about_tinytuya_message_payload_with_custom_tcp

[nguyenphangpmb2022]

i have a question in which how to send the message on custom tcp sender to tuya device
currently i have some tuya ir blaster, see their command log on tuya_cloud device log but i want to use it with other local tcp sender. so i wonder how to get the tcp message in which tiny_tuya send it (the one with the encryped_message (contain aes with key is equal to the local key,..) because i just want to use small tcp_some_specific_device_command.
looking for your message
thank you, sincerely

[jasonacox]

Hi @nguyenphangpmb2022 - some suggestions:

• Check the examples to see if you can find what you are looking to do: https://github.com/jasonacox/tinytuya/tree/master/examples
• For IR, check out https://github.com/jasonacox/tinytuya/blob/master/examples/Contrib/IRRemoteControlDevice-example.py
• For sending codes to Tuya devices see https://github.com/jasonacox/tinytuya?tab=readme-ov-file#tuya-data-points---dps-table

[nguyenphangpmb2022]

ah, thank you. i used the tinytuya to sent that "head-key" to tuya ir blaster and it work. But in my case, i want to use the node-red for easier container management as well as deployment. so i am figure it out how to sent raw tcp to tuya device with it. i am stuck on the way message is encrypted, currently searching on tuya protocol.

[uzlonewolf]

If you enable debug mode with tinytuya.set_debug(True) and then send a command it will show you the final TCP packet it's sending:

...
DEBUG:building command 10 payload=b'{"gwId":"...","devId":"...","uid":"...","t":"..."}'
DEBUG:payload encrypted=b'000055aa000000020000000a0000007845db78...932a33cb2200fc0000aa55'
...

That 'DEBUG:payload encrypted=' line is the TCP packet it sent.

[nguyenphangpmb2022]

If you enable debug mode with tinytuya.set_debug(True) and then send a command it will show you the final TCP packet it's sending:

...
DEBUG:building command 10 payload=b'{"gwId":"...","devId":"...","uid":"...","t":"..."}'
DEBUG:payload encrypted=b'000055aa000000020000000a0000007845db78...932a33cb2200fc0000aa55'
...

That 'DEBUG:payload encrypted=' line is the TCP packet it sent.

hi, i have another question: i want to port that encrypted message to javascript, so can i get the schematic of that pyca flow. is that "{command 7 payload=b'{"protocol":5,"t":1719194345,"data":{"dps":{"1":"false"}}}'} command message getting encrypted with aes "local key" to be final key message or another state because i see the "decrypting part"?.
thank you so much.
here is debug:

DEBUG:Python 3.8.19 (default, Apr 24 2024, 13:04:15)                                                                     [GCC 12.2.0] on linux                                                                                                    DEBUG:Using pyca/cryptography 42.0.5 for crypto, GCM is supported                                                        DEBUG:final payload_dict for 'eb6dd1a4452################' ('v3.4'/'default'): {1: {'command': {'gwId': '', 'devId': '', 'uid': '', 't': ''}}, 7: {'command': {'protocol': 5, 't': 'int', 'data': {}}, 'command_override': 13}, 8: {'command': {'gwId': '', 'devId': ''}}, 9: {'command': {'gwId': '', 'devId': ''}}, 10: {'command': {}, 'command_override': 16}, 13: {'command': {'protocol': 5, 't': 'int', 'data': {}}}, 16: {'command': {}}, 18: {'command': {'dpId': [18, 19, 20]}}, 64: {'command': {'reqType': '', 'data': {}}}}
DEBUG:building command 7 payload=b'{"protocol":5,"t":1719194345,"data":{"dps":{"1":"false"}}}'
DEBUG:sending payload quick
DEBUG:final payload: b'0123456789abcdef'
DEBUG:payload encrypted=b'000055aa000000010000000300000044a2496caf5f143be9df085af9441d00b1ae79b0f7cf8e0bb36ffd0f3d27f6f780880ede900040fb6c7ea59c7fb5f93509d4b535f36715c54000d7396537ab5eee0000aa55'
DEBUG:received data=b'000055aa0000800f0000000400000068000000003d3ac902b272634b16229e959843c14079429f48ba6d14c7b53e583c296c6626f14b8a875521c82324c60b7cbe72f1f5ae79b0f7cf8e0bb36ffd0f3d27f6f78021074949c71286c0bd17b309d57bfe15a96ef5702169bd5af263e44944d660cd0000aa55'
DEBUG:decrypting=b'=:\xc9\x02\xb2rcK\x16"\x9e\x95\x98C\xc1@yB\x9fH\xbam\x14\xc7\xb5>X<)lf&\xf1K\x8a\x87U!\xc8#$\xc6\x0b|\xber\xf1\xf5\xaey\xb0\xf7\xcf\x8e\x0b\xb3o\xfd\x0f=\'\xf6\xf7\x80'
DEBUG:decrypted session key negotiation step 2 payload=b'693fa4b830ed05c5|\x8f\xa7r\xa3\x04\xcf4\xd4\xb3\xfd\xb2\xebv\xf1\xe9B$\x9f\xa6\xe5\x90r<T\xb32\x07S\xb57\xa8'
DEBUG:payload type = <class 'bytes'> len = 48
DEBUG:session local nonce: b'0123456789abcdef' remote nonce: b'693fa4b830ed05c5'
DEBUG:sending payload quick
DEBUG:final payload: b'M3\xb2\xe3ZM\x00\xfe\x196&\xaf\xd4\x7f\xb4\xde\x19\xdc\xedhUm\x93\x97U\x8a\xa3\t\xfdj\xc7\x98'
DEBUG:payload encrypted=b'000055aa000000020000000500000054f45ec002eabbb1beb2a55ccc25187e6ce43f8094003d646260bfa23e29ffb84eae79b0f7cf8e0bb36ffd0f3d27f6f780211594bcc44696f9779287b746da1be2fcd1a37f95619a6146ca854269fd608d0000aa55'
DEBUG:Session nonce XOR'd: b'\x06\x08\x01UU\x01T\x0f\x0b\t\x04\x06SQ\x06S'
DEBUG:Session key negotiate success! session key: b'\xc0%\x01\xad\xd1\t!R`&]\xbc;!\t\xc9'
DEBUG:sending payload
DEBUG:final payload: b'3.4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{"protocol":5,"t":1719194345,"data":{"dps":{"1":"false"}}}'
DEBUG:payload encrypted=b'000055aa000000030000000d000000744e84785692cd49c4a4732e65e3962b85d25c587f9c5ef9ff9c55c6b1a8c78c8bffa8a419349871eea118b52d4a06a5919549d37bbbb7b6eb35a0b03bb758abb604d1619a71632e9689a95c795734e2a70c09d677309eb32f334effefdf963e123b775760778ad8cdc2b9d6b83b238dda0000aa55'

[jasonacox]

Hi @nguyenphangpmb2022 - You can take a look at the source code to see how to build the payload for the different device version, however, you may also want to look at https://github.com/codetheweb/tuyapi which is JS based library that may be easier for you to port for a JS project.

[nguyenphangpmb2022]

Hi @nguyenphangpmb2022 - You can take a look at the source code to see how to build the payload for the different device version, however, you may also want to look at https://github.com/codetheweb/tuyapi which is JS based library that may be easier for you to port for a JS project.

i did search for tuyapi but it not work with ir blaster. It work with other tuya like swith,light,,,,,stuff too but not with ir but when i sent raw command from tinytuya it worked. One question from source code of tinytuya, in this debug log:

DEBUG:final payload: b'0123456789abcdef'
DEBUG:payload encrypted=b'000055aa000000010000000300000044a2496caf5f143be9df085af9441d00b1ae79b0f7cf8e0bb36ffd0f3d27f6f780880ede900040fb6c7ea59c7fb5f93509d4b535f36715c54000d7396537ab5eee0000aa55'
DEBUG:received data=b'000055aa0000800f0000000400000068000000003d3ac902b272634b16229e959843c14079429f48ba6d14c7b53e583c296c6626f14b8a875521c82324c60b7cbe72f1f5ae79b0f7cf8e0bb36ffd0f3d27f6f78021074949c71286c0bd17b309d57bfe15a96ef5702169bd5af263e44944d660cd0000aa55'
DEBUG:decrypting=b'=:\xc9\x02\xb2rcK\x16"\x9e\x95\x98C\xc1@yB\x9fH\xbam\x14\xc7\xb5>X<)lf&\xf1K\x8a\x87U!\xc8#$\xc6\x0b|\xber\xf1\xf5\xaey\xb0\xf7\xcf\x8e\x0b\xb3o\xfd\x0f=\'\xf6\xf7\x80'
DEBUG:decrypted session key negotiation step 2 payload=b'693fa4b830ed05c5|\x8f\xa7r\xa3\x04\xcf4\xd4\xb3\xfd\xb2\xebv\xf1\xe9B$\x9f\xa6\xe5\x90r<T\xb32\x07S\xb57\xa8'
DEBUG:payload type = <class 'bytes'> len = 48
DEBUG:session local nonce: b'0123456789abcdef' remote nonce: b'693fa4b830ed05c5'
DEBUG:sending payload quick
DEBUG:final payload: b'M3\xb2\xe3ZM\x00\xfe\x196&\xaf\xd4\x7f\xb4\xde\x19\xdc\xedhUm\x93\x97U\x8a\xa3\t\xfdj\xc7\x98'
DEBUG:payload encrypted=b'000055aa000000020000000500000054f45ec002eabbb1beb2a55ccc25187e6ce43f8094003d646260bfa23e29ffb84eae79b0f7cf8e0bb36ffd0f3d27f6f780211594bcc44696f9779287b746da1be2fcd1a37f95619a6146ca854269fd608d0000aa55'
DEBUG:Session nonce XOR'd: b'\x06\x08\x01UU\x01T\x0f\x0b\t\x04\x06SQ\x06S'
DEBUG:Session key negotiate success! session key: b'\xc0%\x01\xad\xd1\t!R`&]\xbc;!\t\xc9'
DEBUG:sending payload
DEBUG:final payload: b'3.4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{"protocol":5,"t":1719194345,"data":{"dps":{"1":"false"}}}'
DEBUG:payload encrypted=b'000055aa000000030000000d000000744e84785692cd49c4a4732e65e3962b85d25c587f9c5ef9ff9c55c6b1a8c78c8bffa8a419349871eea118b52d4a06a5919549d37bbbb7b6eb35a0b03bb758abb604d1619a71632e9689a95c795734e2a70c09d677309eb32f334effefdf963e123b775760778ad8cdc2b9d6b83b238dda0000aa55'

there are atleast 2 step. i wonder is it [ "First step: getting iv from "this _AEScipher_Base.def get_encryption_iv( ) and then encrypt at secondary step at _AESCipher_PyCrypto.encrypt() on my specific tuya v3.4 version" "] or is it the first step and after that chained to other same procedure for decrypt and reencrypt. i saw this debug log "DEBUG:session local nonce: b'0123456789abcdef' remote nonce: b'693fa4b830ed05c5'" so i wonder that path "b'693fa4b830ed05c5" should come from somewhere like aes the current time with local-key or...... and ofc i am confusing about key negotiate like this key on debug log "b'\xc0%\x01\xad\xd1\t!R`&]\xbc;!\t\xc9'". where it come from, is it come from the encrypted with the previous key like this one ("b'693fa4b830ed05c5") and is it the key to re-encrypt the final message ("final payload: b'3.4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{"protocol":5,"t":1719194345,"data":{"dps":{"1":"false"}}}'"). to be the last enrypted message.
thank you for your help

[jasonacox]

@uzlonewolf has done a good job trying to capture the protocols here: #260 and related tools here: https://github.com/jasonacox/tinytuya/tree/master/tools

We would love to have additional documentation to help explain the protocol. If you have any ideas, please post here or provide a PR. I do hope the links help.

[uzlonewolf]

Yes, v3.4 and v3.5 devices require a 3-way handshake to negotiate a session key every time a TCP connection is made.

1. The client (TinyTuya) sends the device a nonce.
2. The device responds with its own nonce.
3. The client hashes the device nonce and sends it back to the device.

I collected some protocol notes which may help in implementing a packet parser over at #260

[MarkCupitt]

That is very impressive .. As I develop my use case, anything I find I will also share with you guys Regards Mark Cupitt "Never give up .. its the end if you do .. find a way .. dig deep .." "If we change the world, let it bear the mark of our intelligence"

…

On Tue, Jun 25, 2024 at 10:59 AM Jason Cox ***@***.***> wrote: @uzlonewolf <https://github.com/uzlonewolf> has done a good job trying to capture the protocols here: #260 <#260> and related tools here: https://github.com/jasonacox/tinytuya/tree/master/tools We would love to have additional documentation to help explain the protocol. If you have any ideas, please post here or provide a PR. I do hope the links help. — Reply to this email directly, view it on GitHub <#509 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABJ7RUAEUYODK54K5MTI3NDZJDMIBAVCNFSM6AAAAABJVQY4XOVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TQNRWGQYDA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>