Lost serial number for HM800 inverter :/

[sylvain-fano]

Hi there,
i'm dumb and i can't find where i the package with the S/N label printed on it of one of my HM800 is ... I could get it on the inverter itself, but i would need to climb to the roof again and remove the solar panels & everything again ... :/
Is there a way to scan the S/N from opendtu, or from any other way using the esp32 + the rf board after initializing a power off / power up sequence for example to restart the inverter ? (kind of autodiscover mode for stupid person like me ?)

pls help 🙏

[spcqike]

i don't think so as this would be a big security issue. if you could scan all available inverters, you not only could read but also control them, as there is no additional login or safty feature.

i'm not to sure, but i guess the data is somehow encrypted with the serial number itself, so that you can't read and control every device around you.

[spcqike]

thats intresting to know.

so, one could use a DTU pro to annoy your neighbors?

do you also see devices, that are not yours? if so, could you read or even control them with your openDTU?

[huste511]

As far as I know, the serial number of the inverter is transmitted as plain text.

I had read somewhere online that you could scan/intercept serial numbers with OpenDTU hardware and the corresponding software.

I asked myself exactly the same question back then. What prevents strangers from setting the inverter to, for example, 10% power in the neighborhood or on the move from their car?

This is probably also the standard security for branded products from China. ;-(

PS to the initial question: An edoscope camera for 40-50 EUR on a rod might be a solution.

[0xFEEDC0DE64]

i also lost my serial numbers, can you please show some details on how you scanned the serials? the dtu app only allows me to "scan" barcodes with the camera, but not to search for serials

[stefan123t]

@sylvain-fano can you provide a description (with screenshots) of where in the Hoymiles DTU Pro UI you have searched for the Inverter ?

We know that there is a so called BROADCAST 0x02 Command but we have so far never seen it in the wild sent from the DTU to the Inverter to properly implement this in OpenDTU / AhoyDTU.

We have @broth-itk who has a DTU Pro S and he is able to trace the actual commands sent/received, but S-Models with HMS/HMT Inverters work on a different RF-Frequency, hence it would be nice if you could trace this with your Hoymiles DTU Pro.
You can find a description of his setup with two USB2 Serial Converters here: #1650 (comment)

[sylvain-fano]

@stefan123t @0xFEEDC0DE64
mhh, i'm sorry, I opened up again my IOS S miles app, but was not able to find any scan feature ... but the app changed a lot since 02/24 :/
from what i remember, i didnt do anything fancy, it was pretty straightforward for me to discover the SN of my microinverters directly from the app . The steps were something like that :

1. connect to the DTU's wifi from the phone (eg DTU-xxxxx)
2. open the s-miles app, and connect to DTU
3. once connected, goto toolbox or so
4. here, iirc, there was a way to scan for the microinverters nearby , and their SN was printed cleartext
5. from there, i just noted down the SNs, and regustered them manually following the normal process

[sylvain-fano]

Ah, i think i found it :

click on the microinverter logo

click on toolbox

and from this menu, you should be able to scan compatible microinverters nearby

[stefan123t]

Merci @sylvain-fano !

Do you need to hava a Hoymiles DTU together with the App or does that work with the App alone ?

Which Hoymiles DTU do you have ?

Which inverter do you have HM or HMS/HMT ?

@broth-itk can you double check whether you can capture the 0x02 BROADCAST command with the instructions given by Sylvain on your Hoymiles DTU Pro S and HMS combo ready for tracing the communication ?

[broth-itk]

@stefan123t attached a trace where I selected multiple times "Search" and "Scan" within the app:

communication_log.txt

Additionally at the end of the trace you can find the communication for "Self Test/IPS Test" feature from the app. This will result in a IPS Test Report:
report.txt

This might not be relevant to this issue but contains maybe related valuable information.

[sylvain-fano]

@stefan123t , yes you need to have an up & running DTU pro device, as the first step is to connect to its wifi
actually, the scan is made by the DTU, not the app

I have DTU PRO, only compatible with my HM microinverter, not HMS

[stefan123t]

@broth-itk thanks a lot for the traces, here are the relevant parts, ie. suppressing the usual 0x15/0x95 RealTimeRunData and 0x56/0xD6 ChannelChangeCommand

There are some commands which may be interesting:

• 0x06 REQ_RF_SVERSISON
• 0x53 Yet Unknown see also Lost connection to hms-1600-4t / frequency hopping #2137 (comment)

Regarding the 0x53 I am unsure whether we have a name for that. 0x52 PARASET_ALL can be used to update the EleEnergySet (0x01) and

• 0x51 DEVCONTROL_ALL especially the SubCmd 0x28 / 40 Type_SelfInspection we see here in the wild.

@tbnobody @fishpepper you may want to take a look at these traces / results too ?

$ grep -v 'Frame: 7E\([19]5\|[5D]6\)' communication_log.txt | sed -e 's/7E\([0-9A-F]\{2\}\)\([0-9A-F]\{8\}\)\([0-9A-F]\{8\}\)\([0-9A-F]\{2\}\)\([0-9A-F]\{2\}\)7F/7E \1 \2 \3 \4 \5 7F/g' | less

2025-05-25 14:50:06.976966 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:50:07.121110 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:50:08.417905 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:50:08.484499 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:51:09.394289 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:51:09.538590 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:51:10.835457 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:51:10.894939 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:52:25.643531 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:52:25.787282 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:52:27.084256 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:52:27.138392 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:53:17.127592 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:17.287497 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:18.568224 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:18.644949 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:53:30.846182 [TX] Frame: 7E 53 80729785 80729785 53 7F
2025-05-25 14:53:30.893386 [RX] Frame: 7E D3 80729785 80164633 D2 D6 D4 7F
2025-05-25 14:53:31.214732 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:53:31.277674 [RX] Frame: 7E D3 83199047 80164633 B7 B6 7C 7F
2025-05-25 14:53:32.655487 [TX] Frame: 7E 53 81313070 81313070 53 7F
2025-05-25 14:53:32.718576 [RX] Frame: 7E D3 81313070 80164633 BA B9 C3 7F
2025-05-25 14:53:38.611033 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:38.770997 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:40.067462 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:40.132188 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:53:55.874124 [TX] Frame: 7E 06 83199047 83199047 00 06 7F
2025-05-25 14:53:55.937048 [RX] Frame: 7E 86 83199047 80164633 02 1124831990470502000200000005 52 7F
2025-05-25 14:54:31.111736 [TX] Frame: 7E 06 83199047 83199047 00 06 7F
2025-05-25 14:54:31.255452 [TX] Frame: 7E 06 83199047 83199047 00 06 7F
2025-05-25 14:54:32.232280 [TX] Frame: 7E 06 83199047 83199047 00 06 7F
2025-05-25 14:54:32.297848 [RX] Frame: 7E 86 83199047 80164633 02 1124831990470502000200000005 52 7F
2025-05-25 14:55:22.883225 [TX] Frame: 7E 51 83199047 83199047 81 2800007B007B0936 C7 7F
2025-05-25 14:55:22.956577 [RX] Frame: 7E D1 83199047 80164633 81 00002800241E EC 7F
2025-05-25 14:55:23.619130 [TX] Frame: 7E 51 81313070 81313070 81 2800007B007B0936 C7 7F
2025-05-25 14:55:23.692606 [RX] Frame: 7E D1 81313070 80164633 81 00002800241E 51 7F
2025-05-25 14:55:23.907482 [TX] Frame: 7E 51 80729785 80729785 81 2800007B007B0936 C7 7F
2025-05-25 14:55:23.981081 [RX] Frame: 7E D1 80729785 80164633 81 00002800241E 41 7F
2025-05-25 14:55:45.727542 [TX] Frame: 7E 06 80729785 80729785 00 06 7F
2025-05-25 14:55:45.787994 [RX] Frame: 7E 86 80729785 80164633 02 1164807297850502000200000005 12 7F
2025-05-25 14:57:29.398691 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:57:29.542757 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:57:30.840052 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:57:30.899778 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:57:51.106472 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:51.169354 [RX] Frame: 7E D3 83199047 80164633 B7 B57D 5F 7F
2025-05-25 14:57:51.298844 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:51.345557 [RX] Frame: 7E D3 83199047 80164633 B6 B57D 5E 7F
2025-05-25 14:57:51.474927 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:51.537698 [RX] Frame: 7E D3 83199047 80164633 B7 B57D 5F 7F
2025-05-25 14:57:51.667000 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:51.729722 [RX] Frame: 7E D3 83199047 80164633 B7 B6 7C 7F
2025-05-25 14:57:51.859152 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:51.905956 [RX] Frame: 7E D3 83199047 80164633 B7 B6 7C 7F
2025-05-25 14:57:52.035085 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:52.097514 [RX] Frame: 7E D3 83199047 80164633 B7 B6 7C 7F
2025-05-25 14:57:52.227094 [TX] Frame: 7E 53 81313070 81313070 53 7F
2025-05-25 14:50:06.976966 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:50:07.121110 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:50:08.417905 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:50:08.484499 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:51:09.394289 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:51:09.538590 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:51:10.835457 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:51:10.894939 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:52:25.643531 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:52:25.787282 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:52:27.084256 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:52:27.138392 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:53:17.127592 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:17.287497 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:18.568224 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:18.644949 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:53:30.846182 [TX] Frame: 7E 53 80729785 80729785 53 7F
2025-05-25 14:53:30.893386 [RX] Frame: 7E D3 80729785 80164633 D2 D6 D4 7F
2025-05-25 14:53:31.214732 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:53:31.277674 [RX] Frame: 7E D3 83199047 80164633 B7 B6 7C 7F
2025-05-25 14:53:32.655487 [TX] Frame: 7E 53 81313070 81313070 53 7F
2025-05-25 14:53:32.718576 [RX] Frame: 7E D3 81313070 80164633 BA B9 C3 7F
2025-05-25 14:53:38.611033 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:38.770997 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:40.067462 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:53:40.132188 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:53:55.874124 [TX] Frame: 7E 06 83199047 83199047 00 06 7F
2025-05-25 14:53:55.937048 [RX] Frame: 7E 86 83199047 80164633 02 1124831990470502000200000005 52 7F
2025-05-25 14:54:31.111736 [TX] Frame: 7E 06 83199047 83199047 00 06 7F
2025-05-25 14:54:31.255452 [TX] Frame: 7E 06 83199047 83199047 00 06 7F
2025-05-25 14:54:32.232280 [TX] Frame: 7E 06 83199047 83199047 00 06 7F
2025-05-25 14:54:32.297848 [RX] Frame: 7E 86 83199047 80164633 02 1124831990470502000200000005 52 7F
2025-05-25 14:55:22.883225 [TX] Frame: 7E 51 83199047 83199047 81 2800007B007B0936 C7 7F
2025-05-25 14:55:22.956577 [RX] Frame: 7E D1 83199047 80164633 81 00002800241E EC 7F
2025-05-25 14:55:23.619130 [TX] Frame: 7E 51 81313070 81313070 81 2800007B007B0936 C7 7F
2025-05-25 14:55:23.692606 [RX] Frame: 7E D1 81313070 80164633 81 00002800241E 51 7F
2025-05-25 14:55:23.907482 [TX] Frame: 7E 51 80729785 80729785 81 2800007B007B0936 C7 7F
2025-05-25 14:55:23.981081 [RX] Frame: 7E D1 80729785 80164633 81 00002800241E 41 7F
2025-05-25 14:55:45.727542 [TX] Frame: 7E 06 80729785 80729785 00 06 7F
2025-05-25 14:55:45.787994 [RX] Frame: 7E 86 80729785 80164633 02 1164807297850502000200000005 12 7F
2025-05-25 14:57:29.398691 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:57:29.542757 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:57:30.840052 [TX] Frame: 7E 06 81313070 81313070 00 06 7F
2025-05-25 14:57:30.899778 [RX] Frame: 7E 86 81313070 80164633 02 1164813130700502000200000005 12 7F
2025-05-25 14:57:51.106472 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:51.169354 [RX] Frame: 7E D3 83199047 80164633 B7 B57D 5F 7F
2025-05-25 14:57:51.298844 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:51.345557 [RX] Frame: 7E D3 83199047 80164633 B6 B57D 5E 7F
2025-05-25 14:57:51.474927 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:51.537698 [RX] Frame: 7E D3 83199047 80164633 B7 B57D 5F 7F
2025-05-25 14:57:51.667000 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:51.729722 [RX] Frame: 7E D3 83199047 80164633 B7 B6 7C 7F
2025-05-25 14:57:51.859152 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:51.905956 [RX] Frame: 7E D3 83199047 80164633 B7 B6 7C 7F
2025-05-25 14:57:52.035085 [TX] Frame: 7E 53 83199047 83199047 53 7F
2025-05-25 14:57:52.097514 [RX] Frame: 7E D3 83199047 80164633 B7 B6 7C 7F
2025-05-25 14:57:52.227094 [TX] Frame: 7E 53 81313070 81313070 53 7F

[alromh87]

Hello, I am trying to get the serial number of a couple MI 1200 units, as of now I brute forced 3 missing partial digits using 0x0F command 0x01 frame but I am struggling to get the other one.

I have been reading the Chinese code to replicate the discover functionality, here are my findings so far:

• 0x02 BROADCAST Command is only present in usart_nrf.c, probably MI, called old code and not in later usart_nrf3.c , It sets MainCmd to BROADCAST which I suppose should write to serial and waits 3 seconds for answers, when answer is received, it adds inverters to a list. I have not been able to determine the source and destination address in the payload since the idea is to get an unknown serial device to answer. I tried this message on my code but I only get response when directly sending a message to a know MI, response looks like this.

Response : 8f 40 90 32 81 40 90 32 81 12 00 6e 00 01 05 fa 0d

But I cant find and address that will trigger the response from an unknown device.

Here are some relevant pieces of code:

            case NET_SEARCH_ID: // Search ID
                MainCmd = BROADCAST;
                SubCmd = 0;
                break;

...

case NET_SEARCH_ID: // Search ID (broadcast)
{
    if (UsartNrf_HasSetCurrentInverterOk())
    {
        for (j =  .Property.PortNum; j < PORT_LEN; j++)
        {
            memset((u8 *)MIMajor[j].Property.Pre_Id, 0, 2);
            memset((u8 *)MIMajor[j].Property.Id, 0, 4);
            MIMajor[j].Property.Port = MI_NO;
        }

        Uart_SendBufferLen = UsartNrf_Send_PackBaseCommand(
            (u8 *)MIMajor[PortNO].Property.Id,
            (u8 *)MIMajor[PortNO].Property.Id,
            MainCmd,
            0
        );
    }

    break;
}

....

... UsartNrf_HasSetCurrentInverterOk(void)
else if(Uart_CurSendMainCmd == BROADCAST)
        {
            CurNetCmd = NET_INIT;
            PortNO = 0;
            return false;//
        }

I also tried analyzing the log posted in this thread, but after removing known micro-inverters, since we want to discover new ones. and duplicated messages we can see that there is no command from the DTU to start discovery, at least not in the captured log, perhaps instead it is listening to a broadcast address

sed -E 's/^(.*Frame: )([0-9A-F]+)$/\1\2/; s/(Frame: )(..)(..)(........)(........)(.*)(..)(..)$/\2 \3 \4 \5 \6 \7 \8/; s/^.*(\[TX\]|\[RX\])/\1/' communication_log.txt | grep -v 80729785 | grep -v 83199047 | grep -v 81313070 | sort | uniq

We are left only with channel change commands

[RX] 7E D6 80164633 80164633 01001521 E3 7F
[TX] 7E 56 80164633 80164633 0115211514 62 7F
[TX] 7E 56 80164633 80164633 0115212114 56 7F

@broth-itk
Are there target devices when using scan feature, if so could you record a log targeting MI microinverters,
Could you be so kind to record and post a log starting before enabling scan in the App. 0x02 should be seen in the serial.

I will try to build an nrf24 sniffer and try to identify devices that way.

(More details)[https://github.com/lumapu/ahoy/issues/885#issuecomment-3247761958]

[alromh87]

I'm glad to share I successfully identified and implemented 0x02 BROADCAST (Gongfa Command).
check lumapu/ahoy#885 (comment)

I tested with Gen1 and Gen2 MI units, maybe it works to with Gen 3 and HM. If you try let me know