Amazing work, can you help me contribute for AC?

[gaurav21r]

This is really really fantastic work @ysard ! Can't thank you enough.

I am making an app for better sleep and cure some sleep related disorders for people. One of the essential aspects is the ability of the user to control their temperature and having an IR Blaster with old ACs will ensure this app is usable bythose beyond expensive Home Automation / Centralised Air Conditioning.

When I ran some of the commands mentioned in README, I got this:

NotImplementedError: Deciphering AC IR patterns is not currently supported. Any help is welcome to do this part of reverse engineering!

Even opening the Database, I can see that the JSON still has cryptic parts inside. I'd like to contribute towards deciphering the AC side, but can you tell me some hints / places where I can start?

I understand Base64 encoding but can you point me to someplace where I can see how you have decrypted the other functions / frequencies, the AES details etc?

[ysard]

Hi thank you for your interest,

For all the devices except AC devices, IR patterns are encrypted by Xiaomi, thus the files you will find
in the database are as this from their servers.

The deciphering is made in about 5 lines of Python:

mi_remote_database/src/crypt_utils.py

Lines 37 to 69 in 6751bd8

	def decrypt_pattern(encoded_pattern):
	"""Decrypt base64 string with AES ECB mode and a known "secret key"
	:param encoded_pattern: Encrypted text
	:type encoded_pattern: <str>
	:return: Decrypted bytes
	:rtype: <bytes>
	"""
	# Base64 decode
	encoded_pattern = base64.b64decode(encoded_pattern)
	cipher = AES.new(PATTERN_SECRET_KEY.encode(), AES.MODE_ECB)
	# Remove trailing padding spaces
	return cipher.decrypt(encoded_pattern).rstrip()
	def process_xiaomi_shit(encoded_pattern):
	"""Process encoded IR pattern from the API of Xiaomi
	Operations:
	- Decode base64 string
	- Decrypt pattern (AES ECB mode) with a known "secret key"
	- Uncompress GZIP data to recover the plain text as a JSON array
	- Convert JSON array to Python list
	:param encoded_pattern: Base64 encoded, AES ECB crypted, GZip compressed pattern.
	.. seealso:: :meth:`decrypt_pattern`
	:return: List of raw timmings corresponding to the IR code.
	Each value is the time during the transmitter should be stay ON or OFF
	(It's not based on the number of pulses regarding to the frequency used).
	"""
	decrypted_pattern = decrypt_pattern(encoded_pattern)
	plain_text = gzip.decompress(decrypted_pattern)
	return json.loads(plain_text)

These 5 lines summarize hours of research, the reversing process has been described in a series of articles here:
https://pro-domo.ddns.net/blog/retro-ingenierie-dune-application-android-xiaomi-mi-remote-partie-1.html

BUT the IR patterns for AC devices are not reverse engineered since the data is very different (and seems to be not encrypted).

The data is processed in the Xiaomi Mi Remote application by specific routines.
This is probably because the way these devices are controlled is radically different.

In the AC files, you won't find any IR code for any specific function; the keys are apparently associated with ids.
The ids themselves are associated with pieces of IR patterns, with code from a scripting language (LUA), or with combinations of key ids. Multiple field separators are used, such as &, @ or |.

All of this requires you to go back into the application to determine the processing applied to this data.
You'll have guessed that IR patterns seem to be dynamic (lots of bitwise operations for example) and not fixed as is the case with other devices.

I can't tell you much more than that, but I suppose that having a device supported by the application at hand would enable you to progress quickly in creating a parser.

If you're able to work on this part, I'd be happy to add your knowledge to the project.

[ysard]

Once decompiled, you will find some/all ids to functions mappings in the file com/hzy/tvmao/p394ir/p395ac/ACConstants.java
The app uses the library https://github.com/jasonsantos/luajava for its LUA to Java binding.

More generally you will find all the code related to AC devices in the package com/hzy/tvmao/.

If there is encryption it's as for the rest implemented in a native Android library: for example ./resources/lib/armeabi-v7a/libirdevice.so

With the following routines:

• Java_com_hzy_tvmao_ir_encode_IrDevice_init
• Java_com_hzy_tvmao_ir_encode_IrDevice_getFrequency
• Java_com_hzy_tvmao_ir_encode_IrDevice_createRemote
• Java_com_hzy_tvmao_ir_encode_IrDevice_enc
• Java_com_hzy_tvmao_ir_encode_IrDevice_parse

But as I said earlier, the biggest problem is to understand the processing of the data & LUA code.