Lehkeda/SP108E_controller

Emulating SP108E on a linux box

Closed this issue · 2 comments

jopellerin commented

I am trying to create a SP108E proxy on a linux box I have here at home, so that I can control multiple controllers from the app at the same time.

I have built a socket server that currently replies with its name in the exact same format as the actual device. When returning the same name, the hex output is the exact same from my proxy as from the device, although the device does not show up in the app.

Since you have reverse engineered the controller, I suppose you got a fake device registered in the app to then receive and inspect the calls.

My question is: is there something specific that needs to be done once a reply with the device name is sent to the app? My socket remains open once the reply is sent, and can correctly receive further connections.

Thank you for this package, and for any help you can provide.

Lehkeda commented

I didn't emulate the box. I captured the network traffic that goes out/in from the APP using an application on android then analyzed it using Wireshark.
The application finds devices by sending a broadcast message to see who's alive at port 8189, and if it gets a reply, it sends the command to get the device name.
So I think you should make your emulated box listen on port 8189 and make it reply by sending 1, if it gets a broadcast message. Then when it receives the get name command, make it repliy with its name.

jopellerin commented

Ok gotcha!

I am actually able to receive the broadcast message, and also the request to get the name, to which I reply with a name. But it doesn't show up in the app on my phone.

I investigated a bit more, and there's a byte before the actual name in the reply from the device, and that byte will depend on what was sent in bytes 2-3-4 in the request. I tried multiple different variations of bytes 2, 3 and 4, but I was not able to figure out what the pattern is. I'm guessing it is some kind of validation/error-checking.

Currently, I have given up on trying to build a proxy to control multiple SP108Es at the same time, and will probably just create a web version of the app that has that possibility.

Thanks!