Any Support for Midea A/C?

cab426 · June 11, 2020, 3:13pm

Updated to 0.1.17 and I am still getting the same results. No difference in debug mode.

INFO:msmart.cli:Debug mode active
INFO:msmart.cli:17 - Discovering devices with UDP Broadcast, press CTRL-C to quit...
Traceback (most recent call last):
  File "/usr/local/bin/midea-discover", line 8, in <module>
    sys.exit(discover())
  File "/usr/lib/python3/dist-packages/click/core.py", line 764, in __call__
    return self.main(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/click/core.py", line 717, in main
    rv = self.invoke(ctx)
  File "/usr/lib/python3/dist-packages/click/core.py", line 956, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/lib/python3/dist-packages/click/core.py", line 555, in invoke
    return callback(*args, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/msmart/cli.py", line 63, in discover
    reply = _security.aes_decrypt(data)
  File "/usr/local/lib/python3.8/dist-packages/msmart/security.py", line 26, in aes_decrypt
    decrypted = unpad(decrypted, self.blockSize)
  File "/usr/local/lib/python3.8/dist-packages/Crypto/Util/Padding.py", line 90, in unpad
    raise ValueError("Padding is incorrect.")
ValueError: Padding is incorrect.

guerocp · June 11, 2020, 3:16pm

seems to be the same issue that I have, if you figure it out how to fix it, please let me know!!

mac_zhou · June 12, 2020, 8:54am

update to 0.1.18

guerocp · June 12, 2020, 3:43pm

thanks @mac_zhou, now my ac works like a charm!

floryn08 · June 12, 2020, 5:48pm

Hello!

I’ve been struggling for a couple of days on getting this to work.
Since this has become quite a long thread, can someone please post step by step instructions?

I do have https://github.com/mac-zhou/midea-ac-py installed and configured in configuration.yaml but it doesn’t seem to work.
No errors are being logged either, only these warnings:

2020-06-12 20:42:40 WARNING (MainThread) [homeassistant.loader] You are using a custom integration for hacs which has not been tested by Home Assistant. This component might cause stability problems, be sure to disable it if you experience issues with Home Assistant.

2020-06-12 20:42:43 WARNING (MainThread) [homeassistant.loader] You are using a custom integration for midea_ac which has not been tested by Home Assistant. This component might cause stability problems, be sure to disable it if you experience issues with Home Assistant.

2020-06-12 20:42:43 WARNING (MainThread) [homeassistant.components.climate] ClimateDevice is deprecated, modify MideaClimateACDevice to extend ClimateEntity

My Home Assistant version is 0.111.0 and I have a Midea Blanc R32.

Can someone help?

Thank you!

Foxxy · June 12, 2020, 6:36pm

These are only warnings, it should work despite of them- some are due to breaking changes for custom components- so just ignore for now
Best, JR

g4rpez · June 13, 2020, 4:59am

Hi @mac_zhou, even with 0.1.18 got error:

INFO:msmart.cli:Discovering devices with UDP Broadcast, press CTRL-C to quit...
ERROR:msmart.security:aes_decrypt error: ValueError('Padding is incorrect.') - data: (***hex code***)
Traceback (most recent call last):
  File "/media/Python/hokkaido/venv/bin/midea-discover", line 8, in <module>
    sys.exit(discover())
  File "/media/Python/hokkaido/venv/lib/python3.8/site-packages/click/core.py", line 829, in __call__
    return self.main(*args, **kwargs)
  File "/media/Python/hokkaido/venv/lib/python3.8/site-packages/click/core.py", line 782, in main
    rv = self.invoke(ctx)
  File "/media/Python/hokkaido/venv/lib/python3.8/site-packages/click/core.py", line 1066, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/media/Python/hokkaido/venv/lib/python3.8/site-packages/click/core.py", line 610, in invoke
    return callback(*args, **kwargs)
  File "/media/Python/hokkaido/venv/lib/python3.8/site-packages/msmart/cli.py", line 67, in discover
    m_type = m_ssid.split('_')[1]
IndexError: list index out of range

floryn08 · June 13, 2020, 8:21am

Someone correct me if I’m wrong.

I think “midea-discover” should be used only when the AC is in AP mode.

This is how I got rid of the “Padding is incorrect” and “IndexError: list index out of range” errors.
Although it didn’t give me any output even like this.

I got the device ID using the QR code from share device in the app eventually.

Foxxy · June 13, 2020, 8:43am

No need for AP mode- can run it any time even if connected to Midea app and HA integration (and my backup IRMQTT one).
Best, JR

da_sies · June 13, 2020, 10:09pm

i have a Qlima SC5225 which i can control in hassio using the cloud solution, but doesn’t work using mac_zhou solution.

this is my output of midea-discover:
({ 'id': '9e2d00000012', 'power_state': False, 'audible_feedback': False, 'target_temperature': 17, 'operational_mode': <operational_mode_enum.auto: 1>, 'fan_speed': <fan_speed_enum.Auto:102>, 'swing_mode': <swing_mode_enum.Off: 0>, 'eco_mode': False, 'turbo_mode': False, 'indoor_temperature': 0.0, 'outdoor_temperature': 0.0 })

this id in dec is 173916110716946, which is different from the id i found using the QR code( 19791209311646). With both i get the same result(looks like default values?) It looks like the same problem as will_santana. Anyone a solution?

Annotation 2020-06-14 000852

cab426 · June 16, 2020, 5:38pm

Updated to 0.1.18 and still receiving the same error.

INFO:msmart.cli:Debug mode active
INFO:msmart.cli:Discovering devices with UDP Broadcast, press CTRL-C to quit...
ERROR:msmart.security:aes_decrypt error: ValueError('Padding is incorrect.') - data: 000000000000000022dc1bd9764bc9420d05f89cc23eceb703128edcf0eb052eb77dbce3570e97cc20fdf89cb25ef3883917d129a1adc1599a6c9b9d2978b5ac
Traceback (most recent call last):
  File "/usr/local/bin/midea-discover", line 8, in <module>
    sys.exit(discover())
  File "/usr/lib/python3/dist-packages/click/core.py", line 764, in __call__
    return self.main(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/click/core.py", line 717, in main
    rv = self.invoke(ctx)
  File "/usr/lib/python3/dist-packages/click/core.py", line 956, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/lib/python3/dist-packages/click/core.py", line 555, in invoke
    return callback(*args, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/msmart/cli.py", line 67, in discover
    m_type = m_ssid.split('_')[1]
IndexError: list index out of range

Hypfer · June 17, 2020, 1:34pm

Did anyone ever look into the cloud communication? I’d love to see a full cloud replacement.
It’s actually quite easy to redirect module.appsmb.com to a local host and spin up a tcp server on port 28870.

The message format seems to be the same one used for app to cloud communication as well as local communication via UDP.
At least the header decodes fine with a decoder implemented according to https://github.com/mac-zhou/midea-msmart/blob/1b694e54e716575038b7957431b0ff5e042d46e4/msmart/packet_builder.py#L19-L36

Problem is: I don’t really understand the whole encryption/decryption process. The fact that all existing code is in Python also doesn’t help much. This language is just weird

Anyways,

once started, my dehumidifier spams my server with requests like this one:


5a5a0111680041000000000000000000000000008c2100000014b80b000000000000000003000000aa955809824960ed74d2df0ac63f5717b63c30e1637cf220123211c0e15ad11f915c618b02ed2747fad73f2ffa0db1d3cbfb3be0a3fff793e856306b6ac72a4c

Which decodes to

{
  length: 104,
  msgId: 0,
  mDeviceId: '8c2100000014',
  dateTime: null,
  messageType: 4353,
  unknown1: '0x0',
  unknown2: '0x41',
  unknown3: '0x0'
}

and some payload.

The backend then responds with

5a5a01116800418000000000e89b2a0b110614148c2100000014b80b00000000000000000300000021d4f1451dfe0e7d78ac578da90668142c7632b747d4b37cddb810625bfd39ab74ca78585b9fa58735f35d032778b30e443615aba245e7b46705f14755c8779c

which decodes to

{
  length: 104,
  msgId: 0,
  mDeviceId: '8c2100000014',
  dateTime: 2020-06-17T09:42:15.052Z,
  messageType: 4353,
  unknown1: '0x0',
  unknown2: '0x41',
  unknown3: '0x80'
}

I have some more captures but that would be too much for this post.

Pointers (especially regarding the encryption) much appreciated

paddy0174 · June 18, 2020, 2:15am

I have to ask, but did you take a look at the custom_component from @mac_zhou? This component is local and works without internet connection.

Maybe you could take a look at it and get your knowledge teamed up?

EDIT: This is the custom_component for HA integration

and this is the python library

Hypfer · June 18, 2020, 6:11am

Yep. That’s where the header format is from.
I just find the whole encryption process very hard to understand

Speaking of knowledge:

Since the whole communication is done via http (albeit using some encryption on the payloads), it is insanely easy to build a mock-backend for the official app, so that it can be used to get new devices connected to the wifi, without requiring cloud access.

While it would certainly be better to have a dedicated tool for that, I think that this is a good start to get everything working. Something like that should be done after the cloud communication is understood and hopefully replicated as well.

Hypfer · June 18, 2020, 6:19am

Also, here's a list of device categories supported by the midea ecosystem

smart socket
Smart Remote
Sensor Box
Smart Lighting
Smart Curtain
Smart Router
Air Conditioner
AC
Microwave Oven
Oven
Steamer Oven
Disinfection Cabinet
Small Toaster
Intelligent Cupboard
Hood
Hob
Vacuum Cleaner
Induction
Refrigerator
CAC
Heating water pump heater system
Top
Front
dryer
Dishwasher
Electrical water heater
Gas water heater
Aqua Energy system
Rice Cooker
Electromagnetic Oven
Electric Pressure Cooker
Purifying Machine
Soymilk Maker
Cooling Fan
fan
Heater
Heater
Humidifier
Air Conditioner Fan
Broadcasting Appliances type (All appliances can receive)
Dehumidifier
Microwave steam oven
AirHousekeeper
NutritionHousekeeper
WaterHousekeeper
Security
energy
entertainment
Slow Cooker
jiqiren
MSmart
unknown
Coffeemaker
sensors
Smart gateway
Air box
Electromagnetic
Hanging furnace
Kitchen Scale
Garbage Grinder
Central heating water heater

Assuming that at least some of them use the same cloud protocol, this would be an amazing addition to the list of smart devices which don’t necessarily require cloud access.

will_santana · June 19, 2020, 1:27am

It’s actually NOT that simple

To prevent various kinds of attacks and someone (other than theyselves) to be able to hack into your house, the communication with the server is quite robust

I’ve been workin for weeks now reverse engeneering the OLD midea cloud (not the one that supports midea air devices, but midea smart ones) and, despite the discover and login stages being quite simple, there on it gets a LOT more complicated. Cookies, special HTTP headers, obscure keys negotiations…
And that’s only the HTTP part. Underneath it there’s a proprietary obfuscated XML2HEX protocol conversion

In my case, local communication is even worse, being done almost completely by another obfuscated proprietaty lib

I guess that to the newer cloud the security is even harder
If you really into that, what I’ve done so far was to decompile the APK (an imperfect proccess) to java and with a lot of patience, inspect what it does and then convert it to Python
In my case, as none of the decompilers worked for the last method that handles the effective message posting and response processing, I’m in the process of undestanding smali code to replicate it

As you see, there’s more to it than meets the eye

Att,
Will

mac_zhou · June 19, 2020, 6:07am

as far as I know, midea have a base protocol, then they did some encryption.
library midea-msmart can decode a old encryption protocol(the tcp hex data start with 5a5a).
this library supported all the midea devices, but the specific device’s protocol needs to be studied by yourself. the library helped you to decrypt it. I am only concerned about the air-conditioning now.

I do not recommend abandoning midea app or midea cloud.

i recently found a new encryption protocol(the tcp hex data start with 8370), midea-msmart can’t decode. I recently try to decode，maybe i can’t.

mac_zhou · June 19, 2020, 6:11am

BTW: my english is poor, so i can’t reply all issues here.

will_santana · June 19, 2020, 2:33pm

Hi, @mac_zhou.

First of all, my english isn’t good too. So let’ts get it past us. hahhahaha
Second, after the @Hypfer’s idea, last night I’ve been debuggin your code and MSmart (the app, not the module) code
As I’ve said before my AC unit DO NOT work on midea cloud app, instead, it works with another apps (Midea Start, Midea MSmart and NetHome)

I’ll post some details later, but the protocol is a bit different
From the ports it uses, to the broadcast method to the size of the packets and basecommand
It’s a AC unit and the protocol starts With 5a5a and has a applience code equals to 172 (0XAC), don’t work out of the box with your code
I’ve managed to get the discover working using your code, but I’m still working in mapping the data fields (already got some like date and deviceid) and the security method that’s different too (I guess it’s a MD5 of something, but don’t know exactly what)

As said, I’ll post detailed info later. Hope we all together can solve the mistery

Att,
Will

Hypfer · June 19, 2020, 3:41pm

You’re right. It’s indeed more complex than anticipated.

I was able to decrypt the first four messages of my dehumidifier connecting to the cloud using the known key from the github repository.
Decryption fails for all the following messages it seems.

I’d assume that they’re negotiating a session key using the shared secret and then switch to that?