Add auth flow of a new bluetooth module (SOF: 0xFF 0xAA)
#94
Comments
|
Could you increse the log level and provide a complete log (in best case retrieved using a serial/USB connection)? |
|
Hello Sebastian, thanks for your quick response and your support. Unfortunately I do not have access to the device other than through Bluetooth since it is sealed. I added your log levels and have included the complete logs including the compilation and, in the end, where I move the device out of reach from the battery. Hope this helps? |
|
Your BMS doesn't respond. Do you have an Android app which is able to talk to the BMS? Could you share a link to this app? |
|
No Android app but an iOS app called XiaoXiangElectric which works fine. Could it have something to do with the password I set and am unable to remove? |
|
Yes. The password could probably be the root cause. |
|
Okay, than I am stuck, I have been googling but there seems to be no way to get rid of it since my only connection option is bluetooth which won't work with a password set. Any suggestions other than breaking the seal and the guarantee of this new unit? |
|
Hello Sebastian, Any suggestions on how I can debug this further? I did find a link to an Android App which looks the same as my iPhone app if that helps: https://play.google.com/store/apps/details?id=com.jiabaida.little_elephant&hl=en_US&pli=1 |
|
Some special protocol details of your BMS model / firmware: It looks like the communication isn't using official BLE encryption/pin/authentication features. It's a custom protocol. I guess we have to send an authorization frame to establish proper communication. |
|
Could you provide some screenshots of the Android or iOS app? I would like to understand which types of different passwords are used. It looks like the |
|
Sorry, I have to ask another time: Are you able to borrow a Android smartphone somewhere? A BLE traffic capture would be super helpful (it's part of a standard bug report bundle and can be create pretty easily). The device doesn't need to be rooted. |
|
Really appreciate your help here, thanks! I can try to capture the BME traffic on my Mac using my iPhone I guess. I will give it a try and get back asap. |
|
I've no experiences with iOS. A traffic capture (it called |
|
Well that went smoothly...:) See the attached log. What I did, I removed and reinstalled the app so it would ask for the password again. I hope this gives more insight in how to make it work. LeOr maybe it gives a pointer to remove the bluetooth password all together by maybe sending CLeanAppkeyframe or something which might do the trick as well. Let me know if I need to get your other info, looking forward to hearing your judgement! |
|
I made a selection for you within the apple logger which might make things easier. |
|
Good job! This is the raw traffic: Extract from XiaoXiang log 2.log / |
|
Long story short: Your BMS firmware supports some new / special commands to do some auth flow. We will try to replicate this behavior to get authenticated too. |
|
Wow, I can read and understand the short version and that sounds absolutely marvellous! This is really highly appreciated and I am looking forward to it. Please let me know if I can be of any further help! |
|
These are the most important parts of the communication:
|
|
Unusual question but could you provide your passwords for comparison? |
|
The plaintext password is encrypted against the MAC address of the BMS. The plaintext password would be helpful to reverse engineer the encryption. |
|
Sorry to only now notice your request but I already shared that, it is 123123 and that is the bluetooth password which is the only one I have set. |
|
Oh. I missed the detail the first time. |
|
Yeah, I guessed so ;). Let me know if I can help more, maybe set different passwords or so might ease the decryption? |
|
Could you provide another capture in which you enter an incorrect (but known) password? |
|
Okay, here is what I did. The password was first changed from 123123 to 123412 and the app removed and reinstalled. Filtered the log on the battery only: |
|
Content of the second capture: communications2.json.txt |
|
I am really impressed, looks like you are making progress! I was looking in Wireshark but cannot even see how you determine these packets, to me it looks completely different all together. Maybe I am using wrong settings or something. But never mind, don't let me distract you, let me know when you need me to test something! :) 
|
First of all you should filter for the important parts using: Expand the |
syssi
changed the title
0xFF 0xAA)
|
Could you try to start the App and retrieve some measurements from your BMS without any internet connection? |
|
Sure, just did and no issue, got the data. |
|
How to generate the payload of the "send first level password" frame: |
|
|
That's interesting! not very standard but looks like an algorithm, does it not? Do you need more examples, any specific ones maybe? Or would you like me to test possibly updated code which might support these passwords? |
|
I will care about the so called It looks like frame starting with |
|
|
I am not sure I understand it all but it looks like you are cracking the entire code here. Let me know when I can be of help or test something!! |
|
Hello Sebastian, I am curious whether you have made any progress yet. Or is there something I can do to help maybe? |
Hello, thanks for your great work, unfortunately I cannot get to to work with my unit SP04S034L4S200A.
I have included the log and the home assistant ESPHome configuration and hope to get some pointers to fix this.
It might be relevant that I have accidentally set a bluetooth password on the device. I did try to remove it by changing it to 000000 but not sure whether that helped.
Log underneath:
And the configuration:
The text was updated successfully, but these errors were encountered: