-
-
Notifications
You must be signed in to change notification settings - Fork 337
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
tuya-cli list-app not working after updating app #280
Comments
It seems that the Tuya App (which is still 3.13.x) still works ... but unknown how long I also have reports from tests with older Android APK versions where the App was not able to login because too old. Users test further |
I have a charles file ... send me email (github account) nd I send the file if interested ... |
Looks pretty similar to the new HTTP API we implemented in tuya-convert. Wonder what the AES key might be. Do you have a capture starting from registration? |
May a login be enough too? Then I could capture it |
Ok, it seems to be an app key ... I logged out and closed the app ... the next open started directly again with encrypted messages. Here the data of the very first request of the app even before loging request:
|
Interesting, it still works with the latest version of the TuyaSmart app on iOS. I assume they're going to start rolling out this change to all whitelabeled apps, but it seems like they would've started with their own. |
Version 3.12.6 on Android also seems to work ... 3.13.x interestingly not |
Yes, i tried all last versions. I don‘t know why but I was not able to install the 3.13.x versions from Smart Life App, but 3.12.6 worked for me. |
Where do I get 3.12.6 version of SmartLife apk file? Link please. |
Hi, Regards |
I am experiencing the same with the TuyaSmart app v3.14.0 :( |
@jajajaime yep, Tuya App also got updated today. Only way atm is to use Smart Life or Tuya via apk at Version 3.12.6 |
And make sure to disable the feature to use mobile data if no internet via WiFi I also had IPv6 enabled, had to disable the gateway address temporarly else it would not work (it would just go to tuya on the ipv6 address... (if this is not possible, try set-up a static IP-address instead of DHCP) could possibly be worked around by using the FQDN (fullyqualified domain name) of the device displaying the QR-code but i didnt test that...) |
Hey @kueblc: going by the API that you've been working with, do you think there's any hope of continuing to use the MITM method to retrieve device keys? If not, any ideas on the next best method? |
Version 3.14 on iOS 13 does NOT work anymore. |
@mazafra1 Version 3.14 was the reason why it‘s not working anymore. Use atm Android Simulator with Version 3.12.6 apk. |
I think as soon as we find out what the aes key is we have a chance ... |
@codetheweb I wouldn't give up hope just yet, as @Apollon77 says we have a chance as long as the AES key is static or easily computed. We'll need more data, preferably pcaps along with app/account information. |
Or disassemble the apk?! Maybe also in comparism to an older working version to know where to look at ... But I have no Experience in how to do that :-( |
Certainly, I can do this, but it becomes a lot easier paired with operational data such as stored app data, (non-critical) user credentials, and network captures. |
@HappyTeaFriend |
@FirstS0ul |
@HappyTeaFriend or can i add my lamp with the actual ios app, and login with my account on android?! EDIT: LOL... That worked. Damit... |
Please, can you explain in detail the steps you follow?. For example, how to put de certificate, is I use emu in windows.....
Thank you!
Enviado desde mi iPad
… El 13 ene 2020, a las 12:08, farmdude ***@***.***> escribió:
Yes. I used memu and the apk mentioned and it worked perfect!
Sent from my iPhone
> On Jan 13, 2020, at 12:36 AM, Malcolm Robinson ***@***.***> wrote:
>
>
> @farmdude did the APK work for you? Installing old versions of both tuyaSmart and Smart Life APKs fail for me on rooted BlueStacks.
>
> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub, or unsubscribe.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or unsubscribe.
|
Download “STL Smart Home” (for Android) This worked for me. As described earlier in some post here. Update: |
As assumed: a pairing process generated a new local key. In the end the question is how you want to control it afterwards - if only via other tools then apps then it is fine to have multiple apps ;-) |
I will try later today and install the STL Smart home, get the key and leave those devices there while i ill try to add them to homey (smart hub). Hopefully someone will be able to crack the code to snitch the key in the new version in the future :) |
I spent a bit of time looking into this today.
That being said, the |
We wait it!, thousands os thanks MAX! |
But the link idea also needs more stuff from the users to be done. But yes. The encryption stuff is really bad for our approach. :-( |
@codetheweb By injecting some code into the smart life app I've managed to successfully get the device list with localKey's by using its code API (it's sending "s.m.dev.list" now). Could potentially wrap it up in a public rest API which tuya-cli then uses or something. Super experimental at this point though! |
The AES encryption key is based on some static values in the app and the request ID, with its actual generation being handled by native code (specifically libjnimain.so in the Android apk - the same as the signature stuff). They've gone to extensive lengths to hide it, so I'd certainly agree they'll just change it as soon as they see an implementation pop up online. So much for the open smart home. But anyway, this is also new in the latest version - the certs are being pinned, but only in the tuya app itself - not 3rd parties:
The accepted cert list is a .json file in the app resources - here's the top chunk of it:
The |
But this seems to be SSL certificate pinning ... then it becomes even more problematic :-( |
i was wondering also if in the discovery mode of smartconfig the aes key is modified. |
did someone tried the 3.14 encrypted data with te key from this page (https://github.com/nalajcie/tuya-sign-hacking#tldr) or did they changed the key? |
what is the difference between tuya smart link ( smartconfig) protocol v3.2 and v3.3 |
Hi, Trying to do list-app with Smart Life 3.12.6. I can see in tcpdump that the phone is directing traffic to the proxy, but no results displayed by tuya-cli. I have HTC U12+ with Android 9. Is this supposed to work at all? Thanks. Take care, |
@swiergot this should still work. Tested it last week. |
@HappyTeaFriend Thanks. Is your phone rooted? Did you do anything special to set up the certificate. All I can do is install it, I could not find any option to fully trust it. Do you have the internet when the proxy is configured? I don't but I read somewhere this is normal. Finally, what did you do in Smart Life? Just refresh devices? Any tips how to debug this appreciated. |
Nevermind. I feel like an idiot after spending one day and a half trying to get this working only to find out I have something else listening on port 8001... |
Update to #280 (comment): I've created a new package (written in TypeScript) for Tuya's OpenAPI (https://github.com/TuyaAPI/openapi), rather than further muddying the @tuyapi/cloud package. I started to integrate it into the Link package (https://github.com/TuyaAPI/link), however it doesn't seem to be working with my test device. I'm not sure if the SmartLink protocol changed or if my code never correctly followed the spec in the first case, but that requires investigation if anyone wants to take a stab at it. I'll work on it some more next weekend if I have time, but no ETA on when it will be working yet - sorry. |
I think that they've implemented SSLPinning techniques in their app. Burp Proxy reports "Unknown certificate" when trying to refresh devices. |
The link package has been updated/fixed, as well as the CLI package and the general setup instructions. |
Should we really close it? I would still love to get a proxy style solution because much easier for the users ... |
I would too, but unless they revert back to not encrypting the traffic and not pinning SSL certificates (both of which seem unlikely) the proxy solution won't work. |
@codetheweb can we bypass SSLpinning using frida ?? |
You can try if you want, I'm not going to be removing the list-app functionality. But I will not continue to maintain it, so if you want any updates to be made to it please open a PR. |
Some questions about the setup intructions:
Thanks, |
@mazafra1 I've clarified the instructions, thanks for the questions. I'm locking this issue; if there are further questions or problems please open a new one. If another method of obtaining the local key is found I'll be sure to post here so current commentators are still notified. |
It seems that with the most current Smartlife App 3.14.0 changes the way how communication works ... and so the sync process is dead (again)
Should we have a generic issue for this here or in one of the other repos/libs?
I'm currently collecting more infos and will post here
The text was updated successfully, but these errors were encountered: