Reverse engineering the leynew WF510 light bulb adapter

A few weeks ago I ordered some WF510 WIFI enabled E27 adapters. The WF510 is a device you place between your light fixture and your light bulb, that allows you to control the light with an iOS/Android app. At $56 per lot of 3, they’re the poor man connected light bulb.

WF510 adapters

The reason I bought those adapters was to see if I could find out how the app controls the device, and build a better (open source!) app or web service around that. I always wanted to get more experience with home automation and device control.

When the package arrived yesterday, I was quick to plug one of the devices in and fire up Wireshark to see what was happening. Here’s what I found out:

All communications to and from the device are  over UDP port 5000 (The app send its packets directly to 255.255.255.255:5000). The packets contain bits of comma separated text encoded around the ascii table. I’m not sure if this method of encoding is known and documented, or if it’s proprietary to the manufacturer, but it works like this:

  • Each column of 32 characters in the table is encoded separately (i.e ` through DEL, and @ to _ )
  • For each set, the first 4 characters are shifted 12 places ahead. So @ becomes L and a becomes m, and vice versa.
  • The next 4 characters are shifted 4 places ahead: d becomes h and g becomes k, and vice versa
  • Chars in positions 16 to 19 are shifted 12 places ahead as well. So p becomes | and P becomes \, and vice versa.
  • Chars in positions 20-23 are shifted 4 places ahead, so t becomes x and { becomes w

This took me a little while to figure out, but once I did the device no longer had any secrets for me.

Device setup:

To setup the device you connect to its own WIFI Access point (named WF510-MACADDRESS). You then sends it the credentials for your home network.
Here’s the translated exchange between the app and the device:

App:
search //knock knock, who's there

Device:
search,ACCF23022B80,leynew,WF510,room,\r\nOK-  // I'm ACCF23022B80, manufactured by leynew, model WF510, room(?)

App:
ACCF23022B80,setonoff,0,254, // can you turn off so I can see you

Device
setonoff,0\r\nOK- // sure

App
ACCF23022B80,setonoff,1,254, // and on again?

Device
setonoff,1\r\nOK- //sure

App
ACCF23022B80,setnet,{network ssid},{network password},WPA2PSK,AES, // Here's the network you need to connect to, with WPA2PSK security and AES encryption (possible values are also WPAPSK and TKIP respectively)

Device Control

Turn light off
ACCF23022B80,setbrightness,0,254,

Turn light on
ACCF23022B80,setbrightnes,100,254,

Dim light to 50%
ACCF23022B80,setbrightness,50,254,

What’s next?

I plan to build a library to control the devices – not sure about the stack I’m going to use, but it’s definitely going to be something I haven’t used before.

Making WordPress Better

Yesterday I helped someone write their first WordPress core bug report, and then someone else write their first patch to fix that bug.

It happened after I saw a thread in a Facebook group about an issue with WordPress 3.8.
Turns out this was a bug I was responsible for (doh!), but instead of just fixing it, I offered to tutor anyone interested in how to create a bug report and write their first patch.

Revital and Niv jumped on the offer, and so we chatted about how to test and confirm the bug, and how to write a good bug report. Then we followed with installing WordPress via SVN, running the new build process, and generating a patch.

WordPress just gained two new contributors, and this is probably the most meaningful thing I did all week.

Yair Lapid: Don’t bother protesting, we can’t hear you

I knew of course, that there were people protesting that we shouldn’t export our natural gas (I don’t want to hurt their democratic enthusiasm, but they should know that there isn’t any megaphone that can be heard in a cabinet meeting)

This is a translated excerpt from a Facebook status post by Israel’s Secretary of Finance, Yair Lapid.

What is he saying exactly? That it’s not worth protesting when a politician fails to be true to his promises? That we, as citizens, shouldn’t bother voice our discontent when the government sells the country’s limited natural resources for cheap, without proper discussion in parliament?

Douchebag.

Same Ikea product, 30 years apart

While going through my Mom’s old toolbox a few weeks ago, I found this:

Ikea Patrul, from around 1980

Probably from around 1980, it’s the Patrull drawer safety catch from Ikea. The funny thing is that just a couple days before that, I bought this:

ikea patrull 2013

Same product, 30 years later!

It’s so interesting to see the two products side by side: the differences in style, packaging, and in the product itself are really telling. For example, notice how the old packaging has a textual description in a few languages, which I guess made sense since Ikea was only active in Europe in the early 80’s. Imagine if the current packaging had a description for every country Ikea operates in now!

The plastic itself has evolved quite a bit too – it’s much thinner now. The current pack contains 5 units, while the old one only has 3 – and in a much smaller package.

Makes me wonder how that product would look 30 years from now.

And on that farm he had a hippopotamus!

I’m not sure what to think of this. Jonathan’s tractor toy has a hippo instead of a pig:

EE-I-EE-I-O

Here’s the original:
kidoozie fun time tractor

When you press the hippo, it still sounds like a pig though.

I guess we got the middle eastern version, pigs being considered impure and all.
I wonder if it’s also the version sold in large Seventh-Day Adventist communities.

%d bloggers like this: