Go Down

Topic: Lanbon Switch api? (Read 1 time) previous topic - next topic

sedative16

Does anyone know if there's any sort of documentation on an api for lanbon ( https://www.alibaba.com/product-detail/Lanbon-smart-switch-Wifi-controlled-big_60604636426.html ) switches?
They use wifi to communicate so i hope its not just another mqtt server in hong kong backing it up...

id8tech

Yes, I'd like to know also! I took one of their one gang switches apart but can't make out what chip they're using? A hint is that it can connect using 5GHz.. where as the Sonoff ESP based chips cannot.

amr002eg

Hi , I have the same problem , did you solve it?

mazenelhechi

Hi,

Did you find out what kind of chip is Lanbon using? I read somewhere that it is not the ESP8266?

I want to flash it and install my own program, any one has an idea?




jannewmarch

No documentation that I can find. However, using wireshark in promiscuous mode I have worked out some things. The switch will often talk to a server at 47.52.5.108. This has an Apache server, the home page is not set up, but some sub-page is. The messages are in HTTPS format, so without knowing the private key on that server I can't decode them. However, sometimes the phone app talks directly to the Lanbon switch, and then I can see the packets. Well, it doesn't actually talk directly, it broadcasts a UDP packet to 255.255.255.255 on port 8866. The packet has 31 bytes of data, a mixture of device identifier, the command and lots of noise. The device identifier seems to be in bytes 10 and 11 but is unrelated to the MAC address or to the switch identifier printed on the back of the switch, so I don't know how it is generated/stored. The command seems to be in bytes 5 and 12 but I haven't found any recognisable pattern yet. You can also download the apk code for the phone and disassemble it. The code is a mess, partly because symbolic constants, variable names and method names have been replaced by a, b, c, ... but also because the code looks a mess anyway! I've found where the packets are generated, in method b() of class b in some package, but haven't found where their parameters are set. Nevertheless, I can turn on/off some switches using Python code from my laptop now:

ADDR = '255.255.255.255'
PORT = 8866

frameDeskOn    = makeframe("aa21a010ae201504638602010021a01000000000000000000000
00000000000000")

def sendframe(frame):
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    s.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
    s.sendto(frame, (ADDR, PORT))
    s.close()
    print('Sent')
   
def main():
    sendframe(frameDeskOn)


if __name__ == '__main__':
    main()

jannewmarch

and here is the code for makeframe():

def makeframe(bytestr):
    frame = bytes.fromhex(bytestr)
    return frame

Go Up