Intex Pure Spa wifi control

Hello sorry I didn’t connect to this thread since a while as is it now winter and my Spa is disconnected.
So I don’t remember fully but it seems you have to send a specific command for each value of temp you want to set.
I will surely continue to make some tests next spring when the sun returns. Sorry if I can’t help further. Still if you want to make your own search you can use on your Android device a sniffer app to sniff an old version of the Intex SPA APK, you can find it outside of Play Store easily.
The latest version uses cloud even if you are on your own wifi network so you cannot snif as the packets are then SSL encrypted.
But with the old version it’s all clear in your own LAN so you can easily check which command does what and continue your investigations. Regards

Hi there.
@Olivier_B , I’m a developer and a new owner of a intex carbon spa. I already try your telnet commands with success. I think this can be a good idea for the community to have it in a integration form. I know @elkropac already started this work. Any github initiated with this work? I can be motivated to do so if needed. (and also to extend your searchs)

Hi, thanks for reply.
I have just pushed my work from september 2021.

The code is big hack, it’s glued from examples …

If i remember correctly, it was able to register new device, but I got lost at creating entities.

Mostly because of the async things and because i’m not a python programmer.

I wasn’t able to wrap my mind around it that time.

2 Likes

Not sure how I can help, I’m not a coder. But I would be very interested to get this further. Please let me …

Hi,
can anybody try to send

{"data":"","sid":"1654467840319","type":3}

with telnet on port 8990.
This is send by android app during device setup.

Mine spa responds with

{"sid":"1654467840319","data":"{\"ip\":\"192.168.x.x\",\"uid\":\"0K040210272020102000008062\",\"dtype\":\"spa\"}","result":"ok","type":3}

And it gets “Product name of " Bubble SPA V28062”

Hi,
Tested with:
{“data”:"",“sid”:“1654467840319”,“type”:3} on telnet port 8990

Spa responds with:
{“sid”:“1654467840319”,“data”:{“ip”:“192.168.#.#”,“uid”:“0K04######################”,“dtype”:“spa”}",“result”:“ok”,“type”:3}’

tested with:
{“data”:"",“sid”:"",“type”:3} on telnet port 8990

Spa responds with:
{“sid”:"",“data”:{“ip”:“192.168.#.#”,“uid”:“0K04######################”,“dtype”:“spa”}",“result”:“ok”,“type”:3}’

Product name Bubble SPA2448 (Intex purespa greywood 6 pers)

Hi,

Did some research about how to change the preset temperature.

To change the set temperature we need to send :

    command = {"data": "8888050F0CWWXX", "sid": "", "type": 1}
        WW: (desired_temp) in hex
        XX: (206- desired_temp) in hex

examples:

    desired_temp = 10°C
         WW: 0A
         XX: C4     (206-10 = 196)
         
         command = {"data": "8888050F0C0AC4", "sid": "", "type": 1}
    
    desired_temp = 20°C
         WW: 14
         XX: B4     (206-20= 186)

         command = {"data": "8888050F0C14BA", "sid": "", "type": 1}

Tested with the following temperatures:

    # 10°C    --> data= "8888050F0C0AC4"    196
    # 11°C    --> data= "8888050F0C0BC3"    195
    # 12°C    --> data=  "8888050F0C0CC2"   194
    # 13°C    --> data= "8888050F0C0DC1"    193
    # 20°C    --> data= "8888050F0C14BA"    186
    # 30°C    --> data= "8888050F0C1EB0"    176
    # 40°C    --> data= "8888050F0C28A6"    166

Hi,
can you please share uid from your reply? Or at least show the end of it?
Mine 2000008062 might map to V28062 i have in product name.

SID is just a time stamp + 3 digits (thousands of second ?), you get the same SID in replay that you sent in request

Hi,

Reply with uid:

{“sid”:"",“data”:"{“ip”:“192.168.1.2”,“uid”:“0K04############2000002448”,“dtype”:“spa”}",“result”:“ok”,“type”:3}

Hi,

There is also a broadcast search possible:

send “spa_request” to 255.255.255.255 on port 10549

Responds with:

{“ip”:“192.168.1.2”,“uid”:“0K04############2000002448” “dtype”:“spa”} on port 10500

Hi, , so the last four digits are model, “Bubble SPA V2” vs. “Bubble SPA” is not derived from this part 200000 .

Thanks for tip for broadcast, i will save it somewhere, it could probably be used for autodiscovery later (i don’t have HA in same network as my wifi devices, so it won’t work for me)

Hello guys how can I send these commands from windows? Sorry for dumb question. Would like to know my response… thanks and regards M.

You can install internal telnet client or use putty

1 Like

Thank you Libor will try it at home once back from work… what should I paste in command line once telnet session is open? I tried something yesterday and it did not work for me. Unknown command or just no response…

Hi just found this intex-spa · PyPI maybe it will come handy?

1 Like

Looks good, this should help me, at least the low level stuff will be done properly ;). Thanks for the link!

Hi, I am currently working on a python library for intex-spa, which is already able to retrieve and set main parameters for the spa: https://github.com/mathieu-mp/intex-spa
I am also actively working on a home assistant integration, I’m not fast but I work at it about 2h a week.

2 Likes

Hi everybody,
I’m also interested in an integration and contribution.
I’ve just bought a SPA but it has a defect, so I can’t do anything yet.

I tried to decompile the android app with jadx-gui and found out that code wasn’t obfuscated, so it may be interesting to have a look to find information.
for example the command types :

    public static class CommandType {
        public static final int BubbleOnOff = 3;
        public static final int FilterOnOff = 5;
        public static final int HeatOnOff = 4;
        public static final int JetOnOff = 2;
        public static final int PowerOnOff = 1;
        public static final int Refresh = 0;
        public static final int SanitizerOnOff = 6;
        public static final int TempSet = 7;
        public static final int TempSwitch = 8;
    }

the com.quest.questspaandroid.socketclient.TcpSocketClient shows an heartbeat request.
DeviceSPAActivity shows some byte decoding :

            Log.e(TAG, "Device led status byte 3,4 = " + str.substring(6, 10));
            deviceIconShowBySNData(Integer.toBinaryString(Integer.valueOf(str.substring(6, 10), 16).intValue()));
            Log.e(TAG, "device show status byte 1,2 = " + str.substring(2, 6));

and for the fun, there’s a default hardcoded AES key somewhere :slight_smile:

1 Like

Thank’s for your work , i introduce some new python script to change the Temperature cible using helper and slider and other to obtain the model . My lovelace card is like this :

image

Mathieu-mp , your library works like a charm , very fast , i will convert my scripts to use it.

Status:
Initializing IntexSpa instance
{‘power’: True, ‘filter’: False, ‘heater’: False, ‘jets’: False, ‘bubbles’: True, ‘sanitizer’: False, ‘unit’: ‘°C’, ‘current_temp’: 31, ‘preset_temp’: 31}

Thanks