Last active
January 20, 2018 23:10
-
-
Save torinnguyen/cd3313f41623e612b4e5b83bbd36ceae to your computer and use it in GitHub Desktop.
Use Python script to control all/any buttons on Broadlink MP1 smart socket. This data was captured with Wireshark on an iPhone connected to USB port (rvi0 interface)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Install pyip module with the following command: | |
| # pip install pyip | |
| import udp | |
| import socket | |
| # IP Address of your Broadlink MP1 | |
| # To be replace with your own IP address | |
| IPADDR = '255.255.255.255' | |
| PORTNUM = 80 | |
| MAC_MP1 = 'd6e3c00d43b4'; #little-endian | |
| MAC_RM3 = '7739cc0d43b4'; #little-endian | |
| # UDP packet payload as hex captured by Wireshark | |
| # Right click on line that says "QUIC protocol" -> Copy as Hex stream | |
| # Screenshot: http://take.ms/RNUQ4 | |
| ALL_ON = '5aa5aa555aa5aa5500000000000000000000000000000000000000000000000085d00000b54e6a005b81' + MAC_MP1 + '010000006dc20000523ebd0c77b8926452dc2e0931cae125' | |
| ALL_OFF = '5aa5aa555aa5aa5500000000000000000000000000000000000000000000000032cf0000b54e6a006982' + MAC_MP1 + '010000004fc2000054904347ef21107e594210bb2f317f4f' | |
| S1_ON = '5aa5aa555aa5aa55000000000000000000000000000000000000000000000000fed30000b54e6a001c80' + MAC_MP1 + '0100000035c20000d356fe439bf21e4bb944fdfceff3ddc0' | |
| S2_ON = '5aa5aa555aa5aa5500000000000000000000000000000000000000000000000055d10000b54e6a00b380' + MAC_MP1 + '0100000039c20000bfa473333762d78a100fa163b0aa8a87' | |
| S3_ON = '5aa5aa555aa5aa55000000000000000000000000000000000000000000000000ead20000b54e6a00f480' + MAC_MP1 + '0100000041c20000f53370b354ff855d28dc4eec1578ff93' | |
| S4_ON = '5aa5aa555aa5aa5500000000000000000000000000000000000000000000000098d10000b54e6a00c183' + MAC_MP1 + '0100000051c20000c879102c7a78c5bc07f92fa71542e1ad' | |
| S1_OFF = '5aa5aa555aa5aa5500000000000000000000000000000000000000000000000045d10000b54e6a004b81' + MAC_MP1 + '0100000033c200004d34435a03e4c147e09a3029cec7d0a9' | |
| S2_OFF = '5aa5aa555aa5aa5500000000000000000000000000000000000000000000000004d30000b54e6a00cb83' + MAC_MP1 + '0100000035c200000454e3f2ee3dd263d4b00a8de75cbf7f' | |
| S3_OFF = '5aa5aa555aa5aa550000000000000000000000000000000000000000000000005ed00000b54e6a001382' + MAC_MP1 + '0100000039c2000025174b60fee91b83c52268ace62c516e' | |
| S4_OFF = '5aa5aa555aa5aa55000000000000000000000000000000000000000000000000cbd20000b54e6a00f180' + MAC_MP1 + '0100000041c2000075e1153fe7767cf9fc1e1cfe14eff717' | |
| RM3_TEST = '5aa5aa555aa5aa55000000000000000000000000000000000000000000000000367e000037276a001982' + MAC_RM3 + '0100000094e10000fdc3cba884f58d242134776e6ba78121698c0244e972527c8ddc7638a1a61ab2f407ef7af9d6dfd8d2862b85821abc6f72ce6f3f24c78adb524aaadadeb3788b9cbc192761c10387ad0726a61386a4dcb12e0997ada3a7aa72eb706bd1963294666068a93fef5557a6630e6b16827f2354c99fa20cf66cd3c9d2566b74bdad076572d25e3b8a0107f750938d1a9fc39f6b80382b203e6950fb11c95512e2561ed137789cc56e7ad4032d582943f61a7d4545666f21377409835ac62351fc3a0f0ae083fc4c43cc66313a922aac7039e271c600355e4100b5f1213ac0d230050ae9ccb40a154cb61fbd49de94cfa3ba6a75c27ad4d35710395c1d9e6f3b155c06508868d1c474b1348131e043dd9994315e717cb95dc299a1734a601b315133236eb0800bb761b4764d3760ae23f03dd0a4d09cc93caf35dd3039f128c85129e07bb739b98c72bc2cf9b3585d26ab3a86af5a891f0d2a771b0a2be948f3e6e8cac901d79284b67f3048bee522c14163df95e3974e9d987710ec40007f35dfb6e6' | |
| # Decode the data | |
| PACKETDATA_DECODED = ALL_OFF.decode('hex') | |
| # initialize socket | |
| sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, 0) | |
| sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) | |
| sock.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1) | |
| sentBytes = sock.sendto(PACKETDATA_DECODED, (IPADDR, PORTNUM)) | |
| sock.close() | |
| # debug info | |
| print "Sent %d bytes" % sentBytes |
Hi, thanks for taking the time to reverse engineer MP1's protocol and create this script!
Could you post some syntax examples of how to use this? Sorry, I'm not very familiar with python...
Best Regards, Cassio
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Use broadcast address instead of a specific IP address