about_tinytuya_message_payload_with_custom_tcp #509

nguyenphangpmb2022 · 2024-06-21T09:29:03Z

nguyenphangpmb2022
Jun 21, 2024

i have a question in which how to send the message on custom tcp sender to tuya device
currently i have some tuya ir blaster, see their command log on tuya_cloud device log but i want to use it with other local tcp sender. so i wonder how to get the tcp message in which tiny_tuya send it (the one with the encryped_message (contain aes with key is equal to the local key,..) because i just want to use small tcp_some_specific_device_command.
looking for your message
thank you, sincerely

jasonacox · 2024-06-22T18:41:34Z

jasonacox
Jun 22, 2024
Maintainer

Hi @nguyenphangpmb2022 - some suggestions:

Check the examples to see if you can find what you are looking to do: https://github.com/jasonacox/tinytuya/tree/master/examples
For IR, check out https://github.com/jasonacox/tinytuya/blob/master/examples/Contrib/IRRemoteControlDevice-example.py
For sending codes to Tuya devices see https://github.com/jasonacox/tinytuya?tab=readme-ov-file#tuya-data-points---dps-table

1 reply

nguyenphangpmb2022 Jun 24, 2024
Author

ah, thank you. i used the tinytuya to sent that "head-key" to tuya ir blaster and it work. But in my case, i want to use the node-red for easier container management as well as deployment. so i am figure it out how to sent raw tcp to tuya device with it. i am stuck on the way message is encrypted, currently searching on tuya protocol.

uzlonewolf · 2024-06-23T09:37:19Z

uzlonewolf
Jun 23, 2024
Collaborator

If you enable debug mode with tinytuya.set_debug(True) and then send a command it will show you the final TCP packet it's sending:

...
DEBUG:building command 10 payload=b'{"gwId":"...","devId":"...","uid":"...","t":"..."}'
DEBUG:payload encrypted=b'000055aa000000020000000a0000007845db78...932a33cb2200fc0000aa55'
...

That 'DEBUG:payload encrypted=' line is the TCP packet it sent.

6 replies

nguyenphangpmb2022 Jun 24, 2024
Author

If you enable debug mode with tinytuya.set_debug(True) and then send a command it will show you the final TCP packet it's sending:
...
DEBUG:building command 10 payload=b'{"gwId":"...","devId":"...","uid":"...","t":"..."}'
DEBUG:payload encrypted=b'000055aa000000020000000a0000007845db78...932a33cb2200fc0000aa55'
...
That 'DEBUG:payload encrypted=' line is the TCP packet it sent.

hi, i have another question: i want to port that encrypted message to javascript, so can i get the schematic of that pyca flow. is that "{command 7 payload=b'{"protocol":5,"t":1719194345,"data":{"dps":{"1":"false"}}}'} command message getting encrypted with aes "local key" to be final key message or another state because i see the "decrypting part"?.
thank you so much.
here is debug:

DEBUG:Python 3.8.19 (default, Apr 24 2024, 13:04:15)                                                                     [GCC 12.2.0] on linux                                                                                                    DEBUG:Using pyca/cryptography 42.0.5 for crypto, GCM is supported                                                        DEBUG:final payload_dict for 'eb6dd1a4452################' ('v3.4'/'default'): {1: {'command': {'gwId': '', 'devId': '', 'uid': '', 't': ''}}, 7: {'command': {'protocol': 5, 't': 'int', 'data': {}}, 'command_override': 13}, 8: {'command': {'gwId': '', 'devId': ''}}, 9: {'command': {'gwId': '', 'devId': ''}}, 10: {'command': {}, 'command_override': 16}, 13: {'command': {'protocol': 5, 't': 'int', 'data': {}}}, 16: {'command': {}}, 18: {'command': {'dpId': [18, 19, 20]}}, 64: {'command': {'reqType': '', 'data': {}}}}
DEBUG:building command 7 payload=b'{"protocol":5,"t":1719194345,"data":{"dps":{"1":"false"}}}'
DEBUG:sending payload quick
DEBUG:final payload: b'0123456789abcdef'
DEBUG:payload encrypted=b'000055aa000000010000000300000044a2496caf5f143be9df085af9441d00b1ae79b0f7cf8e0bb36ffd0f3d27f6f780880ede900040fb6c7ea59c7fb5f93509d4b535f36715c54000d7396537ab5eee0000aa55'
DEBUG:received data=b'000055aa0000800f0000000400000068000000003d3ac902b272634b16229e959843c14079429f48ba6d14c7b53e583c296c6626f14b8a875521c82324c60b7cbe72f1f5ae79b0f7cf8e0bb36ffd0f3d27f6f78021074949c71286c0bd17b309d57bfe15a96ef5702169bd5af263e44944d660cd0000aa55'
DEBUG:decrypting=b'=:\xc9\x02\xb2rcK\x16"\x9e\x95\x98C\xc1@yB\x9fH\xbam\x14\xc7\xb5>X<)lf&\xf1K\x8a\x87U!\xc8#$\xc6\x0b|\xber\xf1\xf5\xaey\xb0\xf7\xcf\x8e\x0b\xb3o\xfd\x0f=\'\xf6\xf7\x80'
DEBUG:decrypted session key negotiation step 2 payload=b'693fa4b830ed05c5|\x8f\xa7r\xa3\x04\xcf4\xd4\xb3\xfd\xb2\xebv\xf1\xe9B$\x9f\xa6\xe5\x90r<T\xb32\x07S\xb57\xa8'
DEBUG:payload type = <class 'bytes'> len = 48
DEBUG:session local nonce: b'0123456789abcdef' remote nonce: b'693fa4b830ed05c5'
DEBUG:sending payload quick
DEBUG:final payload: b'M3\xb2\xe3ZM\x00\xfe\x196&\xaf\xd4\x7f\xb4\xde\x19\xdc\xedhUm\x93\x97U\x8a\xa3\t\xfdj\xc7\x98'
DEBUG:payload encrypted=b'000055aa000000020000000500000054f45ec002eabbb1beb2a55ccc25187e6ce43f8094003d646260bfa23e29ffb84eae79b0f7cf8e0bb36ffd0f3d27f6f780211594bcc44696f9779287b746da1be2fcd1a37f95619a6146ca854269fd608d0000aa55'
DEBUG:Session nonce XOR'd: b'\x06\x08\x01UU\x01T\x0f\x0b\t\x04\x06SQ\x06S'
DEBUG:Session key negotiate success! session key: b'\xc0%\x01\xad\xd1\t!R`&]\xbc;!\t\xc9'
DEBUG:sending payload
DEBUG:final payload: b'3.4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{"protocol":5,"t":1719194345,"data":{"dps":{"1":"false"}}}'
DEBUG:payload encrypted=b'000055aa000000030000000d000000744e84785692cd49c4a4732e65e3962b85d25c587f9c5ef9ff9c55c6b1a8c78c8bffa8a419349871eea118b52d4a06a5919549d37bbbb7b6eb35a0b03bb758abb604d1619a71632e9689a95c795734e2a70c09d677309eb32f334effefdf963e123b775760778ad8cdc2b9d6b83b238dda0000aa55'

jasonacox Jun 24, 2024
Maintainer

Hi @nguyenphangpmb2022 - You can take a look at the source code to see how to build the payload for the different device version, however, you may also want to look at https://github.com/codetheweb/tuyapi which is JS based library that may be easier for you to port for a JS project.

nguyenphangpmb2022 Jun 25, 2024
Author

Hi @nguyenphangpmb2022 - You can take a look at the source code to see how to build the payload for the different device version, however, you may also want to look at https://github.com/codetheweb/tuyapi which is JS based library that may be easier for you to port for a JS project.

i did search for tuyapi but it not work with ir blaster. It work with other tuya like swith,light,,,,,stuff too but not with ir but when i sent raw command from tinytuya it worked. One question from source code of tinytuya, in this debug log:

DEBUG:final payload: b'0123456789abcdef'
DEBUG:payload encrypted=b'000055aa000000010000000300000044a2496caf5f143be9df085af9441d00b1ae79b0f7cf8e0bb36ffd0f3d27f6f780880ede900040fb6c7ea59c7fb5f93509d4b535f36715c54000d7396537ab5eee0000aa55'
DEBUG:received data=b'000055aa0000800f0000000400000068000000003d3ac902b272634b16229e959843c14079429f48ba6d14c7b53e583c296c6626f14b8a875521c82324c60b7cbe72f1f5ae79b0f7cf8e0bb36ffd0f3d27f6f78021074949c71286c0bd17b309d57bfe15a96ef5702169bd5af263e44944d660cd0000aa55'
DEBUG:decrypting=b'=:\xc9\x02\xb2rcK\x16"\x9e\x95\x98C\xc1@yB\x9fH\xbam\x14\xc7\xb5>X<)lf&\xf1K\x8a\x87U!\xc8#$\xc6\x0b|\xber\xf1\xf5\xaey\xb0\xf7\xcf\x8e\x0b\xb3o\xfd\x0f=\'\xf6\xf7\x80'
DEBUG:decrypted session key negotiation step 2 payload=b'693fa4b830ed05c5|\x8f\xa7r\xa3\x04\xcf4\xd4\xb3\xfd\xb2\xebv\xf1\xe9B$\x9f\xa6\xe5\x90r<T\xb32\x07S\xb57\xa8'
DEBUG:payload type = <class 'bytes'> len = 48
DEBUG:session local nonce: b'0123456789abcdef' remote nonce: b'693fa4b830ed05c5'
DEBUG:sending payload quick
DEBUG:final payload: b'M3\xb2\xe3ZM\x00\xfe\x196&\xaf\xd4\x7f\xb4\xde\x19\xdc\xedhUm\x93\x97U\x8a\xa3\t\xfdj\xc7\x98'
DEBUG:payload encrypted=b'000055aa000000020000000500000054f45ec002eabbb1beb2a55ccc25187e6ce43f8094003d646260bfa23e29ffb84eae79b0f7cf8e0bb36ffd0f3d27f6f780211594bcc44696f9779287b746da1be2fcd1a37f95619a6146ca854269fd608d0000aa55'
DEBUG:Session nonce XOR'd: b'\x06\x08\x01UU\x01T\x0f\x0b\t\x04\x06SQ\x06S'
DEBUG:Session key negotiate success! session key: b'\xc0%\x01\xad\xd1\t!R`&]\xbc;!\t\xc9'
DEBUG:sending payload
DEBUG:final payload: b'3.4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{"protocol":5,"t":1719194345,"data":{"dps":{"1":"false"}}}'
DEBUG:payload encrypted=b'000055aa000000030000000d000000744e84785692cd49c4a4732e65e3962b85d25c587f9c5ef9ff9c55c6b1a8c78c8bffa8a419349871eea118b52d4a06a5919549d37bbbb7b6eb35a0b03bb758abb604d1619a71632e9689a95c795734e2a70c09d677309eb32f334effefdf963e123b775760778ad8cdc2b9d6b83b238dda0000aa55'

there are atleast 2 step. i wonder is it [ "First step: getting iv from "this _AEScipher_Base.def get_encryption_iv( ) and then encrypt at secondary step at _AESCipher_PyCrypto.encrypt() on my specific tuya v3.4 version" "] or is it the first step and after that chained to other same procedure for decrypt and reencrypt. i saw this debug log "DEBUG:session local nonce: b'0123456789abcdef' remote nonce: b'693fa4b830ed05c5'" so i wonder that path "b'693fa4b830ed05c5" should come from somewhere like aes the current time with local-key or...... and ofc i am confusing about key negotiate like this key on debug log "b'\xc0%\x01\xad\xd1\t!R`&]\xbc;!\t\xc9'". where it come from, is it come from the encrypted with the previous key like this one ("b'693fa4b830ed05c5") and is it the key to re-encrypt the final message ("final payload: b'3.4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{"protocol":5,"t":1719194345,"data":{"dps":{"1":"false"}}}'"). to be the last enrypted message.
thank you for your help

jasonacox Jun 25, 2024
Maintainer

@uzlonewolf has done a good job trying to capture the protocols here: #260 and related tools here: https://github.com/jasonacox/tinytuya/tree/master/tools

We would love to have additional documentation to help explain the protocol. If you have any ideas, please post here or provide a PR. I do hope the links help.

uzlonewolf Jun 25, 2024
Collaborator

Yes, v3.4 and v3.5 devices require a 3-way handshake to negotiate a session key every time a TCP connection is made.

The client (TinyTuya) sends the device a nonce.
The device responds with its own nonce.
The client hashes the device nonce and sends it back to the device.

I collected some protocol notes which may help in implementing a packet parser over at #260

MarkCupitt · 2024-06-25T03:09:40Z

MarkCupitt
Jun 25, 2024

That is very impressive .. As I develop my use case, anything I find I will also share with you guys Regards Mark Cupitt "Never give up .. its the end if you do .. find a way .. dig deep .." "If we change the world, let it bear the mark of our intelligence"

…

On Tue, Jun 25, 2024 at 10:59 AM Jason Cox ***@***.***> wrote: @uzlonewolf <https://github.com/uzlonewolf> has done a good job trying to capture the protocols here: #260 <#260> and related tools here: https://github.com/jasonacox/tinytuya/tree/master/tools We would love to have additional documentation to help explain the protocol. If you have any ideas, please post here or provide a PR. I do hope the links help. — Reply to this email directly, view it on GitHub <#509 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABJ7RUAEUYODK54K5MTI3NDZJDMIBAVCNFSM6AAAAABJVQY4XOVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TQNRWGQYDA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

about_tinytuya_message_payload_with_custom_tcp #509

{{title}}

Replies: 3 comments 7 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

about_tinytuya_message_payload_with_custom_tcp #509

nguyenphangpmb2022 Jun 21, 2024

Replies: 3 comments · 7 replies

jasonacox Jun 22, 2024 Maintainer

nguyenphangpmb2022 Jun 24, 2024 Author

uzlonewolf Jun 23, 2024 Collaborator

nguyenphangpmb2022 Jun 24, 2024 Author

jasonacox Jun 24, 2024 Maintainer

nguyenphangpmb2022 Jun 25, 2024 Author

jasonacox Jun 25, 2024 Maintainer

uzlonewolf Jun 25, 2024 Collaborator

MarkCupitt Jun 25, 2024

nguyenphangpmb2022
Jun 21, 2024

Replies: 3 comments 7 replies

jasonacox
Jun 22, 2024
Maintainer

nguyenphangpmb2022 Jun 24, 2024
Author

uzlonewolf
Jun 23, 2024
Collaborator

nguyenphangpmb2022 Jun 24, 2024
Author

jasonacox Jun 24, 2024
Maintainer

nguyenphangpmb2022 Jun 25, 2024
Author

jasonacox Jun 25, 2024
Maintainer

uzlonewolf Jun 25, 2024
Collaborator

MarkCupitt
Jun 25, 2024