search

nougad / velux-cli

Go Client for Velux Active KIX 300
MIT License
33 stars 3 forks source link

Some Question #3

Open Droccal opened 2 years ago

Droccal commented 2 years ago

Hey nougad/Florian,

first of all thanks very much for this cli tool, it was a great help for me to integrate it as a homebridge plugin (which I'm currently still refining => https://github.com/Droccal/homebridge-velux-active, it is not yet available for homebridge users to install)

I have some questions to the api, would be cool if you could help me out.

Do you know that the "Retrieve Key" does? as when I use it it just answers with "status": "ok".

I'm trying to integrate to open a window with the api, but for that there are some security features implemented. I tried to decompile the android app to understand how it is done but unfortunately I didn't find any clue how.

I intercepted the request from the iOS app to open my window and got the following request data:

{ "home": { "id": "$homeid", "modules": [ { "bridge": "$bridgeId", "sign_key_id": "$signKey", "target_position": 18, "hash_target_position": "$hashedPosition", "id": "$deviceId", "timestamp": 1666247623, "nonce": 0 } ] }, "app_version": "1.10.0" }

They use a signing key and hash the target position. I thought maybe with the retrieve key I could also create that hash to control my window.

Best Regards Thomas

nougad commented 2 years ago

Hey. I'm sorry. I only own rollershutters and don't know how the protocol for opening windows looks like. As far as I know there are some additional security features involved, to exchange a crypto key upfront. This avoids that someone without the key can open windows and can get access to the room.

I was successful back then to intercept the traffic of the app by adding a mtimproxy. But it requires removal of the certificate pinning of the app which is not straight forward either.