Control functions have stopped responding to input

[Dazzzwaa]

Hi,
last week i have noticed the integration has stopped responding to input the magiqtouch display wont update to the value i set in Home assistant, however if i set it on magiqtouch controll it will update on Home assistant

see below information from the log
This error originated from a custom integration.

Logger: magiqtouch
Source: custom_components/magiqtouch/magiqtouch.py:274
Integration: Seeley MagIQtouch (documentation, issues)
First occurred: 8:40:15 PM (3 occurrences)
Last logged: 8:51:34 PM

Failed to set value properly:

[DeltaTangoLima]

Came here to open an issue for the very same thing - identical experience, and log entry. Definitely happened in the past week or so.

[AlexPotterOnGit]

+1 with the same issue

[roelfdiedericks]

+1 same issue with the same error log

[jmot205]

+1 same issue encountered here

[jmot205]

For additional context I have tried deleting and re-adding the HA air con entity and also confirmed that the air con system is still able to be controlled remotely through the Seeley Magiqtouch app.

[andrewleech]

Oh that really sucks. I noticed my control widget wasn't working the other day and just assumed I probably needed to restart something... It looks like the magiqtouch app protocol must have actually changed a bit.

It's probably going to be quite a while before I can get to fixing this, I've only recently joined the "2 under 2" club and don't have much time for projects

[jmot205]

Just sniffed the MagIQTouch app, and in addition to the host
tgjgb3bcf3.execute-api.ap-southeast-2.amazonaws.com
(which is in the ha_magiqtouch integration code) it is also hitting
xs5z2412cf.execute-api.ap-southeast-2.amazonaws.com

Could it potentially just be an updated API URL? Not sure why it'd still be hitting the previous one though.

The error message in this post makes it sound like it just can't hit the tgjgb3bcf3 endpoint.

[andrewleech]

Nice one @jmot205 . I've decompiled a copy of old and newest app, hopefully that'll give me a more direct answer as to what's going on... though I'm coding from phone with Acode app and SSH to my Linux box, so it's just little bits here and there :-)

[andrewleech]

Actually it's bad news on the decompile. Previously the app code was written with dotnet & xamarin which is easy to decompile.

The brand new one has been rewritten from scratch, with that new url reported now locked inside a C / binary library which is much harder to inspect.

Oh, the new url is actually a websocket.
While I haven't decompiled the binary library, just listing strings from it is quite interesting.
wss://xs5z2412cf.execute-api.ap-southeast-2.amazo naws.com/prod
The app is now written with flutter and aws-amplify

    "UserAgent": "aws-amplify-cli/2.0",
    "Version": "1.0",
    "analytics": {
        "plugins": {
            "awsPinpointAnalyticsPlugin": {
                "pinpointAnalytics": {
                    "appId": "b9c0364dab934e9aa7708a0b03417db1",
                    "region": "ap-southeast-2"
                },
                "pinpointTargeting": {
                    "region": "ap-southeast-2"
                }
            }
        }
    },
    "auth": {
        "plugins": {
            "awsCognitoAuthPlugin": {
                "UserAgent": "aws-amplify-cli/0.1.0",
                "Version": "0.1.0",
                "IdentityManager": {
                    "Default": {}
                },
                "CredentialsProvider": {
                    "CognitoIdentity": {
                        "Default": {
                            "PoolId": "ap-southeast-2:87af6d7b-28ef-4014-88f1-67b19c361221",
                            "Region": "ap-southeast-2"
                        }
                    }
                },
                "CognitoUserPool": {
                    "Default": {
                        "PoolId": "ap-southeast-2_uw5VVNlib",
                        "AppClientId": "afh7fftbb0fg2rnagdbgd9b7b",
                        "Region": "ap-southeast-2"
                    }
                },
                "Auth": {
                    "Default": {
                        "authenticationFlowType": "USER_SRP_AUTH",
                        "socialProviders": [],
                        "usernameAttributes": [],
                        "signupAttributes": [
                            "NAME",
                            "FAMILY_NAME",
                            "EMAIL",
                            "PHONE_NUMBER"
                        ],
                        "passwordProtectionSettings": {
                            "passwordPolicyMinLength": 6,
                            "passwordPolicyCharacters": []
                        },
                        "mfaConfiguration": "OFF",
                        "mfaTypes": [],
                        "verificationMechanisms": [
                            "EMAIL"
                        ]
                    }
                },
                "PinpointAnalytics": {
                    "Default": {
                        "AppId": "b9c0364dab934e9aa7708a0b03417db1",
                        "Region": "ap-southeast-2"
                    }
                },
                "PinpointTargeting": {
                    "Default": {
                        "Region": "ap-southeast-2"
                    }
                }
            }
        }
    },
    "api": {
        "plugins": {
            "awsAPIPlugin": {
                "apiGateway": {
                    "endpointType": "REST",
                    "endpoint": "https://tgjgb3bcf3.execute-api.ap-southeast-2.amazonaws.com/prod",
                    "region": "ap-southeast-2",
                    "authorizationType": "NONE"
                }
            }
        }
    }

[andrewleech]

Ah, this integration is also still using ApiUrl = "https://57uh36mbv1.execute-api.ap-southeast-2.amazonaws.com/api/" for much of its functionality; this url appears to no longer exist! So it seems I'll need to find equivalent endpoints oh the newer web API to replace these

[jmot205]

That's a frustrating outcome of them seemingly putting so much effort into re-writing their app - that it throws a spanner into the decompile process. Nice find on that printout - that's a lot of info.

Here's hoping that a drag-and-drop update of the ApiUrl is all it needs to come back to life.

[raym777]

Thanks for looking into this. I came here to report the issue but you guys are obviously all over it already :)

Hopefully not too difficult to get it back up and running.

[andrewleech]

So I've been trying a lot of different things, working day and night ( coding from phone while rocking newborn to sleep :-D )

... and was starting to get quite pessimistic about ever getting it working again.

I tried just changing the old url to either of the new endpoints identifed previously, but they just throw an AWS authentication error. Stack overflow says that particular error means the url path is wrong / doesn't exist...

My initial attempts at decompiling went nowhere (as mentioned above) so I went back to trying to sniff the network traffic.

Turns out there's an awesome on-phone network analyser now called pcapdroid. It acts like a "fake vpn" to intercept traffic and show all the packets. It works great, can select just the magiqtouch app and it shows communications to that new endpoint.

These are all https (aka encrypted) however so don't show the full url path or the request contents. So not enough to figure out how to use it.

Luckily pcapdroid has an option to decrypt these, so I got all that set up and going, only to find the magiqtouch app no longer works, it can't communicate with the server and pcapdroid shows a common error being that the app is detecting / rejecting the proxy decode certificate.

One common workaround for this requires a rooted device. Thankfully I had an old phone in the cupboard that's got magisk root installed so I got that charged, installed everything and tried again with the root / system certificate stuff configured. Same failure :-(

Apparently when this fails it usually means the app itself is enforcing the certificate. 

So I tried a few tools & techniques to patch the app itself to disable this so called "cert pinning". Some methods made the app crash, some didn't. None of them let me decode the API calls unfortunately.

FWIW though one tool that's _very useful for unpacking, smali editing, rebuilding and signing apks is apk.sh

It was about here I was getting close to giving up.

Then I thought, if all the app communication is hidden inside a binary library, maybe I don't need to figure out how the API calls work, maybe I can just copy the binary library and figure out how to embed it into my package, then directly call the official apps' functions in it!

So I took another look at the binary library and quickly figured out this wouldn't work because it's not a normal linux-like shared library, it's a custom format "flutter app" thing.

And that started me down a path of figuring out what flutter is. Tldr it's a cross platform mobile app framework by Google that has its own programming language that compiles to a binary library. Hence all the app code is in a binary library. Unfortunately flutter apps are very hard to decompile, and it's only becoming harder in newer versions. And that cert pinning issue I ran into is standard practice in all flutter apps!

But thankfully flutter is popular enough that lots of people have figured out various ways to patch it / disable cert pinning in different versions of flutter as this kind of network inspection is crucial for a lot of security research.

I tried a couple of ways that crashed the app, before finally one that didn't crash.  And actually worked to disable cert pinning, so network inspection finally worked!

The tool used is reflutter.

It does require a separate inspection proxy that's listening on a different port than pcapdroid uses, so I've got a separate copy of mitmproxy running on my home computer.

After all that, I think a picture is worth a thousand words, so...

PS. This doesn't mean I've fixed anything yet, but does mean I should be able to trace how the real app communicates with the server to copy it!

[DeltaTangoLima]

@andrewleech I am in awe. I could barely write a Python hello world one-liner when our kid was newborn, let alone decompile an app and sniff its traffic with a MITM proxy.

Look - I'm an infrastructure guy, and totally a Python hack. Clearly you've done a lot of the heavy lifting already, and you seem like a guy that enjoys doing this stuff but, if I can help at all, please yell out mate.