I am currently on the search for a budget solution for my thermostats. As I still own night storage heating units I have a relais thermostat for every one of them, which I would like to replace with a, preferably, wifi device.
After some digging I found a thermostat which - again - seems to be built by many different companies only with the name changed and some slight differences. These are some examples:
They all use the same kind of apps:
After trying a port scan, network traffic sniffing and decompiling the APKs I found out they all use a system by Broadlink. It seems it’s the same as in the Broadlink RM pro app. They all ship with a library called “libBLNetwork.so” which has one method “requestDispatch” which sends and receives JSON data.
The thermostat itself also connects the same way to Broadlinks servers hosted on AWS and uses encrypted UDP connections.
I still don’t really get how the setup process works. I suspected the app initiates a connection to the thermostat via hotspot, but I didn’t find the logic yet. I hoped there would be a way to intercept the data and use the thermostat in OpenHAB, best case without their servers.
An alternative would be a binding with their library connecting to their cloud, but it is compiled for an ARM architecture of android phones, so I guess it isn’t compatible?
Is there anyone who already tried reverse engineering these devices?