Open backcountrymountains opened 1 year ago
uzlonewolf
commented
1 year ago Are you opening a persistent connection to catch asynchronous updates? Some DPs are only broadcasted when the device feels like it, you cannot query them directly.
it came back with "2228796" which is 28 bits
How do you figure? The 22nd bit (bit 21) is the highest bit set in that number. 2228796 = 00100010 00000010 00111100
backcountrymountains
commented
1 year ago I used the monitor.py script and it did occasionally show a log for temperature readings that was not queried in addition to the result of status queries. But I didn't get any result using d.generate_payload(tinytuya.UPDATEDPS,['116']) or d.generate_payload(tinytuya.UPDATEDPS) (116 is the DpID for "totalP" that shows some sort of power analog on iot.tuya.com)
Received Payload: {'devId': '75767832c45bbeda0fa3', 'dps': {'1': False, '2': 670, '3': 22, '4': 'cold', '5': 'high', '18': 0, '20': 0, '101': 0, '105': 'off', '110': 2228796, '113': '0', '114': '0', '119': '0', '120': 'off', '123': '0018', '125': 'great', '126': '0', '127': '0', '128': '0', '129': '1', '130': 26, '131': False, '132': False, '133': '0', '134': '{"t":1690814535,"s":false,"clr":true}'}}
Apparently I don't know how bits work.
Mapping your bits to the table from Query Things Data Model (which doesn't include a "19" for some reason) gives:
| Bit | Index | Description |
|---|---|---|
| 0 | 0 | Is the temperature adjustable in dehumidification mode? |
| 0 | 1 | Is the temperature adjustable in the air supply mode? |
| 1 | 2 | Is the temperature adjustable in automatic mode? |
| 0 | 3 | Fresh air volume identification |
| 0 | 4 | Vector air supply |
| 0 | 5 | Sweep left and right |
| 1 | 6 | Photosensitive |
| 0 | 7 | Intelligent dehumidification and mildew prevention |
| 0 | 8 | Humidity sensor |
| 0 | 9 | Evaporator cleaning |
| 0 | 10 | Save money and see it |
| 0 | 11 | Power Statistics |
| 0 | 12 | Generator mode |
| 0 | 13 | High temperature wind/cool wind |
| 1 | 14 | Air quality detection function |
| 0 | 15 | Set to empty (formerly: humidity function) |
| 0 | 16 | Set it to empty (formerly: equipment operation saves money and can be seen, temperature curve display) |
| 0 | 17 | 8 ℃ heating |
| 1 | 18 | Dirty and blocked filter function |
| 1 | 19 | ---not listed in result?--- |
| 1 | 20 | Whether there is PM2.5 |
| 1 | 21 | Temperature scale switch, 1 is Fahrenheit, 0 is Celsius |
| 0 | 22 | soft wind |
| 0 | 23 | Left and right wide-angle air supply |
This doesn't totally reconcile with what I can get from my device; I don't have #20. pm2.5 or #14. Air quality available in the iot.tuya.com logs of my device, but I do have #11 Power in the online logs.
I don't see anything about power in the app. How technically challenging is it to sniff what the device is sending to iot.tuya.com? Is there a guide for setting up MITM?
uzlonewolf
commented
1 year ago If it only updates asynchronously then sending UPDATEDPS will not do anything, you can only wait for the device to broadcast it. I have never seen a device which uploaded a DP to the cloud but did not broadcast it to the LAN.
As for those bits, you start counting from the right (bit 0 is the right-most bit):
| Bit | Index | Description |
|---|---|---|
| 0 | 0 | Is the temperature adjustable in dehumidification mode? |
| 0 | 1 | Is the temperature adjustable in the air supply mode? |
| 1 | 2 | Is the temperature adjustable in automatic mode? |
| 1 | 3 | Fresh air volume identification |
| 1 | 4 | Vector air supply |
| 1 | 5 | Sweep left and right |
| 0 | 6 | Photosensitive |
| 0 | 7 | Intelligent dehumidification and mildew prevention |
| 0 | 8 | Humidity sensor |
| 1 | 9 | Evaporator cleaning |
| 0 | 10 | Save money and see it |
| 0 | 11 | Power Statistics |
| 0 | 12 | Generator mode |
| 0 | 13 | High temperature wind/cool wind |
| 0 | 14 | Air quality detection function |
| 0 | 15 | Set to empty (formerly: humidity function) |
| 0 | 16 | Set it to empty (formerly: equipment operation saves money and can be seen, temperature curve display) |
| 1 | 17 | 8 ℃ heating |
| 0 | 18 | Dirty and blocked filter function |
| 0 | 19 | ---not listed in result?--- |
| 0 | 20 | Whether there is PM2.5 |
| 1 | 21 | Temperature scale switch, 1 is Fahrenheit, 0 is Celsius |
| 0 | 22 | soft wind |
| 0 | 23 | Left and right wide-angle air supply |
uzlonewolf
commented
1 year ago As for MITM-ing the cloud, it's not for the faint of heart. Tuya uses SSL/TLS in PSK mode and you need to get a full-chip firmware dump of your device to get the key to decrypt it. Every device has a different PSK loaded at the factory and so if you have multiple devices you must dump every single one of them. Devices will reject any SSL/TLS negotiation that does not contain the device-specific PSK. Once you have extracted the PSK from the firmware dump it's not too difficult and you can use it to decrypt packet captures without needing to do a full MITM connection intercept.
backcountrymountains
commented
1 year ago Well those bits align pretty well.
All I get using monitor.py for asynchronous updates is:
{'devId': 'xxxxxxxxxxxxxxxxxxxxxxx', 'dps': {'3': 22}, 't': 1690819410} (DpID 3 is temperature in °C)```
Is there a guide for getting the firmware dump? I've messed around with ESPhome chips and have a FTDI uart to usb thing.
uzlonewolf
commented
1 year ago Hmm, looking at the bit list I wonder if setting bit 11 (turning 2228796 into 2230844) would cause it to start sending updates. d.set_value("110", 2230844)
As for dumping the firmware, it is going to depend on which chip the device uses. I have devices with ESP, Realtek, and Beken chips, so there is no one-size-fits-all guide. Beken is pretty well supported with the OpenBeken project, Realtek is not supported at all AFAIK. I'd start by Google-ing "dump <your chip part #> firmware"
backcountrymountains
commented
1 year ago I don't seem able to change DpID 110. In the jumble-fudge of invalid json I got from iot.tuya.com it says {""abilityId"":110,""accessMode"":""ro"",""code"":""markbit"", which makes me think the value is read-only. However, I also can't change DpID 119, the "money" code, that I think should also enable power logging and it's "rw". So I have no idea.
I still don't understand how iot.tuya.com is getting values every 2 minutes almost exactly:
| Time | Device Event | DP ID | Event Details | Source | Source Details |
|---|---|---|---|---|---|
| 2023-08-01 13:53:03 | Report | current temperature | 25℃ | device itself | |
| 2023-08-01 13:51:58 | Report | 电量小数 | 246 | device itself | |
| 2023-08-01 13:51:58 | Report | 运行时间 | 1次 | device itself | |
| 2023-08-01 13:50:01 | Report | 电量小数 | 246 | device itself | |
| 2023-08-01 13:50:01 | Report | 运行时间 | 1次 | device itself | |
| 2023-08-01 13:50:00 | Report | current temperature | 25℃ | device itself | |
| 2023-08-01 13:48:04 | Report | 电量小数 | 246 | device itself | |
| 2023-08-01 13:48:04 | Report | 运行时间 | 1次 | device itself |
运行时间 is:
{\"abilityId\":135,\"accessMode\":\"ro\",\"code\":\"run_time\",\"description\":\" is used for running time accumulation, each Report once every 2 minutes. So the running time is 2*times\",\"name\":\"running time\"Might have to crack it open and see what I can find. My router says that the device is "ESP_DA0FA3 - 192.168.1.xx" so I'm guessing it's an ESP.
Thanks for the help.
jasonacox
commented
1 year ago I still don't understand how iot.tuya.com is getting values every 2 minutes almost exactly
From my experience, Tuya devices are cloud-first designed. They also have a local access that we exploit for TinyTuya and the SmartLIfe app uses for faster control, but it seems clear to me that their firmware directs them to send updates to the cloud with highest priority.
Let us know what you find if you decided to crack it open. 😄
Thanks!
I have a tuya mini-split AC/Heat pump. Everything is working great except for the energy measurement.
In the logs on
iot.tuya.com, I can access the energy values from DpID 116. However, I have not found a way to query DpID 116 locally, even usingset_dpsUsed({"116": None})orupdatedps(index=[116], nowait=False))Is it possible that only the cloud service can query that DpID? How can I get the data from the device?
My device logs are here
I also posted a comment here where someone had what I thought was a related issue. I used tinytuya to monitor the status of the device during large changes in power usage and found no changes in any of the DpIDs that would seem to correlate to any kind of power measurement.
It is also possible to go to
iot.tuya.com->Device Control->Query Propertiesand input mydevice_idand thecodetotalP(found below in Data Model) and get the power reading as follows:I also did the
Query Things Data Modeloniot.tuya.comand translated the output.I tried to get the
markbitinformation but it came back with "2228796" which is 28 bits instead of 24 so I don't know what I'm supposed to do with that.Anyway, this seemed like a unique issue so I'm looking for guidance here.