Cannot connect the device

[mateuszm7]

I try to set up new device but I'm getting:
[16/06/2024, 08:55:14] [GREE Air Conditioner] handleMessage - Package -> {"t":"dev","cid":"9424b8ba5436","bc":"00000000000000000000000000000000","brand":"gree","catalog":"gree","mac":"9424b8ba5436","mid":"10001","model":"gree","name":"","lock":0,"series":"gree","vender":"1","ver":"V2.0.0","ModelType":"32776","hid":"362001065279+U-WB05RT13V1.21.bin"} [16/06/2024, 08:55:16] [GREE Air Conditioner] Scan finished. [16/06/2024, 08:55:16] [GREE Air Conditioner] Warning: Device not bound: 9424b8ba5436 [9424b8ba5436 -- 192.168.100.22:7000]

is there anything that can be done to connect?

[mateuszm7]

I saw that this is related to new encryption method. Maybe this can help? home-assistant/core#109230 and RobHofmann/HomeAssistant-GreeClimateComponent#165

[eibenp]

This means that your AC unit is not supported at the moment. I am currently working on to support the new encryption method.
Unfortunately I do not have this type of GREE AC so I can't test my code. But I will publish beta versions and you can help me to test if it works.

[mateuszm7]

I will be happy to help!

[eibenp]

Thank You! I will tell you if beta is available.

[alexpanait]

@eibenp I have the same issue with a UE G09 BP Y24 and I'm available to test if you publish a beta.

[eibenp]

Thank You!

Can one of you capture network packets between an official GREE mobile app (GREE+ or EWPE Smart) and the AC unit with this issue?

[mateuszm7]

Hi @eibenp
I installed Gree+ on my mac and used Wireshark to capture packets. Please let me know if this is usable or I should capture in different way.

No.     Time           Source                Destination           Protocol Length Info
    396 10.947367      192.168.100.21        192.168.100.4         UDP      481    7000 → 54362 Len=439

Frame 396: 481 bytes on wire (3848 bits), 481 bytes captured (3848 bits) on interface en0, id 0
    Section number: 1
    Interface id: 0 (en0)
    Encapsulation type: Ethernet (1)
    Arrival Time: Jun 19, 2024 15:38:47.697079000 CEST
    UTC Arrival Time: Jun 19, 2024 13:38:47.697079000 UTC
    Epoch Arrival Time: 1718804327.697079000
    [Time shift for this packet: 0.000000000 seconds]
    [Time delta from previous captured frame: 0.000003000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 10.947367000 seconds]
    Frame Number: 396
    Frame Length: 481 bytes (3848 bits)
    Capture Length: 481 bytes (3848 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:udp:data]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: GreeElectric_ba:xx:xx (xx:xx:xx:xx:xx:xx), Dst: Apple_xx:xx:xx (xx:xx:xx:xx:xx:xx)
Internet Protocol Version 4, Src: 192.168.100.21, Dst: 192.168.100.4
User Datagram Protocol, Src Port: 7000, Dst Port: 54362
Data (439 bytes)

0000  7b 22 74 22 3a 22 70 61 63 6b 22 2c 22 69 22 3a   {"t":"pack","i":
0010  31 2c 22 75 69 64 22 3a 30 2c 22 63 69 64 22 3a   1,"uid":0,"cid":
0020  22 22 2c 22 74 63 69 64 22 3a 22 22 2c 22 70 61   "","tcid":"","pa
0030  63 6b 22 3a 22 4c 50 32 34 45 6b 30 4f 61 59 6f   ck":"LP24Ek0OaYo
0040  67 78 73 33 69 51 4c 6a 4c 34 50 67 4d 5a 58 39   gxs3iQLjL4PgMZX9
0050  6a 64 4d 46 35 41 7a 36 36 6a 78 2b 47 30 43 6d   jdMF5Az66jx+G0Cm
0060  4d 61 39 6c 4d 32 52 71 49 2f 4b 79 74 76 4a 33   Ma9lM2RqI/KytvJ3
0070  32 49 73 47 53 5a 58 72 4f 72 2b 4d 61 6b 56 7a   2IsGSZXrOr+MakVz
0080  7a 58 48 62 67 68 50 65 79 69 75 69 2f 67 69 52   zXHbghPeyiui/giR
0090  77 69 2f 32 32 50 31 4e 65 4a 53 62 68 79 6f 44   wi/22P1NeJSbhyoD
00a0  74 32 31 49 59 43 35 6e 6d 54 42 30 46 53 4e 43   t21IYC5nmTB0FSNC
00b0  74 47 53 51 43 71 2b 71 6d 69 52 6d 61 5a 6a 70   tGSQCq+qmiRmaZjp
00c0  52 77 75 4f 37 46 65 35 45 62 74 36 38 78 68 42   RwuO7Fe5Ebt68xhB
00d0  31 63 38 69 69 77 4b 6d 67 7a 4f 4e 43 48 45 49   1c8iiwKmgzONCHEI
00e0  4a 50 52 46 5a 7a 6a 4c 72 55 44 6b 68 76 4d 6a   JPRFZzjLrUDkhvMj
00f0  7a 33 32 79 56 4d 6b 4f 56 73 46 73 54 41 61 66   z32yVMkOVsFsTAaf
0100  7a 65 50 59 37 71 53 65 68 62 5a 49 68 73 62 47   zePY7qSehbZIhsbG
0110  36 43 6b 38 58 31 2b 47 42 41 45 71 45 74 64 78   6Ck8X1+GBAEqEtdx
0120  53 41 52 6d 64 48 7a 73 66 6c 30 68 56 37 43 51   SARmdHzsfl0hV7CQ
0130  4b 4d 79 55 4c 71 66 37 2b 77 48 71 44 66 32 6d   KMyULqf7+wHqDf2m
0140  7a 39 75 7a 4e 46 76 32 65 6a 51 50 70 6e 30 67   z9uzNFv2ejQPpn0g
0150  47 31 79 43 4d 44 72 63 71 47 64 48 32 64 5a 2f   G1yCMDrcqGdH2dZ/
0160  61 51 5a 4d 33 78 55 37 4e 72 6c 45 33 38 50 54   aQZM3xU7NrlE38PT
0170  37 55 7a 78 46 70 68 6a 74 46 6b 59 70 59 32 44   7UzxFphjtFkYpY2D
0180  76 31 42 34 34 4b 4b 52 59 6f 4f 46 42 55 4b 6b   v1B44KKRYoOFBUKk
0190  2b 45 2b 62 77 6b 4b 37 43 36 54 6e 76 4e 6f 4b   +E+bwkK7C6TnvNoK
01a0  73 48 36 62 4e 47 4d 65 42 6b 63 67 43 43 32 76   sH6bNGMeBkcgCC2v
01b0  76 49 71 56 36 22 7d                              vIqV6"}
    Data [truncated]: 7b2274223a227061636b222c2269223a312c22756964223a302c22636964223a22222c2274636964223a22222c227061636b223a224c503234456b304f61596f6778733369514c6a4c3450674d5a58396a644d4635417a36366a782b4730436d4d61396c4d325271492f4b7974764
    [Length: 439]

[eibenp]

Yes! This is exactly the information what I need. This format is acceptable for me. I only need the packet text: {"t":"pack"...} If it is easy to copy this part of the page then it is enough for me. (I need the direction of the packet also.)

First I need all packets sent to AC device and all responses received from AC device during the registration phase. (When you connect the app to the AC device for the first time). The main problem is, that the AC device did not sent a response after the original V1 packet. I need to know the content of the packets which have initialized the binding between the app and the AC device.

[mateuszm7]

In order to complete registration I need to remove my AC from Gree+ and reset WiFi settings on the AC device or I can just install an app on a different phone?

[eibenp]

Sorry, I do not know. 2024. jún. 19. dátummal, 16:10 időpontban mateuszm7 ***@***.***> írta: In order to complete registration I need to remove my AC from Gree+ and reset WiFi settings on the AC device or I can just install an app on a different phone? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[mateuszm7]

Okay, I removed the device from Gree+ and reset WiFi settings. Then I used Gree+ app on my mac to add the AC. I'm attaching all packages I captured. I think the connection started on Frame 659 (second in the file).
gree-connect.txt

[eibenp]

Thank You! At first glance, this seems to be what I need. I need some time to analyze the packets.

[eibenp]

Bad news: Some network packets are missing or this is a 3rd type of network communication.

Original V1 version and V2 version described in RobHofmann/HomeAssistant-GreeClimateComponent/pull/165 work the same way:

1. Send SCAN command (unencrypted)
2. AC device responds with information packet which is encrypted in V1 or V2 version using a predefined key
3. Send BIND REQUEST encrypted the same way as AC device response to SCAN command
4. AC device responds with device key
5. All other communication is encrypted using the key received in response to BIND REQUEST

Between your packets I do not see the SCAN command, but it is no problem because I see the response to the SCAN command. This is encrypted in V1 version using predefined key. (This is several times in your log, e.g. frame 3, 1294, 8761)
But I do not see the BIND REQUEST and the response to the BIND REQUEST also. These are the most important packets to reverse engineer the network protocol.
All other packets are encrypted using an unknown key (they are similar packets as described in step 5. above).

Could you check if there are some other packets when you register or connect the GREE+ app to the AC device? I am looking for the BIND REQUEST and the response to it. BIND REQUEST is sent from GREE+ to AC unit. The frame contains: "t":"pack" and "i":1 parts. If you see "i":0 in the frame then it is a step 5. frame which is not decryptable without the device key.

I tried to guess the missing packets. I have published a new beta version (2.1.0-beta.4) which tries to bind to the device using V2 encryption. If you install it we can see if it works or we can't go forward without the missing network packets.

[mateuszm7]

I don't know how else I can force AC to register to Gree+. Is there a way to easily find BIND REQUEST? I see few frames with "i": 1 and "t":"pack" but you listed them as SCAN command.

Good news is the beta version works! Here are the logs:
gree-hb.txt

[eibenp]

Great! It seems that your device works mixed. Information exchange uses V1 version but binding and all other communication use V2 version. I can go forward. I do not need the missing packets at the moment.

[eibenp]

Hi @alexpanait ,
I have published a beta which can solve the problem. Did you test the latest beta? Does it work with your AC?

[alexpanait]

Hi @alexpanait , I have published a beta which can solve the problem. Did you test the latest beta? Does it work with your AC?

Hey @eibenp, I was able to connect both of the ACs I own and they show up in Home app, the only issue I see is that I cannot set the fan speed, but maybe I'm missing something:

Thank you for the fast beta release, that was pretty cool!

[eibenp]

There is a gear icon in the bottom right corner. It opens settings page. You can set fan speed on settings page. Zero is off, minimum value is quiet, next value is auto, maximum value is turbo. All other values between them are exact fan speeds (3 or 5 steps depending on AC model)2024. jún. 22. dátummal, 23:46 időpontban Alex Panait ***@***.***> írta: Hi @alexpanait , I have published a beta which can solve the problem. Did you test the latest beta? Does it work with your AC? Hey @eibenp, I was able to connect both of the ACs I own and they show up in Home app, the only issue I see is that I cannot set the fan speed, but maybe I'm missing something: D1D03BE1-6675-48BE-9A04-D8E027217D97_4_5005_c.jpeg (view on web) —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[alexpanait]

@eibenp I was able to find the fan settings, it wasn't showing up initially because I had "Temperature sensor" option on. Besides that I haven't seen any issues so far, everything runs smoothly.

[eibenp]

@mateuszm7 @alexpanait
Issue #13 solved in version v2.1.0