So, I just got this new AC from Electrolux that is “smart” and controlled by an app (Electrolux Home+).
I want to integrate it to HA, but have no idea how to proceed.
I tried MITMProxy to get the endpoints but had no success with that, so I opened an iPhone backup and checked the folder for the App, and could see they are using Google’s Firebase within the App.
What would be the best approach to hack it and be able to send commands/read statuses from it?
I’d be keen on this too if you find anything. I have a Kelvinator which is the Australian equivalent to the electrolux. I can’t even get mine to connect to the app though, so have that to battle with first.
I think I can help you with that one!
Mine wasn’t syncing to the App as well. No luck with Electrolux’s techs.
So after trying a LOT I could: when it finally connects to the AC’s access point and start doing its thing, you have to turn off the wifi on your cellphone (iPhone in my case) and it did connect.
Took a few tries though…
Has there been any progress in integrating this AC? I have two being installed today. 
I’m also interested in integrating an Electrolux AC, in my case it is one of their portable ones…
Anyone dived any further into this? I’ve taken some pcaps which may help, unfortunately not sure what to do with them.
Can you share?
I Wiresharked and MITMProxied the requests. I could get the API URLs such as:
https://meu.electrolux.com.br/DesktopModules/ProductRegistration/API/Users/My_Email_Address_Here/
And the JSON request which is:
{
"username": "[email protected]",
"password": null,
"metadata": {
"email": "[email protected]",
"CPF": "123456789",
"name": "My Full",
"cellphone": "123456789",
"NickName": "MyNicknameForTheApp",
"LastGeoLat": -00,
"LastGeoLong": -00,
"LastDeviceToken": "BIIIIIIG_STRING_TOKEN",
"FacebookID": "",
"Interests": " Interest, AnotherInterest",
"Picture": [0,0,0,0,0],
"PictureMimeType": "profile.png",
"PostalCode": "123456789",
"Street": "My Street Address",
"Complement": "My House Number",
"District": "",
"Number": 0,
"City": "My City ",
"State": "My State",
"country": "BR",
"BirthDate": "0001-01-01T02:00:00Z",
"firstname": "My First Name",
"lastname": "My Last Name"
}
}
But had no success trying to CURL those
@alex.venom, Legend! was just about to start down this path having imported everything else I own now into HA (about 3 days ago started with HA again), and finding the only thing that doesn’t have an integration is the aircon.
Did you have the chance to try that out?
I’ve seen this video on Youtube: https://youtu.be/Hl0IpoS503A
I might try that and see if I can get any luck…
I’m running a Kelvinator AC so it may be different.
The Kelvinator Home Comfort app from my iphone has a sqlite db that has the following info for my model profile:
{“ac_mark”:[{“ifttt”:0,“idx”:1,“in”:[1,0,1,2,3,4,5],“act”:3}],“scrdisp”:[{“ifttt”:0,“idx”:1,“in”:[1,0,1],“act”:3}],“modelnumber”:[{“ifttt”:0,“idx”:1,“in”:[3],“act”:3}],“sn”:[{“ifttt”:0,“idx”:1,“in”:[3],“act”:3}],“ac_timingtime”:[{“ifttt”:0,“idx”:1,“in”:[3],“act”:3}],“ac_pwr”:[{“ifttt”:0,“idx”:1,“in”:[1,0,1],“act”:3}],“ac_timingenable”:[{“ifttt”:0,“idx”:1,“in”:[1,0,1],“act”:3}],“mldprfdisplay”:[{“ifttt”:0,“idx”:1,“in”:[1,1],“act”:1}],“slpdisplay”:[{“ifttt”:0,“idx”:1,“in”:[1,0],“act”:1}],“ac_mode”:[{“ifttt”:0,“idx”:1,“in”:[1,0,1,2,3,4,6],“act”:3}],“ac_setsleepinfan”:[{“ifttt”:0,“idx”:1,“in”:[1,0],“act”:1}],“envtemp”:[{“ifttt”:0,“idx”:1,“in”:[2,-20,65,1,1],“act”:1}],“lightdisplay”:[{“ifttt”:0,“idx”:1,“in”:[1,1],“act”:1}],“ac_setautomarkinfan”:[{“ifttt”:0,“idx”:1,“in”:[1,1],“act”:1}],“ac_vdir”:[{“ifttt”:0,“idx”:1,“in”:[1,0,1],“act”:3}],“ac_errcode”:[{“ifttt”:0,“idx”:1,“in”:[2,0,255,1,1],“act”:1}],“ac_setquietinallmode”:[{“ifttt”:0,“idx”:1,“in”:[1,1],“act”:1}],“timer”:[{“ifttt”:0,“idx”:1,“in”:[3],“act”:3}],“ac_slp”:[{“ifttt”:0,“idx”:1,“in”:[1,0,1],“act”:3}],“mldprf”:[{“ifttt”:0,“idx”:1,“in”:[1,0,1],“act”:3}],“temp”:[{“ifttt”:0,“idx”:1,“in”:[2,16,30,1,1],“act”:3}],“ac_settempindehum”:[{“ifttt”:0,“idx”:1,“in”:[1,0,1],“act”:1}]}
1 Like
That was a great idea, @talondnb!
I made a backup of my iPhone and opened using iBackup Viewer. Then got a. file form the Electrolux app called “ConnectAppHub” which turned out to be a SQL database.
I then opened that in DB Browser for SQLite and was able to see a LOT of tables:
Most of those are empty, but I could find my Favorite settings saved in the ArConFavorite table, but what is really cool is the Configuration table, which has all the API endpoints:
I could find my ACs and fridge in the PNCDetails table, but not the token.
I also got a few JSON files but found nothing interesting in those.
2 Likes
I am also interested in integrating my portal Electro lux ac (WP71-265WT), its communicating with ibroadlink.com. I have some dumps of the traffic, captured it with mitmproxy, but Its not a plain-text protocol.
Ibroadlink have a appsdk demo for android and ios on github:
My Findings so Far on Reverse Engineering the Kelvinator Home Comfort API
First off, this is the first time I’m doing anything like this so just brain dumping what I’ve found so far and hoping it helps any smarter people than me, and I’ll keep researching.
I set up mitmproxy running on macOS to intercept traffic from my Android Pixel 4 XL, whilst performing a number of functions in the app including signing in to the app, I found 4 URLs (that appear to be api endpoints by the looks of them). I can’t seem to query then in Postman however and get the error {"error":-2002,"status":-2002,"msg":"数据错误"}
Funnily enough, when toggling the aircon (Kelvinator brand) on/off (or any control for that matter), no traffic is transmitted at all.
Identified the following URL’s
- https://bddb4af53f74edaa03b1aa439b75e7a6bizaccount.ibroadlink.com/account/login
- https://bddb4af53f74edaa03b1aa439b75e7a6bizihcv0.ibroadlink.com/ec4/v1/user/getfamilyid
- https://bddb4af53f74edaa03b1aa439b75e7a6bizihcv0.ibroadlink.com/ec4/v1/family/getallinfo
- https://bddb4af53f74edaa03b1aa439b75e7a6bizihcv0.ibroadlink.com/ec4/v1/common/api
Endpoint /account/login
Traffic is captured when signing into the app, no traffic captured when signing out.
Request
Content-type: application/x-java-serialized-object
system: android
appPlatform: android
language: en-au
timestamp: 1591960217
token: [REDACTED]
User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 4 XL Build/QQ3A.200605.002.A1)
Host: bddb4af53f74edaa03b1aa439b75e7a6bizaccount.ibroadlink.com
Connection: Keep-Alive
Accept-Encoding: gzip
Content-Length: 144
Response
{
"error":0,
"status":0,
"msg":"ok",
"userid":"[REDACTED]",
"companyid":"[REDACTED]",
"nickname":"[REDACTED]",
"iconpath":"",
"sex":"male",
"loginsession":"[REDACTED]",
"logintime":"2020-06-12T19:10:19+08:00",
"loginip":"[REDACTED]",
"fname":"",
"lname":"",
"usertype":"0",
"phone":"[REDACTED]",
"email":"",
"flag":1,
"birthday":"0000-00-00 00:00:00",
"pwdflag":0,
"countrycode":""
}
Endpoint /user/getfamilyid
Traffic is captured when the app is listing the devices in app.
Request
Content-type: application/x-java-serialized-object
system: android
appPlatform: android
language: en-au
loginsession: [REDACTED]
lid: [REDACTED]
userid: [REDACTED]
timestamp: 1591959932
token: [REDACTED]
User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 4 XL Build/QQ3A.200605.002.A1)
Host: bddb4af53f74edaa03b1aa439b75e7a6bizihcv0.ibroadlink.com
Connection: Keep-Alive
Accept-Encoding: gzip
Content-Length: 64
Response
{
"error":0,
"status":0,
"msg":"ok",
"familyinfo":[{
"id":"[REDACTED]",
"familyname":"Electrolux Family",
"version":"2020-03-11 18:25:07",
"shareflag":0
}]
}
Endpoint /family/getallinfo
Traffic is captured after the user/getfamilyid POST and is captured when the app is listing the devices in app. Again funnily enough the only device I have is called Master Bedroom aircon and is not set in a room so don’t know where all the rooms are coming from.
Request
Content-type: application/x-java-serialized-object
system: android
appPlatform: android
language: en-au
loginsession: [REDACTED]
lid: [REDACTED]
userid: [REDACTED]
timestamp: 1591959932
token: [REDACTED]
User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 4 XL Build/QQ3A.200605.002.A1)
Host: bddb4af53f74edaa03b1aa439b75e7a6bizihcv0.ibroadlink.com
Connection: Keep-Alive
Accept-Encoding: gzip
Content-Length: 64
Response
{
"error":0,
"status":0,
"msg":"ok",
"familyallinfo":[{
"familyid":"",
"shareflag":0,
"familystate":0,
"createuser":"[REDACTED]",
"familyinfo":{
"familyid":"[REDACTED]",
"userid":"",
"name":"Electrolux Family",
"description":"20200311 20:21:34",
"familylimit":0,
"postcode":"",
"mailaddress":"",
"longitude":0,
"latitude":0,
"country":"",
"province":"",
"city":"",
"area":"",
"order":0,
"icon":"https://bddb4af53f74edaa03b1aa439b75e7a6bizihcv0.ibroadlink.com",
"version":"2020-03-11 18:25:07",
"location":{
"country":"",
"province":"",
"city":""
},
"orgname":"",
"groupname":"",
"attributes":[""],
"additional":{
"room":{
"roomlist":null,
"action":""
}
}
},
"roominfo":[{
"familyid":"[REDACTED]","roomid":"2108073310317223722","name":"Senior housing","type":22,"order":15},{
"familyid":"[REDACTED]","roomid":"2108119028718423284","name":"Dining room","type":19,"order":12},{
"familyid":"[REDACTED]","roomid":"2108122847830735903","name":"Shower room","type":23,"order":16},{
"familyid":"[REDACTED]","roomid":"2108247970584067929","name":"Bathroom","type":6,"order":6},{
"familyid":"[REDACTED]","roomid":"2108323198848892842","name":"Second bedroom","type":18,"order":11},{
"familyid":"[REDACTED]","roomid":"2108359874668912446","name":"Downstairs","type":28,"order":21},{
"familyid":"[REDACTED]","roomid":"2108432329282346271","name":"Balcony","type":20,"order":13},{
"familyid":"[REDACTED]","roomid":"2108614973837138423","name":"Guest room","type":2,"order":2},{
"familyid":"[REDACTED]","roomid":"2108619978015459890","name":"Dining room","type":14,"order":8},{
"familyid":"[REDACTED]","roomid":"2108729120378245569","name":"Living-room","type":10,"order":7},{
"familyid":"[REDACTED]","roomid":"2108729232751990839","name":"Second floor","type":26,"order":19},{
"familyid":"[REDACTED]","roomid":"2108747350697851510","name":"Study room","type":3,"order":3},{
"familyid":"[REDACTED]","roomid":"2108765696525464922","name":"Master bedroom","type":17,"order":10},{
"familyid":"[REDACTED]","roomid":"2108830474760370051","name":"Upstairs","type":27,"order":20},{
"familyid":"[REDACTED]","roomid":"2108932253061927840","name":"Baby room","type":4,"order":4},{
"familyid":"[REDACTED]","roomid":"2108966886782394463","name":"Kitchen","type":5,"order":5},{
"familyid":"[REDACTED]","roomid":"2109041418065768636","name":"Children room","type":16,"order":9},{
"familyid":"[REDACTED]","roomid":"2109059107734149287","name":"Bedroom","type":1,"order":1},{
"familyid":"[REDACTED]","roomid":"2109127730762341864","name":"Pet room","type":21,"order":14},{
"familyid":"[REDACTED]","roomid":"2109147301001058335","name":"The entrance","type":24,"order":17},{
"familyid":"[REDACTED]","roomid":"2109189274487488426","name":"Ground floor","type":25,"order":18}],
"devinfo":[{
"userid":"",
"familyid":"[REDACTED]",
"version":"",
"roomid":"",
"did":"0000000000000000000024dfa74bbc6f",
"mac":"24:df:a7:4b:bc:6f",
"password":[REDACTED],
"devtype":20379,
"pid":"0000000000000000000000009b4f0000",
"name":"Master Bedroom Aircon",
"lock":false,
"aeskey":"[REDACTED]",
"terminalid":1,
"subdevicenum":0,
"longitude":0,
"latitude":0,
"extend":"",
"wifimac":"",
"devicetypeflag":0,
"groupdevice":null}],
"moduleinfo":[{
"moduleid":"3108480959390461651",
"userid":"",
"familyid":"[REDACTED]",
"version":"",
"roomid":"",
"name":"Master Bedroom Aircon",
"icon":"",
"flag":1,
"moduledev":[{
"did":"0000000000000000000024dfa74bbc6f",
"sdid":"",
"order":0,
"content":"",
"devmoduleid":""}],
"order":1,
"moduletype":1,
"scenetype":"",
"followdev":1,
"extend":"",
"extern":"",
"linkagetype":"",
"attributes":[""],
"resourcetag":""}]}]}
Endpoint /common/api
Traffic captured randomly when opening the app after the 3rd time.
Request
system: android
appPlatform: android
language: en-au
timestamp: 1591962013
User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 4 XL Build/QQ3A.200605.002.A1)
Host: bddb4af53f74edaa03b1aa439b75e7a6bizihcv0.ibroadlink.com
Connection: Keep-Alive
Accept-Encoding: gzip
Response
{
"error":0,
"status":0,
"msg":"ok",
"key":"[REDACTED]",
"timestamp":"1591962015"
}
1 Like
I’ve also unpacked the Android apk for the Kelvinator Home Comfort app, however I’m going to bed so thought I’d upload to GitHub if anyone cared to filter through it.
1 Like
Was anyone able to get an further on this?
@TJohnson93 did you make any progress on this? I’ve just put in a Kelvinator and looking to integrate it to HASS. If I can do it directly that would be awesome, but I also have Tado heating so could use their AC IR control…but then would have to try to hid those units somewhere.
Will be willing to PayPal anyone who can sort this out $20.
There’s some really helpful tips in this thread. When I have some spare time I will see if I can contribute at all.
If anyone seeing this can provide any general advice about what the next steps would be, I’d appreciate it.
Took me about 3 weeks and 30+ support calls to get them to fix the integration with google home, I think the likelihood of any Dev support from Kelvinator/Electrolux whatsoever is absolutely impossible. (For anyone curious they never told me what they did, or responded to my questions asking how they fixed it, it just appeared in my device list in the home app today)
Unfortunately I haven’t had much opportunity to play anymore @pixsoul, I’ve even begun contemplating just putting up with the Google home app haha
following.
This needs to be done. Please 