diff --git a/README.md b/README.md index 63a15d9..68df7fa 100644 --- a/README.md +++ b/README.md @@ -28,4 +28,7 @@ switch.off() Obtaining the key ----------------- -Obtain the key by holding the down button on the switch until the green light flashes, and then run the get_key script. \ No newline at end of file +Obtain the key by holding the down button on the switch until the green light flashes, and then run the get_key script. + +**Noted on firmware 6.4**: `get_key.py` may not work on firmware version 6.4 as the key changing process is updated. However, +if you are able to get the key manually (e.g. from BLE sniffering), the library should still expect to work. diff --git a/decora/__init__.py b/decora/__init__.py index 2a62261..22cf996 100644 --- a/decora/__init__.py +++ b/decora/__init__.py @@ -84,7 +84,7 @@ def get_event(self, event): raise decoraException("Unable to get event") def set_event(self, event, data): - packet = bytearray([0x11, event, data[0], data[1], data[2], data[3]]) + packet = bytearray([0x11, event, *data]) try: self.device.writeCharacteristic(self.handles["event"], packet, withResponse=True) except btle.BTLEException: diff --git a/docs/decora-ble-v6.4.md b/docs/decora-ble-v6.4.md new file mode 100644 index 0000000..826f412 --- /dev/null +++ b/docs/decora-ble-v6.4.md @@ -0,0 +1,51 @@ +# Protocol for firmware 6.4 + +## Test environment: + +- **Device**: Leviton Decora DDMX1 +- **Version**: 6.4 +- **Datetime**: Aug. 7, 2021 + +## Descriptions + +The fireware version `6.4` seems to change the key changing process. + +Currently, there is an mistery byte appending to the KEY sent from Decora BLE pairing mode. + +The actually KEY is now - + +Say we have `KEY_FROM_BLE`, which is (still) four byte long. +The actually `KEY` - which to be sent to BLE for authentication - is the `KEY_FROM_BLE` appended by +the `THE_MISTRIOUS_BYTE`, it's five bytes long. i.e., + +KEY = KEY_FROM_BLE + THE_MISTRIOUS_BYTE + + +The captured traffic on the ATT stack around the auth (Handle 0x37, or "event"): + +> +> 1. ...Auth starts +> +> 1. Localhost -> BLE +> Request Write: `0x37`, Value: _22 53 00 00 00 00 00_ +> +> 1. Localhost -> BLE +> Request Read: `0x37` +> Response: _22 53 **81 46 5C 76** 00_ +> +> 1. Localhost -> BLE +> Request Write: `0x37`, Value: _22 53 **81 46 5C 76** 67_ +> +> 1. Auth completes... +> + +In the above traffic sample, +`KEY_FROM_BLE`=`81 46 5C 76` (or `81 46 5C 76 00`) +`THE_MISTRIOUS_BYTE`=`0x67` +`KEY`=`81 46 5C 76 67` + +Noted that, on the current Decora mobile app UI (both iOS and Android), the user can reset the current authentication and +re-authenticate. This will change the `KEY_FROM_BLE` as well as the `THE_MISTRIOUS_BYTE`. This will de-auth all the paired +devices. + +![Screenshot to de-auth device](./deauth.png) diff --git a/docs/images/deauth.png b/docs/images/deauth.png new file mode 100644 index 0000000..a3ed0d9 Binary files /dev/null and b/docs/images/deauth.png differ diff --git a/setup.py b/setup.py index e5a29ab..bc9378a 100644 --- a/setup.py +++ b/setup.py @@ -12,7 +12,7 @@ setup( name='decora', - version=0.6, + version=0.7, author='Matthew Garrett', author_email='mjg59@srcf.ucam.org', url='http://github.com/mjg59/python-decora',