Electronic heating thermostat reverse engineering (Beok, Floureon, Decdeal)


(Dennis Von Der Bey) #1

Hey guys,
I am currently on the search for a budget solution for my thermostats. As I still own night storage heating units I have a relais thermostat for every one of them, which I would like to replace with a, preferably, wifi device.

After some digging I found a thermostat which - again - seems to be built by many different companies only with the name changed and some slight differences. These are some examples:

Beok
Floureon
Decdeal

They all use the same kind of apps:

Beok
Decdeal

After trying a port scan, network traffic sniffing and decompiling the APKs I found out they all use a system by Broadlink. It seems it’s the same as in the Broadlink RM pro app. They all ship with a library called “libBLNetwork.so” which has one method “requestDispatch” which sends and receives JSON data.
The thermostat itself also connects the same way to Broadlinks servers hosted on AWS and uses encrypted UDP connections.

I still don’t really get how the setup process works. I suspected the app initiates a connection to the thermostat via hotspot, but I didn’t find the logic yet. I hoped there would be a way to intercept the data and use the thermostat in OpenHAB, best case without their servers.
An alternative would be a binding with their library connecting to their cloud, but it is compiled for an ARM architecture of android phones, so I guess it isn’t compatible?

Is there anyone who already tried reverse engineering these devices?

Greetings


(Lucky) #2

Look up Wireshark and make your Wireshark the middleware. If you can sniff the packets and they are not encrypted, then it should just be a matter of replicating the protocol.


(Dennis Von Der Bey) #3

As I said: I already sniffed it using wireshark and it’s using encrypted connections.

I am currently searching the internet for projects that send raw packets to the Broadlink devices to see if my thermostat responds. I’ve found the official SDK documentation and compiled binaries for different architectures. Does someone know if I can use one of these on a Raspberry Pi? This way I could use their cloud service.

OPEN API SDK.pdf
openSDK.zip


(Dennis Von Der Bey) #4

I was just sent the API documentation from the Beok thermostat. It consists of TCP packages sent to their servers. Sadly I don’t know what thermostat ID they are speaking of in their documents. I will add the download link to my post. Maybe someone else can help.

https://mega.nz/#!Op5yBbjD!uh3_5yhPTzrpgpfhvkez3Mwbg5hAyOF2K5N-PU0lfyI


(Oliver Lexis) #5

Hi Dennis,

I just want to do exactly the same. I have currently one Fluoreon controller and I want to communicate from PC/iobroker with the controller.
I already tried to do some packet sniffing, but without big success… I only saw some UDP packets from/to the controller.

Reading your last reply regarding the API from Beok, it seems that one have to use their server on internet to communicate with the controller? Does that mean that the controller also sends all data to their server?

Anyway, I found an interesting project on github, maybe we can extract some things out of that:
https://github.com/ptd006/python-broadlink
And here a discussion about the thermostat: https://github.com/mjg59/python-broadlink/issues/130

Regards,
Oliver


(Dennis Von Der Bey) #6

Thank you for this link. The guys already wrote exactly what I wanted. The thermostat is now pinging to my Mosquitto.

MQTT Bridge:

//edit: pasting my installation procedure from the other forum for you to see:

You need Python2 on your device running the script. So if you’ve installed it (make sure you also have the right python setuptools) you will need to install the broadlink python API fork from github.

  1. Clone this repository
  2. Execute “sudo python2.7 setup.py install”

Then you’re ready to download the MQTT bridge:

  1. Download this repository
  2. Execute “sudo pip install paho-mqtt”
  3. Edit the “broadlink-thermostat.conf” to your needs

Now you can start it via “python2.7 broadlink-thermostat.py” and it should start the discovery and push all discovered devices and their state to MQTT. If you wanna control it from HASS for example you can send MQTT messages to the following topic:

/[topic]/[mac]/cmd/[command]

The command can be one of the following:

‘set_temp’ with the float value in the body
’switch_to_auto’
‘switch_to_manual’

I also installed a systemd file so the bridge starts automatically and set the loop to around 3 seconds to let it update faster.


(Marc-Andre) #7

I received my thermostat last week, I also tried on my side to capture the packets without a very good result. I am very happy that the thermostat works with MQTT !! I will try tomorrow to configure it !Thank you very much !

//Edit
Woot i got it to work
broadlink discover
found: 172.16.82.182 4eae9f34ea34
PID child 26304
Hysen heating controller
4eae9f34ea34 room_temp 27.0
4eae9f34ea34 room_temp 27.0
4eae9f34ea34 room_temp 27.0
4eae9f34ea34 room_temp 27.0
4eae9f34ea34 room_temp 27.0

My plan is to buy one for each room in my house, If I have more than one thermostat, how do I disable the search and add a static ip


(Dennis Von Der Bey) #8

Cool.

To add them via static IP you would need to change the logic here. It uses the python broadlink API do auto discover but you could also create them manually.


(Lucky) #9

Yep. That’s what I do. I set manual DHCP entries based on MAC ID on my DHCP server so I won’t have worry about discovering the IPs


(Yura Chen) #10

Hey guys
I’m still waiting for my thermostat Floureon-Smart-Wi-Fi-Programmable-Thermostat to start playing (dancing :slight_smile: ) with it.
But i trying to understand how to force this thermostat to communicate with my raspberry (HTTP, MQTT or some other protocol)

I’m not to much experienced in Python so i would like to confirm if i understand everything that you wrote here correct.

  1. By default Beok, Floureon, Decdeal thermostats works in WiFi mode and sends data to the Broadlink server and then applications communicates with thermostats
  2. This functionality https://github.com/ptd006/python-broadlink/blob/master/cli/broadlink_discovery discovers such thermostats by scanning network packages and it provides us IP and MAC address of thermostats
  3. Then i believe ReadDevice class code (broadlink-thermostat.py Line 68) setup MQTT client on thermostat which have to publish data to “/broadlink” topic.
  4. And finally broadlink-thermostat.py script subscribes to receive messages from thermostats.

Please correct me if i missed/confused here something.

It sounds really great, but in that case i understood everything correct, what happens to sending data to external cloud ? Do you still able to use phone application to manage your thermostats? Or is there a way to disable data transferring to Broadlink server ? (except blacklisting it on the router level)

Thank you all for really good investigation :slight_smile:

UPD: i received my thermostat and everything works perfect via mqtt. Going to integrate it with my system and buy 6 more devices.


(Attila Aranyos) #11

Hi Guys,
I have Beok thermostat and Broadlink RM Pro. Does your findings mean maybe Broadlink can control Beok thermostat?
Br


(Yura Chen) #12

Hi,

it’s hard to say. As for me it sounds like Beok thermostat should use broadlink algorithm to connect device to the the wifi network but at the same time it doesn’t mean that Broadlink RM Pro will be able to control it.
Even when you will be able to connect your thermostat to Broadlink RM Pro i don’t think it will be compatible with it.
Solutions that described above means that you can be able to use broadlink algorithm to force Beok thermostat to communicate via mqtt protocol.


(Thowa) #13

Hi guys,

thanks for this thread so far. I’m looking into an wlan thermostat as well and I like the floureon design.
I really appreciate that somebody has already made this device usable with openhab :clap:

What I don’t figured out from this thread so far is, that I don’t know if the device is still communication with any external server (will it call home) or will it just communicate with openhab only.

Another slightly offtopic question to the Floureon device:
The description (on Amazon and also some other shops) says, that this device is NOT applicable for water floor heating.
Can anybody tell my why?
Who has used it already with water floor heating?
I would assume It should be possible to connect the electric actuator (in german Stellantrieb) for the water floor heating with the output of the thermostat.

Thanks in advance,
Thorsten


(Ahmad Haghshenas) #14

Hi Guy’s I have a Beca Energy BAC-002-ALW Wifi AC Thermostat and followed this forum but i couldnt discover any devices. It works fine with the Beca Smart app and was guessing it would be the same as the others here. Any suggestions?


(Dennis Von Der Bey) #15

I just saw the new redesigned one a few days ago too. If you wanna help integrate it maybe you could post some details in this GitHub thread?


(John Horvath) #16

Hi Guys,

Great topic. I have a Floureon-Smart-Wi-Fi-Programmable-Thermostat but I could never use the APP I downloaded from Google Play which why is I was happy to see this alternative (also I would prefer not to control my thermostat via a cloud). I could never get the APP to configure; it would find my WiFi SSID but after I entered my password to start the configuration it would try to load and after about 10 seconds it gave the error “Failed to add new equipment.” So I ran through the instructions in this topic and I was able to successfully install everything. However when I ran broadlink-thermostat.py I got the following result:

broadlink discover
Reconnect
Connect, reason: 0

Even though I was unable to configure the APP, I followed the instructions to set FAC to 32 on my device and the WiFi icon is flashing on the unit slowly, which means that it is offline.

Does anyone have any suggestions how to fix this? Am I unable to discover the device because I have to register device with the APP first? I assume this is the problem because the device has not been passed the WiFi parameters so that it can go online. Is there any way to do this in the script? Perhaps adding the ability to add network parameters is a feature which should be added in future versions so that those who don’t wish to register with the cloud (or in my case I am unable to) won’t have this problem.

For now any help to get my device discovered would be much appreciated.

Thanks in advance,
John


(John Horvath) #17

Hi again,

One more thing I would like to add. The messages during the discovery tend to repeat, however recently I received the following:

broadlink discover
Reconnect
Connect, reason: 0
broadlink discover
Reconnect
Disconnect, reason: 1
Disconnect, reason: <paho.mqtt.client.Client object at 0x40908cf0>

Don’t know if this helps in any way to debug the problem.

John

//edit
Finally got the app working. For anyone interested in this device, the so-called English manual is a load of crap. Anyway, after the device was registered with the app everything went perfectly. My device can be discovered so now I can concentrate on the MQTT side of things. There is however something which is a little unusual during when the device is being discovered. This is what I get:

broadlink discover
found: 192.168.1.115 0a447034ea34
PID child 16816
Hysen heating controller
set time 19:32:52 5
Reconnect
Connect, reason: 0
0a447034ea34 room_temp 16.5
0a447034ea34 room_temp 16.5

I tried the discovery several times and I always get the Reconnect and Connect, reason: 0 as before, but then everything proceeds normally. From what I have seen from others with a successful discovery, those two lines don’t appear. Has anyone had anything similar? Why does it reconnect after finding the device? BTW, this reconnect always occurs at the very beginning and then sometimes reoccurs later (without Connect, reason: 0), but not frequently. Also the broadlink discover line sometimes reppear but after the room temperature is shown as before.


(Joaquin Custodio) #18

Hi John

I bought a hysen thermostat

https://de.aliexpress.com/item/2-pcsSmart-Hause-WiFi-Thermostat-f-r-Warme-Elektrische-Fu-bodenheizung-16A-Alexa-Voice-Control-Indoor/32906677789.html?spm=a2g0s.9042311.0.0.3da24c4dW4CTzb

But I can’t set the AP mode, i think that is necessary to do the discover? I followed all the instruction but never found devices.

broadlink discover
Reconnect
broadlink discover
Reconnect
broadlink discover
Reconnect

The English manual is very bad explained, and I try to contact technical support, but was impossible too.

Someone can help to put this in AP MODE?

Note: I have the thermostat working with the APP.

Thanks guys


Recommendations for floor heating thermostat
(Michał Sałak) #19

Are you sure that you installed all required libraries?
pip install paho-mqtt
pip install broadlink
pip install json
pip install pytz


(Joaquin Custodio) #20

Yes, all this dependencies are installed, I tried in a raspberry, in a Mac, always the same result, not found any device.
Maybe the problem is that my thermostat is not working as AP?

Thanks