477461752f614f6b4571737536545763327a43454c7679494a6f43733d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,YFDvKZszCtDrp8XGtau/aOkEqsu6TWc2zCELvyIJoCs= 2021-11-06 08:58:19.587852 082ad202600a3008c8d80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5820122c5a2b316462335954313842422b4f4248674e495a6d2f422f66434767636b3668486a3936504149723172553d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X .,Z+1db3YT18BB+OBHgNIZm/B/fCGgck6hHj96PAIr1rU= 2021-11-06 08:58:20.701146 082ad202600a3008eb0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c6459414f6c484f5936565972775a7a37514e4752507971356d3873417536752f654d5163574c6352754e6b3d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,dYAOlHOY6VYrwZz7QNGRPyq5m8sAu6u/eMQcWLcRuNk= 2021-11-06 08:58:30.878551 082ad2025f0a2f08c1ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c33644b6a516a7339655a4f38644c4d4e62346d416a6448323479794575367572665853794c5032645775553d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,3dKjQjs9eZO8dLMNb4mAjdH24yyEu6urfXSyLP2dWuU= 2021-11-06 08:58:36.870836 082ad202600a3008c0c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c7948045096015864122c7350664b5a45496b45356f7556527172307577417650712f6e524b7951776b4337397667614a597a4452413d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,sPfKZEIkE5ouVRqr0uwAvPq/nRKyQwkC79vgaJYzDRA= 2021-11-06 08:58:42.219485 082ad2025a0a2a089a0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c48655a6a4837333938305250386a546d694b3461654c2b75622b4d6d464837486c506645466935624f52493d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,HeZjH73980RP8jTmiK4aeL+ub+MmFH7HlPfEFi5bORI= 2021-11-06 08:58:42.817426 082ad202590a2908f62e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c336f61346d49486c79646256397074532b372b454f337935696946764a66657859374e3438414342524b453d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,3oa4mIHlydbV9ptS+7+EO3y5iiFvJfexY7N48ACBRKE= 2021-11-06 08:58:52.143797 082ad2025f0a2f08c2ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c2b4e766978346658424c35647834434f70454d5631523759333843386169306349736d614472635a446a4d3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,+Nvix4fXBL5dx4COpEMV1R7Y38C8ai0cIsmaDrcZDjM= 2021-11-06 08:58:56.152689 082ad2025e0a2e08b34010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c4a6b425051746c572f4e636c6a4b2b2f75705779513169692f53687350704942326a724e786d4a756a73453d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,JkBPQtlW/NcljK+/upWyQ1ii/ShsPpIB2jrNxmJujsE= 2021-11-06 08:58:58.799947 082ad202600a3008c1c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c7948045099015864122c33486532747a364961592b3159563547493452624e4e654858414b666c4e4641316475382b384c45756e493d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,3He2tz6IaY+1YV5GI4RbNNeHXAKflNFA1du8+8LEunI= 2021-11-06 08:59:00.326699 082ad202620a3208fbc60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c7a35394a4f6e2f6544705a3434666c39566c556d596b2b685663435a45654d326c597a4c4476484d2f676b3d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,z59JOn/eDpZ44fl9VlUmYk+hVcCZEeM2lYzLDvHM/gk= 2021-11-06 08:59:01.067395 082ad2025e0a2e08ae4010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c58544376635167325753424c355776357a422b74764d77342b55465a526631734752506c68724d386758673d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,XTCvcQg2WSBL5Wv5zB+tvMw4+UFZRf1sGRPlhrM8gXg= 2021-11-06 08:59:07.084170 082ad2025e0a2e08a8d80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507b5833122c6c666658344270687a742b523135483871426377367766766669794478727876427353392f77667430394d3d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P{X3.,lffX4Bphzt+R15H8qBcw6wfvfiyDxrxvBsS9/wft09M= 2021-11-06 08:59:13.543068 082ad2025f0a2f08c3ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c364757326d485a4664594f694447432f5476314e766f596b784c693070416a616473786d4b72667a4242493d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,6GW2mHZFdYOiDGC/Tv1NvoYkxLi0pAjadsxmKrfzBBI= 2021-11-06 08:59:14.673454 082ad202600a3008c9d80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5820122c324f71332b504e6b374a526b3178476a3574756f41645a4e6a4f567654677054613052594f7a4271702b453d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X .,2Oq3+PNk7JRk1xGj5tuoAdZNjOVvTgpTa0RYOzBqp+E= 2021-11-06 08:59:15.889145 082ad202600a3008ec0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c574c6335696d4a73345a58474d327a53494147706f4739706870774861564c795943376d584641452f67553d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,WLc5imJs4ZXGM2zSIAGpoG9phpwHaVLyYC7mXFAE/gU= 2021-11-06 08:59:20.199002 082ad202600a3008c2c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509b015864122c486651577a70596a775031387146374b493934657572724b62566a7466672b4c344856735368694851646b3d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,HfQWzpYjwP18qF7KI94eurrKbVjtfg+L4HVsShiHQdk= 2021-11-06 08:59:34.943179 082ad2025f0a2f08c4ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c39746d592b45774675675167694345446345724b59727550343737696766477555506265484637784f57383d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,9tmY+EwFugQgiCEDcErKYruP477igfGuUPbeHF7xOW8= 2021-11-06 08:59:38.006144 082ad202590a2908f72e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c722b783337324a39515148524d56674c63586d49366d7731344e3173736e7230446643685a45426a6a77453d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,r+x372J9QQHRMVgLcXmI6mw14N1ssnr0DfChZEBjjwE= 2021-11-06 08:59:41.497467 082ad202600a3008c3c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509c015864122c306d7059354433634b43463364454a574c374c7a5a52574b725643364a744a445a732f307268504678766f3d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,0mpY5D3cKCF3dEJWL7LzZRWKrVC6JtJDZs/0rhPFxvo= 2021-11-06 08:59:51.239010 082ad2025e0a2e08b44010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c4d6457614c44574c30564f316d31444e642f73447951792f5232712b5877592b4c68566c753255542f68493d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,MdWaLDWL0VO1m1DNd/sDyQy/R2q+XwY+LhVlu2UT/hI= 2021-11-06 08:59:52.637661 082ad2025a0a2a089b0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c68494631776e5453796e725872444336646e6c6d446351354b6f4d494b7845594f796f6d785377593235593d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,hIF1wnTSynrXrDC6dnlmDcQ5KoMIKxEYOyomxSwY25Y= 2021-11-06 08:59:55.530558 082ad202620a3208fcc60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c574e574a4d4c6f74776c576a397344644367587443382b7038685a6a7163426d615a6359395775735974513d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,WNWJMLotwlWj9sDdCgXtC8+p8hZjqcBmaZcY9WusYtQ= 2021-11-06 08:59:56.154966 082ad2025e0a2e08af4010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c70704a4153592b7953312b744a7a733656757a45584b6b70394f4279584e506f4438527a52644d756c614d3d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,ppJASY+yS1+tJzs6VuzEXKkp9OByXNPoD8RzRdMulaM= 2021-11-06 08:59:56.661587 082ad2025f0a2f08c5ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c2f7539364f336579477a6b74445a6866694c2f5269352f536a766e625056734d6945586b4564612f464b453d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,/u96O3eyGzktDZhfiL/Ri5/SjvnbPVsMiEXkEda/FKE= 2021-11-06 09:00:02.374806 082ad2025e0a2e08a9d80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507b583c122c437476567071366a4873643673633577726c632b4543565135326e356b6e5263417a6f38534145357465343d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P{X<.,CtvVpq6jHsd6sc5wrlc+ECVQ52n5knRcAzo8SAE5te4= 2021-11-06 09:00:07.494337 082ad202600a3008c4c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509d015864122c51364b3439574d467a5156722b316f7a656155787261396b41546f2f5a4a7674614d6875503450577444773d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,Q6K49WMFzQVr+1ozeaUxra9kATo/ZJvtaMhuP4PWtDw= 2021-11-06 09:00:09.851975 082ad202600a3008cad80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5820122c4a2b4b4a4e644e424b4b4139484f2b4e734a624d73717347467952732f5639644b52626a565a77473031513d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X .,J+KJNdNBKKA9HO+NsJbMsqsGFyRs/V9dKRbjVZwG01Q= 2021-11-06 09:00:11.180534 082ad202600a3008ed0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c6c565578424d507933506d6f77587731374152574d697631777a6a4432534151785a6176725666726c68413d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,lVUxBMPy3PmowXw17ARWMiv1wzjD2SAQxZavrVfrlhA= 2021-11-06 09:00:18.471153 082ad2025f0a2f08c6ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c52323642766d534d697359384c75714e676f78655a6f50424b387968416d66785337414954394978696e513d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,R26BvmSMisY8LuqNgoxeZoPBK8yhAmfxS7AIT9IxinQ= 2021-11-06 09:00:33.194660 082ad202590a2908f82e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c5966546e546f7471445254556a35424b595234395872583069417032654e49667336392b7233734c4768493d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,YfTnTotqDRTUj5BKYR49XrX0iAp2eNIfs69+r3sLGhI= 2021-11-06 09:00:35.092409 082ad202600a3008c5c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509e015864122c6758343765567a687539755266772f426b634449756c7035505a636a417844657a31774a4d6e364d6b64383d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,gX47eVzhu9uRfw/BkcDIulp5PZcjAxDez1wJMn6Mkd8= 2021-11-06 09:00:39.756501 082ad2025f0a2f08c7ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c4b41574c3953486b774d5a50335a505a4778435335546f5a4d756c4c31366c6e6a59584a4a59364544436f3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,KAWL9SHkwMZP3ZPZGxCS5ToZMulL16lnjYXJJY6EDCo= 2021-11-06 09:00:46.325635 082ad2025e0a2e08b54010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c6354334a33636e36563670306270562f6f6b483767375257327a39786c313073787a625358594e6b4650773d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,cT3J3cn6V6p0bpV/okH7g7RW2z9xl10sxzbSXYNkFPw= 2021-11-06 09:00:50.617051 082ad202620a3208fdc60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c7338742f3869554f52614158767a716a64584e5172436834506d667864754e556f476b546968764d6e79343d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,s8t/8iUORaAXvzqjdXNQrCh4PmfxduNUoGkTihvMny4= 2021-11-06 09:00:51.242689 082ad2025e0a2e08b04010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c624e652b33412b4e42735768586d79322b793764386a66693044516a324e4c5a6c77314a627a746c547a633d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,bNe+3A+NBsWhXmy2+y7d8jfi0DQj2NLZlw1JbztlTzc= 2021-11-06 09:00:56.444929 082ad202600a3008c6c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509e015864122c4c30624375414e364d65457833534f596b38545a396e2f715231514c787631502f642b4c483748664848383d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,L0bCuAN6MeEx3SOYk8TZ9n/qR1QLxv1P/d+LH7HfHH8= 2021-11-06 09:00:57.666048 082ad2025e0a2e08aad80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5836122c5a72305a6d3769336e4276394171385642655673396c4b32794a48383667676b323575417565322f4b45513d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X6.,Zr0Zm7i3nBv9Aq8VBeVs9lK2yJH86ggk25uAue2/KEQ= 2021-11-06 09:01:01.421733 082ad2025f0a2f08c8ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c464a38456e485773666b2b4e31434c6f74707566574966472b3858397352494a4c624961727250787470303d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,FJ8EnHWsfk+N1CLotpufWIfG+8X9sRIJLbIarrPxtp0= 2021-11-06 09:01:03.055634 082ad2025a0a2a089c0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c43766c59566e67562f31655a693331322b4a39576254477a7a423738534c347248386b44414f69614d726f3d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,CvlYVngV/1eZi312+J9WbTGzzB78SL4rH8kDAOiaMro= 2021-11-06 09:01:05.037001 082ad202600a3008cbd80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5820122c58736a4f65502f345446634942627a2f444145586d5267304d4b6554774b3147543676496a6865444748633d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X .,XsjOeP/4TFcIBbz/DAEXmRg0MKeTwK1GT6vIjheDGHc= 2021-11-06 09:01:06.266005 082ad202600a3008ee0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c397a4635773739334a7351646a5a74334641754932527a375a4f4b32692f334d52536b3272713738626f453d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,9zF5w793JsQdjZt3FAuI2Rz7ZOK2i/3MRSk2rq78boE= 2021-11-06 09:01:17.846000 082ad202600a3008c7c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509e015864122c4a776e426a7244436b4333524b2f312f4c3977554b43554348464e4e55734d4d75394a69725455495047593d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,JwnBjrDCkC3RK/1/L9wUKCUCHFNNUsMMu9JirTUIPGY= 2021-11-06 09:01:23.085303 082ad2025f0a2f08c9ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c4639774458594548544866375938715a694e7858394a64656c68596f36442b634d304b52646a656a7a4c733d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,F9wDXYEHTHf7Y8qZiNxX9JdelhYo6D+cM0KRdjejzLs= 2021-11-06 09:01:28.485870 082ad202590a2908f92e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c6b725062564457536463706f63626d4f584d42644a696d6d6d3645504f46565a5854443477572f763254673d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,krPbVDWSdcpocbmOXMBdJimmm6EPOFVZXTD4wW/v2Tg= 2021-11-06 09:01:39.141954 082ad202600a3008c8c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509f015864122c72616842483145466f465a3131696a73544b5a306a55787754795a5952723742426b6b7a376a68556a52633d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,rahBH1EFoFZ11ijsTKZ0jUxwTyZYRr7BBkkz7jhUjRc= 2021-11-06 09:01:41.412645 082ad2025e0a2e08b64010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c307832596d4b314e4f2f7344734f304936444172534e76786547723430516e5857415259416d412b70306b3d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,0x2YmK1NO/sDsO0I6DArSNvxeGr40QnXWARYAmA+p0k= 2021-11-06 09:01:44.465624 082ad2025f0a2f08caca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c35324162757a484e4875336362662b393663676c486857585737337a545671796379674b69314b54746d633d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,52AbuzHNHu3cbf+96cglHhWXW73zTVqycygKi1KTtmc= 2021-11-06 09:01:45.703871 082ad202620a3208fec60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c4e4647374757756a6155756c416b3549494f63694437716f72725a4d62556c6f5743786c65306c656d57513d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,NFG7GWujaUulAk5IIOciD7qorrZMbUloWCxle0lemWQ= 2021-11-06 09:01:46.326362 082ad2025e0a2e08b14010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c6b424972486b77793268697046764d68422f53354f76365a6171705a61754550794d7036687169657744493d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,kBIrHkwy2hipFvMhB/S5Ov6ZaqpZauEPyMp6hqiewDI= 2021-11-06 09:01:52.955900 082ad2025e0a2e08abd80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c6b5a6e6f653969634d37394249644a46364c38725865636b56597349626469356352467074307a6c6654553d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,kZnoe9icM79BIdJF6L8rXeckVYsIbdi5cRFpt0zlfTU= 2021-11-06 09:02:00.229338 082ad202600a3008ccd80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5820122c47614a726f485052616f6749636f696b347732516d4e70782b6e625144694b4f32454852746a64376179553d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X .,GaJroHPRaogIcoik4w2QmNpx+nbQDiKO2EHRtjd7ayU= 2021-11-06 09:02:00.746153 082ad202600a3008c9c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509f015864122c2b743261326775742b777849517156487841764b7943742f4453612f6f6e6142322b566f444c77342f54343d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,+t2a2gut+wxIQqVHxAvKyCt/DSa/onaB2+VoDLw4/T4= 2021-11-06 09:02:01.659217 082ad202600a3008ef0110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c4a766369637152414d6852772b54634a4a626a43717137647554732b3879727a4a4970705971684a6748493d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,JvcicqRAMhRw+TcJJbjCqq7duTs+8yrzJIppYqhJgHI= 2021-11-06 09:02:05.764045 082ad2025f0a2f08cbca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c61684a76784e706b3648506a66567752326b6d764956316b774e352b4e77593161374c35755356615870513d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,ahJvxNpk6HPjfVwR2kmvIV1kwN5+NwY1a7L5uSVaXpQ= 2021-11-06 09:02:13.473658 082ad2025a0a2a089d0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c6b43344142566d666d2f483474454566493576417935673144766b31444731324349717571446b70584d6f3d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,kC4ABVmfm/H4tEEfI5vAy5g1Dvk1DG12CIquqDkpXMo= 2021-11-06 09:02:22.388623 082ad202600a3008cac40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509f015864122c6d6e48422b394f57343939376e3756447277702b47587139444a476d62532f424a587944726d38727564343d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,mnHB+9OW4997n7VDrwp+GXq9DJGmbS/BJXyDrm8rud4= 2021-11-06 09:02:23.775412 082ad202590a2908fa2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c4771713644373850494e54734a706d58334c3269362b394c41506d6277414c54766e66564c436b7a5979553d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,Gqq6D78PINTsJpmX3L2i6+9LAPmbwALTvnfVLCkzYyU= 2021-11-06 09:02:26.958853 082ad2025f0a2f08ccca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c72426d4d4b2f735051754e57334d69755134745a344a6e346c65342b6d4b686d7166692b7a2b70326b4c4d3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,rBmMK/sPQuNW3MiuQ4tZ4Jn4le4+mKhmqfi+z+p2kLM= 2021-11-06 09:02:36.602116 082ad2025e0a2e08b74010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c51356f67496b3050554968755971524842764d745163696c634230746f544456494273487456326e3547383d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,Q5ogIk0PUIhuYqRHBvMtQcilcB0toTDVIBsHtV2n5G8= 2021-11-06 09:02:40.792478 082ad202620a3208ffc60210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c34622b56715a66345432695138356244696255414b75425936776a6a6854724d535a7052775447494542513d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,4b+VqZf4T2iQ85bDibUAKuBY6wjjhTrMSZpRwTGIEBQ= 2021-11-06 09:02:41.412220 082ad2025e0a2e08b24010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c34334b6e446d6379494953675170626e393673534c5a4d367062494a414a4c4c522b3565743179574476453d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,43KnDmcyIISgQpbn96sSLZM6pbIJAJLLR+5et1yWDvE= 2021-11-06 09:02:44.050023 082ad202600a3008cbc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c4c4f727750756a79636435654f46444755376b65356a6446685a36507a50646246774845745765706432593d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,LOrwPujycd5eOFDGU7ke5jdFhZ6PzPdbFwHEtWepd2Y= 2021-11-06 09:02:48.246768 082ad2025e0a2e08acd80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c41364a4a2b7448367876426a384a53344d794e6c554654667a4146697430686a73456c4c434c37486a6b4d3d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,A6JJ+tH6xvBj8JS4MyNlUFTfzAFit0hjsElLCL7HjkM= 2021-11-06 09:02:48.358846 082ad2025f0a2f08cdca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c4f496e3841375274614a7a2f54586b6278544f6f38496e777632754f56376b6435522f2b374b4a31546d383d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,OIn8A7RtaJz/TXkbxTOo8Inwv2uOV7kd5R/+7KJ1Tm8= 2021-11-06 09:02:55.721291 082ad202600a3008cdd80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5828122c415055712f7151307a78617035624e67687a574a4c3452693052654164736c46414d5a43765a35304855773d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X(.,APUq/qQ0zxap5bNghzWJL4Ri0ReAdslFAMZCvZ50HUw= 2021-11-06 09:02:57.155279 082ad202600a3008f00110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c5230584f653852736952643635394e34694a776d685946486f772b6664657779537138327a7941525538593d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,R0XOe8RsiRd659N4iJwmhYFHow+fdewySq82zyARU8Y= 2021-11-06 09:03:08.656138 082ad2025a0a2a089e0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c46396379357a6e435a786a6e31624d6770677272364b526c4c6936484d545a5a79714537793774746f6f493d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,F9cy5znCZxjn1bMgpgrr6KRlLi6HMTZZyqE7y7ttooI= 2021-11-06 09:03:09.002609 082ad202600a3008ccc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c7557664768706f41464566464b59376f7367627037585758794c77652f645278566e444f66536f793541593d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,uWfGhpoAFEfFKY7osgbp7XWXyLwe/dRxVnDOfSoy5AY= 2021-11-06 09:03:09.758641 082ad2025f0a2f08ceca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c416b55534c6447544d4d782f35355344674d72496579733977574b2b6a41644166564257362f377a7349493d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,AkUSLdGTMMx/55SDgMrIeys9wWK+jAdAfVBW6/7zsII= 2021-11-06 09:03:19.066138 082ad202590a2908fb2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c656279374972736e76624e436b427a4f6c77707251687569615357762f4e322f51316e774f6c424e3445513d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,eby7IrsnvbNCkBzOlwprQhuiaSWv/N2/Q1nwOlBN4EQ= 2021-11-06 09:03:30.337928 082ad202600a3008cdc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c42596777645268635a4f3934676d4d554857464857524a37784935777663742f4d5354616746386269686b3d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,BYgwdRhcZO94gmMUHWFHWRJ7xI5wvct/MSTagF8bihk= 2021-11-06 09:03:31.160625 082ad2025f0a2f08cfca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507c5864122c4744564e443962575730583647506336522f32734e7242714d422f76514331587977426d6c4a612f6e396b3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P|Xd.,GDVND9bWW0X6GPc6R/2sNrBqMB/vQC1XywBmlJa/n9k= 2021-11-06 09:03:31.686155 082ad2025e0a2e08b84010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c6977754a462b7849323470624e36777a6748756e516954437a786a564b646163507065586d3767324464553d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,iwuJF+xI24pbN6wzgHunQiTCzxjVKdacPpeXm7g2DdU= 2021-11-06 09:03:36.164881 082ad202620a320880c70210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507c582f122c65462b552f37424d59432b486b6e4574464b4356646d6e334a352f4d7772647357434830306844315865593d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P|X/.,eF+U/7BMYC+HknEtFKCVdmn3J5/MwrdsWCH00hD1XeY= 2021-11-06 09:03:36.498667 082ad2025e0a2e08b34010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c4848433758627256664f494954724b7072633264714a6668797437726b2f3262354d5a47594836756852553d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,HHC7XbrVfOIITrKprc2dqJfhyt7rk/2b5MZGYH6uhRU= 2021-11-06 09:03:43.537077 082ad2025e0a2e08add80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c577869697a736c56676378504b626b4f6959426c597979386d78454a5047306641524e4c654971504136633d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,WxiizslVgcxPKbkOiYBlYyy8mxEJPG0fARNLeIqPA6c= 2021-11-06 09:03:51.127794 082ad202600a3008ced80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5828122c3966496f4458316a554b4b51496e63394b307368536c343263417162756d55597a626c4e6b596d343930553d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X(.,9fIoDX1jUKKQInc9K0shSl42cAqbumUYzblNkYm490U= 2021-11-06 09:03:51.634558 082ad202600a3008cec40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c477638306f4c52766c4f6c704e37434130744d584b6a6f44794b4668396a636c5342617068356c736f52453d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,Gv80oLRvlOlpN7CA0tMXKjoDyKFh9jclSBaph5lsoRE= 2021-11-06 09:03:52.352146 082ad2025f0a2f08d0ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c536c734d536948474678517746413371646133366234695235704a7932324b787747694c61435a443970513d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,SlsMSiHGFxQwFA3qda36b4iR5pJy22KxwGiLaCZD9pQ= 2021-11-06 09:03:52.356086 082ad202600a3008f10110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c7962514b6773754a31514b3038687a546933534b2f584e3863783644715241377a4251436c4d68596b55773d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,ybQKgsuJ1QK08hzTi3SK/XN8cx6DqRA7zBQClMhYkUw= 2021-11-06 09:04:12.932599 082ad202600a3008cfc40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c6f356637674d776a314c344a4572464736396233536b646c4f32314571717735477379444f5465664646733d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,o5f7gMwj1L4JErFG69b3SkdlO21Eqqw5GsyDOTefFFs= 2021-11-06 09:04:13.853831 082ad2025f0a2f08d1ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c4d436a4f774c7a4f67553562676d386b71654f327954364874562b595838594e753354683467566e6863343d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,MCjOwLzOgU5bgm8kqeO2yT6HtV+YX8YNu3Th4gVnhc4= 2021-11-06 09:04:14.356548 082ad202590a2908fc2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c796d6559746d2b6934514a2b6b3859715a4c573571796a512f574a65514d514d326f4f47506e2f347843303d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,ymeYtm+i4QJ+k8YqZLW5qyjQ/WJeQMQM2oOGPn/4xC0= 2021-11-06 09:04:19.044042 082ad2025a0a2a089f0510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c36384362727a656d316a71545061455662732f5a674d4932506136386c5939714d725475616e546950676b3d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,68Cbrzem1jqTPaEVbs/ZgMI2Pa68lY9qMrTuanTiPgk= 2021-11-06 09:04:26.874854 082ad2025e0a2e08b94010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c7a6b69326349705839325a6152496363455a666d3769346f6f417276314244776f6570496839574f7531383d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,zki2cIpX92ZaRIccEZfm7i4ooArv1BDwoepIh9WOu18= 2021-11-06 09:04:31.353223 082ad202620a320881c70210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507d582f122c646d5641784770537077766d7a4c6b794f55566341442f6a61614d487861376756744c4b4f373864354e4d3d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P}X/.,dmVAxGpSpwvmzLkyOUVcAD/jaaMHxa7gVtLKO78d5NM= 2021-11-06 09:04:31.584851 082ad2025e0a2e08b44010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c336a43385876502f4534616c78646d474b6a586e31453057745176794c527658664363557131794556536f3d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,3jC8XvP/E4alxdmGKjXn1E0WtQvyLRvXfCcUq1yEVSo= 2021-11-06 09:04:34.331134 082ad202600a3008d0c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c3259466535486b45706a6559702b5357356968522f7939392b4b65456150726a504a6e6452535a635536733d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,2YFe5HkEpjeYp+SW5ihR/y99+KeEaPrjPJndRSZcU6s= 2021-11-06 09:04:35.254981 082ad2025f0a2f08d2ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c72344953624e67524a495a54724d73677832634c2b784b50544b5a7871543255674d30306d314e6c42316f3d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,r4ISbNgRJIZTrMsgx2cL+xKPTKZxqT2UgM00m1NlB1o= 2021-11-06 09:04:38.827506 082ad2025e0a2e08aed80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c634c667a623577447070375a62625a48483732556350324a5270467a6a48616b486e644c6c5045324a47493d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,cLfzb5wDpp7ZbbZHH72UcP2JRpFzjHakHndLlPE2JGI= 2021-11-06 09:04:46.211077 082ad202600a3008cfd80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5828122c785a346d63646e595359654f6b614f4e7762334f4c5057317633667642613346694e367679754f6f316a303d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X(.,xZ4mcdnYSYeOkaONwb3OLPW1v3fvBa3FiN6vyuOo1j0= 2021-11-06 09:04:47.441915 082ad202600a3008f20110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c384d3075463961384a3576364b6863454a3758536d5a625261556a443159304f2b4136686b6654394634733d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,8M0uF9a8J5v6KhcEJ7XSmZbRaUjD1Y0O+A6hkfT9F4s= 2021-11-06 09:04:56.652476 082ad2025f0a2f08d3ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c765048512f6b792b645039734c7a6f4f4e664b55737432326a4f537576784335555a432f2f7063657047593d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,vPHQ/ky+dP9sLzoONfKUst22jOSuvxC5UZC//pcepGY= 2021-11-06 09:04:56.857121 082ad202600a3008d1c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c312f4e6e44314759425a706568354d4f33374b6f494b4837332b4b714b2f446b4d3772692f7951456445493d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,1/NnD1GYBZpeh5MO37KoIKH73+KqK/DkM7ri/yQEdEI= 2021-11-06 09:05:09.749458 082ad202590a2908fd2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c6b2b5462504353366e492b4470516b714461796c717561784b75344f504669756661336263527842544e413d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,k+TbPCS6nI+DpQkqDaylquaxKu4OPFiufa3bcRxBTNA= 2021-11-06 09:05:18.768553 082ad2025f0a2f08d4ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c50625635562f763044556e6c384a384366734368323579486d445a73784a61396e535475674c314a505a553d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,PbV5V/v0DUnl8J8CfsCh25yHmDZsxJa9nSTugL1JPZU= 2021-11-06 09:05:19.111849 082ad202600a3008d2c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c5776457743715465384c30644d526a766379446d6861524f484d596945764a4b3831554d586953356542383d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,WvEwCqTe8L0dMRjvcyDmhaROHMYiEvJK81UMXiS5eB8= 2021-11-06 09:05:21.964492 082ad2025e0a2e08ba4010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507c5838122c363349736d53386154626f2b2b6761706e694351427644766d75793254674d715745725255367351536e413d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P|X8.,63IsmS8aTbo++gapniCQBvDvmuy2TgMqWErRU6sQSnA= 2021-11-06 09:05:26.541145 082ad202620a320882c70210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507d582f122c71307651704f6e73774d624155336a4b5872532f6470527631487377726d764974386f546e4a46307451673d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P}X/.,q0vQpOnswMbAU3jKXrS/dpRv1HswrmvIt8oTnJF0tQg= 2021-11-06 09:05:26.674157 082ad2025e0a2e08b54010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c6b3130685a365431495937584970374b58524634564144377951386c4472425676794841775875775933733d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,k10hZ6T1IY7XIp7KXRF4VAD7yQ8lDrBVvyHAwXuwY3s= 2021-11-06 09:05:29.435325 082ad2025a0a2a08a00510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c716a766b63436f3276466f716e49784233345a4f4b6264637649474c56427874496a4a694466596b4272413d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,qjvkcCo2vFoqnIxB34ZOKbdcvIGLVBxtIjJiDfYkBrA= 2021-11-06 09:05:34.017589 082ad2025e0a2e08afd80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c4857534a3330646b716d434a2b4b6c6f664157696a4f68705565795950514f45394b65516b4678423270303d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,HWSJ30dkqmCJ+KlofAWijOhpUeyYPQOE9KeQkFxB2p0= 2021-11-06 09:05:40.474412 082ad202600a3008d3c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509f015864122c655974367451693470505a2b36624c537766624c6752494451716d346d51716c446256596e4e5164652f733d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,eYt6tQi4pPZ+6bLSwfbLgRIDQqm4mQqlDbVYnNQde/s= 2021-11-06 09:05:40.922253 082ad2025f0a2f08d5ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c454b76503079667451696f316661494b585878476275377333674f45786168584137444e7775486e7835773d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,EKvP0yftQio1faIKXXxGbu7s3gOExahXA7DNwuHnx5w= 2021-11-06 09:05:41.297027 082ad202600a3008d0d80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5828122c3047784d523063694b7a366b30354b6649704d4e423867344d353164462f4b556b6949336e454d6c536a6f3d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X(.,0GxMR0ciKz6k05KfIpMNB8g4M51dF/KUkiI3nEMlSjo= 2021-11-06 09:05:42.527542 082ad202600a3008f30110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c5968633846744772495076704a4148656565327750587364485a65435831556f737836713746486a6d796b3d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,Yhc8FtGrIPvpJAHeee2wPXsdHZeCX1Uosx6q7FHjmyk= 2021-11-06 09:06:01.874799 082ad202600a3008d4c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c794804509f015864122c2f514378566e52494a794c6a7468343265442b74416e61424f4c41504870366b7a743939746d4b6d4554453d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,/QCxVnRIJyLjth42eD+tAnaBOLAPHp6kzt99tmKmETE= 2021-11-06 09:06:05.039876 082ad202590a2908fe2e10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c643066536e397762666c3435624834666546714144426f4256744466516456703842386f616a4d334c33343d .*..Y.).......ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,d0fSn9wbfl45bH4feFqADBoBVtDfQdVp8B8oajM3L34= 2021-11-06 09:06:06.003023 082ad2025f0a2f08d6ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c705a7348624353436a48672b364e66787a2f6c624b624b51416d384a43715367447a702b336e35587542383d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,pZsHbCSCjHg+6Nfxz/lbKbKQAm8JCqSgDzp+3n5XuB8= 2021-11-06 09:06:17.046709 082ad2025e0a2e08bb4010031a0c6563396630643934313563612003280330013801420b4d617374657220426174684803507d5838122c6f7a524c4530452b55724f737970686d6e6971694a5878386c354d5a5857434b694b5572422f73433938413d .*..^....@....ec9f0d9415ca .(.0.8.B.Master BathH.P}X8.,ozRLE0E+UrOsyphmniqiJXx8l5MZXWCKiKUrB/sC98A= 2021-11-06 09:06:21.757415 082ad2025e0a2e08b64010001a0c6563396630643934313637362003280330013801420b44696e696e6720526f6f6d4803507c5831122c7a78434a464a55454d4179595367315735566c56466746683079772b63594f4b38687a646e6758427749413d .*..^....@....ec9f0d941676 .(.0.8.B.Dining RoomH.P|X1.,zxCJFJUEMAyYSg1W5VlVFgFh0yw+cYOK8hzdngXBwIA= 2021-11-06 09:06:21.836122 082ad202620a320883c70210021a0c6563396630643934306565612003280330013801420e4d617374657220426564726f6f6d4803507d582e122c474c6e7a33774c6f2b6e797a4256454d5252537768466f34497a6668384c34316e544e41583236714848343d .*..b.2........ec9f0d940eea .(.0.8.B.Master BedroomH.P}X..,GLnz3wLo+nyzBVEMRRSwhFo4Izfh8L41nTNAX26qHH4= 2021-11-06 09:06:23.786170 082ad202600a3008d5c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c346843644f79304147414c6c414a7a61443534436c5046617351704d633375507038654d356a492f5a63733d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,4hCdOy0AGALlAJzaD54ClPFasQpMc3uPp8eM5jI/Zcs= 2021-11-06 09:06:27.685555 082ad2025f0a2f08d7ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c61747462374a767058584c3733324b4b755650634770304474634c426b386f4f454a2b51466338554477383d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,attb7JvpXXL732KKuVPcGp0DtcLBk8oOEJ+QFc8UDw8= 2021-11-06 09:06:29.511453 082ad2025e0a2e08b0d80210061a0c6563396630643934303837322003280330013801420a477565737420426174684803507c5833122c354156386e672f626945615a475753535761517350366e7a566c484b686a557251467279326b48487264453d .*..^..........ec9f0d940872 .(.0.8.B.Guest BathH.P|X3.,5AV8ng/biEaZGWSSWaQsP6nzVlHKhjUrQFry2kHHrdE= 2021-11-06 09:06:36.384213 082ad202600a3008d1d80210011a0c6563396630643934313363322003280330013801420c4c61756e64727920426174684803507c5828122c344c35534d7250564c594c6e574130386a384d6d6663477476324b2f34435636376c455745374b47666b303d .*..`.0........ec9f0d9413c2 .(.0.8.B.Laundry BathH.P|X(.,4L5SMrPVLYLnWA08j8MmfcGtv2K/4CV67lEWE7KGfk0= 2021-11-06 09:06:37.613790 082ad202600a3008f40110071a0c6563396630643934313563322003280330013801420d477565737420426564726f6f6d4803507c582a122c6f4b2b71636c61616b4374376a30764264416c5a69575165786f6f6d395146315756686247637a614f584d3d .*..`.0.......ec9f0d9415c2 .(.0.8.B.Guest BedroomH.P|X*.,oK+qclaakCt7j0vBdAlZiWQexoom9QF1WVhbGczaOXM= 2021-11-06 09:06:39.826400 082ad2025a0a2a08a10510041a0c656339663064393430636665200328033001380142074b69746368656e4803507d582d122c6549425a3258584e634c5a58796f43535a304b625732503276345646376345686931397942524d3135356b3d .*..Z.*.......ec9f0d940cfe .(.0.8.B.KitchenH.P}X-.,eIBZ2XXNcLZXyoCSZ0KbW2P2v4VF7cEhi19yBRM155k= 2021-11-06 09:06:45.902491 082ad202600a3008d6c40110121a0c6334626538346632326332622001280930013802420b4856414320537570706c79480450a0015864122c465434686263783574792b726753594e5376316e57396853374f4f2f327059767578426f58773172664b383d .*..`.0........c4be84f22c2b .(.0.8.B.HVAC SupplyH.P..Xd.,FT4hbcx5ty+rgSYNSv1nW9hS7OO/2pYvuxBoXw1rfK8= 2021-11-06 09:06:48.973872 082ad2025f0a2f08d8ca0110131a0c6334626538346632323235652001280930013802420b485641432052657475726e4802507d5864122c653736785033756374443456457735687a706f637746717035367663546d5572774e364874336d784777733d .*.._./........c4be84f2225e .(.0.8.B.HVAC ReturnH.P}Xd.,e76xP3uctD4VEw5hzpocwFqp56vcTmUrwN6Ht3mxGws= ```

Messages sent by sensors during link mode

``` 2021-11-06 09:12:50.148661 082bd202590a2908872f10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c627742346a6b71635870344a745a4d505449486d4c797231436766714f52533152614a744a50622f49446f3d .+..Y.)../....ec9f0d9415f6 .(.0.8.B.OfficeH.P{X).,bwB4jkqcXp4JtZMPTIHmLyr1CgfqORS1RaJtJPb/IDo= ```

What are your thoughts, @garbled1?

hpeyerl commented 2 years ago

I wonder if the SocketHandler thread is blocked on the WiFi Setup dialog.

Maybe I'll try to drive the touchscreen through /dev/input/event1 later after my 'work day' ends.

I once hacked this into streaming from /dev/fb0 ... https://github.com/n3wtron/simple_mjpeg_streamer_http_server I'll see if I can find that hack somewhere.

garbled1 commented 2 years ago

I was able to get SSDP 100% reliable in C. My firmware is older tho. I'll have to test again with my more modern one. I'm not sure about the announcements, but normally you force one by asking for them with an SSDP scan.

doug-hoffman commented 2 years ago

I let HA handle the scan and it'd rarely work. It may be possible to make it more reliable, but doing it HA's way wasn't – at least on the latest stat firmware. It's also possible the bug is only in newer firmware or only certain models.

hpeyerl commented 2 years ago

I hacked this up to stream the contents of /dev/fb0 while running maestro. It did correctly stream the above Wifi dialog but after restarting maestro to see what intermediate screens it would display, there weren't any and I can't get that dialog back. So now I'm not sure what to think. But I also don't have time to dig into it any more this week.

#!/usr/bin/python
'''
    Author: Igor Maculan - n3wtron@gmail.com
    A Simple mjpg stream http server
'''
import sys
from PIL import Image
import os
import threading
from BaseHTTPServer import BaseHTTPRequestHandler,HTTPServer
from SocketServer import ThreadingMixIn
import encodings.idna
import subprocess
import StringIO
import time
capture=None

class CamHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path.endswith('.mjpg'):
            self.send_response(200)
            self.send_header('Content-type','multipart/x-mixed-replace; boundary=--jpgboundary')
            self.end_headers()
            while True:
                try:
                                        img = get_frame()
                    jpg = Image.frombuffer("RGBA", (480,272), img, 'raw', 'RGBA', 0, 1)
                                        rgb=jpg.convert('RGB')
                    rgb.save("/tmp/foo.jpg")
                                        st=os.stat("/tmp/foo.jpg")
                    self.wfile.write("--jpgboundary\r\n".encode())
                    self.send_header('Content-type','image/jpeg')
                    self.send_header('Content-length',str(st.st_size))
                    self.end_headers()
                    rgb.save(self.wfile,format='JPEG')
                    time.sleep(0.05)
                except KeyboardInterrupt:
                    break
            return
        return

class ThreadedHTTPServer(ThreadingMixIn, HTTPServer):
    """Handle requests in a separate thread."""

def get_frame():
     fb.seek(0)
     buf=fb.read(480*272*4)
     return buf

def main():
        global img
        global fb

        fb = open("/dev/fb0", "rb")
    try:
        server = ThreadedHTTPServer(('', 8080), CamHandler)
        print "server started"
        server.serve_forever()
    except KeyboardInterrupt:
        server.socket.close()

if __name__ == '__main__':
    main()

Edit: I lied. It does come up, if I wait long enough.

tannercollin commented 2 years ago

Could we do a replay attack? Capture sensor messages for every 0.5 C increment in a reasonable range and replay them to the thermostat?

I'm looking to get my own temperature data into the thermostat via my home automation system. The data will come from various Arduino and Acurite sensors throughout my house. All I need is to fake one Venstar Wifi sensor to get a temperature value in.

tannercollin commented 2 years ago

@pavlohamov any hints?

TeXniKK commented 2 years ago

I was about to say they're probably just adding a salt to it.

Interesting, the firmware image appears to be a compressed kernel with a jffs2 filesystem. On a lark, thinking I might be able to find something related to the above, I binwalk'd it, extracted the jjfs2 and mounted it. Looks to be a pretty boring busybox linux-2.6.30 arm.

Appears that most thermostat functions are done with drivers statically linked into the kernel. Anyone want to try going after them for driver source given the GPL should confer those rights on us. :-)

It appears to use a GUI app called 'maestro' which is probably some internal thing that writes to /dev/fb.

There are some Sqlite queries but no .db file.

There are also some RSA Private keys and certificates. Possibly for Skyport access or something.

1 ./linuxrc
0 ./proc
23    ./.DS_Store
15    ./home/.DS_Store
0 ./home/volatile
51    ./home/bootloader/Updater.bin
5 ./home/bootloader/blupdate
1 ./home/bootloader/startupdate
56    ./home/bootloader
0 ./home/thermostat
1 ./home/gui/startgui
577   ./home/gui/stat.mxe
263   ./home/gui/fonts/arial.ttf
48    ./home/gui/fonts/VeraMono-Bold.ttf
75    ./home/gui/fonts/gen.ttf
51    ./home/gui/fonts/arb.ttf
50    ./home/gui/fonts/fut.ttf
4 ./home/gui/fonts/icomoon.ttf
490   ./home/gui/fonts
0 ./home/gui/lang
27    ./home/gui/settings.json
6 ./home/gui/images/holrp1.png
1 ./home/gui/images/svpt.png
5 ./home/gui/images/daydwn.png
2 ./home/gui/images/linvd.png
1 ./home/gui/images/bbnext.png
2 ./home/gui/images/clnxt1.png
4 ./home/gui/images/holpvo.png
3 ./home/gui/images/pcen1.png
5 ./home/gui/images/scbg.png
10    ./home/gui/images/isbg.png
2 ./home/gui/images/clprv2.png
1 ./home/gui/images/clearr.png
3 ./home/gui/images/tpmdo2.png
2 ./home/gui/images/clhol.png
14    ./home/gui/images/daybg.png
19    ./home/gui/images/hmsnfl.png
3 ./home/gui/images/tpprmt.png
1 ./home/gui/images/arrow.png
1 ./home/gui/images/liitds.png
4 ./home/gui/images/holupu.png
2 ./home/gui/images/wfssls.png
3 ./home/gui/images/wfrefs.png
2 ./home/gui/images/oeled1.png
5 ./home/gui/images/holnxu.png
2 ./home/gui/images/oskal2.png
8 ./home/gui/images/g7bg.png
2 ./home/gui/images/limnit.png
1 ./home/gui/images/etccks.png
2 ./home/gui/images/tdmm2.png
2 ./home/gui/images/wfsskb.png
5 ./home/gui/images/altuv0.png
5 ./home/gui/images/icons/skyport.png
1 ./home/gui/images/icons/infocard.png
7 ./home/gui/images/icons/scrnsv.png
6 ./home/gui/images/icons/acc.png
7 ./home/gui/images/icons/prefs.png
1 ./home/gui/images/icons/alerr.png
8 ./home/gui/images/icons/time.png
1 ./home/gui/images/icons/images-stack.png
3 ./home/gui/images/icons/wfon.png
1 ./home/gui/images/icons/clock-select.png
1 ./home/gui/images/icons/alexc.png
6 ./home/gui/images/icons/eheat.png
1 ./home/gui/images/icons/gear.png
6 ./home/gui/images/icons/sec.png
8 ./home/gui/images/icons/sched.png
3 ./home/gui/images/icons/skicn.png
9 ./home/gui/images/icons/fnprog.png
1 ./home/gui/images/icons/dealer.png
5 ./home/gui/images/icons/wifi.png
7 ./home/gui/images/icons/info.png
9 ./home/gui/images/icons/setup.png
2 ./home/gui/images/icons/lcksm.png
7 ./home/gui/images/icons/disp.png
6 ./home/gui/images/icons/altbnr.png
2 ./home/gui/images/icons/skicy.png
6 ./home/gui/images/icons/hum.png
3 ./home/gui/images/icons/altmsg.png
7 ./home/gui/images/icons/vac.png
3 ./home/gui/images/icons/wfof.png
1 ./home/gui/images/icons/succes.png
1 ./home/gui/images/icons/alqst.png
7 ./home/gui/images/icons/alerts.png
135   ./home/gui/images/icons
2 ./home/gui/images/limnsl.png
10    ./home/gui/images/wfnfbg.png
2 ./home/gui/images/homeblits/black/hmmdo1.png
2 ./home/gui/images/homeblits/black/hmfno1.png
2 ./home/gui/images/homeblits/black/hmfna1.png
3 ./home/gui/images/homeblits/black/hmmdh2.png
3 ./home/gui/images/homeblits/black/hmmda2.png
2 ./home/gui/images/homeblits/black/hmmwh1.png
3 ./home/gui/images/homeblits/black/hmmwh2.png
1 ./home/gui/images/homeblits/black/hmfno2.png
2 ./home/gui/images/homeblits/black/hmmwo1.png
2 ./home/gui/images/homeblits/black/hmmdo2.png
3 ./home/gui/images/homeblits/black/hmmdc2.png
2 ./home/gui/images/homeblits/black/hmmwo2.png
1 ./home/gui/images/homeblits/black/hmfna2.png
2 ./home/gui/images/homeblits/black/hmmdh1.png
3 ./home/gui/images/homeblits/black/hmmwc2.png
3 ./home/gui/images/homeblits/black/hmmda1.png
6 ./home/gui/images/homeblits/black/hmmdbg.png
5 ./home/gui/images/homeblits/black/hmfnbg.png
3 ./home/gui/images/homeblits/black/hmmwc1.png
3 ./home/gui/images/homeblits/black/hmmdc1.png
49    ./home/gui/images/homeblits/black
3 ./home/gui/images/homeblits/hmcl1.png
2 ./home/gui/images/homeblits/hmstc.png
2 ./home/gui/images/homeblits/hmsti.png
10    ./home/gui/images/homeblits/hmomsg.png
2 ./home/gui/images/homeblits/hmste.png
2 ./home/gui/images/homeblits/hmsth.png
3 ./home/gui/images/homeblits/hmwm1.png
3 ./home/gui/images/homeblits/hmwm2.png
2 ./home/gui/images/homeblits/blue/hmmdo1.png
2 ./home/gui/images/homeblits/blue/hmfno1.png
2 ./home/gui/images/homeblits/blue/hmfna1.png
3 ./home/gui/images/homeblits/blue/hmmdh2.png
3 ./home/gui/images/homeblits/blue/hmmda2.png
2 ./home/gui/images/homeblits/blue/hmmwh1.png
3 ./home/gui/images/homeblits/blue/hmmwh2.png
1 ./home/gui/images/homeblits/blue/hmfno2.png
2 ./home/gui/images/homeblits/blue/hmmwo1.png
2 ./home/gui/images/homeblits/blue/hmmdo2.png
3 ./home/gui/images/homeblits/blue/hmmdc2.png
2 ./home/gui/images/homeblits/blue/hmmwo2.png
1 ./home/gui/images/homeblits/blue/hmfna2.png
2 ./home/gui/images/homeblits/blue/hmmdh1.png
3 ./home/gui/images/homeblits/blue/hmmwc2.png
3 ./home/gui/images/homeblits/blue/hmmda1.png
5 ./home/gui/images/homeblits/blue/hmmdbg.png
5 ./home/gui/images/homeblits/blue/hmfnbg.png
3 ./home/gui/images/homeblits/blue/hmmwc1.png
3 ./home/gui/images/homeblits/blue/hmmdc1.png
49    ./home/gui/images/homeblits/blue
2 ./home/gui/images/homeblits/hmstfc.png
3 ./home/gui/images/homeblits/hmcl2.png
127   ./home/gui/images/homeblits
1 ./home/gui/images/clsel.png
17    ./home/gui/images/tpsplt.png
11    ./home/gui/images/wfscan.png
2 ./home/gui/images/tiit1.png
4 ./home/gui/images/wfnwat.png
3 ./home/gui/images/pccl2.png
4 ./home/gui/images/icdelt.png
2 ./home/gui/images/clnxt2.png
1 ./home/gui/images/pes5.png
3 ./home/gui/images/pebg.png
3 ./home/gui/images/ldanim.gif
2 ./home/gui/images/bbaway.png
11    ./home/gui/images/tpedit.png
7 ./home/gui/images/tsetbg.png
2 ./home/gui/images/oskan2.png
12    ./home/gui/images/osknum.png
3 ./home/gui/images/holupn.png
2 ./home/gui/images/sixit2.png
7 ./home/gui/images/pgicon.png
1 ./home/gui/images/oebtn1.png
5 ./home/gui/images/numbg.png
4 ./home/gui/images/tpmdc2.png
2 ./home/gui/images/holchk.png
2 ./home/gui/images/oskal1.png
3 ./home/gui/images/isnxt2.png
3 ./home/gui/images/holrpo.png
1 ./home/gui/images/bbback.png
3 ./home/gui/images/tprvbg.png
1 ./home/gui/images/anldot.png
2 ./home/gui/images/wfnwof.png
4 ./home/gui/images/tpmdh2.png
19    ./home/gui/images/svbg.png
29    ./home/gui/images/anlcbg.png
3 ./home/gui/images/holck.png
3 ./home/gui/images/tpmdo1.png
2 ./home/gui/images/oskmr2.png
3 ./home/gui/images/anmfan.gif
2 ./home/gui/images/wfs4.png
11    ./home/gui/images/hmlkbg.png
12    ./home/gui/images/hmlkbr.png
2 ./home/gui/images/linvd2.png
2 ./home/gui/images/tdhp2.png
1 ./home/gui/images/pes1.png
2 ./home/gui/images/tdminm.png
2 ./home/gui/images/tpbg.png
2 ./home/gui/images/clgrid.png
4 ./home/gui/images/tpnite.png
18    ./home/gui/images/skpstatus.png
2 ./home/gui/images/g7icn.png
3 ./home/gui/images/bbhome.png
2 ./home/gui/images/wfssit.png
0 ./home/gui/images/themes/halloween
0 ./home/gui/images/themes/kitchen
0 ./home/gui/images/themes/leather
0 ./home/gui/images/themes/hanukkah
20    ./home/gui/images/themes/christmas/bg_night.jpg
1 ./home/gui/images/themes/christmas/bbbg.png
40    ./home/gui/images/themes/christmas/bg_day.jpg
60    ./home/gui/images/themes/christmas
0 ./home/gui/images/themes/everest
0 ./home/gui/images/themes/outback
0 ./home/gui/images/themes/wood
1 ./home/gui/images/themes/cinco/bbbg.png
35    ./home/gui/images/themes/cinco/bg_day.jpg
36    ./home/gui/images/themes/cinco
0 ./home/gui/images/themes/metal
0 ./home/gui/images/themes/sunset
0 ./home/gui/images/themes/coffee
0 ./home/gui/images/themes/maui
0 ./home/gui/images/themes/thanksgiving
38    ./home/gui/images/themes/buildings/bg_night.jpg
1 ./home/gui/images/themes/buildings/bbbg.png
37    ./home/gui/images/themes/buildings/bg_day.jpg
75    ./home/gui/images/themes/buildings
171   ./home/gui/images/themes
5 ./home/gui/images/tpday.png
2 ./home/gui/images/wfs5.png
10    ./home/gui/images/link.gif
2 ./home/gui/images/oskmr1.png
7 ./home/gui/images/altuv1.png
2 ./home/gui/images/alrtsv.png
1 ./home/gui/images/bbof.png
3 ./home/gui/images/tpeve.png
2 ./home/gui/images/tctuov.png
2 ./home/gui/images/tpmdsl.png
1 ./home/gui/images/alrtc1.png
3 ./home/gui/images/liitpr.png
12    ./home/gui/images/osklow.png
3 ./home/gui/images/isnxt1.png
20    ./home/gui/images/itbshort.png
2 ./home/gui/images/tphglt.png
74    ./home/gui/images/holbg.png
3 ./home/gui/images/isprv1.png
1 ./home/gui/images/alrtuv.png
4 ./home/gui/images/tpmda2.png
5 ./home/gui/images/analrt.gif
1 ./home/gui/images/pes2.png
2 ./home/gui/images/holoit.png
5 ./home/gui/images/ovbg.png
2 ./home/gui/images/tpchk.png
1 ./home/gui/images/alrtbr.png
5 ./home/gui/images/tcsplt.png
3 ./home/gui/images/holdnd.png
9 ./home/gui/images/skpaired.png
2 ./home/gui/images/clprv1.png
14    ./home/gui/images/tcedit.png
1 ./home/gui/images/tptuov.png
3 ./home/gui/images/altics.png
2 ./home/gui/images/oskdl1.png
2 ./home/gui/images/oeled0.png
1 ./home/gui/images/lock.png
3 ./home/gui/images/dglchl.png
1 ./home/gui/images/bbup.png
2 ./home/gui/images/dlreml.png
2 ./home/gui/images/alrtfn.png
1 ./home/gui/images/alrtc2.png
16    ./home/gui/images/skpair1.png
5 ./home/gui/images/holrp2.png
1 ./home/gui/images/alticr.png
9 ./home/gui/images/isdet2.png
5 ./home/gui/images/holpvu.png
8 ./home/gui/images/tdehbg.png
2 ./home/gui/images/osksp1.png
1 ./home/gui/images/pcbtd.png
2 ./home/gui/images/tiit2.png
2 ./home/gui/images/linvu2.png
2 ./home/gui/images/alrtby.png
2 ./home/gui/images/tdhrm.png
1 ./home/gui/images/hmvbar.png
7 ./home/gui/images/iebg.png
4 ./home/gui/images/hlinfu.png
4 ./home/gui/images/icfan.png
2 ./home/gui/images/linvu.png
4 ./home/gui/images/tpmda1.png
17    ./home/gui/images/altfn1.png
2 ./home/gui/images/oskdl2.png
2 ./home/gui/images/stgit2.png
1 ./home/gui/images/tpspdn.png
2 ./home/gui/images/osksf2.png
3 ./home/gui/images/holdnn.png
15    ./home/gui/images/altfn0.png
1 ./home/gui/images/track.png
3 ./home/gui/images/holupd.png
2 ./home/gui/images/sixit1.png
2 ./home/gui/images/bbaltlcom.png
1 ./home/gui/images/pes0.png
3 ./home/gui/images/wflock.png
1 ./home/gui/images/svanim.gif
5 ./home/gui/images/holnxd.png
2 ./home/gui/images/tiit3.png
9 ./home/gui/images/hollgn.png
1 ./home/gui/images/alrtc3.png
2 ./home/gui/images/wflsit.png
6 ./home/gui/images/clhead.png
2 ./home/gui/images/dlrcnt.png
2 ./home/gui/images/osksf1.png
1 ./home/gui/images/litgup.png
3 ./home/gui/images/sixbg.png
1 ./home/gui/images/alrtc4.png
1 ./home/gui/images/tpclck.png
2 ./home/gui/images/oskcl2.png
2 ./home/gui/images/holinf.png
29    ./home/gui/images/dgccbg.png
4 ./home/gui/images/holrpu.png
2 ./home/gui/images/wfs3.png
2 ./home/gui/images/wfs1.png
12    ./home/gui/images/wfskp.png
2 ./home/gui/images/tdmp2.png
4 ./home/gui/images/hlinfd.png
1 ./home/gui/images/oskovr.png
1 ./home/gui/images/mslt.png
2 ./home/gui/images/altbt1.png
1 ./home/gui/images/bbcl.png
2 ./home/gui/images/tctdov.png
2 ./home/gui/images/holhlt.png
1 ./home/gui/images/bbht.png
2 ./home/gui/images/peday0.png
2 ./home/gui/images/pechk.png
2 ./home/gui/images/hmsoff.png
2 ./home/gui/images/ieitem.png
52    ./home/gui/images/widgetbg.png
2 ./home/gui/images/oskcl1.png
14    ./home/gui/images/stgbg.png
12    ./home/gui/images/hmlkbn.png
14    ./home/gui/images/msbg.png
2 ./home/gui/images/stgit1.png
3 ./home/gui/images/litgdn.png
1 ./home/gui/images/tpmdov.png
1 ./home/gui/images/alrtbw.png
5 ./home/gui/images/holpvd.png
3 ./home/gui/images/pcen2.png
2 ./home/gui/images/liitpo.png
1 ./home/gui/images/bbdown.png
1 ./home/gui/images/oebtn2.png
1 ./home/gui/images/clnow.png
5 ./home/gui/images/wifiscan.gif
1 ./home/gui/images/bbstcl.png
3 ./home/gui/images/hmssel.png
6 ./home/gui/images/oebg.png
3 ./home/gui/images/pccl1.png
1 ./home/gui/images/msrt.png
2 ./home/gui/images/osksp2.png
2 ./home/gui/images/tdhm2.png
0 ./home/gui/images/weather
3 ./home/gui/images/peday1.png
2 ./home/gui/images/holexc.png
1 ./home/gui/images/tpspup.png
1 ./home/gui/images/bbchk.png
9 ./home/gui/images/hmmdbg.png
29    ./home/gui/images/dgchbg.png
2 ./home/gui/images/liitsl.png
12    ./home/gui/images/osksym.png
2 ./home/gui/images/tpspdb.png
2 ./home/gui/images/pcen0.png
1 ./home/gui/images/bbstht.png
2 ./home/gui/images/dlrphn.png
2 ./home/gui/images/oskan1.png
1 ./home/gui/images/liit.png
8 ./home/gui/images/isdet1.png
2 ./home/gui/images/holrit.png
11    ./home/gui/images/hmmnfl.png
4 ./home/gui/images/holrpd.png
4 ./home/gui/images/dayup.png
1 ./home/gui/images/altbt0.png
20    ./home/gui/images/wfsspc.png
15    ./home/gui/images/kpbg.png
29    ./home/gui/images/dgcibg.png
1 ./home/gui/images/pes7.png
12    ./home/gui/images/oskcap.png
2 ./home/gui/images/dlrweb.png
8 ./home/gui/images/cnicon.png
3 ./home/gui/images/tpmdh1.png
6 ./home/gui/images/hmfnbg.png
2 ./home/gui/images/tdminp.png
4 ./home/gui/images/holnxo.png
3 ./home/gui/images/holrwn.png
1 ./home/gui/images/alrtbg.png
2 ./home/gui/images/sshsbg.png
1 ./home/gui/images/etcchk.png
1 ./home/gui/images/tptdov.png
3 ./home/gui/images/tpmorn.png
2 ./home/gui/images/tdhrp.png
2 ./home/gui/images/holcb.png
5 ./home/gui/images/tpmdc1.png
3 ./home/gui/images/isprv2.png
2 ./home/gui/images/holhdr.png
2 ./home/gui/images/wfs2.png
4 ./home/gui/images/holdnu.png
1590  ./home/gui/images
16    ./home/gui/launcher.mxe
2700  ./home/gui
0 ./home/volatilerestore
12    ./home/calibrate/center.png
11    ./home/calibrate/wait.png
36    ./home/calibrate/tscalibrate
21    ./home/calibrate/fbview
1 ./home/calibrate/startcalibrate
12    ./home/calibrate/botright.png
12    ./home/calibrate/topright.png
15    ./home/calibrate/post.png
12    ./home/calibrate/botleft.png
12    ./home/calibrate/topleft.png
143   ./home/calibrate
0 ./home/secure
2913  ./home
17    ./manifest.json.gz
0 ./lib
2 ./etc/profile
1 ./etc/sddpd.conf
1 ./etc/platform
1 ./etc/br-version
0 ./etc/ld.so.conf.d
3 ./etc/ld.so.cache
1 ./etc/fstab
1 ./etc/random-seed
11    ./etc/services
1 ./etc/TZ
1 ./etc/hostname
1 ./etc/inittab
1 ./etc/init.d/S45owl
1 ./etc/init.d/rcS
1 ./etc/init.d/S09temp
2 ./etc/init.d
2 ./etc/protocols
1 ./etc/identity
1 ./etc/passwd
1 ./etc/ifplugd/ifplugd.action
1 ./etc/ifplugd
1 ./etc/resolv.conf
1 ./etc/network/interfaces
1 ./etc/network
1 ./etc/ts.conf
1 ./etc/shadow
1 ./etc/issue
1 ./etc/directfbrc
1 ./etc/securetty
2 ./etc/inputrc
1 ./etc/group
1 ./etc/hosts
33    ./etc
0 ./usr
0 ./sys
0 ./mnt
1 ./bin/pwd
1 ./bin/kill
1 ./bin/ping
1 ./bin/run-parts
1 ./bin/linux32
1 ./bin/stty
1 ./bin/setarch
1 ./bin/cp
1 ./bin/rmdir
1 ./bin/mktemp
1 ./bin/date
1 ./bin/getopt
1 ./bin/ps
1 ./bin/mkdir
1 ./bin/watch
1 ./bin/mountpoint
1 ./bin/sync
1 ./bin/hostname
1 ./bin/dumpkmap
1 ./bin/rm
1 ./bin/netstat
1 ./bin/ln
1 ./bin/fdflush
1 ./bin/mv
1 ./bin/pidof
1 ./bin/ash
1 ./bin/touch
1 ./bin/mknod
1 ./bin/cat
1 ./bin/linux64
1 ./bin/uname
1 ./bin/mount
1 ./bin/dmesg
1 ./bin/pipe_progress
1 ./bin/printenv
295   ./bin/busybox
1 ./bin/ls
1 ./bin/login
1 ./bin/false
1 ./bin/echo
1 ./bin/true
1 ./bin/chmod
783   ./bin/maestro
1 ./bin/umount
1 ./bin/sh
1099  ./bin
0 ./var
0 ./sbin
0 ./dev/tty1
0 ./dev/mtd0
0 ./dev/mmcblk0p1
0 ./dev/i2c-0
0 ./dev/tty2
0 ./dev/mtd1
0 ./dev/mtdblock1
0 ./dev/console
0 ./dev/rtc0
0 ./dev/event0
0 ./dev/ttyS0
1 ./dev/thermostat/RemoteTemp
1 ./dev/thermostat/W2
1 ./dev/thermostat/GE
1 ./dev/thermostat/W3
1 ./dev/thermostat/OB
1 ./dev/thermostat/RTCLegacy
1 ./dev/thermostat/Y1
1 ./dev/thermostat/OutdoorTemp
1 ./dev/thermostat/IndoorTemp
1 ./dev/thermostat/EquipmentType
1 ./dev/thermostat/G
1 ./dev/thermostat/W1
1 ./dev/thermostat/Y2
7 ./dev/thermostat
0 ./dev/mtd2
0 ./dev/tty
1 ./dev/backlight
0 ./dev/mtdblock0
0 ./dev/random
0 ./dev/fb0
0 ./dev/mtdblock2
0 ./dev/event1
0 ./dev/urandom
0 ./dev/watchdog
0 ./dev/null
0 ./dev/ttySDIO0
0 ./dev/tty0
0 ./dev/mmcblk0
7 ./dev
0 ./tmp
4091  .

Guys, could you please advice, how can I dump firmware from my own Colortouch?

hpeyerl commented 2 years ago

We were working with the firmware images on the Venstar site and simply mounting them as images either using qemu tools or losetup under Linux. I don't think we've figured out (or tried to figure out) how to dump images straight from the devices themselves.

TeXniKK commented 2 years ago

We were working with the firmware images on the Venstar site and simply mounting them as images either using qemu tools or losetup under Linux. I don't think we've figured out (or tried to figure out) how to dump images straight from the devices themselves.

Got it. Are those images still available to download so that I can play with them?

hpeyerl commented 2 years ago

I don't know. I would imagine so since they're the images that the devices download to upgrade themselves. Before you ask, I don't know the URL anymore so I would have to figure that out again.

TeXniKK commented 2 years ago

I don't know. I would imagine so since they're the images that the devices download to upgrade themselves. Before you ask, I don't know the URL anymore so I would have to figure that out again.

Do I need to use Wireshark to capture this link it somehow?

doug-hoffman commented 2 years ago

Could we do a replay attack?

Yes. It wouldn't scale well for faking multiple sensors since every message includes everything about the sensor (name, id, MAC, power source, battery level, temp). If you only want to fake one, you could.

Are those images still available to download so that I can play with them?

https://apps.skyportlabs.com/ColorTouchDesktopApp/setup.exe https://apps.skyportlabs.com/ColorTouchDesktopApp/ColorTouchDesktopApp.dmg

You'll need to run the app to extract the firmware.

I gave up on Venstar, due to poor handling of aux heat with heat pumps (and an unwillingness to address issues), and switched to a RPi with one of these running Node-RED. After finding out Venstar stats were just ARM devices running linux, I was a lot less afraid of reliability issues doing the same thing to build my own.

tannercollin commented 2 years ago

It wouldn't scale well for faking multiple sensors

That's okay. I suspect whoever needs this functionality could get away with only faking one sensor as well. That's because their automation system could decide what actual sensors to listen to or average in software, and send the data via the fake one.

That's how I was yesterday. Try spoofing a packet with this:
echo -n 82bd202590a2908872f10051a0c656339663064393431356636200328033001380142064f66666963654803507b5829122c627742346a6b71635870344a745a4d505449486d4c797231436766714f52533152614a744a50622f49446f3d | xxd -p -r | socat - UDP-DATAGRAM:255.255.255.255:5001,broadcast
That's a "button press" packet, so it should get it to do things, even if it's not paired.

Were you able to get this replay to work? It doesn't seem to be doing anything for me :(

doug-hoffman commented 2 years ago

Replaying messages caused an unavailable (timed out) sensor to return to an available state when I was testing in the past. That message may not be enough to get the stat to add a new sensor. I never captured the initial pairing to see if there was any unicast traffic exchanged. No reason you can't do the pairing with the real sensor and replay the messages for the fake.

Like I said, I've moved on from Venstar, so I've not got anything set up to test with at this point.

tannercollin commented 2 years ago

I've moved on from Venstar

Want to ship me your old wifi sensor? I'll pay for shipping and publish any of my findings. I'm having a hell of a time finding them in Canada conveniently. Also be nice to reduce e-waste.

doug-hoffman commented 2 years ago

Want to ship me your old wifi sensor? I'll pay for shipping

Sure. Email me, (redacted).

tannercollin commented 2 years ago

Update: got the hardware! Thanks for sending it.

JeremyLaurenson commented 1 year ago

Hey folks,

My temp pros wont stay on the network and I was thinking of replacing with my own ESP or RP2020 + BME devices. Did you ever get any further?

hpeyerl / venstar_colortouch

Support for Wi-Fi sensor messages #34

What I've identified so far

Sample messages