nkaminski / csrmesh

Reverse engineered bridge implementation of the CSRMesh BTLE protocol
GNU Lesser General Public License v3.0
70 stars 20 forks source link

Move #16

Closed andrasj closed 7 years ago

andrasj commented 7 years ago

Hello, great job! I also have some MOVE units and would like to control them from domotics software, so I'm very interested in your work. I'm not a python developer, but should be able to tweak/run it. I already captured some BT-traffic from the original app, so I guess I should be able to read in some packet and brute force the pin. but I'm having 2 questions: -easiest way to get the binary packet in python? (hex-string and some kind of parsing??) -does it matter which BT-packet and do I need the whole BT-packet or only the 'attribute protocol part' (I'm not -yet- familiar with the BT protocol-stack)

I'm gonna try to make the BT-dongle work in linux now...

andrasj commented 7 years ago

I'm having trouble getting the pin for my teptron-MOVE's. I sniffed some communication ( https://drive.google.com/open?id=0B5u5XJln3zKCSm1GYnVINFBvd1U ), but the brute-force-method doesn't find a macth for any of the keys.

I verified my method based on: https://github.com/nkaminski/csrmesh/issues/4#issuecomment-236512833 and the bt-log posted there (also validated the brute force on another hexstring I built from another packet in the log). So i think there is no error in the code, when I just substitute the hexstring with one from my move (ie. "ba446400805da915701cf616833118c751ff") the brute force doesn't find a solution.

Is there a different approach for MOVE vs the lightbulbs? I do remember that the app required some 'password' during initial setup, but I have no idea if this was a string/numeric password or how long it should be. I don't even remember what I entered, but it is not needed to add other devices to the network.

Any help on what I could try next? (maybe I should totally wipe the data of the official app, factory reset a device and start over...)

andrasj commented 7 years ago

Ok, it seems the pin is exactly what can be entered in the 'official' app. When I keep this only 4 digits, it seems to work.

sorry for disturbing