Broadlink Black Bean (RM 3 Mini) IR Controller - Integration in OpenHAB


(davorf) #42

By the way, should I change the name of the topic, and remove “help with understanding their UDP protocol” part? Maybe add something like Python script for RM 3 Mini control, so other people would know what it is about?

Best regards,
Davor


(Lionello Marrelli) #43

Hi Dave,
thank you for you research.
I would suggest to change the topic name to
"Broadlink Black Bean (RM 3 Mini) IR Controller - Integration in Openhab"

Ciao
Lionello


(davorf) #44

Hello Lionello,

thank you for the suggestion. I’ve changed the topic name.

Best regards,
Davor


(Lionello Marrelli) #45

@Maximo
I would expect that sending intercepted udp packets works. In any case, if you look the following site,
http://milillicuti.com/an-api-to-connect-your-broadlink-rm-pro-irrf-wifi-bridge-to-your-home-automation-system/
you will see that you can send IR commands to the broadlink RM pro by sending http requests to an Android device with a proper app installed.
Not only that, you can also read the temperature measurement.
The only drawback is that you have to dedicate an Android device to the purpose of communicating with the broadlink rm pro.

Lionello


(Lionello Marrelli) #46

For those having troubles using wireshark for packet sniffing, the HTTP Bridge App inhis recent new version, offer an alternative way to operate the broadlink mini 3
http://rm-bridge.fun2code.de/
The developer managed to make tha app compatible, thanks to a workaround.
The drawback of this approach is that Openhab do not communicate directly with the Mini but passes through an android device.


(davorf) #47

Hello!

Last night I’ve tried to intercept the learning part, but it left me pretty confused. The communication is still UDP, android app sends a command to trigger a learning process, then RM 3 returns payload to the app. Returned payload is 178 bytes long and begins with 5aa5aa55, same as the command sent from the app, that we intercept and use with Python. The problematic part is - command received after learning process, and command that you send with the button you used to learn command are totally different. The only common parts are 5aa5 part, and MAC address of the RM 3 (in little endian). I’ve tried to find some way to decode it from the received command to used command, but was unable to find anything in common for the two commands.

Here are examples of the two commands I’ve worked with:

After sending learn signal (by pressing Volume Up on the app’s not yet learned button), and pressing Volume Up button on the TV remote, RM 3 responds with:

5aa5aa555aa5aa55000000000000000000000000000000000000000000000000b9f000003727ee0339820a22cc0d43b4010000000ac7000036b507f6cc50c1f37b19cc5f91cfa7217bd524a579cb7bb8172ee774ff36a05e7783e7870e6ad53eaca1673b776dade8843a33bcfde7c1bafa0b909512b29241c0c218722143841b3ed28eb29e1aaf46

After that, when I try to send Volume Up command from the app, it sends this:

5aa5aa555aa5aa550000000000000000000000000000000000000000000000001def000037276a0061810a22cc0d43b40100000008c700002bfb0aa884a1fdbe097ea8c34eb9a0ff9cebd5004685b47f41cf93ebe6b43a97b97d0d86ca8dc9732bbaf721050426ed81d80f72a33cbf103961a443503121bb700e0338e0eb1c3531d705cde184abbf

The same goes for Volume Down button - RM 3 response after learning:

5aa5aa555aa5aa5500000000000000000000000000000000000000000000000084ee00003727ee0367820a22cc0d43b4010000000bc70000a41d55e3f0cb41085325e9809b4d21d4cd834b97f02e169a697f9d0046cd5614cecaa1778034d2cab55d3d6d2cbd5ce05069adad87aae07b4cfe7cd82ef119749eb64d98c1418065161520613f73b31a

UDP payload sent from the app:

5aa5aa555aa5aa55000000000000000000000000000000000000000000000000e9ee000037276a001e800a22cc0d43b40100000009c70000dc23af4c138a7a55e2a9fbb2bf476e149ed530d1ffa10c1b29103ba39194a5f8325965fe909aec44e8f0773c282751c8e50d3bca85a3b0d7e60303835168577906cd35823b79ffc6acb9b33714aa12d6

I hope someone else could take a look and, perhaps, find something in common for the learned and sent commands.

P.S. I forgot to mention that I’ve tried sending both commands - the first one (received from RM 3) doesn’t work. The second one works, the same way it was working before.

Best regards,
Davor


(Lionello Marrelli) #48

One byte sequence may be encrypted with some key which may be hard to find. in any case it may be interesting to look at more packets hoping that a simple relation holds (bit reversal, bit shift,…?)
What happens if you learn the same command two or more times? You have found that 4 bytes in the packet being sent by the app vary each time.
Are the learnt packets identical or do they slightly differ?

Have you tried using the http bridge app? When learning a command the web interface shows the http string that includes the byte sequence. Does it correspond to the one that you intercept?
In particular, I find intersting that the same command can be sent to another mini, by specifying its mac address. But how would the packets sent by the http bridge app look like?

Regards,
Lionello


(davorf) #49

Hello!

I’ve had the same idea last night, so I’ve installed RM Bridge and tried intercepting packets. The result is the same - the packet received from RM 3 after learning differs from the packet sent from RM Bridge. I haven’t tried to learn the same command twice yet. I’ll try that tonight. Regarding the data that you can find in RM Bridge, it’s even harder to find a relation to UDP packet. It is represented by stream of numerals, with only two (if I recall correctly) hex bytes. It also contains a lot of repeating parts of the stream (for example: 11141114 that repeats for 5 or 6 times in a row), but hex dump does not contain any value that repeatedly occurs 5 or 6 times. It was my plan B, to make import of codes from RM Bridge to BlackBeanControl settings file, if I can’t make learning within application possible, but it looks like that would be impossible too. I’ve tried sending that stream of numerals via UDP send application, but it doesn’t trigger a learned command (I guess it should include MAC address or something, but I don’t know where, or what format should it be in). I’ll try investigating it a bit more tonight, and report here if I find anything.

Best regards,
Davor


(Garry McCandless) #50

I should have made myself a lot clearer in my post. What I should have asked was would this script be able to switch on and off the light switches? Or is there an alternative already available.

I’m not overly interested at the moment in using the IR side, that’s something for later on.


(farhan) #51

Hi,

Have you guys seen this? Works with RM3 too…


(Lionello Marrelli) #52

@Maximo The script, in principle, acts like the android App. Therefore, if the broadlink app can switch on and off the lights, then also the script should.

@Farhanito. Thanks for the link. It actually works with my two Minis. I managed to discover both, make them learn a code and subsequently send it back.

@davorf: I guess that you very easily will prepare a script to directly create a settings file with all the commands. It should be easy to write the encrypted packets also to a MAP file so that it will be compatible with the UDP binding alone (probably duplicating each code) to be used by those openhab user that cannot use python on their platform.


(davorf) #53

Hello Lionello!

I’m trying this code at the moment, but I found a lot of errors, so it took me a while to correct them. I’ve managed to send learn code from the script, and it does switch RM 3 into learning mode (white LED turns on). I’ve also managed to retrieve the code, but it’s the same code RM Bridge returns (lots of repeating numerals), and using that code to send it via send function of said script doesn’t trigger learned command. I’ll have to look into it. If I manage to make it work, it will be easy to integrate it into an app.

Best regards,
Davor


(davorf) #54

Hello!

I’ve tried a script you’ve provided, but I’m unable to make it work on RM 3. It does (with some changes) put RM 3 into learning mode, and returns learned command, but if I try to resend that learned command, the action is not triggered (for example, does not change volume on my TV). What kind of test have you tried? I’m still trying to figure out the encryption of the payload, but I can’t get the right code to send, from the received code. I suppose that, as Lionello said, AES key and IV are not the same for RM 2 and RM 3.

Best regards,
Davor


(Lionello Marrelli) #55

@Davorf: Actually I was able to send the learned code to TV. I have two Minis, I do not know if the problem you have depend on the fact that you have only one. Moreover I simply downloaded the code into my raspberry without any customized python library and found no error. Have you tried to run the script on a clean install?
Have you seen if the packet is sent by python when you try to send a code?


(davorf) #56

Hello Lionello!

What version of Python you use? I guess the script was made for 2.X, and that’s the reason I get so many errors. Besides, how do you distinguish between 2 RMs? Do you use it as an element of an array? I’ve tried printing learned and sent command, but it’s not hex at all.

Best regards,
Davor


(davorf) #57

By the way, as soon as I try to run the script, I get an error ImportError: No module named 'Crypto'

Edit: Could you please post a code you use for calling broadlink script?

Best regards,
Davor


(Lionello Marrelli) #58

Hi Davorf, I use the standard python version distributed with Raspbian

Python 2.7.9 (default, Mar  8 2015, 00:52:26) 
[GCC 4.9.2] on linux2

If you follow instructions of the README you will see that devices is an array of all devices found on the network. You have to reference to one at at a time with an index
devices[0] is the first fiscovered
devices[1] is the second one

devices = broadlink.discover(timeout=5) // get devices
devices[0].auth()  // get the key to talk with device[0]
devices[0].host // return the name of the first mini
devices[0].enter_learning() // the mini enter learning mode
// I operate the command
ir_packet = devices[0].check_data()
// ir_packet is the byte sequence unenecrypted
devices[0].send_data(ir_packet)

An example of ir_packet is a string that encodes hex bytes
as follows

“&\x00\xe6\x00o6\x0f(\x10’\x10\x0c\x0f\r\x0f\x0c\x0f(\x0f\r\x0f\r\x0e(\x0f(\x0f\r\x0f(\x0f\r\x0f\x0c\x0f(\x0f(\x0f\r\x0f(\x0f(\x0f\x0c\x10\x0c\x0f(\x0f\r\x0f\r\x0e)\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\r\x0e\r\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\x0c\x10\x0c\x0f\r\x0f(\x0f\r\x0e\r\x0f(\x0f\r\x0f\x0c\x0f(\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\r\x0f(\x0f’\x10\x0c\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\r\x0e\r\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\r\x0e\r\x0f\r\x0e\r\x0f\x0c\x10\x0c\x0f\x0c\x10\x0c\x0f\r\x0f\x0c\x0f\r\x0f\r\x0e\r\x0f\x0c\x0f\r\x0f\x0c\x10\x0c\x0f\x0c\x10\x0c\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\r\x0e\r\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\x0c\x0f\r\x0f\r\x0e(\x0f\r\x0f\x00\r\x05\x00\x00”

I’m wondering if the command devices[0].send_data(ir_packet) can be modified in order to return the encrypted version of the ir_packet.

Ciao
Lionello


(davorf) #59

Hello Lionello!

As I supposed, you’re using 2.X Python. There is pretty big difference between 2.X and 3.X, and the code is not always compatible. I’ve managed to go past the last error (had to reinstall pycrypto from a wheel), but when I try to execute your code, I get the same error I’ve got last night:

es\broadlink-0.1-py3.5.egg\broadlink\__init__.py", line 34, in discover
    packet[0x08] = timezone
TypeError: an integer is required

For some reason, Python 3.X represents this value as float. I’ll try to install Python 2.X on some virtual machine and see if it works that way. Thank you for your help.

Best regards,
Davor


(farhan) #60

Hi Davor,

Yes, as @Lionello_Marrelli said, this python module currently works only with python 2.x


(davorf) #61

Hello!

I’ve managed to incorporate Broadlink package to BlackBeanControl. The new version should be used with Python 2.X only (because Broadlink package supports only Python 2.X). There are 2 new settings inside of BlackBeanControl.ini:

  • MACAddress - MAC address of the RM 3 mini
  • Timeout - time in seconds, between beginning of learning process and reading learned command (should be under 60 seconds)

Command line now includes -m switch (command line MAC address parameter) - in case you have more then one RM3. Syntax is similar:

BlackBeanControl.py -c [-i ] [-p ] [-m ]

If the command you send is found in the .ini file, it will send it. If it is not found, it will start learning process (after that, you should press the button on the remote, so RM3 receives it), wait until timeout, and then save learned command. Next time you use a command with that name, it will send code from the .ini file. If you encounter any errors, write about it here, or on github.

Best regards,
Davor