Reverse engineering Mr Steam Steam Linx

So I have a Mr Steam shower steam generator and it came with these two modules. One plugs into the main board on the steam generator and the other one plugs into your router.

I’d like to see if I could just replace this device with a ESP32 sitting next to the steam generator. There is 4 wires going from the module to the mainboard. I assume its power and tx/rx. So I’m wondering if there is a way to reverse engineer the signals to just copy them so I can control it myself?

I pulled apart the router side module and it has a RF board that I assume connects to the other side and sends commands from the app. The app has very few commands, on/off and set temperature. That’s literally it.

Wondering how you all might figure this out. I thought about a proxy that monitors the app and seeing if I could somehow interface through their API, but this thing is so bad that I suspect that stops working at some point. App has like 1 star in both app store and play store.

Any ideas on where you might start? Can I somehow log what is being sent to the port on the Mr steam using an esp32 I have laying around? I wouldn’t know what to do even if that would work so any suggestions are welcome.

Adding some notes

Here is the RF module specs from the FCCID https://fccid.io/OA3MRF89XAM9A

And this article is what I found about reverse engineering the RF signal, but that seems like it would just tell me what the two RF modules are saying to each other and not what the receiver is saying to the mainboard of the steam generator?

Fortunately, MOST of the signals are clearly labeled on that board. Specifically, you have 3.3VDC, 5VDC, and GROUND on the left edge, and a multi-pin header on the right edge. Do you have a volt/multi-meter available? I would ground the black probe, and set the meter’s voltage range to 1000VDC or lower. Then carefully touch the other probe (red?) to each of those pins. You’d be looking for either 5VDC or 3.3VDC signals that fluctuate rapidly when the unit is operating. That pin would likely be TX / TXD / TRANSMIT providing output data, hopefully asynchronous serial 8-bit data. Some console/debug output from the board would probably be very helpful.

Finally, it appears Gecko builds these circuit boards primarily for spa / hot tub manufacturers. You might inquire with someone in the business. They may be helpful.

Also, this comes from the technical information PDF file available at the Mr. Steam web site.

• The signal from the Home Automation system must
be a momentary contact closure to turn the Steam Generator ON
or OFF. A sustained contact closure or voltage will damage the
HomeWizard.
• The feedback from the HomeWizard is a sustained contact closure
when the steam generator is ON and an open circuit when the
steam generator is OFF. The maximum voltage for the feedback
circuit is 2A at 12 VDC.

These two items alone make it a perfect fit for an ESP8266 / Wemos D1 Mini running ESPHome with a relay to provide the contact closure needed.

Sounds like a typical garage door opener :slight_smile:

Exactly. Quite simple.