Reverse engineering an MQTT thermostat

I have heater/cooler manufactured by Rinnai which I have been trying to integrate, but it uses a proprietary thermostat. They have finally released a wifi module alongside an Android/iPhone app, but no API. With my little coding knowledge I have captured the packets with Wireshark and it appears to be using a form of MQTT! The frustrating thing is I can see the payload data but nothing else. From my understanding to send and receive data to this module I will need credentials and topics. How can I go about finding these? I have decompiled the Android app and looked everywhere for a mention of credentials or topics, but I only found more payload data.

Here is a screenshot of Wireshark during the initial connection (I had to manually choose MQTT as the ports aren’t standard) Any pointers would be hugely appreciated!

1 Like