Anker app can get nearly realtime data over cloud based mqtt

[p4i1ipp]

When you open the Battery page in the app you get realtime data over solarpower, chargingpower and homefeed power.
You can see sometimes a short (debug?) message in the app connecting to an MQTT Broker.
I've sniffed the traffic from the App and can see, that it connects to the same MQTT-Broker the solarbank does (aiot-mqtt-eu.anker.com) over the same port 8883.
As we already know the battery did the auth via mTLS with a certificate which CN ist the battery serial number.
So, the app did not have such a seriel - and i don't think Anker will put a private key in an app.
Further thinking is, that the broker maybe can be accessed with with app credentials reading the live data?
Maybe someone else has done some research on this part?

Greetings, Phil

[thomluther]

Hi @p4i1ipp
Why shouldn't the App use the device SN as well for the MQTT connection?
I know there has been an Api endpoint to query the mqtt setup which listed various certificates.
However, this endpoint was removed, probably due to security reasons.

If someone is able to get the MQTT connection to work for real time device data, that would be great.
That may also provide battery temp information, which is not provided via Api.

[p4i1ipp]

Hi @thomluther,

i did a deep dive into the android app with some debugging attached.
Can you try call the API with this path: /app/devicemanage/get_user_mqtt_info

Phil

[thomluther]

Hi @p4i1ipp
It throws still an error for non existing endpoint. I think it was removed from the cloud Api as said earlier. You may still find fragments in the app.

Testing Solix API:
Request Error: 404, message='Not Found', url=URL('https://ankerpower-api-eu.anker.com/power_service/v1/app/devicemanage/get_user_mqtt_info')
Response Text: 404 page not found

[p4i1ipp]

Hi @thomluther,

the path the app uses don'r prefix it with "/power_service/v1/" - it was called directly:
"url": "https://3.19.49.144/app/devicemanage/get_user_mqtt_info",
(IP is from US-Cloud, not EU)

[thomluther]

Ah ok, That works indeed. Shows a couple of my certificates.
So you can use that for your own with the test module:
CONSOLE.info(json.dumps((await myapi.request("post", "app/devicemanage/get_user_mqtt_info",json={})), indent=2))

[p4i1ipp]

I'm able to connect to the MQTT Service after some try and error. They do some nasty things not specified in the MQTT5 protocol.
Now the fun part begins: Which Topics they subscribe to?
Currently my guesses are all wrong.

[thomluther]

I have no clue. They do nasty things with the Api fields too, having different meanings and no values in special situations....
MQTT is a completely different construction place I'm not going to start with :-)
Still busy with getting normal App features into the HA integration

[typomedia]

In the meantime I have managed to get some C1000 realtime data from the MQTT broker 🤯🥳 I didn't search for the correct protobuf schemes any further 🧐
Instead, at some point I tried searching for the values displayed in the anchor app inside the Base64-encoded binary string in order to find its position/offset.
The many previous unsuccessful attempts have resulted in a lot of spaghetti code 😵‍💫, which I have to get into shape now so that I can finally put the functional part into a Go library 😉

[thomluther]

Interesting, so you just have some 'offsets' to certain values, but no real decoding of the binary string?
Any experience or measurements what that means to the device if pushing MQTT data to the cloud 24x7? I would assume that may reflect in self consumption increase, since they are not designed to push MQTT data 24x7, are they?

[typomedia]

Yes, just offsets to certain values!
I don't have any experience over a longer period of time. However, MQTT was designed for low energy consumption. For now, I'm happy that it works finally somehow dirty quirky 🤓
I haven't noticed any dependency with the app either. Meaning: I also receive data without having to start the app first. So far I get those values which match those in the app: AC consumption, DC consumption, solar input power, temperature, battery charge level.
That said, I also own a C300. Although it also sends data to the broker, I can't read it with the same logic, which is probably due to a completely different firmware. My C1000 is on version v1.5.1, the C300 v1.0.4.1

[thomluther]

If the devices send MQTT anyway all the time even without trigger, I even less understand Ankers policy to not offer a local MQTT interface (not even any interface)....
For local traffic, it would not even have to be encrypted. Just a local broker address would be sufficient, eventually with TLS setup for the broker. Should not be that difficult to implement since just an additional address where to send (unencrypted) MQTT data.

[typomedia]

To clarify: I subscribe the broker aiot-mqtt-eu.anker.com from home. My Powerstation C1000 is located at a different location outside the city and is connected to the Internet via wifi using an LTE router. I have not yet used a traffic analyzer to verify if the Powerstation is transmitting all the time - or only after subscribing!?
For now we can only speculate why Anker does not open their API: increased traffic, support requests....

[dnks23]

Hello @typomedia & @p4i1ipp !
looping myself in as I'm currently also trying to connect via MQTT to read data from a Solarbank 3.
Looks like i am able to connect via paho-mqtt however during subscribing to a topic (e.g. dt/anker_power/A17C5/APCDJE..../param_info) i am getting unspecified error. Not sure if I missed sth during client initialization etc. Would anyone of you be able to provide a snippet that shows client init and subscription, consuming messages?
thanks in advance!

[mboisson]

Hello,
Any details on how to connect to the MQTT and do stuff with it ?

I see from inspecting requests locally that it queries .../v1/openapi/devicemanage/get_user_mqtt_info

I have no clue how to get any kind of info from this. The data I see is encrypted.

I am trying to integrate with my F3800 Plus, but sadly the current API shows no useful information... merely the name of the product and the total battery capacity.

[thomluther]

No details for MQTT, but maybe a local Bluetooth interface may be possible for your device if you have a BT adapter in device range.
However, I have no experience with it and the current implementations do not look like you can control anything over BT.

[rschoebel]

i tried some stuff maybe someone else figgers out the last pice of the puzzel -> #218