小白手撕Panasonic Smart China 松下新风WIFI成功接入HA

omegaojian · 发表于 2022-7-17 19:09:50

本帖最后由 omegaojian 于 2022-7-20 23:01 编辑

20220720更新：成功接入HA（虽然只是作为开关）

整体思路：1.在安卓虚拟机下安装APP，跳过SSL Pinning机制抓包，获取Cookie，DeviceID，UserID，设备Token。（见20220717-20220719更新）
2.HA中使用command line switch 创建开关，用curl发送post请求实现 turn_on turn_off 并判断 is_on。
分享几点经验：
1.curl命令可直接用cmd调试，但cmd里引号的规则和HA里不一样，HA里的单引号在cmd里要用双引号，json数据里的双引号要用\转译。
2.在curl中加 -k参数可以跳过ssl证书校验，非常nice。
3.用rest switch更方便，但rest switch判断is_on只能用get不能用post，如果不介意is_on状态，可以用rest switch。

有两点都是关于Cookie，第二点希望有有大神攻克。
1.POST需要在Header里加COOKIE，COOKIE每次登录时会刷新，旧的会失效（APP上会提示已经在别处登录）。在虚拟机抓包时建议使用另外一个手机号注册一个账号，通过分享家庭的方式对设备进行抓包。否则虚拟机抓到Cookie后同一账号再别处登录会导致抓到的Cookie失效。
2.Cookie有效期有待观察，如不是长期有效就比较麻烦。因为APP登录时抓包抓到的密码是加密的，加密规则暂不清楚。除非破译APP登录时的加密规则，否则无法在HA里模拟登录的过程来获取Cookie。

楼主能力有限，没有任何HTTP/Python基础，工作也编程毫不相关。初衷也只是搞几个Switch能在HA中实现一些简单的自动化，如开窗自动关闭新风，晚上自动开启睡眠模式等，搞几个开关够用就行了。基础和精力难以支持开发集成。
因此把整个过程都写成流水账，希望能给感兴趣的大神提供一些思路。
这一系列更新可能就告一段落了。我们期待大神出现。

代码如下：
switch
  - platform: command_line
switches:
   new_fan_in_bedroom:
      friendly_name: New Fan
      command_on: >
      curl -H 'Content-Type: application/json' -H 'User-Agent: SmartApp' -H 'Cookie: SSID=此处为COOKIE' -d '{"id":0,"params":{"deviceId":"此处为dvice ID,"tOnH":127,"saSet":255,"token":"此处为token","tOffH":127,"HeatM":255,"tOnSta":255,"runM":255,"oaFilCl":255,"autoSen":255,"airVo":255,"raFilCl":255,"usrId":"此处为user Id","preM":255,"tOffMin":127,"raFilEx":255,"holM":255,"saFilCl":255,"tOnMin":127,"runSta":1,"oaFilEx":255,"saFilEx":255,"tOffSta":255}}' -k -X POST "https://app.psmartcloud.com/App/ADevSetStatusMidERV"
      command_off: >
      curl -H 'Content-Type: application/json' -H 'User-Agent: SmartApp' -H 'Cookie: SSID=此处为COOKIE' -d '{"id":1,"params":{"deviceId":"此处为deviceID","tOnH":127,"saSet":255,"token":"此处为token","tOffH":127,"HeatM":255,"tOnSta":255,"runM":255,"oaFilCl":255,"autoSen":255,"airVo":255,"raFilCl":255,"usrId":"此处为usrId","preM":255,"tOffMin":127,"raFilEx":255,"holM":255,和"saFilCl":255,"tOnMin":127,"runSta":0,"oaFilEx":255,"saFilEx":255,"tOffSta":255}}' -k -X POST "https://app.psmartcloud.com/App/ADevSetStatusMidERV"
      command_state: >
      curl -H 'Content-Type: application/json' -H 'User-Agent: SmartApp' -H 'Cookie: SSID=此处为COOKIE' -d '{"id":2,"params":{"token":"此处为token","deviceId":"此处为deviceId","usrId":"此处为userID"}}' -k -X POST "https://app.psmartcloud.com/App/ADevGetStatusMidERV"
      value_template: >
      {{value_json['results']['runSta'] == 1 }}
      icon_template: >
      {% if value_json['results']['runSta'] == 1 %} mdi:toggle-switch
      {% else %} mdi:toggle-switch-off
      {% endif %}

20220717
家里有一台松下壁挂新风FV-RZ06VD1，可以通过WIFI接入一款叫Panasonic Smart China 松下智能家电的APP。想把他接入Homeassistant。

在论坛上搜到一个松下新风的帖子，现在好像还没有大神通过WIFI实现接入。

1.寻找集成。网上搜了一圈，github上只有一个 Panasonic Smart APP TW的集成，不知道能否借用或者抄袭。但看了下代码，URL都带TW，应该是没法直接用。
专门注册一个TW区的AppleID，登录注册账号需要TW手机号进不去，但看登录界面和China差挺多的。

2.抓包。
尝试用抓包工具对APP抓包。是个大难题。在IOS里用Steam / WebProxy Tool，在Windows里用Charles / Fiddler，证书啥的都搞的没问题，但是一开HTTPS抓包 APP就断网了，提示“请检查网络环境，重新请求”。Steam中报错：Error Domain=kCFStreamErrorDomainSSL Code=-9806 "(null)" UserInfo=(NSLocalizedRecoverySuggestion=Error code definition can be found in Apple's SecureTransport.h}

3.找原因。网上搜了一圈，怀疑是这个APP用了 SSL Pinning. 绑定使用了APP内置的证书。https://github.com/ProxymanApp/P ... uecomment-515285933

找到一个攻略
http://t.zoukankan.com/meiniu-p-12642054.html
说可以使用VitualXposed框架+JustTrustMe模块解决
但是手头没有安卓机，等改天有空了找个或在虚拟机上试一下。

20220717晚更新：成功抓包！

使用Genymotion搭建Android环境，在Xposed框架下安装JustTrustMe模块。使用Charles抓包成功。

如下：
1.Genymotion虚拟机，使用Android 7.1的Google Pixel XL
2.安装Xposed框架https://support.genymotion.com/h ... Genymotion-Desktop-
3.安装JustTrustmehttps://github.com/Fuzion24/JustTrustMe
4.Panasonic Smart China APP仅支持ARM架构，虚拟机中无法直接安装，需要安装Genymotion_ARM_Translation
https://www.e-learn.cn/topic/3806063
https://github.com/m9rco/Genymotion_ARM_Translation
5.安装Panasonic Smart China APP
http://appdl.psmartcloud.com/download.html?C=0800_MIDERV
6.在虚拟机中设置代理：https://gist.github.com/trungpv1 ... 4b7366c7b0fa57ec0bf
7.使用Charles抓包HTTPS成功。
https://blog.csdn.net/weixin_41948075/article/details/100042729

20220718更新：研究了App机制
1.登录。
/UsrLogin
Request
{"id":98,"uiVersion":4.0,"params":{"pwd":"******************","checkFailCount":1,"usrId":"*********","telId":"02:00:00:00:00:00"}}       //UserID为手机号，pwd为加密后的密码。
Respond
{"id":98,"results":{"usrId":"7******8","ssId":"6********0","realFamilyId":4*****9,"familyId":0}} //返回ssld，后面每个Post请求的Headers里都要作为Cookie带着，否则返回"error       Object { code: 4102, message: "认证错误" }
退出APP再登陆后ssid会变

2.获取设备信息
/UsrGetBindDevInfo
Request
{"id":143,"uiVersion":4.0,"params":{"realFamilyId":"4*****9","familyId":"0","usrId":"7****8"}}
Respond
{"id":143,"results":{"readList":[],"devList":[{"params":{"statusTitle":"在线","aircornImgType":0,"devSubTypeId":"MIDERV","deviceName":"新风系统","usrLevel":"master","roomId":"1445194","roomName":"主卧","imgUrl":"http://images.psmartcloud.com/aircleaner/body/MidERV_small.png","bindTime":1657962033,"statusAll":{"oaFilCl":"255","coldF":"0","sVer":"0","oaFilEx":"255","saFilEx":"1","oaFilExTL":"65535","raPMM":"65535","autoSen":"2","holMinL":"127","runM":"4","holM":"0","raFilExTL":"65535","serverTime":"0","saFilCl":"0","saFilClTL":"719","raPMC":"65535","holHL":"127","raFilClTL":"65535","saFilExTL":"1439","oaFilClTL":"65535","hVer":"0","airVo":"1","raFilEx":"255","runSta":"0","raFilCl":"255","alSta":"0","preM":"0"},"deviceMNO":"FV-RZ06VD1","shareDev":0,"imgUrlsec":""},"deviceId":"00*******3"}],"shareList":[],"roomList":[{"devCount":0,"roomId":"1445192","roomName":"客厅"},{"devCount":0,"roomId":"1445193","roomName":"厨房"},{"devCount":1,"roomId":"1445194","roomName":"主卧"}]}}

3.设备Token
完全不知道是怎么生成的

有两个关于Token的Path
/UsrGetToken
Request
{"id":97,"uiVersion":4.0,"params":{"usrId":"1******5"}}
Respond
{"id":97,"results":{"token":"7****2"}}

/SetDeviceToken
Request
{"id":102,"uiVersion":4.0,"params":{"aliToken":"d******9","devToken":"","usrId":"779388"}}    //不知道这个aliToken是从哪来的
Respond
{"id":102}  //没有返回任何东西

然后设备Token突然就从请求参数中蹦出来了
/ADevGetLocalSettingMidERV
{"id":149,"params":{"token":"98a***********************8eb","deviceId":"0****************3","usrId":"7*****8"}}

不知道咋生成的，因此也不知道有效期多久。退出APP后重新登陆不影响，跟昨天也没有变化。可能是新风设备联网绑定时生成的？这样的话应该只要不解绑Token就不会变。

4.Get设备状态

Get和Set都需要带着三个参数: token deviceId userId

/ADevGetStatusMidERV
Request
{
      "id": 157,
      "params": {
            "token": "98a8***********18eb",
            "deviceId": "0016*****01-03",
            "usrId": "7****8"
      }
}

Respond
{
      "id": 157,
      "results": {
            "runSta": 0, //机器状态，0-待机，1-开机
            "runM": 4,    //运行模式 0-热交换 2-内循环 3-睡眠 4-自动ECO
            "airVo": 1,    //风量 1-弱 2-中 3-强
            "preM": 0,
            "holM": 0,
            "holHL": 127,
            "holMinL": 127,
            "autoSen": 2,
            "coldF": 0,
            "raPMC": 65535,
            "raPMM": 65535,
            "saFilClTL": 719,
            "oaFilClTL": 65535,
            "raFilClTL": 65535,
            "saFilExTL": 1439,
            "oaFilExTL": 65535,
            "raFilExTL": 4320,
            "saFilCl": 0,
            "oaFilCl": 255,
            "raFilCl": 255,
            "saFilEx": 1,
            "oaFilEx": 255,
            "raFilEx": 0,
            "alSta": 0,
            "hVer": 0,
            "sVer": 0,
            "offline": 0,
            "serverTime": 1658159007,
            "oaPMC": 10,
            "oaHumC": 66,
            "oaTeC": 26,
            "clockDisplayFlag": 0,
            "tSta1": 0,
            "tSet1": 1,
            "tH1": 1,
            "tMin1": 24,
            "tWeek1": 254,
            "tSta2": 0,
            "tSet2": 0,
            "tH2": 0,
            "tMin2": 0,
            "tWeek2": 254,
            "tSta3": 0,
            "tSet3": 0,
            "tH3": 0,
            "tMin3": 0,
            "tWeek3": 254,
            "tSta4": 0,
            "tSet4": 0,
            "tH4": 0,
            "tMin4": 0,
            "tWeek4": 254,
            "tSta5": 0,
            "tSet5": 0,
            "tH5": 0,
            "tMin5": 0,
            "tWeek5": 254,
            "tSta6": 0,
            "tSet6": 0,
            "tH6": 0,
            "tMin6": 0,
            "tWeek6": 254,
            "preSet": 3
      }
}

5.Set设备状态（以设置风量为例，更多请见二楼）
Request

{
      "id": 2019,
      "params": {
            "deviceId": "0************3",
            "tOnH": 127,
            "saSet": 255,
            "token": "98********************8eb",
            "tOffH": 127,
            "HeatM": 255,
            "tOnSta": 255,
            "runM": 255,
            "oaFilCl": 255,
            "autoSen": 255,
            "airVo": 3,    //风量
            "raFilCl": 255,
            "usrId": "7*****8",
            "preM": 255,
            "tOffMin": 127,
            "raFilEx": 255,
            "holM": 255,
            "saFilCl": 255,
            "tOnMin": 127,
            "runSta": 255,
            "oaFilEx": 255,
            "saFilEx": 255,
            "tOffSta": 255
      }
}

Respond
{
      "id": 2019,
      "results": {
            "todoId": 95
      }
}

20220719更新：在FireFox里试了一下发送Post包，成功（见图）。
说明ssl pinning机制是封装在APP里的，云端没有限制，感觉离成功走近了一大步。

但是遇到两个问题：
1.云端的ssl证书是自签名的，需要下载后在本地安装，并设置例外。PC端可以处理，不知道HA里能不能搞得定。
2.Set和Get设备状态的POST请求，Header里需要带Cookie，否则报错，Cookie是登录账号时返回的，每次登录会变，不知道在Cookie有效期多久。

未完待续。希望有大神能协助或接力。

omegaojian · 发表于 2022-7-17 22:19:30

本帖最后由 omegaojian 于 2022-7-17 22:24 编辑

20220717晚更新2：帖几个包

Request
开机
"params": {
"deviceId": "*************",
"tOnH": 127,
"saSet": 255,
"token": "******************************",
"tOffH": 127,
"HeatM": 255,
"tOnSta": 255,
"runM": 255,
"oaFilCl": 255,
"autoSen": 255,
"airVo": 255,
"raFilCl": 255,
"usrId": "**************",
"preM": 255,
"tOffMin": 127,
"raFilEx": 255,
"holM": 255,
"saFilCl": 255,
"tOnMin": 127,
"runSta": 1,
"oaFilEx": 255,
"saFilEx": 255,
"tOffSta": 255
}

关机
params": {
"deviceId": "**************",
"tOnH": 127,
"saSet": 255,
"token": "*****************",
"tOffH": 127,
"HeatM": 255,
"tOnSta": 255,
"runM": 255,
"oaFilCl": 255,
"autoSen": 255,
"airVo": 255,
"raFilCl": 255,
"usrId": "******",
"preM": 255,
"tOffMin": 127,
"raFilEx": 255,
"holM": 255,
"saFilCl": 255,
"tOnMin": 127,
"runSta": 0,
"oaFilEx": 255,
"saFilEx": 255,
"tOffSta": 255
}

1.3模式：自动ECO

"params": {
            "deviceId": "************",
            "tOnH": 127,
            "saSet": 255,
            "token": "*************************",
            "tOffH": 127,
            "HeatM": 255,
            "tOnSta": 255,
            "runM": 4,
            "oaFilCl": 255,
            "autoSen": 255,
            "airVo": 255,
            "raFilCl": 255,
            "usrId": "*************",
            "preM": 255,
            "tOffMin": 127,
            "raFilEx": 255,
            "holM": 255,
            "saFilCl": 255,
            "tOnMin": 127,
            "runSta": 255,
            "oaFilEx": 255,
            "saFilEx": 255,
            "tOffSta": 255
      }

模式：睡眠
"params": {
            "deviceId": "****************",
            "tOnH": 127,
            "saSet": 255,
            "token": "***********************************",
            "tOffH": 127,
            "HeatM": 255,
            "tOnSta": 255,
            "runM": 3,
            "oaFilCl": 255,
            "autoSen": 255,
            "airVo": 255,
            "raFilCl": 255,
            "usrId": "**************",
            "preM": 255,
            "tOffMin": 127,
            "raFilEx": 255,
            "holM": 255,
            "saFilCl": 255,
            "tOnMin": 127,
            "runSta": 255,
            "oaFilEx": 255,
            "saFilEx": 255,
            "tOffSta": 255
      }

模式：热交换
"params": {
            "deviceId": "******************",
            "tOnH": 127,
            "saSet": 255,
            "token": "*******************",
            "tOffH": 127,
            "HeatM": 255,
            "tOnSta": 255,
            "runM": 0,
            "oaFilCl": 255,
            "autoSen": 255,
            "airVo": 255,
            "raFilCl": 255,
            "usrId": "******************",
            "preM": 255,
            "tOffMin": 127,
            "raFilEx": 255,
            "holM": 255,
            "saFilCl": 255,
            "tOnMin": 127,
            "runSta": 255,
            "oaFilEx": 255,
            "saFilEx": 255,
            "tOffSta": 255
      }

模式：内循环
"params": {
            "deviceId": "*****************",
            "tOnH": 127,
            "saSet": 255,
            "token": "*******************************************",
            "tOffH": 127,
            "HeatM": 255,
            "tOnSta": 255,
            "runM": 2,
            "oaFilCl": 255,
            "autoSen": 255,
            "airVo": 255,
            "raFilCl": 255,
            "usrId": "****************",
            "preM": 255,
            "tOffMin": 127,
            "raFilEx": 255,
            "holM": 255,
            "saFilCl": 255,
            "tOnMin": 127,
            "runSta": 255,
            "oaFilEx": 255,
            "saFilEx": 255,
            "tOffSta": 255
      }

风量：强
"params": {
            "deviceId": "**************",
            "tOnH": 127,
            "saSet": 255,
            "token": "*******************************",
            "tOffH": 127,
            "HeatM": 255,
            "tOnSta": 255,
            "runM": 255,
            "oaFilCl": 255,
            "autoSen": 255,
            "airVo": 3,
            "raFilCl": 255,
            "usrId": "**************",
            "preM": 255,
            "tOffMin": 127,
            "raFilEx": 255,
            "holM": 255,
            "saFilCl": 255,
            "tOnMin": 127,
            "runSta": 255,
            "oaFilEx": 255,
            "saFilEx": 255,
            "tOffSta": 255
      }

风量：中
"params": {
            "deviceId": "**************",
            "tOnH": 127,
            "saSet": 255,
            "token": "**********************",
            "tOffH": 127,
            "HeatM": 255,
            "tOnSta": 255,
            "runM": 255,
            "oaFilCl": 255,
            "autoSen": 255,
            "airVo": 2,
            "raFilCl": 255,
            "usrId": "************",
            "preM": 255,
            "tOffMin": 127,
            "raFilEx": 255,
            "holM": 255,
            "saFilCl": 255,
            "tOnMin": 127,
            "runSta": 255,
            "oaFilEx": 255,
            "saFilEx": 255,
            "tOffSta": 255
      }

风量：弱
"params": {
            "deviceId": "**********",
            "tOnH": 127,
            "saSet": 255,
            "token": "****************",
            "tOffH": 127,
            "HeatM": 255,
            "tOnSta": 255,
            "runM": 255,
            "oaFilCl": 255,
            "autoSen": 255,
            "airVo": 1,
            "raFilCl": 255,
            "usrId": "*****",
            "preM": 255,
            "tOffMin": 127,
            "raFilEx": 255,
            "holM": 255,
            "saFilCl": 255,
            "tOnMin": 127,
            "runSta": 255,
            "oaFilEx": 255,
            "saFilEx": 255,
            "tOffSta": 255
      }

APP每2秒钟请求一次状态，

Request:

{
"id": 4073,
"params": {
"token": "**************",
"deviceId": "*************",
"usrId": "***********"
}
}

Response：

{
"id": 4073,
"results": {
"runSta": 1,
"runM": 2,
"airVo": 1,
"preM": 0,
"holM": 0,
"holHL": 127,
"holMinL": 127,
"autoSen": 2,
"coldF": 0,
"raPMC": 5,
"raPMM": 9,
"saFilClTL": 719,
"oaFilClTL": 65535,
"raFilClTL": 65535,
"saFilExTL": 1439,
"oaFilExTL": 65535,
"raFilExTL": 4320,
"saFilCl": 0,
"oaFilCl": 255,
"raFilCl": 255,
"saFilEx": 1,
"oaFilEx": 255,
"raFilEx": 0,
"alSta": 0,
"hVer": 0,
"sVer": 0,
"offline": 0,
"serverTime": 1658067750,
"oaPMC": 6,
"oaHumC": 58,
"oaTeC": 27,
"clockDisplayFlag": 0,
"tSta1": 0,
"tSet1": 1,
"tH1": 1,
"tMin1": 24,
"tWeek1": 254,
"tSta2": 0,
"tSet2": 0,
"tH2": 0,
"tMin2": 0,
"tWeek2": 254,
"tSta3": 0,
"tSet3": 0,
"tH3": 0,
"tMin3": 0,
"tWeek3": 254,
"tSta4": 0,
"tSet4": 0,
"tH4": 0,
"tMin4": 0,
"tWeek4": 254,
"tSta5": 0,
"tSet5": 0,
"tH5": 0,
"tMin5": 0,
"tWeek5": 254,
"tSta6": 0,
"tSet6": 0,
"tH6": 0,
"tMin6": 0,
"tWeek6": 254,
"preSet": 3
}
}

河边的泡泡 · 发表于 2022-7-17 22:33:07

抓包过程很有帮助，改天我试试抓布朗新风的包。

论坛助手,iPhone

ciasdmxhxjjpd@c · 发表于 2022-7-18 07:14:21

有了post 参数，就可以用 nr dashboard , 做个类似遥控器样子的面板，面板上每个按钮后面接 http post 模块。

参考
https://github.com/inwaar/node-red-contrib-gree-hvac

, 另外，研究下 token 有效期。

omegaojian · 发表于 2022-7-18 09:10:55

ciasdmxhxjjpd@c 发表于 2022-7-18 07:14
有了post 参数，就可以用 nr dashboard , 做个类似遥控器样子的面板，面板上每个按钮后面接 http post 模块 ...

多谢大神指路！虽然还看不太懂，慢慢研究。
有一个问题，如何在HA里与设备进行交互呀？
是在HA创建一个集成模拟APP，与云端交互；还是想办法在局域网内与设备直连交互？谢谢！

meiki · 发表于 2022-7-18 13:07:51

我觉得还是走串口方便

omegaojian · 发表于 2022-7-18 14:26:38

meiki 发表于 2022-7-18 13:07
我觉得还是走串口方便

请教下，壁挂新风也可以走串口吗

Alkali · 发表于 2022-7-19 17:19:01

支持一下，我以前也是wifi模块，不过现在已经更换485模块了

auditek · 发表于 2022-7-20 09:50:31

楼主加油，我的松下新风接入有望了

jeffen · 发表于 2022-7-20 10:17:19

家里有个松下nanoeX的空气净化器，抓到了

		自动登录	找回密码
密码			立即注册

[插件集成] 小白手撕Panasonic Smart China 松下新风WIFI成功接入HA

评分