{"id":2404,"date":"2020-06-25T21:46:49","date_gmt":"2020-06-25T21:46:49","guid":{"rendered":"http:\/\/blog.rastersoft.com\/?p=2404"},"modified":"2020-10-21T12:15:38","modified_gmt":"2020-10-21T12:15:38","slug":"a-ritmo-de-conga-y-2","status":"publish","type":"post","link":"https:\/\/blog.rastersoft.com\/?p=2404","title":{"rendered":"A ritmo de conga (2)"},"content":{"rendered":"\n<p><strong>Actualizado:<\/strong> varios comandos de servidor a aspiradora terminaban con un LF. A\u00f1adidos.<\/p>\n\n\n\n<p><strong>DISCLAIMER:<\/strong> no ser\u00e9 responsable si alguien decide seguir mis pasos y se carga su aspiradora. En principio todo lo que cuento deber\u00eda ser seguro, pero por motivos obvios no me puedo responsabilizar de lo que hagan otras personas, s\u00f3lo de lo que haga yo.<\/p>\n\n\n\n<p>Ahora que ya sab\u00eda la estructura b\u00e1sica del protocolo de la aspiradora, decid\u00ed escribir un peque\u00f1o programa en <a rel=\"noreferrer noopener\" href=\"https:\/\/www.python.org\/\" target=\"_blank\">Python<\/a> que me extrajese la informaci\u00f3n de manera m\u00e1s clara, y as\u00ed no tener que andar con <a rel=\"noreferrer noopener\" href=\"https:\/\/www.wireshark.org\/\" target=\"_blank\">Wireshark<\/a>, que es bastante pe\u00f1azo. Con \u00e9l tengo las secuencias y el orden en que se transmiten disponibles de un vistazo. El <a href=\"https:\/\/www.rastersoft.com\/conga.py\">c\u00f3digo se puede bajar desde mi web<\/a>.<\/p>\n\n\n\n<figure class=\"wp-block-video aligncenter meme\"><video height=\"192\" style=\"aspect-ratio: 320 \/ 192;\" width=\"320\" src=\"https:\/\/blog.rastersoft.com\/wp-content\/uploads\/2020\/06\/working.mp4\"><\/video><\/figure>\n\n\n\n<p>Lo primero que hice fue apagar completamente la aspiradora para que se borrase todo lo que tuviese en memoria, y emparejarla de nuevo, a ver si cambiaba algo en el proceso. Tras comparar ambas, todo es igual excepto:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>el campo <strong>nonce<\/strong><\/li><li>el campo <strong>sign <\/strong>(aunque esto es, probablemente, porque actualic\u00e9 el firmware)<\/li><li>el campo <strong>token<\/strong><\/li><li>el campo <strong>authcode<\/strong><\/li><\/ul>\n\n\n\n<p>A mayores, la aspiradora envi\u00f3 una petici\u00f3n HTTP extra a <em>POST \/baole-web\/common\/uploadLog.do HTTP\/1.1<\/em> con informaci\u00f3n de un fallo, pero no parece nada importante.<\/p>\n\n\n\n<figure class=\"wp-block-video aligncenter meme\"><video height=\"216\" style=\"aspect-ratio: 320 \/ 216;\" width=\"320\" src=\"https:\/\/blog.rastersoft.com\/wp-content\/uploads\/2020\/06\/perfect.mp4\"><\/video><\/figure>\n\n\n\n<p>Siguiendo con el an\u00e1lisis, decid\u00ed que tocaba empezar a enviar comandos, as\u00ed que inici\u00e9 la captura de paquetes y orden\u00e9 a la aspiradora que comenzase a funcionar. Este fue el resultado (el campo targetId es, en realidad, un valor hexadecimal aparentemente aleatorio, pero \u00fanico para cada aspiradora, as\u00ed que lo anonimizo aqu\u00ed. Es el mismo valor todas las veces que aparece). El n\u00famero decimal es el instante de tiempo (en segundos) desde que empec\u00e9 a registrar los datos, y el sentido del paquete se indica con <em>s-&gt;a<\/em> si es de servidor a aspiradora, <em>a-&gt;s<\/em> si es de aspiradora a servidor:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted mycode\">3.5093190670013428\ns-&gt;a d1 00 00 00 | fa 00 c8 00 | 00 00 09 01 | 1a 27 00 00 | 00 00 00 00\n{\n  \"cmd\":0,\n  \"control\":{\n    \"authCode\":\"yyyyyy\"\n    \"deviceIp\":\"192.168.18.3\",\n    \"devicePort\":\"8888\",\n    \"targetId\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\":\"3\"\n  },\n  \"seq\":0,\n  \"value\":{\"transitCmd\":\"100\"}\n}\\n\n\n3.6597180366516113\na-&gt;s db 01 00 00 | fa 00 00 00 | 01 00 00 00 | 1a 27 00 00 | 00 00 00 00\n{\n  \"version\":\"1.0\",\n  \"control\":{\n    \"targetId\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\":\"3\",\n    \"broadcast\":\"0\"\n  },\"value\":{\n    \"noteCmd\":\"102\",\n    \"workState\":\"5\",\n    \"workMode\":\"0\",\n    \"fan\":\"2\",\n    \"direction\":\"0\",\n    \"brush\":\"2\",\n    \"battery\":\"100\",\n    \"voice\":\"2\",\n    \"error\":\"0\",\n    \"standbyMode\":\"1\",\n    \"waterTank\":\"40\",\n    \"clearComponent\":\"0\",\n    \"waterMark\":\"0\",\n    \"version\":\"3.11.416(513)\",\n    \"attract\":\"0\",\n    \"deviceIp\":\"192.168.18.3\",\n    \"devicePort\":\"8888\",\n    \"cleanGoon\":\"2\",\n    \"extParam\":\"{\\\"cleanModule\\\":\\\"3\\\"}\"\n  }\n}\n\n3.7990760803222656\na-&gt;s bc 01 00 00 | 18 00 00 00 | 01 00 00 00 | 1a 00 00 00 | 00 00 00 00\n{\n  \"version\":\"1.0\",\n  \"control\":{\n    \"targetId\":\"0\",\n    \"targetType\":\"6\",\n    \"broadcast\":\"0\"\n  },\"value\":{\n    \"noteCmd\":\"102\",\n    \"workState\":\"5\",\n    \"workMode\":\"0\",\n    \"fan\":\"2\",\n    \"direction\":\"0\",\n    \"brush\":\"2\",\n    \"battery\":\"100\",\n    \"voice\":\"2\",\n    \"error\":\"0\",\n    \"standbyMode\":\"1\",\n    \"waterTank\":\"40\",\n    \"clearComponent\":\"0\",\n    \"waterMark\":\"0\",\n    \"version\":\"3.11.416(513)\",\n    \"attract\":\"0\",\n    \"deviceIp\":\"192.168.18.3\",\n    \"devicePort\":\"8888\",\n    \"cleanGoon\":\"2\",\n    \"extParam\":\"{\\\"cleanModule\\\":\\\"3\\\"}\"\n  }\n}\n\n3.883021116256714\ns-&gt;a 3c 00 00 00 | 19 00 c8 00 | 01 00 00 00 | 1a 00 00 00 | 01 00 00 00\n{\n  \"msg\":\"OK\",\n  \"result\":0,\n  \"version\":\"1.0\"\n}\\n\n\n4.672595024108887\na-&gt;s 14 00 00 00 | 00 01 c8 00 | 01 00 00 00 | 1b 00 00 00 | e7 03 00 00\n\n4.731273174285889\ns-&gt;a 14 00 00 00 | 11 01 c8 00 | 01 00 08 01 | 1b 00 00 00 | e7 03 00 00\n\n6.818763017654419\na-&gt;s bd 01 00 00 | 18 00 00 00 | 01 00 00 00 | 1c 00 00 00 | 00 00 00 00\n{\n  \"version\":\"1.0\",\n  \"control\":{\n    \"targetId\":\"0\",\n    \"targetType\":\"6\",\n    \"broadcast\":\"0\"\n  },\"value\":{\n    \"noteCmd\":\"102\",\n    \"workState\":\"1\",\n    \"workMode\":\"11\",\n    \"fan\":\"2\",\n    \"direction\":\"0\",\n    \"brush\":\"2\",\n    \"battery\":\"100\",\n    \"voice\":\"2\",\n    \"error\":\"0\",\n    \"standbyMode\":\"1\",\n    \"waterTank\":\"40\",\n    \"clearComponent\":\"0\",\n    \"waterMark\":\"0\",\n    \"version\":\"3.11.416(513)\",\n    \"attract\":\"0\",\n    \"deviceIp\":\"192.168.18.3\",\n    \"devicePort\":\"8888\",\n    \"cleanGoon\":\"2\",\n    \"extParam\":\"{\\\"cleanModule\\\":\\\"3\\\"}\"\n  }\n}\n\n6.9016029834747314\ns-&gt;a 3c 00 00 00 | 19 00 c8 00 | 01 00 00 00 | 1c 00 00 00 | 01 00 00 00\n{\n  \"msg\":\"OK\",\n  \"result\":0,\n  \"version\":\"1.0\"\n}\\n\n\n8.281097173690796\ns-&gt;a d1 00 00 00 | fa 00 c8 00 | 00 00 09 01 | 1c 27 00 00 | 00 00 00 00\n{\n  \"cmd\":0,\n  \"control\":{\n    \"authCode\":\"zzzzzz\",\n    \"deviceIp\":\"192.168.18.3\",\n    \"devicePort\":\"8888\",\n    \"targetId\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\":\"3\"\n  },\n  \"seq\":0,\n  \"value\":{\"transitCmd\":\"131\"}\n}\\n\n\n8.425811052322388\na-&gt;s 54 01 00 00 | fa 00 00 00 | 01 00 00 00 | 1c 27 00 00 | 00 00 00 00\n{\n  \"version\":\"1.0\",\n  \"control\":{\n    \"targetId\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\":\"3\",\n    \"broadcast\":\"0\"\n  },\"value\":{\n    \"transitCmd\":\"132\",\n    \"doTime\":\"614\",\n    \"clearArea\":\"0\",\n    \"clearTime\":\"0\",\n    \"clearModule\":\"11\",\n    \"clearSign\":\"2020-06-24-01-31-41-2\",\n    \"chargerPos\":\"-1,-1\",\n    \"map\":\"AAAAAAAAZABk0vwAKtgACtgAKtPVAA==\",\n    \"track\":\"AQABADIx\"\n  }\n}\n\n12.955074071884155\ns-&gt;a d1 00 00 00 | fa 00 c8 00 | 00 00 09 01 | 1f 27 00 00 | 00 00 00 00\n{\n  \"cmd\":0,\n  \"control\":{\n    \"authCode\":\"zzzzzz\",\n    \"deviceIp\":\"192.168.18.3\",\n    \"devicePort\":\"8888\",\n    \"targetId\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\":\"3\"\n  },\n  \"seq\":0,\n  \"value\":{\"transitCmd\":\"131\"}\n}\\n\n\n13.06220006942749\na-&gt;s 5c 01 00 00 | fa 00 00 00 | 01 00 00 00 | 1f 27 00 00 | 00 00 00 00\n{\n  \"version\":\"1.0\",\n  \"control\":{\n    \"targetId\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\":\"3\",\n    \"broadcast\":\"0\"\n  },\"value\":{\n    \"transitCmd\":\"132\",\n    \"doTime\":\"619\",\n    \"clearArea\":\"0\",\n    \"clearTime\":\"5\",\n    \"clearModule\":\"11\",\n    \"clearSign\":\"2020-06-24-01-31-41-2\",\n    \"chargerPos\":\"-1,-1\",\n    \"map\":\"AAAAAAAAZABk0vwAKoDXAApA1wAqgNPUAA==\",\n    \"track\":\"AQACADIxMzE=\"\n  }\n}<\/pre>\n\n\n\n<figure class=\"wp-block-video aligncenter meme\"><video height=\"216\" style=\"aspect-ratio: 288 \/ 216;\" width=\"288\" controls src=\"https:\/\/blog.rastersoft.com\/wp-content\/uploads\/2020\/06\/phew.mp4\"><\/video><\/figure>\n\n\n\n<p>Bueeeeeeno&#8230; menuda parrafada. Sin embargo empezamos a sacar ya cosas en claro: para poner en marcha la aspiradora y que comience a limpiar, la clave parece estar en este bloque, que parece servir para enviar un comando espec\u00edfico: en este caso, el servidor env\u00eda un paquete con el comando 100, como se especifica en <em>transitCmd<\/em>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted mycode\">s-&gt;a d1 00 00 00 | fa 00 c8 00 | 00 00 09 01 | 1a 27 00 00 | 00 00 00 00\n{\n  \"cmd\":0,\n  \"control\":{\n    \"authCode\":\"yyyyyy\",\n    \"deviceIp\":\"192.168.18.3\",\n    \"devicePort\":\"8888\",\n    \"targetId\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\":\"3\"\n  },\n  \"seq\":0,\n  \"value\":{\"transitCmd\":\"100\"}\n}\\n<\/pre>\n\n\n\n<p>Otro detalle interesante es que siempre que la aspiradora env\u00eda un paquete, su s\u00e9ptimo byte es 00, pero si lo env\u00eda el servidor es C8. Esto tambi\u00e9n se cumpl\u00eda en las comunicaciones anteriores, salvo en los paquetes <em>ping<\/em>, los que aparentemente s\u00f3lo son necesarios para mantener la comunicaci\u00f3n. A pesar de todo, esa parte a\u00fan va a requerir m\u00e1s investigaci\u00f3n.<\/p>\n\n\n\n<p>Una vez que la aspiradora est\u00e1 en marcha, el servidor env\u00eda repetidamente el comando 131, el cual parece que pide a la aspiradora que devuelva informaci\u00f3n sobre su posici\u00f3n y estado actual.<\/p>\n\n\n\n<p>La darle a la opci\u00f3n de dejar de aspirar, los comandos que se intercambian son:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted mycode\">2.3617970943450928\ns-&gt;a d1 00 00 00 | fa 00 c8 00 | 00 00 09 01 | 23 27 00 00 | 00 00 00 00\n{\n  \"cmd\":0,\n  \"control\":{\n    \"authCode\":\"yyyyyy\",\n    \"deviceIp\":\"192.168.18.3\",\n    \"devicePort\":\"8888\",\n    \"targetId\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\":\"3\"\n  },\n  \"seq\":0,\n  \"value\":{\"transitCmd\":\"102\"}\n}\\n\n\n2.4898791313171387\na-&gt;s dc 01 00 00 | fa 00 00 00 | 01 00 00 00 | 23 27 00 00 | 00 00 00 00\n{\n  \"version\": \"1.0\",\n  \"control\": {\n    \"targetId\": \"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\": \"3\",\n    \"broadcast\": \"0\"\n  },\n  \"value\": {\n    \"noteCmd\": \"102\",\n    \"workState\": \"1\",\n    \"workMode\": \"11\",\n    \"fan\": \"2\",\n    \"direction\": \"0\",\n    \"brush\": \"2\",\n    \"battery\": \"100\",\n    \"voice\": \"2\",\n    \"error\": \"0\",\n    \"standbyMode\": \"1\",\n    \"waterTank\": \"40\",\n    \"clearComponent\": \"0\",\n    \"waterMark\": \"0\",\n    \"version\": \"3.11.416(513)\",\n    \"attract\": \"0\",\n    \"deviceIp\": \"192.168.18.3\",\n    \"devicePort\": \"8888\",\n    \"cleanGoon\": \"2\",\n    \"extParam\": \"{\\\"cleanModule\\\":\\\"3\\\"}\"\n  }\n}\n\n2.6665220260620117\na-&gt;s bc 01 00 00 | 18 00 00 00 | 01 00 00 00 | 1d 00 00 00 | 00 00 00 00\n{\n  \"version\": \"1.0\",\n  \"control\": {\n    \"targetId\": \"0\",\n    \"targetType\": \"6\",\n    \"broadcast\": \"0\"\n  },\n  \"value\": {\n    \"noteCmd\": \"102\",\n    \"workState\": \"2\",\n    \"workMode\": \"0\",\n    \"fan\": \"2\",\n    \"direction\": \"0\",\n    \"brush\": \"2\",\n    \"battery\": \"100\",\n    \"voice\": \"2\",\n    \"error\": \"0\",\n    \"standbyMode\": \"1\",\n    \"waterTank\": \"40\",\n    \"clearComponent\": \"0\",\n    \"waterMark\": \"0\",\n    \"version\": \"3.11.416(513)\",\n    \"attract\": \"0\",\n    \"deviceIp\": \"192.168.18.3\",\n    \"devicePort\": \"8888\",\n    \"cleanGoon\": \"2\",\n    \"extParam\": \"{\\\"cleanModule\\\":\\\"3\\\"}\"\n  }\n}\n\n2.751024007797241\ns-&gt;a 3c 00 00 00 | 19 00 c8 00 | 01 00 00 00 | 1d 00 00 00 | 01 00 00 00\n{\n  \"msg\":\"OK\",\n  \"result\":0,\n  \"version\":\"1.0\"\n}\\n\n\n4.319652080535889\na-&gt;s 84 01 00 00 | 14 00 00 00 | 01 00 00 00 | 1e 00 00 00 | 00 00 00 00\n{\n  \"version\": \"1.0\",\n  \"control\": {\n    \"targetId\": \"0\",\n    \"targetType\": \"6\",\n    \"broadcast\": \"0\"\n  },\n  \"value\": {\n     \"noteCmd\": \"101\",\n    \"clearArea\": \"0\",\n    \"clearTime\": \"10\",\n    \"clearSign\": \"2020-06-24-01-31-41-2\",\n    \"clearModule\": \"11\",\n    \"isFinish\": \"1\",\n    \"chargerPos\": \"-1,-1\",\n    \"extParam\": \"{\\\"fan\\\":\\\"2\\\",\\\"waterTank\\\":\\\"40\\\",\\\"mode\\\":\\\"0\\\"}\",\n    \"map\": \"AAAAAAAAZABk0vwAaoDXAGpA1wBqgNcAqNL8AA==\",\n    \"track\": \"AQAEADIxMzExMTEy\"\n  }\n}<\/pre>\n\n\n\n<p>El comando para detenerse parece ser el 102, lo que es consistente con que el de iniciar sea el 100.<\/p>\n\n\n\n<figure class=\"wp-block-video aligncenter meme\"><video height=\"144\" style=\"aspect-ratio: 258 \/ 144;\" width=\"258\" controls src=\"https:\/\/blog.rastersoft.com\/wp-content\/uploads\/2020\/06\/busstop.mp4\"><\/video><\/figure>\n\n\n\n<p>Por \u00faltimo, si pulsamos la opci\u00f3n de volver a la estaci\u00f3n base, \u00e9sto es lo que sale:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted mycode\">0.530087947845459\ns-&gt;a d1 00 00 00 | fa 00 c8 00 | 00 00 d6 4c | 25 27 00 00 | 00 00 00 00\n{\n  \"cmd\": 0,\n  \"control\": {\n    \"authCode\": \"yyyyyy\",\n    \"deviceIp\": \"192.168.18.3\",\n    \"devicePort\": \"8888\",\n    \"targetId\": \"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\": \"3\"\n  },\n  \"seq\": 0,\n  \"value\": {\n    \"transitCmd\": \"104\"\n  }\n}\\n\n\n0.6716470718383789\na-&gt;s db 01 00 00 | fa 00 00 00 | 01 00 00 00 | 25 27 00 00 | 00 00 00 00\n{\n  \"version\": \"1.0\",\n  \"control\": {\n    \"targetId\": \"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\": \"3\",\n    \"broadcast\": \"0\"\n  },\n  \"value\": {\n    \"noteCmd\": \"102\",\n    \"workState\": \"2\",\n    \"workMode\": \"0\",\n    \"fan\": \"2\",\n    \"direction\": \"0\",\n    \"brush\": \"2\",\n    \"battery\": \"100\",\n    \"voice\": \"2\",\n    \"error\": \"0\",\n    \"standbyMode\": \"1\",\n    \"waterTank\": \"40\",\n    \"clearComponent\": \"0\",\n    \"waterMark\": \"0\",\n    \"version\": \"3.11.416(513)\",\n    \"attract\": \"0\",\n    \"deviceIp\": \"192.168.18.3\",\n    \"devicePort\": \"8888\",\n    \"cleanGoon\": \"2\",\n    \"extParam\": \"{\\\"cleanModule\\\":\\\"3\\\"}\"\n  }\n}\n\n0.8249011039733887\na-&gt;s bc 01 00 00 | 18 00 00 00 | 01 00 00 00 | 20 00 00 00 | 00 00 00 00\n{\n  \"version\": \"1.0\",\n  \"control\": {\n    \"targetId\": \"0\",\n    \"targetType\": \"6\",\n    \"broadcast\": \"0\"\n  },\n  \"value\": {\n    \"noteCmd\": \"102\",\n    \"workState\": \"4\",\n    \"workMode\": \"0\",\n    \"fan\": \"1\",\n    \"direction\": \"0\",\n    \"brush\": \"2\",\n    \"battery\": \"100\",\n    \"voice\": \"2\",\n    \"error\": \"0\",\n    \"standbyMode\": \"1\",\n    \"waterTank\": \"40\",\n    \"clearComponent\": \"0\",\n    \"waterMark\": \"0\",\n    \"version\": \"3.11.416(513)\",\n    \"attract\": \"0\",\n    \"deviceIp\": \"192.168.18.3\",\n    \"devicePort\": \"8888\",\n    \"cleanGoon\": \"2\",\n    \"extParam\": \"{\\\"cleanModule\\\":\\\"3\\\"}\"\n  }\n}\n\n0.8965139389038086\ns-&gt;a 3c 00 00 00 | 19 00 c8 00 | 01 00 00 00 | 20 00 00 00 | 01 00 00 00\n{\n  \"msg\":\"OK\",\n  \"result\":0,\n  \"version\":\"1.0\"\n}\\n\n\n2.895132064819336\na-&gt;s 83 01 00 00 | 14 00 00 00 | 01 00 00 00 | 21 00 00 00 | 00 00 00 00\n{\n  \"version\": \"1.0\",\n  \"control\": {\n    \"targetId\": \"0\",\n    \"targetType\": \"6\",\n    \"broadcast\": \"0\"\n  },\n  \"value\": {\n    \"noteCmd\": \"101\",\n    \"clearArea\": \"0\",\n    \"clearTime\": \"15\",\n    \"clearSign\": \"2020-06-24-01-31-41-2\",\n    \"clearModule\": \"0\",\n    \"isFinish\": \"0\",\n    \"chargerPos\": \"49,49\",\n    \"extParam\": \"{\\\"fan\\\":\\\"1\\\",\\\"waterTank\\\":\\\"40\\\",\\\"mode\\\":\\\"0\\\"}\",\n    \"map\": \"AAAAAAAAZABk0vwAaoDXAGpA1wBqgNcAqNL8AA==\",\n    \"track\": \"AQAEADIxMzExMTEy\"\n  }\n}\n\n2.9380459785461426\ns-&gt;a d1 00 00 00 | fa 00 c8 00 | 00 00 09 01 | 27 27 00 00 | 00 00 00 00\n{\n  \"cmd\":0,\n  \"control\":{\n    \"authCode\":\"yyyyyy\",\n    \"deviceIp\":\"192.168.18.3\",\n    \"devicePort\":\"8888\",\n    \"targetId\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\":\"3\"\n  },\n  \"seq\":0,\n  \"value\":{\n    \"transitCmd\":\"131\"\n  }\n}\\n\n\n3.048809051513672\na-&gt;s 64 01 00 00 | fa 00 00 00 | 01 00 00 00 | 27 27 00 00 | 00 00 00 00\n{\n  \"version\": \"1.0\",\n  \"control\": {\n    \"targetId\": \"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\": \"3\",\n    \"broadcast\": \"0\"\n  },\n  \"value\": {\n    \"transitCmd\": \"132\",\n    \"doTime\": \"643\",\n    \"clearArea\": \"0\",\n    \"clearTime\": \"15\",\n    \"clearModule\": \"0\",\n    \"clearSign\": \"2020-06-24-01-31-41-2\",\n    \"chargerPos\": \"49,49\",\n    \"map\": \"AAAAAAAAZABk0vwAaoDXAGpA1wBqgNcAqNL8AA==\",\n    \"track\": \"AQAEADIxMzExMTEy\"\n  }\n}\n\n7.939983129501343\ns-&gt;a d1 00 00 00 | fa 00 c8 00 | 00 00 09 01 | 2a 27 00 00 | 00 00 00 00\n{\n  \"cmd\": 0,\n  \"control\": {\n    \"authCode\": \"yyyyyy\",\n    \"deviceIp\": \"192.168.18.3\",\n    \"devicePort\": \"8888\",\n    \"targetId\": \"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\": \"3\"\n  },\n  \"seq\": 0,\n  \"value\": {\n    \"transitCmd\": \"131\"\n  }\n}\\n\n\n8.04991602897644\na-&gt;s 6c 01 00 00 | fa 00 00 00 | 01 00 00 00 | 2a 27 00 00 | 00 00 00 00\n{\n  \"version\": \"1.0\",\n  \"control\": {\n    \"targetId\": \"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\": \"3\",\n    \"broadcast\": \"0\"\n  },\n  \"value\": {\n    \"transitCmd\": \"132\",\n    \"doTime\": \"648\",\n    \"clearArea\": \"0\",\n    \"clearTime\": \"20\",\n    \"clearModule\": \"0\",\n    \"clearSign\": \"2020-06-24-01-31-41-2\",\n    \"chargerPos\": \"50,50\",\n    \"map\": \"AAAAAAAAZABk0vwAaoDXAGpA1wBqgNcAqNL8AA==\",\n    \"track\": \"AQAGADIxMzExMTEyMjIyMQ==\"\n  }\n}\n\n12.952444076538086\ns-&gt;a d1 00 00 00 | fa 00 c8 00 | 00 00 09 01 | 2c 27 00 00 | 00 00 00 00\n{\n  \"cmd\": 0,\n  \"control\": {\n    \"authCode\": \"yyyy\",\n    \"deviceIp\": \"192.168.18.3\",\n    \"devicePort\": \"8888\",\n    \"targetId\": \"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\": \"3\"\n  },\n  \"seq\": 0,\n  \"value\": {\n    \"transitCmd\": \"131\"\n  }\n}\\n\n\n13.123134136199951\na-&gt;s 70 01 00 00 | fa 00 00 00 | 01 00 00 00 | 2c 27 00 00 | 00 00 00 00\n{\n  \"version\": \"1.0\",\n  \"control\": {\n    \"targetId\": \"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\",\n    \"targetType\": \"3\",\n    \"broadcast\": \"0\"\n  },\n  \"value\": {\n    \"transitCmd\": \"132\",\n    \"doTime\": \"653\",\n    \"clearArea\": \"0\",\n    \"clearTime\": \"25\",\n    \"clearModule\": \"0\",\n    \"clearSign\": \"2020-06-24-01-31-41-2\",\n    \"chargerPos\": \"50,48\",\n    \"map\": \"AAAAAAAAZABk0vwAaoDXAGpA1wBqgNcAqNgABdLjAA==\",\n    \"track\": \"AQAHADIxMzExMTEyMjIyMTIz\"\n  }\n}\n\n13.785572052001953\na-&gt;s bc 01 00 00 | 18 00 00 00 | 01 00 00 00 | 22 00 00 00 | 00 00 00 00\n{\n  \"version\": \"1.0\",\n  \"control\": {\n    \"targetId\": \"0\",\n    \"targetType\": \"6\",\n    \"broadcast\": \"0\"\n  },\n  \"value\": {\n    \"noteCmd\": \"102\",\n    \"workState\": \"5\",\n    \"workMode\": \"0\",\n    \"fan\": \"2\",\n    \"direction\": \"0\",\n    \"brush\": \"2\",\n    \"battery\": \"100\",\n    \"voice\": \"2\",\n    \"error\": \"0\",\n    \"standbyMode\": \"1\",\n    \"waterTank\": \"40\",\n    \"clearComponent\": \"0\",\n    \"waterMark\": \"0\",\n    \"version\": \"3.11.416(513)\",\n    \"attract\": \"0\",\n    \"deviceIp\": \"192.168.18.3\",\n    \"devicePort\": \"8888\",\n    \"cleanGoon\": \"2\",\n    \"extParam\": \"{\\\"cleanModule\\\":\\\"3\\\"}\"\n  }\n}\n\n13.849518060684204\ns-&gt;a 3c 00 00 00 | 19 00 c8 00 | 01 00 00 00 | 22 00 00 00 | 01 00 00 00\n{\n  \"msg\":\"OK\",\n  \"result\":0,\n  \"version\":\"1.0\"\n}\\n<\/pre>\n\n\n\n<p>Y, efectivamente, el comando es el 104. \u00bfSer\u00e1n pares todos los comandos?<\/p>\n\n\n\n<p>Adem\u00e1s, parece que cuando la aspiradora ha llegado al cargador, emite autom\u00e1ticamente una trama para indicarlo (la del instante de tiempo 13.785572052001953). Tambi\u00e9n vemos que el servidor env\u00eda repetidamente el comando 131 durante el trayecto, lo que parece confirmar que, efectivamente, se utiliza para pedir la posici\u00f3n y estado de la aspiradora mientras se est\u00e1 moviendo.<\/p>\n\n\n\n<p>Y con esto ya est\u00e1n analizados los tres comandos m\u00e1s importantes. En la pr\u00f3xima entrega intentar\u00e9 enviar yo mis propios comandos haci\u00e9ndome pasar por el servidor, y en la cuarta espero analizar\u00e9 el resto de comandos: selecci\u00f3n del modo de aspirado, potencia del motor, fregona y control manual.<\/p>\n\n\n\n<figure class=\"wp-block-video aligncenter meme\"><video height=\"190\" style=\"aspect-ratio: 258 \/ 190;\" width=\"258\" controls src=\"https:\/\/blog.rastersoft.com\/wp-content\/uploads\/2020\/06\/thatsallfolks.mp4\"><\/video><\/figure>\n\n\n\n<p><a href=\"https:\/\/blog.rastersoft.com\/?p=2428\">Parte 3<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Actualizado: varios comandos de servidor a aspiradora terminaban con un LF. A\u00f1adidos. DISCLAIMER: no ser\u00e9 responsable si alguien decide seguir mis pasos y se carga su aspiradora. En principio todo lo que cuento deber\u00eda ser seguro, pero por motivos obvios no me puedo responsabilizar de lo que hagan otras personas, s\u00f3lo de lo que haga &hellip; <a href=\"https:\/\/blog.rastersoft.com\/?p=2404\" class=\"more-link\">Seguir leyendo <span class=\"screen-reader-text\">A ritmo de conga (2)<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,16,7],"tags":[],"class_list":["post-2404","post","type-post","status-publish","format-standard","hentry","category-cacharreo","category-opendonita","category-tutoriales"],"_links":{"self":[{"href":"https:\/\/blog.rastersoft.com\/index.php?rest_route=\/wp\/v2\/posts\/2404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.rastersoft.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.rastersoft.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.rastersoft.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.rastersoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2404"}],"version-history":[{"count":26,"href":"https:\/\/blog.rastersoft.com\/index.php?rest_route=\/wp\/v2\/posts\/2404\/revisions"}],"predecessor-version":[{"id":2594,"href":"https:\/\/blog.rastersoft.com\/index.php?rest_route=\/wp\/v2\/posts\/2404\/revisions\/2594"}],"wp:attachment":[{"href":"https:\/\/blog.rastersoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.rastersoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.rastersoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}