Controlling robot vacuum cleaner through TCP request

Hello guys,
i created tutorial which can be used to control your robot vacuum cleaner if he accept TCP requests.
I am using it with Robzone duoro xcontrol, which should be same as Proscenic 790T.
Hope it can help someone :wink: . I believe this tutorial can be also used for many other devices.

Controlling robot vacuum cleaner from Openhab – Robzone, Proscenic or any other controlled by tcp request.

By rhapen on 14.12.2018

  • sniff packets on android
  • create script
  • add into Openhab
  • Control your vacuum from your home automation

I used this instruction for my Robzone duoro Xcontrol / It is copy of Proscenic 790T.
Connect through original android app for your vacuum (RobZone in my case)
Start sniffing app tPacketCapture this will capture all requests coming out of your android phone.
Start capturing by clicking on capture.

Then switch to your original android app and click buttons you want to learn. I pushed power on/start, pause and go home/off.

Go back to the sniffing app and click “Running”. Follow the steps to disconnect VPN made by tPacketCapture app.

Go back to tPacketCapture app click File List tab -> click on the last capture file created and click share button. Choose how to send it to your computer. (i used Google Drive but you can use mail or anything else)

Now download it to on your computer to analyze by wireshark or other similar application to read pcap file.

Open the file in wireshark. Find message which was sent to your vacuum IP. ( in my case). If you find the right line you can also see message being sent. There are usually more connection lines before the message being send, it is not important in this step to find the one with message.

Now either right click on the line->Follow->TCP Stream or ctrl+alt+shift+T

You will see following. choose only the communication coming to the vacuum and “show and save data as Raw”

In here i can see that the messages are the ones starting with “bd” (this is HEX code and will be different in your case, message includes authorization code, IP and other specific attributes)

Lines staring with “14” are only some keep alive traffic.

Now you can save this 3 lines with the code to text file for later use.

The messages appear in order you pushed the buttons. So for me these are ON, PAUSE, HOME.

Now the part on OpenHAB server. I am running Openhabian on raspberry PI . If you are running on windows you will have to slightly modify this steps.

I created script /etc/openhab2/robzone/ (path and name is up to you). Dont forget to give it executable permissions

chmod +x /etc/openhab2/robzone/

And here is the script content, change the bd000… to your own HEX codes and IP and port of your vacuum cleaner (you can see the port in the wireshark, in my case 8888):

case "$1" in
    echo -n bd000000fa00c8000000a927a8270000000000007b22636d64223a302c22636f6e74726f6c223a7b2261757468436f6465223a223633333631222c226465766963654970223a2231302e32302e312e323239222c22646576696365506f7274223a2238383838222c227461726765744964223a2238383863373639316337636437303933222c2274617267657454797065223a2233227d2c22736571223a302c2276616c7565223a7b227472616e736974436d64223a22313030227d7d| perl -pe 's/([0-9a-f]{2})/chr hex $1/gie' | nc -4 -q1 8888
    echo -n bd000000fa00c8000000a927a8270000000000007b22636d64223a302c22636f6e74726f6c223a7b2261757468436f6465223a223633333631222c226465766963654970223a2231302e32302e312e323239222c22646576696365506f7274223a2238383838222c227461726765744964223a2238383863373639316337636437303933222c2274617267657454797065223a2233227d2c22736571223a302c2276616c7565223a7b227472616e736974436d64223a22313032227d7d| perl -pe 's/([0-9a-f]{2})/chr hex $1/gie' | nc -4 -q1 8888
    echo -n bd000000fa00c8000000a927a8270000000000007b22636d64223a302c22636f6e74726f6c223a7b2261757468436f6465223a223633333631222c226465766963654970223a2231302e32302e312e323239222c22646576696365506f7274223a2238383838222c227461726765744964223a2238383863373639316337636437303933222c2274617267657454797065223a2233227d2c22736571223a302c2276616c7565223a7b227472616e736974436d64223a22313034227d7d| perl -pe 's/([0-9a-f]{2})/chr hex $1/gie' | nc -4 -q1 8888
    echo "parameters are -start -stop -home"
    exit 1

I use exec1 binding. I still did not get well in touch with exec 2 binding.
Items (…/items/default.items)

String Robzone	"Robot vacuum" [ "Switchable" ] { exec=">[ON:/bin/sh@@-c@@cd /etc/openhab2/robzone/;sh -r] >[PAUSE:/bin/sh@@-c@@cd /etc/openhab2/robzone/;sh -s] >[OFF:/bin/sh@@-c@@cd /etc/openhab2/robzone/;sh -h]" }

Sitemap (…/items/default.items)

Switch item=Robzone label="Vacuum[]" icon="woman_3" mappings=[ON="Start", PAUSE="Pause", OFF="Go Home"]

Optional creating item to be controlled by Google home.
Items (…/items/default.items)

Switch Robzone_voice "Robot vacuum" [ "Switchable" ]

Rules for voice control (…/rules/vacuum.rules)

rule "rVacuum_voice"
	Item Robzone_voice received command
    switch (receivedCommand) {
	case ON : 
        case OFF :

Wow !! cool.
I can use it with robovac.


First of all thanks for writing this down! As a clueless beginner it has given me a route to follow :slight_smile:

I manage to identify some packets transmitted to my vacuum (Proscenic 800T), but whereas the info in your TCP stream is clearly readable, in my case I get (filtering just what is sent to the vacuum cleaner) I get what appears to be encoded gibberish:

…N$…`…@.z.]1~f.T}.2.{…X9.].c.h…o.1.F…]…E.d…!..t_.L…:…E .6.*.E…U

Being a complete newbie with wireshark (and after having failed googling around), do you have any recommendation?

Thanks and cheers!

Hi, thanks for ideas. I went a step further and also got the maps and path from the robot. The gibberish json is a weird protocol on TCP. You find a protocol description of it at maybe this can be used to integrate a map into the plugin.

does this work with the robovac?

I unsuccessfully tried to use the udp messages to control my 790T. After some research and analyzing the packages with wireshark it seems to me that it is no longer possible to use direct communication between a local device and robot. A new firmware (in my case wifi 1.0.36 mcu 999,9(000)) the robot communicates directly with the proscenic server and ignores direct udp messages.
Simulating the server seems a dead end too, because some keys morph during communication. (
Does anyone successfully control the robot with a new firmware? If not I recommend to stay with the stock firmware if you want to use your robot with openhab.

Hi Florian:

The 790T seems the same robot than the Cecotec Conga 1490, which is the one I have. I programmed a new server that implements all the API (not only “start”, “stop” and “home” but also maps, suction power, manual control…). Maybe you can check it. And since my server uses a REST API, it should be easy to integrate it with openhab…

I also wrote several entries in my blog explaining all the things I discovered and how I created it, but they are in spanish…

1 Like

Hi Rastersoft,

Thanks for your approach. I unsuccessfully tried to make it work. I have set up my raspberry as in your manual, but got no connection to my robot. I see some traffic in Wireshark between the robot and the raspberry but as I’m using a third PC for sniffing and it is wifi 802.11 I cannot analyze the traffic.

As the proscenic 790T does not support e.g. different vacuum power levels I’m not sure if our models are identical… Do you have further indication for your assumption?
It would be great if we could make this work.

Then clearly it isn’t the same robot. I wrote a complete series of articles explaining how I hacked it, so maybe they can help you ( ). The only problem is that they are in Spanish…

Is this working with OH3?