Skip to content

Latest commit

 

History

History
99 lines (79 loc) · 3.03 KB

README.md

File metadata and controls

99 lines (79 loc) · 3.03 KB
Raw

AKWA Technologies / Leako water leak detectors MQTT bridge for Home Assistant

/!\ Base on reverse engineering for interoperability with Home Assistant /!\

Every information used come from public documentation or traffic interception using mitmproxy on my local network

Behaviour and Assumption:

  • Every minutes the controller do a Post request to https://app.akwatek.com/collect2.php
    • Controlling the valve remotely can take 1 minute to be real and another minute to have state feedback
  • This domain can be changed during the wifi configuration.
  • The controller validate the TLS server certificate without controlling the certificate chain
    • That means you have to present any certificate signed by a CA even a Self-signed CA, not a Self-signed server certificate
  • Port 443 seem to be hardcoded

Home Assistant Addon for Akwatek here

Features

  • Get sensors informations (leak and low battery)
  • Control the valve
  • Home Assistant MQTT Discovery
  • Passthrough mode, relay controller's calls to Akwatek Cloud

Envs

  • AMB_TLS_PORT default 443
  • AMB_MQTT_BROKER_PORT default 1883
  • AMB_MQTT_CLIENT_ID default akwatek
  • AMB_MQTT_BASE_TOPIC default akwatek
  • AMB_HASS_DISCOVERY_TOPIC default homeassistant
  • AMB_MQTT_BROKER_HOST
  • AMB_MQTT_USERNAME
  • AMB_MQTT_PASSWORD

example.png

Reverse engineering

Parsing the request payload

{
    "Itek_V1": {
        "Cont_status": "18041",
        "ID": "1213",
        "MAC_address": "BC:FF:4D:XX:XX:XX",
        "zone01-25": "1000000000000010000500000",
        "zone26-50": "1100000000000000100000000",
        "zone51-75": "00000000000000000000E0000",
        "zone76-100": "0000000000000000000000000"
    }
}

Fields:

  • Cont_status: hexadecimal value about the controller status
  • ID: it's seem a checksum/crc, I didn't succeed to reverse engineering
  • MAC_address: it's obvious, it's the mac adress of the esp32 used by the controller, it's also the identifier of the controller on app.akwatek.com
  • zone01-25: hexadecimal value of each zone

After multiple tests with different conditions, I success to identify most of the bits useful.

Cont_status

Example 18041

0001 1000 0000 0100 0001
  • first hex 0001 => Power status
  • second hex 1000 => Probably something related to the controller battery state
  • third hex 0000 => Alarm status, 0001 if triggered
  • fourth hex 0100 => not sure
  • fifth hex 0001 => valve status 0001 is open 0000 is close

zone01-25

each hex is a sensors, 0 means no sensors configured for this zone example of some values

1 => 0001
5 => 0101
9 => 1001
D => 1101
  • least significant bit, indicate there is en sensors configured, somethings like that
  • second bit, Lost of signal
  • third bit, Low battery status
  • fourth bit, Leak detection

Parsing the response payload

Standby response

{"Itek_V1":{"mess":"OK"}}

Valve action response to open the valve

{"Itek_V1":{"mess":"OK","valve":"1"}}