Kepler calibration

[asturkinos]

Hello,

I have been following this repo ever since I got my Kepler some months ago, mainly out of frustration with the app. I have never been able to see readings from the unit in my phone, although I was successful assigning an IP, examining the packets I only see the app sending info to a web server related to the Tencent cloud in China but never communicating to the IP assigned to the Kepler in my LAN.

So far so good I thought, I don't care that much if I can't see the values on my phone as long as the alarm still triggers if I have gas or CO in my kitchen. Then one day the gas alarm went off for no reason (I made sure I did not have any leakage) and from then on it's got an offset of 5% all the time, going up to 6% (and hence triggering the annoying beeping) from time to time randomly (the change from 5% to 6% seems to happen when the temperature is lower than 19-18 degrees Celsius).

Long story short: I would like to recalibrate the gas sensor to compensate the 5% offset. So far I've explored two possibilities: hardware and software. I'm sure there must be a way to enter a calibration menu but until now I had no luck finding it. There is a hard reset button but it has no effect in the calibration of the sensor. Opening the unit you find a connector marked P2 that might be used (maybe a JTAG interface) to write firmware into the SoC but there is little information available on this particular chip (MXCHIP MX1081). I wrote an e-mail to Orvibo's support but reading the lousy reviews on Kickstarters I don't fool myself thinking they will care much.

Now I've just started exploring the software avenue but I cannot manage to get much. There seems to be a lot of projects related to the s20 plugs but I think you're the only one working on the Kepler.

Can you please share if you had any progress? Is there anything I can do to help? Reverse engineering the UDP packets is a good start but I'm not sure that would give access to the sensor's calibration.

Based on the number of disgruntled backers I think a small tool to be able to log readings into a home automation system (imagine you have a very small gas leakage that only triggers warnings when you are not home or sleeping) would be very well received. And I could not find a product with similar characteristics (Nest protect or Birdie don't have gas detection, which is a very big issue for me). Besides, the hardware of the Kepler is actually not bad at all (in particular when you look under the hood). It's the software and documentation where it's horribly disappointing.

Well, I would really appreciate if you share your thoughts... thanks!

[Grayda]

Hi @asturkinos, I haven't made any progress on this for a while. The app never worked for me, even after about 100 tries to pair it, I couldn't get anywhere. The hardware and firmware are really responsive though, so if I could work out how to construct the packets, I could probably make some progress.

The packets are encrypted with a key which you can easily obtain from the app (just decompile it, and it's in the source code somewhere). So I'm able to read packets, but I'm unable to put them back together. When the packets are created, a CRC is put on the end, and so far I haven't been able to work out how to generate the right CRC, as I don't know what info goes in to making them.

On top of all of this, I've been working on a separate project that has taken up the last eight months of my time, and coupling that with my home automation system (Ninja Sphere) being dead in the water, I haven't really touched it.

If you're able to pull apart the APK and work out what data goes in to calculating the CRC that is tacked on the end of the packets, that'd be an enormous help.

As for calibrating the unit, it looks like the MX1081 is the WiFi chip, and I'm wondering if it has an "AP mode" like the S20, where you serial commands via UDP where you might be able to send calibration commands. I'm more software than hardware, so I'm not sure how you would find those commands out, but just a thought.

Hope some of this helps?

[asturkinos]

Hello David,

Thank you for your comments. I will keep trying the hardware and I'm going to take a shot to the serial mode. Yesterday I got the idea of playing with the app using Android SDK's emulator (I want to trace the packages in more detail and I think it'll be easier with Wireshark instead of some crappy app).

Have you tried to hard reset your unit before pairing? You can to it pushing a clip through the hole on the back for 3-5 seconds. Once you pair the unit there is no way to pair again unless you hard reset it.

I will be back as soon as I get some progress.

[Grayda]

@asturkinos I'll give the hard reset another try. I think I've done it before, but I'm not 100% sure.

EDIT: I'm connected! It took about 10 shots, but I managed to get it. Now to fire up Shark for Root and get snooping!

EDIT 2: I'm documenting what I've found so far here: https://gist.github.com/Grayda/3b31300bbf917be1e280746939c5b81e

The app actually keeps a ton of logs showing what packets were sent and what they are before and after encryption, so there's a starting point too. Those logs are actually stored in a folder called "orvibo" in a user-accessible folder, no root required. I was running Wireshark (or rather, Shark for Root) on the phone too, so I could catch all incoming and outgoing stuff without needing to fiddle around with hotspots and stuff on my PC

I might re-decompile the app now and have a second look for some info about what is CRC'd.. the info is all in there, but because decompilation doesn't do a great job and keeping method names and such, I didn't spend too long looking for info

[asturkinos]

Hi,

I see you had quite some progress, great! I'm following what you are doing. I've decompiled the apk with APK Studio and I'm looking to the code now. So far I have not seen anything related to the calibration. Apparently you can change the gas levels (normal, abnormal and danger) but I think that would only be applicable for the app (it would be a way around to prevent alarm notifications on my phone but since that never really worked and what I care about is the real buzzer that would not even be half of the solution).

The commands look promising, out of the 25 maybe one is related to the calibration parameters but it's difficult to know. It seems logical to me to be able to recalibrate without cracking the unit open.

A funny side note is that yesterday I was using a lighter to see if the gas level was going higher (it did, up the danger level showing the skull on the display and all) and now I have a permanent 6% gas (yesterday it was 5% still below the abnormal trigger level which is exactly at 6%); it seems if you expose the sensor to a high gas concentration the calibration breaks apart.

I have been looking at the hardware side too but I could not manage much. I found lots of info on the platform here https://github.com/MXCHIP-EMW/WICED-for-EMW. According to one of the documents OTA and a webserver are supported for firmware updates but I could not find any open ports yet.

Keep up the good work, I will let you know if I see something useful in the code.