Getting data directly from communication module and not from eModul.eu

[martinsefcik]

Did somebody try to catch and understand TCP communication from Tech Wifi module (5060RS) to emodul.eu servers? Or do you have idea what kind of RS communication (232, 485?) are they using for communication between L-7, M-7 and 5060RS module?

I would like to get data directly within local environment (in local network) and not from online emodul.eu servers. It looks to me as another point of failure if data is downloaded from emodul servers and also in case if internet connection is lost then no data are received.

[jontofront]

It good idea. I have long freezes...

[mchlrv]

Recently I tried to get data out using a USB RS-485. I was able to see some data but is was all scrambled up. As this is the first time that I try to sniff RS-485 it might be due to my lack of skills in this area.

[martinsefcik]

@mchlrv Are you sure tech controllers is using RS-485? Can you explain how you connect it?

[mchlrv]

No I'm not sure it is using RS-485 but since I have a RS-485 to USB dongle I thought to give it a try. Also their EU-L-X WiFi is using RS-485 https://tech-controllers.com/p/eu-l-x-wifi using the same two connections.

I've contacted TECH and they told me the following: "There is our dedicated RS-285" which they use with their controllers.

If someone with better skills in this area has some ideas please contact me as I'm more than happy to test.

[martinsefcik]

Are you sure it is RS-285 and not RS-232 ? I never heard about RS-285, but I'm not skilled in this area too.

[mchlrv]

Are you sure it is RS-285 and not RS-232 ? a never heard about RS-285, but I'm not skilled in this area too.

That is what they have told me too. However I have also never heard of RS-285 nor find any reference of it. I think it might be decoded RS-232 and that is why they call it RS-285.

[nepozs]

RS232 and RS485 (not 285 - it must be some misunderstanding) are completely different hardware interfaces
RS232 uses voltage levels and needs at least 3 wires Tx, Rx and GND (+eventually 5 additional control signals) and can be used over relatively short distances.
RS485 needs only 2 wires and it is current loop and can be used over relatively long distances, so it is popular in home automation and in industrial installations.

Every hardware serial interface can be used with many different protocols - most used in home automation is modbus, which can be sent over RS232 or over RS485, so I think Tech just uses different protocol or modified modbus.

[norbi771]

I was just wondering if communication module uses https for the communication with emodul.eu.
If not, the easiest way could be to use "man in the middle" attack. Overwrite the DNS in LAN and have own server in LAN that would behave like the emodule.eu

[martinsefcik]

It communicates using TCP with server.

[martinsefcik]

I was not able to identify the protocol. E.g. if I set zone name for the same zone twice to the same value it is sent to the server always in packets with different content.

[norbi771]

it is probably signed with a timestamp or something time based

[norbi771]

I think I forced talking to my web server, but it was just a super simple test server (RebexTinyWebServer) and has some issues with TLS. Tomorrow I will setup proxy with nginx and have the module to talk to real server. Then maybe I will see something interesting in logs. I wish that even they use https they do not check certificate depth and similar matters ... we will see.

Alternatively there is a chance that we can read something directly from the board. A few days ago I saw somewhere a thread about that but cannot find it right now.
Another option is to replace tech main control module with something more DYI friendly. All I want is to connect existing infrastructure to my Home Assistant, but without the cloud.