Open svanrossem opened 6 months ago
It looks like communication between the app on the NSPanel Pro and the builtin Zigbee module is done via MQTT.
px30_evb:/vendor/bin/siliconlabs_host
px30_evb:/ # ls -lh /vendor/bin/siliconlabs_host
Readme.txt libcrypto.so.1.1 libssl.so.1.1 mosquitto.conf mosquitto_pub zgateway
factory_shell.sh libfreezgb.so mosquitto mosquitto.password mosquitto_sub
guard_process.sh libmosquitto.so.1 mosquitto.acl mosquitto_passwd run.sh
px30_evb:/vendor/bin/siliconlabs_host # cat factory_shell.sh
#!/bin/sh
export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH}
cp -r /vendor/bin/siliconlabs_host/libmosquitto.so.1 /vendor/lib
cp -r /vendor/bin/siliconlabs_host/libcrypto.so.1.1 /vendor/lib
cp -r /vendor/bin/siliconlabs_host/libssl.so.1.1 /vendor/lib
cp -r /vendor/bin/siliconlabs_host/mosquitto_pub /system/bin
cp -r /vendor/bin/siliconlabs_host/mosquitto_sub /system/bin
/vendor/bin/siliconlabs_host/mosquitto_pub -t "gw/factoryTest" -q 2 -m "{\"commands\":\"FactoryTest\"}" -i factory_Test
res=$(/vendor/bin/siliconlabs_host/mosquitto_sub -h "localhost" -t "gw/factoryTest" -i factory_Test -C 1)
echo "$res"
exit 0
px30_evb:/vendor/bin/siliconlabs_host # cat guard_process.sh
#!/bin/bash
echo "-------------Zigbee guard_process run-------------------------"
export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH}
echo ${LD_LIBRARY_PATH}
Z3GatewayHost_sonoff_go() {
echo "do Z3GatewayHost_sonoff_go"
killall zgateway
sleep 1
# killall mosquitto
# sleep 1
echo $(pwd)
cd /vendor/bin/siliconlabs_host/
echo $(pwd)
# sleep 1
# /vendor/bin/siliconlabs_host/mosquitto -c /vendor/bin/siliconlabs_host/mosquitto.conf &
sleep 3
#在终端打印整个运行日志
/vendor/bin/siliconlabs_host/zgateway &
}
check() {
echo "do check"
local Z3GatewayHost_sonoffNum=`ps -A | grep -w 'zgateway' | grep -v "grep" | wc -l`
# local mosquittoNum=`ps -A | grep -w 'mosquitto' | grep -v "grep" | wc -l`
echo "Z3GatewayHost_sonoffNum:"${Z3GatewayHost_sonoffNum}
if [ ${Z3GatewayHost_sonoffNum} -ne 1 ]; then
echo "Z3GatewayHost_sonoffNum restart `date +"%Y-%m-%d %H:%M:%S"`" >> /data/vendor/siliconlabs_host/zgatewayStatus
Z3GatewayHost_sonoff_go
fi
}
while true
do
sleep 60
check
done
px30_evb:/vendor/bin/siliconlabs_host # cat run.sh
#!/bin/bash
echo "-------------Zigbee Host run-------------------------"
LOCAL_TIME=$(date +"%Y-%m-%d %H:%M:%S")
echo $LOCAL_TIME 'Zigbee Host, start' > /vendor/run.log
export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH}
echo ${LD_LIBRARY_PATH}
#检查是否需要拷贝
if [ ! -d "/data/vendor/siliconlabs_host" ]; then
echo "cp oem..."
mkdir /data/vendor/siliconlabs_host
chmod 777 /data/vendor/siliconlabs_host
echo $LOCAL_TIME 'Zigbee Host, start' > /data/vendor/run.log
# cp -r /vendor/bin/siliconlabs_host/* /oem/siliconlabs_host/
else
echo "file exist"
fi
# sleep 1
# echo "copy libfreezgb.so"
# cp -r /vendor/bin/siliconlabs_host/libfreezgb.so /vendor/lib
# cp -r /vendor/bin/siliconlabs_host/libfreezgb.so /system/lib
# echo "copy libfreezgb.so"
# cp -r /vendor/bin/siliconlabs_host/libmosquitto.so.1 /vendor/lib
# cp -r /vendor/bin/siliconlabs_host/libmosquitto.so.1 /system/lib
# sleep 1
killall zgateway
# sleep 1
killall guard_process
killall mosquitto
sleep 1
echo $(pwd)
cd /vendor/bin/siliconlabs_host/
echo $(pwd)
#需要先启动MQTT 服务
/vendor/bin/siliconlabs_host/mosquitto -c /vendor/bin/siliconlabs_host/mosquitto.conf &
sleep 3
#在终端打印整个运行日志
/vendor/bin/siliconlabs_host/zgateway &
sh /vendor/bin/siliconlabs_host/guard_process.sh &
This tells we're be able ro run mosquito
pub and sub commands e.g.
export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH}
/vendor/bin/siliconlabs_host/mosquitto_sub -v -h 127.0.0.1 -t "#" -i debug
export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH}
/vendor/bin/siliconlabs_host/mosquitto_pub -t "gw/factoryTest" -q 2 -m "{\"commands\":\"FactoryTest\"}" -i debug
I've modified mosquitto.conf
to log *
mount -o remount,rw /vendor
busybox vi /vendor/bin/siliconlabs_host/mosquitto.conf
per_listener_settings false
allow_zero_length_clientid false
check_retain_source false
max_inflight_messages 20
max_keepalive 60
persistent_client_expiration 1w
retain_available true
sys_interval 3600
#listener 1883 127.0.0.1
listener 1883
persistence false
user root
allow_anonymous true
#password_file /oem/siliconlabs_host/mosquitto.password
#acl_file /oem/siliconlabs_host/mosquitto.acl
log_dest file /data/vendor/siliconlabs_host/mosquitto.log
log_type all
connection_messages true
log_timestamp true
log_timestamp_format %Y-%m-%dT%H:%M:%S
sys_interval 10
And a clean logfile (switched to Repeater mode)
px30_evb:/ # cat /data/vendor/siliconlabs_host/mosquitto.log
2024-01-03T23:46:21: mosquitto version 2.0.8 starting
2024-01-03T23:46:21: Config loaded from /vendor/bin/siliconlabs_host/mosquitto.conf.
2024-01-03T23:46:21: Opening ipv6 listen socket on port 1883.
2024-01-03T23:46:21: Opening ipv4 listen socket on port 1883.
2024-01-03T23:46:21: mosquitto version 2.0.8 running
2024-01-03T23:46:24: New connection from 127.0.0.1:59082 on port 1883.
2024-01-03T23:46:24: New client connected from 127.0.0.1:59082 as zigbee (p5, c1, k60, u'zigbee').
2024-01-03T23:46:24: Will message specified (48 bytes) (r1, q2).
2024-01-03T23:46:24: zigbee/system/availability
2024-01-03T23:46:24: Sending CONNACK to zigbee (0, 0)
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: zigbee/system/network-role/switch (QoS 2)
2024-01-03T23:46:24: zigbee 2 zigbee/system/network-role/switch
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: zigbee/system/unpair (QoS 2)
2024-01-03T23:46:24: zigbee 2 zigbee/system/unpair
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: zigbee/system/pair (QoS 2)
2024-01-03T23:46:24: zigbee 2 zigbee/system/pair
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: zigbee/system/discover (QoS 2)
2024-01-03T23:46:24: zigbee 2 zigbee/system/discover
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: zigbee/system/transmit-power-update (QoS 2)
2024-01-03T23:46:24: zigbee 2 zigbee/system/transmit-power-update
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: zigbee/device/+/update/# (QoS 2)
2024-01-03T23:46:24: zigbee 2 zigbee/device/+/update/#
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: zigbee/device/+/delete (QoS 2)
2024-01-03T23:46:24: zigbee 2 zigbee/device/+/delete
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: hardware/button/factory-reset/updated/press (QoS 2)
2024-01-03T23:46:24: zigbee 2 hardware/button/factory-reset/updated/press
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: gw/factoryTest (QoS 2)
2024-01-03T23:46:24: zigbee 2 gw/factoryTest
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: zigbee/device/+/firmware-update (QoS 2)
2024-01-03T23:46:24: zigbee 2 zigbee/device/+/firmware-update
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: zigbee/device/+/configure/# (QoS 2)
2024-01-03T23:46:24: zigbee 2 zigbee/device/+/configure/#
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:24: Received SUBSCRIBE from zigbee
2024-01-03T23:46:24: zigbee/device/+/read/# (QoS 2)
2024-01-03T23:46:24: zigbee 2 zigbee/device/+/read/#
2024-01-03T23:46:24: Sending SUBACK to zigbee
2024-01-03T23:46:29: Received PUBLISH from zigbee (d0, q0, r1, m0, 'zigbee/system/availability', ... (43 bytes))
2024-01-03T23:46:29: Received PUBLISH from zigbee (d0, q0, r1, m0, 'zigbee/system/transmit-power-updated', ... (19 bytes))
2024-01-03T23:46:29: Received PUBLISH from zigbee (d0, q0, r1, m0, 'zigbee/system/network-role/information', ... (19 bytes))
2024-01-04T02:19:10: New connection from 127.0.0.1:59086 on port 1883.
2024-01-04T02:19:10: New client connected from 127.0.0.1:59086 as CKMQTTClientID_1 (p5, c1, k60, u'app_dev_1').
2024-01-04T02:19:10: No will message specified.
2024-01-04T02:19:10: Sending CONNACK to CKMQTTClientID_1 (0, 0)
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/system/availability (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/system/availability
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Sending PUBLISH to CKMQTTClientID_1 (d0, q0, r1, m0, 'zigbee/system/availability', ... (43 bytes))
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/system/discovering (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/system/discovering
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/system/discovered (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/system/discovered
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/device/+/information (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/device/+/information
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/device/+/availability (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/device/+/availability
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/device/+/update-result/# (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/device/+/update-result/#
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/device/+/updated/# (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/device/+/updated/#
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/device/+/deleted (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/device/+/deleted
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/device/+/firmware-updating (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/device/+/firmware-updating
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/device/+/firmware-updated (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/device/+/firmware-updated
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/device/+/configure-result/# (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/device/+/configure-result/#
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/device/+/read-result/# (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/device/+/read-result/#
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/system/transmit-power-updated (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/system/transmit-power-updated
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Sending PUBLISH to CKMQTTClientID_1 (d0, q0, r1, m0, 'zigbee/system/transmit-power-updated', ... (19 bytes))
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/system/network-role/information (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/system/network-role/information
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Sending PUBLISH to CKMQTTClientID_1 (d0, q0, r1, m0, 'zigbee/system/network-role/information', ... (19 bytes))
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/system/pairing (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/system/pairing
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/system/paired (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/system/paired
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/system/pair-information (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/system/pair-information
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
2024-01-04T02:19:10: Received SUBSCRIBE from CKMQTTClientID_1
2024-01-04T02:19:10: zigbee/system/unpaired (QoS 2)
2024-01-04T02:19:10: CKMQTTClientID_1 2 zigbee/system/unpaired
2024-01-04T02:19:10: Sending SUBACK to CKMQTTClientID_1
It looks like New client connected from 127.0.0.1:59086 as CKMQTTClientID_1 (p5, c1, k60, u'app_dev_1').
CKMQTTClientID_1
is identified as the eWelink app.
I thought it was maybe something special in config files in /vendor/bin/siliconlabs_host/
so i've pulled the directories in both scenarios, switching between Coordinator and Repeater mode in the eWelink app.
adb pull /vendor/bin/siliconlabs_host repeater
Switch to Coordinator mode in the app.
adb pull /vendor/bin/siliconlabs_host coordinator
And check if there are differences...
diff coordinator repeater
No differences :(
Thank you for the detailed info! I'll check it. Btw I opened a discussion (forum) here on github so with your retroactive permission I'll put it somehow there because it is very usefull!
regards, Robert
Trying to check differences in the android APK.
px30_evb:/ $ pm list packages | grep eWeLinkControlPanel
package:com.eWeLinkControlPanel
px30_evb:/ $ pm path com.eWeLinkControlPanel
package:/system/app/kz_app/kz_app.apk
adb pull /system/app/kz_app/kz_app.apk
I've pulled kz_app.apk
from both scenarios, Coordinator mode and Repeater mode. After switching between modes in the eWelinkApp the app on the NSPanel Pro resets itself. Is there any difference?
sha256sum coo/kz_app.apk rep/kz_app.apk | sha256sum --check
coo/kz_app.apk: OK
rep/kz_app.apk: OK
Sadly, no!
I've unzipped the kz_app.apk
app and decompiled classesX.dex
unzip kz_app.apk
for x in classes classes2 classes3; do enjarify ${x}.dex -o ${x}.jar; done
Inspecting classes.jar
, classes2.jar
and classes3.jar
with JD-GUI for any clue.
I've searched in the wrong direction. It looks like the compiled ELF
file zateway
is doing all the work.
By inspecting zateway
I've found two functions, I'll try to extract both for further progress.
adb pull /vendor/bin/siliconlabs_host/zgateway
strings zgateway | grep start_mqtt
start_mqtt_router
start_mqtt_coor
I've unzipped the
kz_app.apk
app and decompiledclassesX.dex
unzip kz_app.apk for x in classes classes2 classes3; do enjarify ${x}.dex -o ${x}.jar; done
Inspecting
classes.jar
,classes2.jar
andclasses3.jar
with JD-GUI for any clue.
In com.eWeLinkControlPanel.MQTT.CKMQTTService$1
there was some interesting information.
class CKMQTTService$1 implements Runnable {
public void run() {
MemoryPersistence memoryPersistence = new MemoryPersistence();
this();
String str1 = "app_dev_1";
String str2 = "12345678";
try {
MqttConnectionOptions mqttConnectionOptions = new MqttConnectionOptions();
this();
byte b = 1;
mqttConnectionOptions.setCleanStart(b);
long l = 0L;
Long long_ = Long.valueOf(l);
mqttConnectionOptions.setSessionExpiryInterval(long_);
b = 60;
mqttConnectionOptions.setKeepAliveInterval(b);
mqttConnectionOptions.setUserName(str1);
byte[] arrayOfByte = str2.getBytes();
mqttConnectionOptions.setPassword(arrayOfByte);
MqttAsyncClient mqttAsyncClient = new MqttAsyncClient();
str2 = host;
String str6 = clientId;
this(str2, str6, (MqttClientPersistence)memoryPersistence);
CKMQTTService$1$1 cKMQTTService$1$1 = new CKMQTTService$1$1();
this(this);
mqttAsyncClient.setCallback(cKMQTTService$1$1);
String str4 = CKMQTTService.TAG;
StringBuilder stringBuilder = new StringBuilder();
this();
str6 = "Connecting to broker:";
stringBuilder = stringBuilder.append(str6);
str6 = host;
stringBuilder = stringBuilder.append(str6);
String str5 = stringBuilder.toString();
Log.i(str4, str5);
IMqttToken iMqttToken = mqttAsyncClient.connect(mqttConnectionOptions);
iMqttToken.waitForCompletion();
String str3 = CKMQTTService.TAG;
str5 = "mqtt is Connected";
Log.i(str3, str5);
CKMQTTService cKMQTTService = CKMQTTService.this;
HashMap<String, MqttAsyncClient> hashMap = CKMQTTService.access$100(cKMQTTService);
str5 = clientId;
hashMap.put(str5, mqttAsyncClient);
} catch (MqttException mqttException) {
str1 = CKMQTTService.TAG;
StringBuilder stringBuilder5 = new StringBuilder();
this();
stringBuilder5 = stringBuilder5.append("reason ");
int i = mqttException.getReasonCode();
String str7 = stringBuilder5.append(i).toString();
Log.i(str1, str7);
str1 = CKMQTTService.TAG;
StringBuilder stringBuilder4 = new StringBuilder();
this();
stringBuilder4 = stringBuilder4.append("msg ");
String str9 = mqttException.getMessage();
String str6 = stringBuilder4.append(str9).toString();
Log.i(str1, str6);
str1 = CKMQTTService.TAG;
StringBuilder stringBuilder3 = new StringBuilder();
this();
stringBuilder3 = stringBuilder3.append("loc ");
str9 = mqttException.getLocalizedMessage();
String str5 = stringBuilder3.append(str9).toString();
Log.i(str1, str5);
str1 = CKMQTTService.TAG;
StringBuilder stringBuilder2 = new StringBuilder();
this();
stringBuilder2 = stringBuilder2.append("cause ");
Throwable throwable = mqttException.getCause();
String str4 = stringBuilder2.append(throwable).toString();
Log.i(str1, str4);
str1 = CKMQTTService.TAG;
StringBuilder stringBuilder1 = new StringBuilder();
this();
String str8 = "excep ";
String str3 = stringBuilder1.append(str8).append(mqttException).toString();
Log.i(str1, str3);
mqttException.printStackTrace();
}
}
}
When starting zgateway
it gives the following log.
px30_evb:/vendor/bin/siliconlabs_host # ./zgateway
#---Firmware compile time:Nov 1 2023 02:00:51 Firmware version:1.2.2---
{"modle":"ZBMINI-L","wait_flag":0}
{"modle":"S40LITE","wait_flag":0}
{"modle":"ZBCurtain","wait_flag":0}
{"modle":"ZBMINIL2","wait_flag":0}
{"modle":"CK-BL702-MWS-01(7016)","wait_flag":0}
{"modle":"CK-MG22-ROUTER-01(7018)","wait_flag":0}
{"modle":"CK-BL702-ROUTER-01(7018)","wait_flag":0}
{"modle":"SNZB-01P","wait_flag":1}
{"modle":"SNZB-02P","wait_flag":1}
{"modle":"SNZB-02D","wait_flag":1}
{"modle":"SNZB-04P","wait_flag":1}
{"modle":"SNZB-03P","wait_flag":1}
{"modle":"CK-BL702-SWP-01(7020)","wait_flag":0}
{"modle":"CK-BL702-SWP-01(7021)","wait_flag":0}
{"modle":"CK-BL702-SWP-01(7022)","wait_flag":0}
{"modle":"TRVZB","wait_flag":0}
{"modle":"CK-MG22-TRVZB-01","wait_flag":0}
{"modle":"SNZB-06P","wait_flag":0}
{"modle":"CK-MG22-TRVZB-01(7017)","wait_flag":0}
#uart_index:/dev/ttyS5
#workpath:/data/vendor/siliconlabs_host
#baudrate:115200
[host_open_handle] <159>: host open type : 2
[host_open_handle] <207>: path : /data/vendor/siliconlabs_host
[host_open_handle] <217>: port : /dev/ttyS5, baudrate : 115200
[host_open_handle] <249>: ncp_argv 0PPPPP[mqtt_client_init] <374>: ------------mqtt client init---------------
[host_callback_thread] <126>: thread start ...
./Z3GatewayHost
-n1
-p/dev/ttyS5
-b115200
[mqtt_client_init] <384>: mosquitto_sub version running on libmosquitto 2.0.8.
----------message list init--------------
zcl open rev:0
[startmain] <87>: devinfo path : /data/vendor/siliconlabs_host
[recv_message_queue_init] <58>: ----------recv message list init--------------
the workdir is /data/vendor/siliconlabs_host
[sonoff_gw_start] <1737>: sonoff_gw_start
Reset info: 11 (SOFTWARE)
Delaying 1 seconds
Setting up serial port
Error: Timeout occurred waiting for read data.
ncp in app we can init
ezsp ver 0x08 stack type 0x02 stack ver. [6.10.1 GA build 216]
Ezsp Config: set security level to 0x0005:Success: set
Ezsp Config: set address table size to 0x0002:Success: set
Ezsp Config: set TC addr cache to 0x0002:Success: set
Ezsp Config: set stack profile to 0x0002:Success: set
Ezsp Config: set MAC indirect TX timeout to 0x1E00:Success: set
Ezsp Config: set max hops to 0x001E:Success: set
Ezsp Config: set tx power mode to 0x8000:Success: set
Ezsp Config: set supported networks to 0x0001:Success: set
Ezsp Value : set end device keep alive support mode to 0x00000003:Success: set
Ezsp Policy: set binding modify to "allow for valid endpoints & clusters only":Success: set
Ezsp Policy: set message content in msgSent to "return":Success: set
Ezsp Value : set maximum incoming transfer size to 0x00000052:Success: set
Ezsp Value : set maximum outgoing transfer size to 0x00000052:Success: set
--------------cca Threshold 0xf4b5
Ezsp Config: set binding table size to 0x0010:Success: set
Ezsp Config: set key table size to 0x0004:Success: set
Ezsp Config: set max end device children to 0x0020:Success: set
Ezsp Config: set aps unicast message count to 0x000A:Success: set
Ezsp Config: set broadcast table size to 0x000F:Success: set
Ezsp Config: set neighbor table size to 0x0010:Success: set
NCP supports maxing out packet buffers
Ezsp Config: set packet buffers to 253
Ezsp Config: set end device poll timeout to 0x0008:Success: set
Ezsp Config: set zll group addresses to 0x0000:Success: set
Ezsp Config: set zll rssi threshold to 0xFFD8:Success: set
Ezsp Config: set transient key timeout to 0x00B4:Success: set
Ezsp Endpoint 1 added, profile 0x0104, in clusters: 2, out clusters 2
534
Error: Could not create default directory '/data/vendor/siliconlabs_host/ota-files': File exists
check and create network the roleTypeis 0 and the nodeid is 65534
---------------network start success----------
[publish_sys_availability] <534>: pub string: {"online":true,"reason":"zigbee app start"}
mosquitto publish Error Code: 4 The client is not currently connected.
[publish_updated_transmit_power] <4073>: reqClientId:[zigbee]reqSequence[1704548047143]
[publish_updated_transmit_power] <4074>: pub string: {"transmitPower":9}
Trying to check differences in the android APK.
px30_evb:/ $ pm list packages | grep eWeLinkControlPanel package:com.eWeLinkControlPanel px30_evb:/ $ pm path com.eWeLinkControlPanel package:/system/app/kz_app/kz_app.apk
adb pull /system/app/kz_app/kz_app.apk
I've pulled
kz_app.apk
from both scenarios, Coordinator mode and Repeater mode. After switching between modes in the eWelinkApp the app on the NSPanel Pro resets itself. Is there any difference?sha256sum coo/kz_app.apk rep/kz_app.apk | sha256sum --check coo/kz_app.apk: OK rep/kz_app.apk: OK
Sadly, no!
It will be allways the same the apk does not store states /data/user/0/
zgateway
NSPanel Pro uses the standard siliconlabs z3 gateway you can build it with https://www.silabs.com/developers/simplicity-studio
as I remeber the code is freely available.
So, I've finally found the solution!
I've removed all bloated applications from the NSPanel Pro and installed a few custom scripts. Switching to Coordinator mode without the eWelink smartphone app and start pairing mode is all done by shell scripts. It's in early stage, I'll try to make the scripts cleaner and adding checks in a few days.
You could test it by adding all scripts below.
Enable root
adb
shell and start a shell!
adb root
adb shell
px30_evb:/ # mount -o remount,rw /vendor
px30_evb:/ # cd /vendor/bin/siliconlabs_host
px30_evb:/vendor/bin/siliconlabs_host #
mod-debloat_nspanelpro.sh
#!/system/bin/busybox bash
echo "NSPanel Pro apps debloater!"
echo
# https://blakadder.com/nspanel-pro-secrets/#debloat-apps
for a in "com.eWeLinkControlPanel" \
"com.eWeLinkNSPro.dev" \
"com.rockchip.devicetest" \
"android.rockchip.update.service" \
"com.android.gl2jni" \
"com.smatek.test" \
"android.rk.RockVideoPlayer" \
"acr.browser.barebones" \
"org.chromium.webview_shell" \
"com.android.music" \
"com.android.nfc" \
"com.DeviceTest" \
"com.cghs.stresstest"
do
echo Removing ${a}
pm uninstall --user 0 ${a}
done
mod-mqtt_listen.sh
#!/system/bin/busybox bash
export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH}
/vendor/bin/siliconlabs_host/mosquitto_sub -v -h 127.0.0.1 -t "#" -i debug
mod-set_zigbee_coordinator_mode.sh
#!/system/bin/busybox bash
export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH}
/vendor/bin/siliconlabs_host/mosquitto_pub -t 'zigbee/system/network-role/switch' -q 0 -m '{"role":"Coordinator"}' -i whoami -D PUBLISH user-property reqClientId whoami
echo "Switch to Zigbee coordinator mode, rebooting..."
reboot
mod-set_zigbee_repeater_mode.sh
#!/system/bin/busybox bash
export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH}
/vendor/bin/siliconlabs_host/mosquitto_pub -t 'zigbee/system/network-role/switch' -q 0 -m '{"role":"Repeater"}' -i whoami -D PUBLISH user-property reqClientId whoami
echo "Switch to Zigbee repeater mode, rebooting..."
reboot
mod-zigbee_repeater_pairing_mode.sh
#!/system/bin/busybox bash
export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH}
echo "Start Zigbee repeater pair mode!"
/vendor/bin/siliconlabs_host/mosquitto_pub -t 'zigbee/system/pair' -q 0 -m '{"pair":true}' -i whoami -D PUBLISH user-property reqClientId whoami -D PUBLISH payload-format-indicator 1 -D PUBLISH user-property reqSequence 1337
echo "Wait for 180sec"
sleep 180
echo "Done!
px30_evb:/vendor/bin/siliconlabs_host # chmod +x mod-* -v
chmod 'mod-debloat_nspanelpro.sh' to 100777
chmod 'mod-mqtt_listen.sh' to 100777
chmod 'mod-set_zigbee_coordinator_mode.sh' to 100777
chmod 'mod-set_zigbee_repeater_mode.sh' to 100777
chmod 'mod-zigbee_repeater_pairing_mode.sh' to 100777
From now on you could switch between modes and start pair mode.
If you wish to debug things, you could log the output of zgateway
by patching line 49 in run.sh
/vendor/bin/siliconlabs_host/zgateway >> /data/vendor/siliconlabs_host/zgateway.txt &
So, I've finally found the solution!
I've removed all bloated applications from the NSPanel Pro and installed a few custom scripts. Switching to Coordinator mode without the eWelink smartphone app and start pairing mode is all done by shell scripts. It's in early stage, I'll try to make the scripts cleaner and adding checks in a few days.
You could test it by adding all scripts below.
Enable
root
adb
shell and start a shell!adb root
adb shell
px30_evb:/ # mount -o remount,rw /vendor px30_evb:/ # cd /vendor/bin/siliconlabs_host px30_evb:/vendor/bin/siliconlabs_host #
mod-debloat_nspanelpro.sh
#!/system/bin/busybox bash echo "NSPanel Pro apps debloater!" echo # https://blakadder.com/nspanel-pro-secrets/#debloat-apps for a in "com.eWeLinkControlPanel" \ "com.eWeLinkNSPro.dev" \ "com.rockchip.devicetest" \ "android.rockchip.update.service" \ "com.android.gl2jni" \ "com.smatek.test" \ "android.rk.RockVideoPlayer" \ "acr.browser.barebones" \ "org.chromium.webview_shell" \ "com.android.music" \ "com.android.nfc" \ "com.DeviceTest" \ "com.cghs.stresstest" do echo Removing ${a} pm uninstall --user 0 ${a} done
mod-mqtt_listen.sh
#!/system/bin/busybox bash export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH} /vendor/bin/siliconlabs_host/mosquitto_sub -v -h 127.0.0.1 -t "#" -i debug
mod-set_zigbee_coordinator_mode.sh
#!/system/bin/busybox bash export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH} /vendor/bin/siliconlabs_host/mosquitto_pub -t 'zigbee/system/network-role/switch' -q 0 -m '{"role":"Coordinator"}' -i whoami -D PUBLISH user-property reqClientId whoami echo "Switch to Zigbee coordinator mode, rebooting..." reboot
mod-set_zigbee_repeater_mode.sh
#!/system/bin/busybox bash export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH} /vendor/bin/siliconlabs_host/mosquitto_pub -t 'zigbee/system/network-role/switch' -q 0 -m '{"role":"Repeater"}' -i whoami -D PUBLISH user-property reqClientId whoami echo "Switch to Zigbee repeater mode, rebooting..." reboot
mod-zigbee_repeater_pairing_mode.sh
#!/system/bin/busybox bash export LD_LIBRARY_PATH=/vendor/bin/siliconlabs_host/:${LD_LIBRARY_PATH} echo "Start Zigbee repeater pair mode!" /vendor/bin/siliconlabs_host/mosquitto_pub -t 'zigbee/system/pair' -q 0 -m '{"pair":true}' -i whoami -D PUBLISH user-property reqClientId whoami -D PUBLISH payload-format-indicator 1 -D PUBLISH user-property reqSequence 1337 echo "Wait for 180sec" sleep 180 echo "Done!"
px30_evb:/vendor/bin/siliconlabs_host # chmod +x mod-* -v chmod 'mod-debloat_nspanelpro.sh' to 100777 chmod 'mod-mqtt_listen.sh' to 100777 chmod 'mod-set_zigbee_coordinator_mode.sh' to 100777 chmod 'mod-set_zigbee_repeater_mode.sh' to 100777 chmod 'mod-zigbee_repeater_pairing_mode.sh' to 100777
From now on you could switch between modes and start pair mode.
If you wish to debug things, you could log the output of
zgateway
by patching line 49 inrun.sh
/vendor/bin/siliconlabs_host/zgateway >> /data/vendor/siliconlabs_host/zgateway.txt &
@seaky could you try above on a firmware below v2.2.0?
Thx for the info, I'm gonna try I have some 1.4, 1.5 devices.
I've added all scripts in https://gitlab.com/svanrossem/sonoff-nspanelpro-scripts, sorry I'm a Gitlab user...
As an extra I've also added Zigbee turbo mode :rocket: .
@seaky when you're done with testing it is maybe an idea to add a extra screen in nspanel_pro_tools
or something with those extra's.
Hi @svanrossem I went through your scripts and it seems to have worked perfect. I was able to put it into Repeater Mode and was able to pair it with the Zigbee Controller I have in Home Assistant.
I did get ehis error after the 180secs was up when pairing:
/vendor/bin/siliconlabs_host/mod-set_zigbee_repeater_pairing_mode.sh: line 11: syntax error: unterminated quoted string
I noticed in your script, line 11 you missed the double-quote (") at the end of the echo "Done" line:
echo "Wait for 180sec" sleep 180 echo "Done!
I have tried this with 1.6.0 without any success, but once I updated to 2.2.0 it worked on the first try. Successfully paired to zigbee2mqtt as repeater.
I've just checked the fw1.6 and I compared to 2.2.0 and the zgetway indeed upgraded significantly. But I assumed that I can incorporte the zigbee binaries of 2.2.0 into nspanel tools app after I finished the v2.1
once it's connected as a repeater, does it exposed stuff ? I enabled adb : is it risky to updated from 1.7 to 2.2 ?
once it's connected as a repeater, does it exposed stuff ? I enabled adb : is it risky to updated from 1.7 to 2.2 ?
If you've already rooted your device it is safe to upgrade to 2.2 using @seaky's tools. @seaky also reported to backport the Zigbee binaries https://github.com/seaky/nspanel_pro_roottool_apk/issues/3#issuecomment-1913643105.
once it's connected as a repeater, does it exposed stuff ? I enabled adb : is it risky to updated from 1.7 to 2.2 ?
If you've already rooted your device it is safe to upgrade to 2.2 using @seaky's tools. @seaky also reported to backport the Zigbee binaries #3 (comment).
i'm just wanted to inform you I started to incorporate this into my app. If I have a working copy would be great to share with you for testing. Could you contact with me at seaky77(the big G's proprietary email system)
I used this to update my old 1.4 panel to have Zigbee router mode enabled now, thank you!
I used mod-debloat_npanelpro.sh, but the display became blank. Is there any way to help?
I used mod-debloat_npanelpro.sh, but the display became blank. Is there any way to help?
That is normal, u removed all app which prevents the deep sleep. So your device went to deepsleep. Just restart it and set display time to never or install other apps which is able to wake up the device.
Hi all, Their is a new version 3.0 :) My nspanel pro is up to date (3.0).
If i configure zigbee as router, can i connect zigbee2mqtt with out rooting ? If yes, do you know wich port is expose and if their is any user/password ? Thank you for your help (I'm new to zigbee protocols).
Hi,
Internal mosquito port is 1889 username: user password: user123
Do I need to root or install something ? Triing to configure zigbee2mqtt with, and still having error can't connect.
Cool you provide a configuration.yaml of zigbee2mqtt ? Thank's for your help
once it's connected as a repeater, does it exposed stuff ? I enabled adb : is it risky to updated from 1.7 to 2.2 ?
If you've already rooted your device it is safe to upgrade to 2.2 using @seaky's tools. @seaky also reported to backport the Zigbee binaries #3 (comment).
i'm just wanted to inform you I started to incorporate this into my app. If I have a working copy would be great to share with you for testing. Could you contact with me at seaky77(the big G's proprietary email system)
@seaky I've tried contacting you without any response, are you still working on this?
一旦它作为中继器连接,它会暴露东西吗?我启用了 adb :从 1.7 更新到 2.2 有风险吗?
如果你已经 root 了你的设备,可以安全地升级到 2.2,使用@seaky的工具。@seaky还报告了反向移植 Zigbee 二进制文件#3 (评论)。
hello @svanrossem
Could you please let me know if the chip model of your NSPanel Pro is EFR32MG13p, and what is the version of it?
I have some S6 smart panels, and their mainboard is very similar to the NSPanel Pro, produced by the same manufacturer. I want to know if in the future updates of the nspanel_pro_tools, my smart panels will be able to have the related zigbee functionality. The zigbee chip on mine is printed as: EFR32MG13
Through the elelabs-zigbee-ezsp-utility, I found the status of my chip:
~/elelabs-zigbee-ezsp-utility $ python3 Elelabs_EzspFwUtility.py probe -p /dev/ttyS5 2024/05/31 16:34:27 Elelabs_EzspFwUtility: Generic Zigbee EZSP adapter detected: 2024/05/31 16:34:27 Elelabs_EzspFwUtility: Firmware: 6.5.5-176 2024/05/31 16:34:27 Elelabs_EzspFwUtility: EZSP v7
After flashing the NSPanel Pro OTA 3.0 upgrade package, these parameters have not changed.
Thank you.
I'm collecting info about the Coordinator and Repeater mode for the builtin Zigbee module.
My NSPanel Pro was root activated since version v1.5.6. To switch between the two modes you need v2.2.0 or higher. To archieve this, you'll need to update it, we'll use
adb
.On the NSPanel Pro open the app and update it :rocket:. After a reboot the tool will tell you you're running v2.2.0.
Open the eWeLink app on you're smartphone, scan the QR-code and click ‘Device Settings–Pilot Features–Zigbee Mode’ to switch between the Coordinator and Repeater mode.