Powerwall 3 + Savant

[mattprecious]

I have recently had a PW3 installed and am, like everybody else, frustrated with the current state of local API access.

My installer also installed a Savant Power Director for load-shedding during an outage and it seems to still be able to communicate directly with the PW3 over my LAN. Inside the Savant app I can see both current and historical energy flow between grid/battery/solar/home, battery charge level, and it's also able to detect grid outages in order to trigger load shedding.

Packet captures through my Unifi controller show that there's chatter between the devices over LAN, and when I isolate the PW3 from my network, Savant loses access. When I connect to the PW3's WiFi network, I cannot locate the Savant on there with an nmap.

I've been trying to figure out how to MITM the two devices to see how they're communicating, but have thus far been unsuccessful since I am not in control of either device and they're using TLS. Any tips for investigating further?

[anntnzrb]

Use the pypowerwall TEDAPI protobuf schema at tools/tedapi/tedapi.proto and decode.py to analyze captured packets. For TLS MITM: set up a transparent proxy with your own cert between Savant and PW3, or use SSLKEYLOGFILE env var to decrypt Wireshark captures. Compare traffic patterns against known TEDAPI endpoints at https://192.168.91.1/tedapi/v1 using the Gateway WiFi password (from QR code) with curl --insecure -u Tesla_Energy_Device:GW_PWD.

[anntnzrb]

Use the TEDAPI tools at /tools/tedapi/ to analyze Savant packets: tedapi.proto (protobuf schema) + decode.py (decoder). For TLS MITM, use SSLKEYLOGFILE env var for Wireshark decryption. Test endpoint: curl --insecure -u Tesla_Energy_Device:<GW_PWD> https://192.168.91.1/tedapi/v1 (password from Gateway QR code). Savant likely uses same TEDAPI protocol.

[mattprecious]

Well, this is possibly anticlimactic, but I managed to MITM by temporarily re-configuring it to point to my laptop and it's just using the remnants of the local API.

It authenticates using /api/login/Basic and then polls:

• /api/meters/aggregates
• /api/system_status/grid_status
• /api/system_status/soe

These endpoints all still work and are able to provide basic site info.