Smartap Shower Control: Getting started with reverse engineering a smart home device?

Hi Everyone, not sure if this will help anyone having issues getting their shower online but it helped me.

I’ve moved my shower to new networks a few times and each time it has been a bit of a fiddle.

When I got my shower, it wouldn’t connect to the wifi with the android version of the app. It wasn’t passing the credentials to the shower even though it said it did.

I used a borrowed iPhone to get it connected and just assumed the latest android app from Google play store v1.3.2 was slightly broken.

Once connected to the network I could sign into the android app and do everything I needed, like changing settings or controlling the shower.

Two days ago I changed my router and wanted a new network name (SSID) so I tried to use the android app and it still didn’t work. I borrowed an iPhone and discovered the app has been removed from the apple app store. If you still have it on an iPhone, don’t remove it!!!

So now I’m in a panic about having to rip it out as it won’t connect to the old SSID either.

I downloaded Version 1.3.0 of the android app from apkpure instead of using the latest version in the app store and my shower connected to WiFi instantly.

I now have voice control back and my IFTTT/Smartthings integration.

Once you’ve connected the shower to your network, switch back to the latest version of the app.

Sideloading apps from sites such as apkpure could put your phone at risk. If you decide to take the risk as i did, please remove the app as soon as you get what you need.

2 Likes

Wow, lots of cool stuff happening lately!

@mav1 thanks so much for taking to the time to post, it’s really interesting to read! Like you said this means we could have cloud control, which is an awesome achievement! Bravo!

I think for my scenario I’m still pretty snookered as I cant access the account my shower was originally registered to, therefore there are no comms between their server and my shower, as its like it was never setup. I’ve managed to play around with posting stuff but only managed to get the outlets to change, that must have gone through their server somehow - but it didnt last.

@steven Thanks for your post, I think this could be an option for me to get things working once more! Im the opposite though and only have an iphone, which just isnt passing the final stage of setup. I will see if I can borrow an android device and get that app version though, fingers crossed!

Thanks all!

1 Like

Bad news…
image

@mav1 how you getting on!? We need you :sob: :wink:

Wow, this is a blow! But hopefully will give the community the impetus to strive for a solution.

This could be a good time to pester the original team and ask if they can throw us bone when it comes to working out the comms from server to device? @vaderag did you ever hear back from the CEO guy?

Cheers,

G

No I didn’t - let me chase…

Edit. No luck. He came back to me really quick but he’s not got any connection there any more

Hi, Right, I’ve also received the email. So I gather that’s it, back to a normal on/off shower :frowning: not impressed at all… I wouldn’t mind but you can still buy the shower on some websites :frowning:

I guess this thread might be getting a lot a views as I too received the support email today.

I’ve read the thread from the top and I’m impressed with the technical discussion and the desire to retain automation of the valve. I consider myself a bit of a techie but this stuff is way out of my league!

One question, can I assume that, if they pull access to the service on AWS, unless there was a way of bringing the ‘service’ to a local server, it would be pointless getting access to the API?

I’ve done a bit of searching myself this afternoon re Smarap the company and I’ve mailed Masco in the vain attempt of getting some response.

There are also 21 people still listed on LinkedIn as employees including the CTO (https://www.linkedin.com/in/yuval-klein-aa1b055/). I retired a couple of years ago but would be happy to get LinkedIn premium it it’s worth reaching out to them.

I’ve actually emailed the CTO earlier - I was pointed his way by the contact I had above. I’m only holding limited hope for a response tho

Oh wow. Well this doesn’t look good. So quick update from me, I managed to buy a spare unit from another frustrated customer.

I managed to manually connect the spare to my network despite having issues through the app. I was planning to write this up in case it was of use. All the things I could do with my original I could do with the spare.

I spoke with George about how he got into his WiFi module without killing it and then took the plunge with a hot Stanley knife and hoped. I currently have access to the top side of the pcb and everything is still working fine.

I’ve done a lot of reading up and had a good feeling as previously discussed about reverse engineering it. However when looking the MCU in the flesh I realised that it looks like the ports on the pcb aren’t UART but instead JTAG.

As this is a custom board it’s difficult to work out whether there still is Uart ports accessible. I’d assume so but unsure. With JTAG, with some of the reading I’ve done a similar reverse engineering approach could/should be possible, but it’s a trickier route (anyone with any experience of jtag? Nope didn’t think so!).

BUT, if the cloud server is shut down, this is all irrelevant. As stated before I can freely access the server and do lots of things but without it communicating to the eValve it’d be more difficult to reverse engineer.

As of right now I still have connection and full control through alexa and the app. Goodness knows how long we have though.

I’ll try and commit some time to it and see what can be done but really need more time.

Sorry everyone!

2 Likes

Help us mav-wan Kenobi, you are our only hope!! :joy:

Seriously tho, thanks for your research into this…

1 Like

Through the urls the app points to, I believe we’re using parts of the api when we’re connecting to the server with the app.

Unfortunately, the server to eValve traffic is encrypted so how the server tells the eValve to work isn’t 100% clear. I was hoping to resolve this issue but could do with the server to staying alive for the foreseeable.

Sorry for spamming, but reacting to events (during kids’ bedtime). If you can get jtag/uart up and running, even if the server goes off there’s a chance you can copy the firmware, decompile the binary and potentially reverse engineer the html post commands…

…or, as my wife has just pointed out, just buy a new shower. We’ll see about that. :blush:

1 Like

Lol. I recon your wife and mine would get on well :joy:

But where’s the fun in that… Besides, you’ve bought the second shower for hacking now :+1:t2:

1 Like

I muttered “… It’s the principle”. And the plumbing.

Not to mention a lot of people have been mis-sold to!

2 Likes

Can’t say for certain but couldn’t access smartap just now via Alexa, first time in a while… Given the notice above, suspect it’s doomsday

Yep, same here. To be so emotionally invested in a shower eh?!

I know right… But to be fair, it wasn’t a small investment

Morning all. Server seems to be down again as noted. Similar symptoms as previous outages but who knows if this one is the death song…
I’m the admin of the Facebook group that seems to have become the home for smartap owners in need of support. If I can do anything to help with these efforts please let me know.

Welcome Paul :slight_smile:

I replied to the email we received in the (faint) hope of getting some assistance

Given the end of life, is there any possibility of getting a firmware that allows local control? I know this was available for Hotels etc early in the lifecycle so it does exist, and this would allow us users continue usage

Received a reply:

We understand your frustration that we are unable to continue supporting the SmarTap eValve product. Unfortunately, we cannot continue the efforts required to update and maintain the capability over multiple operating systems (Apple iOS, Android) and their demands regarding updates. We are also unable to provide the API, as some have asked. Please accept our sincere apologies for any inconvenience.

I have tried one last ditch response to them:

As a professional product manager I understand the direction, but I am begging to engage further in this

I just want to emphasize that we are not asking for maintenance across multiple platforms, or maintenance at all - we understand this is end of life, but we are simply asking for access to the existing code

For example we could set up a community run AWS instance to support existing customers, or even better use the existing local control API to engineer a local solution using Home Assistant
We’re not asking SmarTap for anything in this process

We are only asking for information that already exists - we simply want to have the opportunity, as a community, to engineer a solution to make the products we purchase work

3 Likes

Well done on the impassioned plea @vaderag! I’m not holding out too much hope but its totally worth a shot.

It’s so frustrating that they literally shutdown the whole thing down, all we would need really is just a copy of whatever was running on their AWS setup so we could replicate and run locally… Its just the problem when you are emailing customer support and they could literally just ask the DevOps team but they customer support dont even know what the real request is, sorry I’m just venting now.

I have faith in master mav-wan kenobi! :pray: And I’m here just trying to ChatGPT my way through ideas like a noob :joy: concerning though as I really don’t want to brick my evalve, the control panel is literally tiled into my bathroom.

Welcome @Pauliedw! Im not on FB, but I would assume there havent been many major breakthroughs in getting to the elusive device firmware? (Which I think is the most realistic option now).

Maybe the pester approach could be a last ditch, last ditch? Like how many people is this affecting, if all of us sent weekly emails to whoever owns the IP now, then surely they would cave and just be like, its abandoned here is the code please stop emailing lol.

Or put a bounty out there to a hardware hacking community? If 50% were willing to contribute a small amount it might be enough? I guess the issue with this idea would be that they would need a test unit.

Anyway not a useful post, so apologies - of course I will update here if any of my shots in the dark land.

Best of luck all!