Hello,
I’m one of those who regret buying this device. While the work you people have done here is great, I too would love to be able to control (or at least query the state of) the device without depending on the cloud service to be available (for another 10 or 15 years!) - and without having to get more obsolete or self-made hardware just for that purpose.
So, in order to remove the cloud from the equation, I think these are the options:
1) find a way to connect to the device locally.
While the device listens to port 80, I’ve found no interesting urls. There seems to be just the root path: the license list. But is there really HTTP server only for listing the licenses? Maybe more research is needed! Edit: see below.
I would like to try looking inside the firmware to find clues, but I don’t know how to find the download url, since I cannot eavesdrop the device traffic (see below). I’d be glad to hear if anyone has ideas on this.
2) present a fake cloud API to the device.
It seems that the device connects to a3kcc1b80m5pmv-ats.iot.eu-west-1.amazonaws.com
(possibly not always the same address) and keeps an open connection to 443. When I change a setting in the mobile app, the server sends the command via the TCP connection. Looks like a websocket, as someone mentioned already.
Could we forward this traffic to our own server instead, and mimic the cloud service?
I tried setting up mitmproxy to intercept the connections, but the device seems to check the server certificate (as it should). Looks like a dead end.
I also had a brief look at the Android app. It’s Hermes bytecode, and will be a bit easier to investigate once the disassembling tool supports v84 bytecode (https://github.com/bongtrop/hbctool/issues/12). But I’m not sure we can find anything of value there, not even the firmware upgrade urls. They might only be in the firmware itself.
Then there’s the Wifi AP mode. I suspect it only allows one to set up non-WPS Wifi connection, instead of e.g. using the phone as a proxy even temporarily. Anyway, MITMing the app might give us something, but it’s a long shot.
I’m out of ideas.
Edit 2022-02-04: the http server does have something else. So far I found:
/config/adapter/user_info
{"rsc":2000,"method":"polling","resource_id":123456}
# id redacted
/config/adapter/datetime
{"rsc":2000,"date":"2022/2/4","time":"10:6:56","sta":2}
/config/adapter/timezone
{"rsc":2000,"tmdf":120,"dst":1,"zone":150}
/config/adapter/product_info
{"rsc":2000,"model_name":"����������������������������������������","serial_number":"000000000000","region":"eu","device_type":0,"device_kind":"RA"}
# (model name is just hex `FF FF FF` ...)
/config/adapter/err_info
{"rsc":2000,"cnt_net_err":1,"con_ltime":"2022/02/03 18:58:01","discon_ltime":"2022/02/03 18:57:17","boot_cnt":5,"reboot_cnt_ping":1,"reboot_cnt_sync":0}
/config/firmware/info
{"rsc":2000,"version":"1_12_51","revision":"59F98A32","sw_id":"19002923","edid":"0000000003365089"}
/config/firmware/update
GET Method Not Allowed
# (here's how to brick your device? :))
/config/system/reboot
# (didn't try yet)
/config/wlan/settings
{"rsc":2000,"ssid":"abcdef","security":"mixed","link":1,"rssi":-54,"sec_type":"WPA2"}
# ssid redacted
/config/wlan/scan/result
{"rsc":2000,"cnt":0}
/config/wlan/scan/start
# (didn't try)
/config/cloud/connect
# Android app includes this string but the url return 404. Maybe for different model, or maybe it gives 404 once it's connected.
Someone else had also found these endpoints, see Daikin Airconditioning & WiFi module - #68 by jons. Anyway, none of this looks promising.