I recall a couple of things that initially caught me when getting mine working:
You have to send only the payload part of the intercepted packet, not the entire content. The wireshark application for windows easily highlights the payload.
Hi Lionello, i tried to send only the payload, no luck, this was the payload :
55000000000000000000000000000000000000000000000000bcec000037276a0088835d28e40d43b401000000f0c600000bfdaad200a1e1a1ab38d9f35a49b354b8bd5a2903625de48c770a583bcbbf8a840e5253f0233b67f8497e1b3f2e781856665429430ccfd855500b43bc1d194158ef35dba23932896682d6d4fa4933bb
I could send you a .pcap file if you wish to take a look.
Thanks
You have to send the payload of the UDP packet, not the QUIC one. By looking at the wireshark window I realize that the only place where you can find the “payload” string is inside the QUIC part, and this is confusing.
You have to select the QUIC line, and all the bytes that you need to send will appear: I guess they will start from 5a a5 … (at least my packets start with these numbers).
for me capturing the codes is not very clear…
1 pushed 3 buttons on the app.
1: 3 times
2: 4 times
3: 2 times
and got this:
5aa5aa555aa5aa5500000000000000000000000000000000000000000000000024f2000037276a005e80cf1ee40d43b40100000073c60000e19a157bb2ebf75adff415f7f8764f2c2f3066aad6ddae8f78ab58c5350fc389a62e7838eda0be1d6226b12879d4941d39f918fff2d012d63283ca6c194d4f826951e659babcebce2a212a4ce54bef6c
5aa5aa555aa5aa5500000000000000000000000000000000000000000000000017f2000037276a004e83cf1ee40d43b40100000073c60000e19a157bb2ebf75adff415f7f8764f2c2f3066aad6ddae8f78ab58c5350fc389a62e7838eda0be1d6226b12879d4941d39f918fff2d012d63283ca6c194d4f826951e659babcebce2a212a4ce54bef6c
5aa5aa555aa5aa55000000000000000000000000000000000000000000000000e8f1000037276a002280cf1ee40d43b40100000073c60000e19a157bb2ebf75adff415f7f8764f2c2f3066aad6ddae8f78ab58c5350fc389a62e7838eda0be1d6226b12879d4941d39f918fff2d012d63283ca6c194d4f826951e659babcebce2a212a4ce54bef6c
5aa5aa555aa5aa55000000000000000000000000000000000000000000000000d5f4000037276a000480cf1ee40d43b40100000074c6000054d411c45ce1b0c972dd0116fea3bcda6885ba57b5128cb5b87b946529c240b59b8bed235aef386f074cec4331af96da9650c2378197ef947dda6361c843d7fa30fca49fa58192dc08e7d0d9b59c9a7d
5aa5aa555aa5aa5500000000000000000000000000000000000000000000000030f5000037276a005e81cf1ee40d43b40100000074c6000054d411c45ce1b0c972dd0116fea3bcda6885ba57b5128cb5b87b946529c240b59b8bed235aef386f074cec4331af96da9650c2378197ef947dda6361c843d7fa30fca49fa58192dc08e7d0d9b59c9a7d
5aa5aa555aa5aa5500000000000000000000000000000000000000000000000091f5000037276a00be82cf1ee40d43b40100000074c6000054d411c45ce1b0c972dd0116fea3bcda6885ba57b5128cb5b87b946529c240b59b8bed235aef386f074cec4331af96da9650c2378197ef947dda6361c843d7fa30fca49fa58192dc08e7d0d9b59c9a7d
5aa5aa555aa5aa55000000000000000000000000000000000000000000000000daf4000037276a000782cf1ee40d43b40100000074c6000054d411c45ce1b0c972dd0116fea3bcda6885ba57b5128cb5b87b946529c240b59b8bed235aef386f074cec4331af96da9650c2378197ef947dda6361c843d7fa30fca49fa58192dc08e7d0d9b59c9a7d
5aa5aa555aa5aa55000000000000000000000000000000000000000000000000cef0000037276a001d82cf1ee40d43b40100000075c6000054d411c45ce1b0c972dd0116fea3bcdac50cb755c49c95e02ea6d5810df7c3b976ef0f736e88279f0fd810713b35583d505a7e6ce5aa4e5a2c26ebbdddb69d09b063aa138f5ff9bf7537cd36d04b9b16
5aa5aa555aa5aa5500000000000000000000000000000000000000000000000051f1000037276a009f83cf1ee40d43b40100000075c6000054d411c45ce1b0c972dd0116fea3bcdac50cb755c49c95e02ea6d5810df7c3b976ef0f736e88279f0fd810713b35583d505a7e6ce5aa4e5a2c26ebbdddb69d09b063aa138f5ff9bf7537cd36d04b9b16
is this correct?
what is the max length? and how must I use this stings? (convert?)
Hello all!
I’m sorry I wasn’t able to participate here, but it was rather busy few months, and I really had no time for the side projects. @Lionello_Marrelli and @benhelps, thank you for stepping in and helping other users. I hope the other issues but the last are resolved. Regarding the last question, your payload looks OK, just copy the whole string for each command (only once) and put it in the configuration file, name it (without blanks), and then call the application with that command as parameter. It should do the trick. I hope in the next month or so I will be able to get back to this and try to make an app that will make learning and programming codes much easier.
Best regards,
Davor
@remb0. Sorry for not answering earlier. The sequences look right. If you use “packet sender” for windows you have to copy one sequence in the “hex” window and then sendo to the ip address of the mini (using udp)
Hello!
I finally had some free time to get back to this, so, before I start with a learning commands part of the app, I wanted to clean the mess and confusion Dummy command did. I’ve managed to isolate the parts which should be different every time, and replace them with randomly generated hex code. There are two parts of the learned command, two bytes long each. Long story short - I’ve removed DummyCommand from the Settings.py and the .ini file, and there is no need to send two commands each time, anymore. I’ve uploaded changes to the github repository. If you encounter any problems, you can open an issue on github, or write about it here. The next step should be a part which would make learning IR commands directly from a command line into an .ini file possible.
Best regards,
Davor
Will your script work with this?
Lionello_Marrelli: it works thanks!
davor I gonna test the update thanks!
Hello!
Since I don’t have RM Pro, I can’t tell you if it will work. First, you need to capture some UDP packets on your android phone, while using their application (you should be on the same Wi-Fi network as the RM Pro - to avoid going through their web service). Next, you can try this app as-is, with packets you’ve captured entered into BlackBeanControl.ini, to see if it will work. I doubt it will, because I doubt they change the same four bytes of payload. Secondly, if you are familiar with Python, you can try to send unchanged payload, if RM Pro doesn’t require different payload every time it receives command.
Just change this line:
UDPData = bytearray.fromhex(CommandToSend)
with this line:
UDPData = bytearray.fromhex(CommandFromSettings)
If that doesn’t work, you can try and revert code to an earlier version, to try sending dummy command before real payload, but that would require intercepting UDP payload for some unused remote code. And, at last, if RM Pro requires different payload every time, you can try to find the part(s) of the payload that gets changed in two consecutive commands (command must be the same), and the applying random hex string patch from the last commit on the GitHub. If you need any more help, feel free to ask.
Best regards,
Davor
By the way, should I change the name of the topic, and remove “help with understanding their UDP protocol” part? Maybe add something like Python script for RM 3 Mini control, so other people would know what it is about?
Best regards,
Davor
Hi Dave,
thank you for you research.
I would suggest to change the topic name to
"Broadlink Black Bean (RM 3 Mini) IR Controller - Integration in Openhab"
Ciao
Lionello
Hello Lionello,
thank you for the suggestion. I’ve changed the topic name.
Best regards,
Davor
@Maximo
I would expect that sending intercepted udp packets works. In any case, if you look the following site,
http://milillicuti.com/an-api-to-connect-your-broadlink-rm-pro-irrf-wifi-bridge-to-your-home-automation-system/
you will see that you can send IR commands to the broadlink RM pro by sending http requests to an Android device with a proper app installed.
Not only that, you can also read the temperature measurement.
The only drawback is that you have to dedicate an Android device to the purpose of communicating with the broadlink rm pro.
Lionello
For those having troubles using wireshark for packet sniffing, the HTTP Bridge App inhis recent new version, offer an alternative way to operate the broadlink mini 3
http://rm-bridge.fun2code.de/
The developer managed to make tha app compatible, thanks to a workaround.
The drawback of this approach is that Openhab do not communicate directly with the Mini but passes through an android device.
Hello!
Last night I’ve tried to intercept the learning part, but it left me pretty confused. The communication is still UDP, android app sends a command to trigger a learning process, then RM 3 returns payload to the app. Returned payload is 178 bytes long and begins with 5aa5aa55, same as the command sent from the app, that we intercept and use with Python. The problematic part is - command received after learning process, and command that you send with the button you used to learn command are totally different. The only common parts are 5aa5 part, and MAC address of the RM 3 (in little endian). I’ve tried to find some way to decode it from the received command to used command, but was unable to find anything in common for the two commands.
Here are examples of the two commands I’ve worked with:
After sending learn signal (by pressing Volume Up on the app’s not yet learned button), and pressing Volume Up button on the TV remote, RM 3 responds with:
5aa5aa555aa5aa55000000000000000000000000000000000000000000000000b9f000003727ee0339820a22cc0d43b4010000000ac7000036b507f6cc50c1f37b19cc5f91cfa7217bd524a579cb7bb8172ee774ff36a05e7783e7870e6ad53eaca1673b776dade8843a33bcfde7c1bafa0b909512b29241c0c218722143841b3ed28eb29e1aaf46
After that, when I try to send Volume Up command from the app, it sends this:
5aa5aa555aa5aa550000000000000000000000000000000000000000000000001def000037276a0061810a22cc0d43b40100000008c700002bfb0aa884a1fdbe097ea8c34eb9a0ff9cebd5004685b47f41cf93ebe6b43a97b97d0d86ca8dc9732bbaf721050426ed81d80f72a33cbf103961a443503121bb700e0338e0eb1c3531d705cde184abbf
The same goes for Volume Down button - RM 3 response after learning:
5aa5aa555aa5aa5500000000000000000000000000000000000000000000000084ee00003727ee0367820a22cc0d43b4010000000bc70000a41d55e3f0cb41085325e9809b4d21d4cd834b97f02e169a697f9d0046cd5614cecaa1778034d2cab55d3d6d2cbd5ce05069adad87aae07b4cfe7cd82ef119749eb64d98c1418065161520613f73b31a
UDP payload sent from the app:
5aa5aa555aa5aa55000000000000000000000000000000000000000000000000e9ee000037276a001e800a22cc0d43b40100000009c70000dc23af4c138a7a55e2a9fbb2bf476e149ed530d1ffa10c1b29103ba39194a5f8325965fe909aec44e8f0773c282751c8e50d3bca85a3b0d7e60303835168577906cd35823b79ffc6acb9b33714aa12d6
I hope someone else could take a look and, perhaps, find something in common for the learned and sent commands.
P.S. I forgot to mention that I’ve tried sending both commands - the first one (received from RM 3) doesn’t work. The second one works, the same way it was working before.
Best regards,
Davor
One byte sequence may be encrypted with some key which may be hard to find. in any case it may be interesting to look at more packets hoping that a simple relation holds (bit reversal, bit shift,…?)
What happens if you learn the same command two or more times? You have found that 4 bytes in the packet being sent by the app vary each time.
Are the learnt packets identical or do they slightly differ?
Have you tried using the http bridge app? When learning a command the web interface shows the http string that includes the byte sequence. Does it correspond to the one that you intercept?
In particular, I find intersting that the same command can be sent to another mini, by specifying its mac address. But how would the packets sent by the http bridge app look like?
Regards,
Lionello
Hello!
I’ve had the same idea last night, so I’ve installed RM Bridge and tried intercepting packets. The result is the same - the packet received from RM 3 after learning differs from the packet sent from RM Bridge. I haven’t tried to learn the same command twice yet. I’ll try that tonight. Regarding the data that you can find in RM Bridge, it’s even harder to find a relation to UDP packet. It is represented by stream of numerals, with only two (if I recall correctly) hex bytes. It also contains a lot of repeating parts of the stream (for example: 11141114 that repeats for 5 or 6 times in a row), but hex dump does not contain any value that repeatedly occurs 5 or 6 times. It was my plan B, to make import of codes from RM Bridge to BlackBeanControl settings file, if I can’t make learning within application possible, but it looks like that would be impossible too. I’ve tried sending that stream of numerals via UDP send application, but it doesn’t trigger a learned command (I guess it should include MAC address or something, but I don’t know where, or what format should it be in). I’ll try investigating it a bit more tonight, and report here if I find anything.
Best regards,
Davor
I should have made myself a lot clearer in my post. What I should have asked was would this script be able to switch on and off the light switches? Or is there an alternative already available.
I’m not overly interested at the moment in using the IR side, that’s something for later on.