Beginners question, is there a reason we can’t reverse engineer something similar for lights made by Govee? Is it because it’s WiFi and harder to MITM?
There may be an easier way, but another HN thread pointed out that you can use tailscale to make it easier to tcpdump phone apps (because you can send all of the phone traffic through an endpoint you control.) (Presumably raw wireguard is enough? I haven't tried (or seen tutorials for) either approach, it was just a "that sounds clever, save it for my next sniffer project" idea)
I bricked my Christmas lights
51–60 of 85 posts
Re: I bricked my Christmas lights
#52Reminds me somewhat of certain keyboard MCUs that would also brick when fed certain lighting commands.
OpenRGB ended up having to disable the particular module from running automatically on that hardware. (Although the vendor software would also trigger said bug, on occassion.)
Unfortunately, the usual way for triggering the in-system programming mode required sending a usb hid report, but affected devices wouldn't even enumerate anymore. (Assuming it was even firmware corruption and not some other undefined behaviour causing hardware damage)
Re: I bricked my Christmas lights
#53"We can't send plaintext over the air, it's unsafe" "Don't worry I've added AES encryption"
Tuya is so hilarious in this regard. The protocol is just TLS over TCP, but the app happily sprays your Wi-Fi password to every STA in the area every time you add a new device. (It's how pairing is done - the app blindly broadcasts packets to 255.255.255.255 and the target device (lightbulb, power outlet, et al) just sits in promiscuous mode. The packet contents are protected by WPA2 et al, but the packet lengths are…
That sounds extremely greasy
Re: I bricked my Christmas lights
#54FTA: > When we try and decrypt the on and off packets we get: > 05 54 55 52 4E 01 00 00 00 00 00 00 00 00 00 00 > 05 54 55 52 4E 00 00 00 00 00 00 00 00 00 00 00 > 05 54 55 52 4E 01 00 00 00 00 00 00 00 00 00 00 > 05 54 55 52 4E 00 00 00 00 00 00 00 00 00 00 00 > 05 54 55 52 4E 01 00 00 00 00 00 00 00 00 00 00 > 05 54 55 52 4E 00 00 00 00 00 00 00 00 00 00 00 > Success! This is a lot more sensible. A fixed header, by…
And it's probably not padding, just a uint
Re: I bricked my Christmas lights
#55"We can't send plaintext over the air, it's unsafe" "Don't worry I've added AES encryption"
Tuya is so hilarious in this regard. The protocol is just TLS over TCP, but the app happily sprays your Wi-Fi password to every STA in the area every time you add a new device. (It's how pairing is done - the app blindly broadcasts packets to 255.255.255.255 and the target device (lightbulb, power outlet, et al) just sits in promiscuous mode. The packet contents are protected by WPA2 et al, but the packet lengths are…
Very clever.
IoT pairing is a tricky problem because phone/laptop devices give a very limited API for communicating with a new WiFi device that isn't yet on your WiFi network.
Re: I bricked my Christmas lights
#56Why do they use encryption?
Re: I bricked my Christmas lights
#57Power supply failure? The WS281x things can go really bright, and, in bulk, suck an awful lot of current. A 12V, 3A power supply on a strip of 100 is just about enough to drive them all to full bright white, and dazzlingly bright it is. So I'd look for a blown fuse. The fact that the firmware only drives them to 31 out of a possible maximum brightness of 255 offers a clue.
These don't appear to be WS2812. Look at the Ali link he posted. There is a pic of the wires that show four conductors on the strip: 12V, red, green, and blue. I think this is an analog RGB strip where are the lights in the strip are the same color vs. individually addressible. https://www.aliexpress.com/item/1005005485885067.html Anybody wanting to do anything with LED lighting owes it to themselves to look at WLED.…
The actual string I have is three wires. Data and + - it’s likely they have been swapped out for cheaper lesds now, or the picture is wrong.
Re: I bricked my Christmas lights
#58Can we see a disassembly of the dead christmas lights?
Knowing what chip they have inside can give a clue if there is flash memory and if it might be easy to dump.
Re: I bricked my Christmas lights
#59Earlier quoted context omitted.
These don't appear to be WS2812. Look at the Ali link he posted. There is a pic of the wires that show four conductors on the strip: 12V, red, green, and blue. I think this is an analog RGB strip where are the lights in the strip are the same color vs. individually addressible. https://www.aliexpress.com/item/1005005485885067.html Anybody wanting to do anything with LED lighting owes it to themselves to look at WLED.…
The actual string I have is three wires. Data and + - it’s likely they have been swapped out for cheaper lesds now, or the picture is wrong.
I looked at the picture again, it does show a three wire set up.
Re: I bricked my Christmas lights
#60Power supply failure? The WS281x things can go really bright, and, in bulk, suck an awful lot of current. A 12V, 3A power supply on a strip of 100 is just about enough to drive them all to full bright white, and dazzlingly bright it is. So I'd look for a blown fuse. The fact that the firmware only drives them to 31 out of a possible maximum brightness of 255 offers a clue.
Thanks for the tip off.
I've updated the code to shift right by 3 places and so go back to a 5 bit number.
That's a neat way of limiting the power usage.