Broadlink SP4M-US Integration #63853

spencerthayer · 2022-01-10T19:59:01Z

The problem

The problem is that the Broadlink SP4M-US use FastCon™ Bridging which is just a proprietary mesh network for Broadlink devices. According to Broadlink's documentation FastCon works as follows.

BroadLink 4th gen smart plugs support FastCon™ Bridging which allows
devices building their own sub networks with one of them acting as
master and others as clients to minimize the connection load of Wi-Fi
router. When the device was added in the network. It will look for
better network routes in 1-2 minutes and may join a sub network.

This causes issues with the existing Homeassistant integration since we cannot access the switches via their IP address. The following forum posts go into greater detail.

Is it, or could it be possible, to access and control the SP4M-US over the FastCon "sub network" via the device MAC address? It is worth noting that for all users at least one SP4M-US, functioning as the hub for FastCon, does connect to Homeassistant.

What version of Home Assistant Core has the issue?

core-2021.11.5

What was the last working version of Home Assistant Core?

core-2021.11.5

What type of installation are you running?

Home Assistant OS

Integration causing the issue

Broadlink

Link to integration documentation on our website

https://www.home-assistant.io/integrations/broadlink#switch

Additional information

The advised hack were users disconnect the each SP4M-US from the internet via the router to prevent FastCon does not work for the latest SP4M-US firmware and as of this posting there is no existing work around.

probot-home-assistant · 2022-01-10T19:59:04Z

broadlink documentation
broadlink source
_{^{(message by IssueLinks)}}

probot-home-assistant · 2022-01-10T19:59:07Z

Hey there @Danielhiversen, @felipediel, @L-I-Am, mind taking a look at this issue as it has been labeled with an integration (broadlink) you are listed as a code owner for? Thanks!
_{^{(message by CodeOwnersMention)}}

spencerthayer · 2022-01-19T07:17:49Z

Anything y'all?

OMVMMG · 2022-03-08T22:21:50Z

Has anyone managed to get the current and power sensors working? Plugs are active using different accounts to avoid the mesh issue but neither provide data for sensors even though the sensors are recognised by Home Assistant.

felipediel · 2022-03-20T00:31:29Z

Hi. We are adding support for the FastCon technology: mjg59/python-broadlink#669.

Could you help with tests? I don't have the device.

spencerthayer · 2022-03-21T16:25:05Z

@felipediel absolutely I'll help. @OMVMMG if you can contribute too that would be awesome.

OMVMMG · 2022-03-21T22:56:53Z

@spencerthayer Happy to help. Please let me know.

felipediel · 2022-03-21T23:31:53Z

Awesome, thanks! Instructions: mjg59/python-broadlink#669 (comment)

megabitus98 · 2022-05-05T03:41:35Z

Hi. Any update here?

spencerthayer · 2022-05-05T16:09:35Z

@megabitus98 they are working on it mjg59/python-broadlink#669 (comment)

github-actions · 2022-08-03T17:07:49Z

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.
Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍
This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

spencerthayer · 2022-08-03T17:56:18Z

Unless I've missed it, this issue still isn't resolved. Please keep it open.

issue-triage-workflows · 2023-01-11T19:06:48Z

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.
Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍
This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

felipediel · 2023-01-11T19:18:02Z

Let's keep it open, please. We still need to find a way to discover the subdevices. I don't have time to dedicate to this right now, any help would be appreciated.

felipediel · 2023-01-11T19:23:38Z

/still valid

TanTrungNguyen · 2023-04-10T18:37:32Z

felipediel,

Are you using the DID (device unique identifier) with the SDK dnaControl after AddDevice?
https://docs.ibroadlink.com/public/appsdk_en/appsdk_05/#api10
See section 2.7.5

felipediel · 2023-04-10T19:10:54Z

We don't use the sdk, but we have something similar. Our struggle is one step before addDevice, the question is how to discover the subdevices?

They possibly come in the end of the payload when we discover the master, I just don't have any FastCon device to confirm.

TanTrungNguyen · 2023-04-10T19:53:59Z

I have 3 SP4M-US that I can control from the Broadlink App.
None of them have sub device identified from the Broadlink App.

Trying the code

import broadlink as blk
device = blk.hello("192.168.0.16") # Example IP address
device.auth()
subdevices = device.get_subdevices()
did = subdevices[0].get("did")
device.get_state(did)
device.set_state(did, pwr=1)
device.set_state(did, pwr=0)
But it fails at device.get_subdevices() saying get_subdevices does not exist

Since I know the DID for each of my device from the Broadlink App
Could you use the DID directly in the get_state and set_state?

{"Device own info":{"DID":"00000000000000000000a043b0d5c527","Data Cloud":"American server","Device IP":"192.168.2.110@80","Firmware":"v57218","IoT Cloud":"American server","MAC":"a0:43:b0:d5:c5:27","PID":"0000000000000000000000008b640000","Plug-in version":"1.5.6","Routine traits":"Trigger and action","S/N code":"","SDK":"2.16.35"}}

Kinetic69 · 2023-05-01T07:25:33Z

We don't use the sdk, but we have something similar. Our struggle is one step before addDevice, the question is how to discover the subdevices?

They possibly come in the end of the payload when we discover the master, I just don't have any FastCon device to confirm.
@felipediel
Mate I'll send you some devices.

felipediel · 2023-05-01T19:53:35Z

@Kinetic69 Thanks mate, I appreciate your support, but I am not sure they make these plugs to my country's specifications, we have a very specific plug unfortunately. Could you run some code with your devices instead? They need to be FastCon enabled devices configured as subdevices of a master device.

These are 3 hypotheses I have based on how other Broadlink devices work:

Test 1 - Public discovery

import socket

def discover(ip_addr):
    conn = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    conn.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    conn.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
    conn.settimeout(10)
    packet = bytearray(0x30)
    packet[0x26] = 6
    checksum = sum(packet, 0xBEAF) & 0xFFFF
    packet[0x20:0x22] = checksum.to_bytes(2, "little")
    conn.sendto(packet, (ip_addr, 80))
    resp = conn.recvfrom(1024)
    conn.close()
    return resp

resp = discover("192.168.0.16")  # Example master device IP address
print(resp)

Test 2 - S2K-like discovery

import broadlink as blk
from broadlink import exceptions as e

def get_subdevices(device) -> dict:
    packet = bytearray(16)
    packet[0] = 0x06
    response = device.send_packet(0x6A, packet)
    e.check_error(response[0x22:0x24])
    payload = device.decrypt(response[0x38:])
    count = payload[0x4]
    subdevice_data = payload[0x6:]
    subdevices = [
        bytearray(subdevice_data[i * 83 : (i + 1) * 83])
        for i in range(len(subdevice_data) // 83)
    ]
    return {
        "count": count,
        "subdevices": [
            {
                "status": subdevice[0],
                "name": subdevice[4:26].decode().strip("\x00"),
                "type": subdevice[3],
                "order": subdevice[1],
                "serial": subdevice[26:30].hex(),
            }
            for subdevice in subdevices
            if any(subdevice[26:30])
        ],
    }

device = blk.hello("192.168.0.16")  # Example master device IP address
device.auth()
resp = get_subdevices(device)
print(resp)

Test 3 - S3-like discovery

import broadlink as blk
from broadlink import exceptions as e

def get_subdevices(device):
    state = {"count": 5, "index": 0}
    packet = device._encode(14, state)
    resp = device.send_packet(0x6A, packet)
    e.check_error(resp[0x22:0x24])
    return device._decode(resp)

device = blk.hello("192.168.0.16")  # Example master device IP address
device.auth()
resp = get_subdevices(device)
print(resp)

TanTrungNguyen · 2023-05-02T00:32:33Z

Test 1 - Public discovery response
(b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\xd0\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8bdl\x02\xa8\xc0e\xb1\xd5\xb0C\xa025739\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x01E\x9a\x9aE\x02\x00\x00\x00\x1c\xf1[E\xdf\x0b\x00\x00\x02\x00\xa0C\xb0\xb7iL\xa0C\xb0\xd5\xc5'", ('192.168.2.108', 80))

felipediel · 2023-05-02T00:45:45Z

Awesome, thanks a lot! We found something, possibily a subdevice in the end of the payload:

>>> r = b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\xd0\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8bdl\x02\xa8\xc0e\xb1\xd5\xb0C\xa025739\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x01E\x9a\x9aE\x02\x00\x00\x00\x1c\xf1[E\xdf\x0b\x00\x00\x02\x00\xa0C\xb0\xb7iL\xa0C\xb0\xd5\xc5'"
>>> r[0x80:].hex()
'459a9a45020000001cf15b45df0b00000200a043b0b7694ca043b0d5c527'

How many subdevices that you have? Do you recognize any mac address or product id in this string?

TanTrungNguyen · 2023-05-02T00:56:10Z

I have 3 devices with the following MAC
a0:43:b0:b7:69:4c
a0:43:b0:d5:c5:27
a0:43:b0:d5:b1:65
All 3 devices have as Device IP 192.168.2.108@80 but none has any sub device listed

felipediel · 2023-05-02T01:52:46Z

Making some progress... the third device is the master. The MAC addresses of the first two devices start from byte 18.

>>> r = b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\xd0\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8bdl\x02\xa8\xc0e\xb1\xd5\xb0C\xa025739\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x01E\x9a\x9aE\x02\x00\x00\x00\x1c\xf1[E\xdf\x0b\x00\x00\x02\x00\xa0C\xb0\xb7iL\xa0C\xb0\xd5\xc5'"
>>> b = r[0x80:]

>>> m1 = bytes.fromhex("a043b0b7694c")
>>> m2 = bytes.fromhex("a043b0d5c527")
>>> m3 = bytes.fromhex("a043b0d5b165")
>>> b.find(m1)
18
>>> b.find(m2)
24
>>> b.find(m3)
-1  # The third device is the master


>>> len(b)
30

# MAC address 1
>>> b[18:24].hex()
'a043b0d5c527'

# MAC address 2
>>> b[24:30].hex()
'a043b0d5c527'

# Unknown bytes
>>> b[:18].hex()
'459a9a45020000001cf15b45df0b00000200'

We still need to decode the first 18 bytes (unknown bytes). The first 4 bytes are the header:

>>> b[:4].hex()
'459a9a45'

Byte 4 to 8 is the number of devices in little-endian:

>>> int.from_bytes(b[4:8], 'little')
2

We still need to figure this out:

>>> b[8:18].hex()
'1cf15b45df0b00000200'

Do you recognize anything in this string? Do you know your product ids (devtype)? You can check them in the device info in the official app.

TanTrungNguyen · 2023-05-02T15:12:29Z

Don't recognize byte 8:18
Here is an export of the device info and the printscreen has the product ID

{"Device own info":{"DID":"00000000000000000000a043b0d5b165","Data Cloud":"American server","Device IP":"192.168.2.114@80","Firmware":"v57218","IoT Cloud":"American server","MAC":"a0:43:b0:d5:b1:65","PID":"0000000000000000000000008b640000","Plug-in version":"1.5.6","Routine traits":"Trigger and action","S/N code":"","SDK":"2.16.35"}}

Kinetic69 · 2023-05-03T05:34:17Z

Sorry I don't have any WiFi enabled BL globes, only FastCon BLE enabled which I'm trying to get working.

You don't have E27 or Bayonet globe sockets in Brazil?

ovionlogis · 2023-05-07T11:57:34Z

@felipediel I tried running the code on my environment and got similar results

>>> r = b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$\xd2\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x13%:\x8ba\x0bX\xa8\xc0\x915\x00\xb0C\xa0Smart Plug 2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00E\x9a\x9aE\x02\x00\x00\x00\xca\xd46RR\x0b\x00\x00\x02\x00\xa0C\xb0/\xf8\x19\xa0C\xb0\x00'\xfe"
>>> b = r[0x80:]

>>> b.hex()
'459a9a4502000000cad43652520b00000200a043b02ff819a043b00027fe'

MAC address 1

>>> b[18:24].hex()
'a043b02ff819'

MAC address 2

>>> b[24:30].hex()
'a043b00027fe'

Unknown bytes

>>> b[:18].hex()
'459a9a4502000000cad43652520b00000200'

This part is updated on every request

>>> b[8:12].hex()
'cad43652'

ovionlogis · 2023-05-07T12:23:41Z

@felipediel

Byte 16 to 18 is the number of devices in little-endian:

>>> int.from_bytes(b[16:18], 'little')
2

felipediel · 2023-05-07T19:32:32Z

@ovionlogis Thanks!

b[8:12] is probably a checksum. I tried adler32 and crc32, no one matched. b[12] possibly some kind of flag and b[13] marks the end of the metadata.

I think it's possible to ignore the metadata and go straight to the mac addresses. I wish we could retrieve the device type though, I think they send another packet after this to get the type.

@Kinetic69 Yes, but they are e27 110v. I think Broadlink only makes e27 220v or e26 110v.

Tdubs3 · 2023-06-21T01:47:42Z

Any chance I could assist in implementing this same approach via BLE? I have a GW4C hub that will control devices via the cloud but I really want all of this to live locally. I’m not super savvy in decoding but have the skills and hardware to hopefully push this integration into the BLE side of things too.

spencerthayer · 2023-07-14T04:53:03Z

I've put my Broadlink plugs in a box and forgot about them until one day I realized I threw them away. I am glad to see this issue getting some attention but at this point I think it is best for the Home Assistant enthusiast to stay away from Broad-link devices.

issue-triage-workflows · 2023-10-12T05:06:06Z

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.
Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍
This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

probot-home-assistant bot added the integration: broadlink label Jan 10, 2022

probot-home-assistant bot assigned Danielhiversen Jan 10, 2022

spencerthayer mentioned this issue Jan 10, 2022

Broadlink SP4M-US Integration #60669

Closed

github-actions bot added the stale label Aug 3, 2022

github-actions bot removed the stale label Aug 3, 2022

issue-triage-workflows bot added the stale label Jan 11, 2023

issue-triage-workflows bot removed the stale label Jan 11, 2023

issue-triage-workflows bot added the stale label Oct 12, 2023

issue-triage-workflows bot closed this as not planned Won't fix, can't repro, duplicate, stale Oct 22, 2023

github-actions bot locked and limited conversation to collaborators Nov 21, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Broadlink SP4M-US Integration #63853

Broadlink SP4M-US Integration #63853

spencerthayer commented Jan 10, 2022 •

edited

Loading

probot-home-assistant bot commented Jan 10, 2022

probot-home-assistant bot commented Jan 10, 2022

spencerthayer commented Jan 19, 2022

OMVMMG commented Mar 8, 2022

felipediel commented Mar 20, 2022

spencerthayer commented Mar 21, 2022

OMVMMG commented Mar 21, 2022

felipediel commented Mar 21, 2022

megabitus98 commented May 5, 2022

spencerthayer commented May 5, 2022

github-actions bot commented Aug 3, 2022

spencerthayer commented Aug 3, 2022 •

edited

Loading

issue-triage-workflows bot commented Jan 11, 2023

felipediel commented Jan 11, 2023

felipediel commented Jan 11, 2023

TanTrungNguyen commented Apr 10, 2023

felipediel commented Apr 10, 2023

TanTrungNguyen commented Apr 10, 2023

Kinetic69 commented May 1, 2023 •

edited

Loading

felipediel commented May 1, 2023 •

edited

Loading

TanTrungNguyen commented May 2, 2023

felipediel commented May 2, 2023

TanTrungNguyen commented May 2, 2023 •

edited

Loading

felipediel commented May 2, 2023 •

edited

Loading

TanTrungNguyen commented May 2, 2023 •

edited

Loading

Kinetic69 commented May 3, 2023

ovionlogis commented May 7, 2023

ovionlogis commented May 7, 2023

felipediel commented May 7, 2023 •

edited

Loading

Tdubs3 commented Jun 21, 2023

spencerthayer commented Jul 14, 2023

issue-triage-workflows bot commented Oct 12, 2023

Broadlink SP4M-US Integration #63853

Broadlink SP4M-US Integration #63853

Comments

spencerthayer commented Jan 10, 2022 • edited Loading

The problem

What version of Home Assistant Core has the issue?

What was the last working version of Home Assistant Core?

What type of installation are you running?

Integration causing the issue

Link to integration documentation on our website

Additional information

probot-home-assistant bot commented Jan 10, 2022

probot-home-assistant bot commented Jan 10, 2022

spencerthayer commented Jan 19, 2022

OMVMMG commented Mar 8, 2022

felipediel commented Mar 20, 2022

spencerthayer commented Mar 21, 2022

OMVMMG commented Mar 21, 2022

felipediel commented Mar 21, 2022

megabitus98 commented May 5, 2022

spencerthayer commented May 5, 2022

github-actions bot commented Aug 3, 2022

spencerthayer commented Aug 3, 2022 • edited Loading

issue-triage-workflows bot commented Jan 11, 2023

felipediel commented Jan 11, 2023

felipediel commented Jan 11, 2023

TanTrungNguyen commented Apr 10, 2023

felipediel commented Apr 10, 2023

TanTrungNguyen commented Apr 10, 2023

Kinetic69 commented May 1, 2023 • edited Loading

felipediel commented May 1, 2023 • edited Loading

Test 1 - Public discovery

Test 2 - S2K-like discovery

Test 3 - S3-like discovery

TanTrungNguyen commented May 2, 2023

felipediel commented May 2, 2023

TanTrungNguyen commented May 2, 2023 • edited Loading

felipediel commented May 2, 2023 • edited Loading

TanTrungNguyen commented May 2, 2023 • edited Loading

Kinetic69 commented May 3, 2023

ovionlogis commented May 7, 2023

MAC address 1

MAC address 2

Unknown bytes

This part is updated on every request

ovionlogis commented May 7, 2023

Byte 16 to 18 is the number of devices in little-endian:

felipediel commented May 7, 2023 • edited Loading

Tdubs3 commented Jun 21, 2023

spencerthayer commented Jul 14, 2023

issue-triage-workflows bot commented Oct 12, 2023

spencerthayer commented Jan 10, 2022 •

edited

Loading

spencerthayer commented Aug 3, 2022 •

edited

Loading

Kinetic69 commented May 1, 2023 •

edited

Loading

felipediel commented May 1, 2023 •

edited

Loading

TanTrungNguyen commented May 2, 2023 •

edited

Loading

felipediel commented May 2, 2023 •

edited

Loading

TanTrungNguyen commented May 2, 2023 •

edited

Loading

felipediel commented May 7, 2023 •

edited

Loading