{"id":647,"date":"2022-10-10T21:17:41","date_gmt":"2022-10-10T19:17:41","guid":{"rendered":"https:\/\/thegreydiamond.de\/blog\/?p=647"},"modified":"2022-10-11T22:55:16","modified_gmt":"2022-10-11T20:55:16","slug":"reverse-engineering-moonside-lighthouse","status":"publish","type":"post","link":"https:\/\/thegreydiamond.de\/blog\/2022\/10\/10\/reverse-engineering-moonside-lighthouse\/","title":{"rendered":"Reverse engineering a Moonside Lighthouse Light"},"content":{"rendered":"\n
<\/path><\/svg>

Working in Progress<\/h4>

This article is still a work in progress, which means it will be updated in the future. Images may be missing captions or alt-texts. There might also be some language weirdness. <\/p><\/div><\/div>\n\n\n\n

<\/p>\n\n\n\n

I’ve had a Moonside Lighthouse<\/a> lying around for some time. It’s a pretty nice-looking light fixture, however, there was no way to integrate it into my Homeassistant setup. I’ve had a shot at reverse engineering it’s communication and here are my results:<\/p>\n\n\n\n

Trying the network route<\/h2>\n\n\n\n

Lighthouse is able to join your WiFi-Network for remote control, because of that I was hoping to find some open network port using Nmap. A quick scan showed nothing, meaning that this way is likely a dead end. <\/p>\n\n\n\n

However, this digging surfaced one interesting piece of information about its MAC Address, which belongs to the Espressif MAC range (meaning it’s likely something ESPy).<\/p>\n\n\n\n

Internet<\/h3>\n\n\n\n

There also exists a public API<\/a> which enables you to control the fixture remotely. I was unable to get it working, also I would like to be able to control my light locally. I have not explored this route further.<\/p>\n\n\n\n

Bluethooth<\/h2>\n\n\n\n

After it became clear that networking is sadly not an option I started looking into Bluethooth. The App uses BLE to talk to the lamp. My first attempt was to use the nRF Connect tool to reads its characteristics.<\/p>\n\n\n\n

\"A<\/figure>\n\n\n\n
\"A<\/figure>\n\n\n\n

None of these characteristics were helpful, except one which piqued my interest., “Nordic UART Service”, I’ve never heard of that before, though it seems fairly helpful. Using the nRF toolbox<\/a> I was able to connect to it via BLE UART. That itself worked fine, however, brute-forcing commands were not useful as there was no response to anything.<\/p>\n\n\n\n

Snooping the traffic<\/h3>\n\n\n\n

The next logical step was to snoop on the traffic between the android app and the hardware counterpart. That proved to be not as easy as it sounds, in the end, I used Wireshark to look at the traffic.<\/p>\n\n\n\n

First step was to enable Bluetooth Snooping in the developer settings. Then after some debugging and using this command: <\/p>\n\n\n\n

db shell su -c \"'nc -s 127.0.0.1 -p 8872 -L system\/bin\/tail -f -c +0 data\/misc\/bluetooth\/logs\/btsnoop_hci.log'\"<\/code><\/pre>\n\n\n\n
The interface showed up in Wireshark. Though you need to android dump androiddump module for Wireshark.<\/p>\n\n\n\n
Info<\/h4>
It seems like your device needs to be rooted for this to work, I’ve seen contradicting information about that, however.<\/p><\/div><\/div>\n\n\n\n
<\/p>\n\n\n\n
Finally, I was able to see communication with a device called Espressi_2a:9d:5a, which looks suspiciously like the device in question.<\/p>\n\n\n\n
Deconstructing the communication<\/h3>\n\n\n\n
The became apparent that the app talks in clear text with the light fixture. These commands started showing up:<\/p>\n\n\n\n
Command<\/strong><\/th>Description<\/strong><\/th><\/tr><\/thead>
LEDOFF<\/td>Turns the light off<\/td><\/tr>
LEDON<\/td>Turns the light on<\/td><\/tr>
BRIGHXXX<\/em><\/td>Brightness, replace XXX with number (max: 120, min:0)<\/td><\/tr>
COLORRRRGGGBBB XXX<\/em><\/td>Sets the colour, replace R with red value, G with green value and B with blue value (0-255), optional X brightness argument<\/td><\/tr>
THEME.????????<\/td>Sets a theme<\/td><\/tr>
PIXEL,ID<\/em>,XXX<\/em> COLOR<\/em>?<\/td>Set a pixel, where ID is the pixel (0-89), XXX is the brightness and COLOR is the colour in an unknown format<\/td><\/tr>
MODEPIXEL<\/td>Applies pixel settings<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Mind you the values of for example the ID range might be different between devices, however I will probably not buy more devices just to prove my theory. <\/p>\n\n\n\n
Some things are also just unknown. I do not understand how sound-enabled modes work (yet!). It sends some number string and that’s it. I was also unable to figure out the COLOR format for pixel setting, it is six digits ranging from 0-9.<\/p>\n\n\n\n
Themes<\/h3>\n\n\n\n
Themes are a whole different topic. They are way more configurable than the app gives you options. Here is a list of the themes from the app:<\/p>\n\n\n\n
Theme name<\/th>Themenick<\/th><\/tr><\/thead>
RAINBOW1.20,<\/td>Rainbow One<\/td><\/tr>
FIRE1.20,<\/td>Night Fire<\/td><\/tr>
THEME.THEME1.162,255,174,255,85,90,<\/td>Blue Raspberry<\/td><\/tr>
THEME.WAVE1.255,0,0,255,0,255,<\/td>Pink Ball<\/td><\/tr>
THEME.BEAT1.255,0,0,0,255,0,0,0,255,<\/td>Dancing Beat<\/td><\/tr>
THEME.GRADIENT2.0,255,0,20,65,20,200,200,200,<\/td>Green Land<\/td><\/tr>
THEME.THEME3.0,0,200,0,100,200,100,0,200,200,0,0,200,06,100,120,200,0,<\/td>Candy Mix<\/td><\/tr>
THEME.THEME1.255,0,0,0,0,255,<\/td>My Moon<\/td><\/tr>
THEME.BEAT2.255,255,0,0,0,255,<\/td>Bouning Stars<\/td><\/tr>
THEME.GRADIENT1.0,255,0,255,0,0,<\/td>Christmas Blend<\/td><\/tr>
THEME.RAINBOW3.0,<\/td>Blending Rainbow<\/td><\/tr>
THEME.THEME2.138,35,135,242,113,33,<\/td>Wire Tap<\/td><\/tr>
THEME.COLORDROP1.10,100,255,200,200,200,<\/td>Raining Blue<\/td><\/tr>
THEME.TWINKLE1.255,0,0,0,0,255,<\/td>Twinkle Star<\/td><\/tr>
THEME.FIRE2.0,0,0,0,255,0,200,0,0,255,0,0,<\/td>Green Fire<\/td><\/tr>
THEME.GRADIENT2.145,3,245,255,25,194,191,176,187,<\/td>Purple Cake<\/td><\/tr>
THEME.GRADIENT1.150,0,255,255,214,243,<\/td>Purple Dream<\/td><\/tr>
THEME.LAVA1.200,0,0,50,0,0,0,0,255,<\/td>Blue Lava<\/td><\/tr>
THEME.LAVA1.20,255,2,255,100,0,255,0,60,<\/td>MacMac<\/td><\/tr>
THEME.THEME1.168,255,120,120,255,214,<\/td>Summer Glow<\/td><\/tr>
THEME.BEAT2.7,200,249,13,34,135,<\/td>Dancing Ocean<\/td><\/tr>
THEME.PALETTE2.0,0,200,0,100,200,100,0,200,200,0,0,2006,0,100,120,200,0,<\/td>Colorful Swinging<\/td><\/tr>
THEME.GRADIENT1.255,80,0,0,0,0,<\/td>Late OJ<\/td><\/tr>
THEME.BEAT1.255,190,100,255,190,100,<\/td>Shining Beat<\/td><\/tr>
THEME.GRADIENT1.255,208,50,100,100,100,<\/td>Margo<\/td><\/tr>
THEME.RAINBOW2.20,<\/td>Rising Rainbow<\/td><\/tr>
THEME.THEME5.200,20,150,0,60,255,<\/td>Vibrant City<\/td><\/tr>
THEME.COLORDROP1.0,255,0,255,8,130,<\/td>Rose Drop<\/td><\/tr>
THEME.FIRE2.0,0,0,31,255,110,155,252,212,255,255,255,<\/td>Ghost Fire<\/td><\/tr>
THEME.GRADIENT1.255,0,0,200,200,200,<\/td>Pink Dawn<\/td><\/tr>
THEME.PULSING1.255,0,20,20,20,255,<\/td>Super Pulsing<\/td><\/tr>
THEME.PULSING1.115,255,182,250,255,204,<\/td>Super Limeade<\/td><\/tr>
THEME.GRADIENT1.147,71,255,255,102,50,<\/td>Galaxy Purple<\/td><\/tr>
THEME.GRADIENT2.255,0,0,50,190,10,0,160,200,<\/td>Nemo Green<\/td><\/tr>
THEME.LAVA1.0,183,255,0,0,0,255,255,255,<\/td>Cool Sky<\/td><\/tr>
THEME.THEME1.0,0,255,255,0,255,<\/td>Distant Night<\/td><\/tr>
THEME.FIRE2.0,0,0,255,0,0,0,255,0,0,0,255,<\/td>Rainbow Fire<\/td><\/tr>
THEME.GRADIENT2.255,0,0,80,20,0,200,200,200,<\/td>Volcano Ice Cream<\/td><\/tr>
THEME.THEME1.255,0,0,0,255,0,<\/td>Wild Watermelon<\/td><\/tr>
THEME.TWINKLE1.255,0,0,0,180,0,<\/td>Twinkle Christmas<\/td><\/tr>
THEME.GRADIENT2.255,66,20,255,66,20,8,217,255,<\/td>Ali<\/td><\/tr>
THEME.GRADIENT1.198,255,221,247,45,50,<\/td>Megatron<\/td><\/tr>
THEME.GRADIENT1.255,0,0,0,50,200,<\/td>Blue Raspberry<\/td><\/tr>
THEME.GRADIENT1.0,255,0,200,200,200, Wizard<\/td>Vibe Beat<\/td><\/tr>
THEME.THEME4.255,50,0,0,90,220,<\/td>Orange Ocean<\/td><\/tr>
THEME.GRADIENT2.0,255,0,255,0,0,100,0,0,<\/td>Jingle Bell<\/td><\/tr>
THEME.LAVA1.255,25,0,100,30,0,255,150,0,<\/td>Glowing Lava<\/td><\/tr>
THEME.GRADIENT2.59,250,229,255,85,0,255,0,20,<\/td>Celebration Candy<\/td><\/tr>
THEME.GRADIENT2.0,0,255,30,102,128,255,255,255,<\/td>Ice Mountain<\/td><\/tr>
THEME.GRADIENT1.86,255,119,98,38,210,<\/td>Magic Blend<\/td><\/tr>
THEME.GRADIENT1.255,255,30,36,255,65,<\/td>Martini<\/td><\/tr>
THEME.PALETTE1.0,<\/td>Color Wheel<\/td><\/tr>
THEME.LAVA1.255,0,0,60,60,60,0,255,0,<\/td>Christmas Snow<\/td><\/tr>
THEME.GRADIENT1.195,255,210,2,9,19,<\/td>Petrol<\/td><\/tr>
THEME.GRADIENT1.0,150,255,200,200,200,<\/td>Aqua Wave<\/td><\/tr>
THEME.FIRE2.0,0,0,255,0,0,0,0,255,255,255,255,<\/td>Magic Fire<\/td><\/tr>
THEME.GRADIENT2.8,175,212,178,37,247,242,12,188,<\/td>WaterShine<\/td><\/tr><\/tbody><\/table>
All themes<\/figcaption><\/figure>\n\n\n\n
Sound-activated modes seem to be variations of themes. These have yet to be mapped. However, they commonly start with M and another number following that. After that, there are colour arguments again. <\/p>\n\n\n\n
<\/p>\n\n\n\n
Modifiying theme data<\/h4>\n\n\n\n
There are a few theme “keywords” which can then be mixed with arguments. These are: THEME1, THEME2, THEME3, THEME4, THEME5, WAVE1, BEAT1, BEAT2, BEAT3, GRADIENT1, GRADIENT2, RAINBOW1, RAINBOW2, RAINBOW3, TWINKLE1, FIRE2, COLORDROP1, LAVA1, COLORDROP1, PULSING1<\/code><\/p>\n\n\n\n
Following these theme keywords are blocks of colour, most in this format: (yes they end in a ,<\/code>)<\/p>\n\n\n\n
THEME.THEME1.RRR1,GGG1,BBB1,RRR2,GGG2,BBB2,<\/code><\/pre>\n\n\n\n
It seems like every theme’s colour values change different aspects of the effect. (more will be added below over time)<\/p>\n\n\n\n
Theme<\/th>Description<\/th><\/tr><\/thead>
FIRE2.BBB,BBB,BBB,111,111,111,222,222,222,333,333,333<\/td>B is the “background” or base colour of the effect, you can leave it with 0s, meaning it will stay off. The rest 1-3 are other effect colours.<\/td><\/tr>
<\/td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Building a smart home interface<\/h2>\n\n\n\n
I’ve built a basic Sketch which connects to the WiFi network. Have a look below! (I will continue working on this sketch)<\/p>\n\n\n\n