Use Existing RF scanned codes ?

[macaddictcr]

I setup my RM Pro to test a handful of RF ceiling fans and outlets prior to setting up the Homebridge and RM plugin. It was an extensive procedure since I had to cycle through multiple button presses due to the nature of my devices.

Is it possible for the plugin to recognize or retrieve the already stored RF codes so that i can add them into my accessory list?

[peros550]

I had the same question about the IR codes. Is it possible for the plugin to know what devices are stored within the app?

[lprhodes]

Not a bad idea, I'll look into it.

[70mmy]

Had a quick look into this today, found 2 possible ways to do this.

1. The app has a cloud backup feature, I found the endpoints but in the limited amount of time I spent on this was not able to authenticate to get a backup.
2. The app has a WLAN share feature, enabling this will broadcast on the network a endpoint that once accessed gives out a zip archive with all of the app configuration. Should be doable to listen in node js for this and then initiate a download from the provided endpoint to get the archive containing the app configuration

Using the second method I got this example of a RF button for my RM PRO+ for a light switch:

{
    "code": [
      -78,
      69,
      38,
      0,
      6,
      6,
      6,
      6,
      10,
      6,
      6,
      6,
      5,
      7,
      5,
      11,
      6,
      6,
      6,
      6,
      5,
      6,
      17,
      6,
      5,
      6,
      6,
      11,
      6,
      5,
      11,
      11,
      11,
      6,
      5,
      6,
      5,
      7,
      5,
      11,
      11,
      11,
      0,
      0
    ],
    "id": 1,
    "order": 0,
    "delay": 0,
    "buttonId": 1,
    "name": ""
  }

Maybe someone else has a better understanding of the codes and can easily convert that into a hex

[70mmy]

Also, if anyone can figure out the format of this file it would be awesome

I have an air conditioner (Beko) added in the app. The remote was recognised by the app as a "rn02j" and the attached file looks like the configuration for it.

The shared archived contained this file under "ConCode" directory

1037.gz

[lprhodes]

Great work thanks @70mmy. I doubt that the cloud sync is encrypted beyond SSL so with the correct authentication we should be good to go with that.

Have you any devices other than an AC? They often have the current time included and so the code changes each time. If you had another device you could learn that in the plugin and compare it to the array from the second method.

[70mmy]

The JSON fragment above is for a RF switch, the hex code learned with the plugin for the same device is:

b280260011060506050b06060b0b0b0605060506050b0b0b060506050b0606060606050b0606060605060000

The cloud uses a MD5 signature approach to secure requests, the signature is a JSON representation of the request, salted with a static key (that I found) but I was not able to do a valid request, and since there was an easier method I chose not to waste any more time.

If the information in there is useful and we can actually get it to work, we can invest more time into getting the info from the cloud

[lprhodes]

Awesome information thanks @70mmy, I'm impressed they went to the effort. When I get my new RM Pro on Wednesday I'll spend a little bit of time on the cloud function and then revert to the second if I have no luck.

[70mmy]

I downloaded the android APK and decoded it with an online tool and poked around the source code to get a feel of how they did it, you can find the endpoints in there and salts for MD5 signature, I can give you some details if you'd like, so you don't start from scratch.

On the other hand, I think the second method is actually better because you don't need to create an account with them for it to work.

[70mmy]

I managed to get the plugin to work (switch my light on and off) with a hex generated from the decimals array in the shared archive by the app.

The way I see this would work at this point is to:

• Add a new import button similar to the ones for learning IR or RF
• When pressed, the code will listen for UDP broadcast and download the shared archive
• Extract from the archive the configured buttons each with it's own hex code available
• Print the buttons in the log (could actually be the JSON that can be copy pasted in the config)

[70mmy]

As for the AC, the file above should be the configuration for my AC, I can successfully control the AC from the app using that config.

At this point I suspect the file is a password protected sqlite database, but did not have time to research it further

I believe that in that database might be a better way to configure an AC, ideally the plugin configuration for the AC would have small hex codes for each mode, or each temperature and the plugin would build the full hex code to be sent according to the user input in the home app.

There are some instructables on how to reverse engineer the AC remote, but that would take time and if all that information is in that file all the better.

Even better, the plugin could use files like the one above and the user would have the option to just use a predefined remote for the AC instead of the data key

[70mmy]

I did the import using the share method, turns out the app does a bonjour broadcast when the share function is active

https://github.com/lprhodes/homebridge-broadlink-rm/pull/533

It logs something like this:

Import listener started, go to the app and click on 'Share to other phones in WLAN'
Download from: http://Andreis-iPhone.local:48815
Extract archive: /tmp/BLImport/shared.zip
Extract codes from: /tmp/BLImport
Codes: [ { name: 'Living high',
    hex: 'b2452606666a666575b666656116566b65bbb656575bbb00' } ]

I'm not really a node js developer, so any suggestion you might have on the code are welcomed

[lprhodes]

Thanks, my new RM Pro gets here Wednesday so I’ll check it out then.

On 11 Jan 2020, at 10:29 pm, 70mmy notifications@github.com wrote:

 I did the import using the share method:

533

It logs something like this:

Import listener started, go to the app and click on 'Share to other phones in WLAN' Download from: http://Andreis-iPhone.local:48815 Extract archive: /tmp/BLImport/shared.zip Extract codes from: /tmp/BLImport Codes: [ { name: 'Living high', hex: 'b2452606666a666575b666656116566b65bbb656575bbb00' } ] I'm not really a node js developer, so any suggestion you might have on the code are welcomed

— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or unsubscribe.

[70mmy]

Just discovered there are 2 more apps working with the RM, the code I made is for the "e-control" but there is one called "Broadlink" and another called "IHC"

[Andrew49]

@70mmy Yes, it's quite confusing! And to make it worse, the e-Control app seems to no longer work with the most recent version(s) of RM2Pro bought in the last few months, which is what I have - this seems to require either the "IHC" app, or another app called "IHC EU". This has a type id of 279d which is different from earllier RM2's. Unfortunately I haven't managed to find a way to capture RF codes successfully from these. It can be detected and identified by the windows "Broadlink Manager" ("RM2Pro3") but I've not managed to get it to capture RF codes. Similar with python-broadlink. I wonder if Broadlink have somehow changed the protocol slightly? @lprhodes lprhodes: very interested to hear what you find with your new RMPro when it arrives!!

[lprhodes]

Me too, I have Wednesday evening free to test and make sure we can all scan RF codes consistently and easily (and import them!)

On 13 Jan 2020, at 8:45 pm, Andrew notifications@github.com wrote:

 @70mmy Yes, it's quite confusing! And to make it worse, the e-Control app seems to no longer work with the most recent version(s) of RM2Pro bought in the last few months, which is what I have - this seems to require either the "IHC" app, or another app called "IHC EU". This has a type id of 279d which is different from earllier RM2's. Unfortunately I haven't managed to find a way to capture RF codes successfully from these. It can be detected and identified by the windows "Broadlink Manager" ("RM2Pro3") but I've not managed to get it to capture RF codes. Similar with python-broadlink. I wonder if Broadlink have somehow changed the protocol slightly? @lprhodes lprhodes: very interested to hear what you find with your new RMPro when it arrives!!

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[lprhodes]

What I've found with my new RM pro is an inability to add it to any of broad links apps despite it successfully joining the network. The plugin discovers it though!

[70mmy]

Yeah, if you are on iOS the apps have issue with that. I managed to configure the RM from android and then add it in IHC and the e-control apps. The Broadlink app on iOS I could bot add the RM