Mort Bay Smart USB Wireless Controller

Forums › Gadgets, robotics, home automation, electronics (including wearables) › Mort Bay Smart USB Wireless Controller

mcgavinp

10 posts

Wannabe Geek
+1 received by user: 5

Topic # 242426 27-Oct-2018 22:54

One person supports this post

I spotted this item in my local Bunnings Warehouse recently - somewhat like a WiFi smart plug for remote switching of 240V AC devices, but simpler. I bought one right off the shelf.

It comes with a USB transmitter for communicating with the plug and uses its own protocol and frequency that doesn't interfere with standard WiFi. Also it doesn't communicate with the cloud - just direct computer to plug. So, for example, I could use it to switch my WiFi access point off and on, which obviously wouldn't work if it had to use WiFi and communicate with the cloud.

The main issue is that I want to use it from my own program, not with the Windows-only GUI app that comes with it (SmartRF.exe).

So I reverse engineered the USB protocol with WireShark. It appears to be simply an 8-byte binary sequence sent to the USB to turn it off and a different 8-byte sequence to turn it on. Sending the same 8 bytes from a python program using pyusb on Linux works just fine.

Maybe the sequence is different for different plugs --- I only have one.

Anyway, is anyone interested in more details?

Kind regards, Peter.

1 | 2

I iz your trusted friend
5827 posts

Uber Geek
+1 received by user: 143

Mod Emeritus

Trusted

Lifetime subscriber

Reply # 2166675 24-Jan-2019 08:34

I just saw this today and thought of a possible good use for it is to use it with a certain ISP-modem so when the PC that the USB connected to can no longer get a suitable/acceptable set of ping reply, then it will trigger the wifi AC to power cycle.

Is that a good idea, someone can do it?

Internet is my backyard...

«Geekzone blog: Tech 'n Chips Takeaway» «Personal blog: And then...»

Please read the Geekzone's FUG

mcgavinp

10 posts

Wannabe Geek
+1 received by user: 5

Reply # 2166769 24-Jan-2019 10:36

That's exactly what I use it for. It doesn't happen very often, but occasionally my cable modem stops working and the only way to fix it seems to be to power it off and on --- most annoying when it happens when I'm away from home, there's nobody at home and I can't access my home servers.

Now I have a crontab job which periodically attempts to ping the ISP gateway. If this repeatedly fails, it powers the cable modem off and on. It has triggered twice since I set it up in October.

chiefie

I iz your trusted friend
5827 posts

Uber Geek
+1 received by user: 143

Mod Emeritus

Trusted

Lifetime subscriber

Reply # 2166950 24-Jan-2019 14:03

Oh excellent! So... how do you go about doing that? Care to share your how-to?

Internet is my backyard...

«Geekzone blog: Tech 'n Chips Takeaway» «Personal blog: And then...»

Please read the Geekzone's FUG

gcorgnet

651 posts

Ultimate Geek
+1 received by user: 122

Subscriber

Reply # 2166952 24-Jan-2019 14:13

What was the price for one of these?

Lias

3625 posts

Uber Geek
+1 received by user: 2115

Trusted

Lifetime subscriber

Reply # 2166959 24-Jan-2019 14:33

gcorgnet:

What was the price for one of these?

$40

https://www.bunnings.co.nz/mort-bay-smart-usb-wireless-controller-white_p00279424

Information wants to be free. The Net interprets censorship as damage and routes around it.

mcgavinp

10 posts

Wannabe Geek
+1 received by user: 5

Reply # 2167176 24-Jan-2019 20:40

2 people support this post

chiefie:Oh excellent! So... how do you go about doing that? Care to share your how-to?

Well, more of an outline than a HowTo:

Running the supplied SmartRF.exe in a Windows VirtualBox guest under a Linux host and using usbmon and WireShark, I captured the Off/On USB sequences. I expect these will be different for each plug - but I don't really know. For my plug, the captured 8-byte URB payloads are:

Off (hex): 14 23 08 20 60 0c 18 00
On (hex): 14 23 88 20 60 0c 18 00

Next I created /etc/udev/rules.d/99-mortbay.rules containing:

SUBSYSTEM=="usb", ATTRS{idVendor}=="0c45", ATTRS{idProduct}=="7463", GROUP:="myusername", MODE:="0660"

(substitute your username for myusername), then:

sudo udevadm control --reload-rules

Now we don't have to be root to access the device.

Copying a pyusb tutorial example changing a few lines --- the USB vendor/product code and string to write at the end, and assuming the indentation isn't messed up (see attached image for how it should be), the resulting /usr/local/bin/mortbay_on.py is:

[code]#!/usr/bin/env python2

import sys
import usb.core
import usb.util

dev = usb.core.find(idVendor=0x0c45, idProduct=0x7463)
if dev is None:
raise ValueError('Device not found')

for cfg in dev:
for intf in cfg:
if dev.is_kernel_driver_active(intf.bInterfaceNumber):
try:
dev.detach_kernel_driver(intf.bInterfaceNumber)
except:
sys.exit("Could not detach kernel driver from interface({0}): {1}".format(intf.bInterfaceNumber, str(e)))

dev.set_configuration()
cfg = dev.get_active_configuration()
intf = cfg[(0,0)]

ep = usb.util.find_descriptor(intf, custom_match = lambda e: \
usb.util.endpoint_direction(e.bEndpointAddress) == \
usb.util.ENDPOINT_OUT)
assert ep is not None

cmd_off = b'\x14\x23\x08\x20\x60\x0c\x18\x00'
cmd_on = b'\x14\x23\x88\x20\x60\x0c\x18\x00'

ep.write(cmd_on)[/code]

Similarly for /usr/local/bin/mortbay_off.py except change cmd_on in the last line to cmd_off. Make these files executable:

sudo chmod +x /usr/local/bin/mortbay_on.py /usr/local/bin/mortbay_off.py

Running these scripts turns the plug off or on.

I created reset_internet_connection.sh which switches the plug off and on if it can ping the router but not the gateway:

#!/bin/sh

ROUTER=192.168.1.1
GATEWAY=203.118.153.254

if ping -q -w 1 -c 1 ${ROUTER} > /dev/null ; then
if ! ping -q -w 1 -c 1 ${GATEWAY} > /dev/null ; then
sleep 1
if ! ping -q -w 1 -c 1 ${GATEWAY} > /dev/null ; then
sleep 10
if ! ping -q -w 1 -c 1 ${GATEWAY} > /dev/null ; then
sleep 10
if ! ping -q -w 1 -c 1 ${GATEWAY} > /dev/null ; then
date
/usr/local/bin/mortbay_off.py
sleep 10
/usr/local/bin/mortbay_on.py
echo "Switched off and on"
fi
fi
fi
fi
fi

(Change the IP numbers for your config.) Make the script executable:

chmod +x reset_internet_connection.sh

Finally I appended the following line to the end of my crontab to run the above script at 17 and 47 minutes past every hour:

17,47 * * * * /full/path/to/reset_internet_connection.sh >> /full/path/to/reset_internet_connection.log 2>&1

with:

EDITOR=gedit crontab -e

chiefie

I iz your trusted friend
5827 posts

Uber Geek
+1 received by user: 143

Mod Emeritus

Trusted

Lifetime subscriber

Reply # 2167335 25-Jan-2019 09:54

Wow cool... so umm.. any work for making this a Windows task? hehe

Internet is my backyard...

«Geekzone blog: Tech 'n Chips Takeaway» «Personal blog: And then...»

Please read the Geekzone's FUG

mcgavinp

10 posts

Wannabe Geek
+1 received by user: 5

Reply # 2167356 25-Jan-2019 11:06

chiefie:Wow cool... so umm.. any work for making this a Windows task? hehe

Sorry I'm a Linux geek.

However I suspect the On/Off Python scripts are portable to Windows, assuming Python, PyUSB and appropriate libusb are installed.

Also I read that Windows includes a Task Scheduler and that it now supports Linux bash.

MurrayM

1616 posts

Uber Geek
+1 received by user: 235

Reply # 2167365 25-Jan-2019 11:22

Rather than have two different Python programs that only differ in one line, wouldn't it have been better to have just the one program and have it accept a command line argument, eg "-on" and "-off", to specify what you want it to do? (Sorry, just the programmer in me comming through!)

mcgavinp

10 posts

Wannabe Geek
+1 received by user: 5

Reply # 2167387 25-Jan-2019 12:27

One person supports this post

MurrayM:Rather than have two different Python programs that only differ in one line, wouldn't it have been better to have just the one program

Agreed. Initially I wrote the program(s) for myself and was too lazy to code a few lines to parse and check commandline arguments.

Here's a version ( /usr/local/bin/mortbay.py say ) which remedies that:

[code]

#!/usr/bin/env python2

import sys
import usb.core
import usb.util

if len(sys.argv) != 2 or (sys.argv[1] != "on" and sys.argv[1] != "off"):
sys.exit("Usage: "+sys.argv[0]+" on|off")

dev = usb.core.find(idVendor=0x0c45, idProduct=0x7463)
if dev is None:
raise ValueError('Device not found')

dev.set_configuration()
cfg = dev.get_active_configuration()
intf = cfg[(0,0)]

ep = usb.util.find_descriptor(intf, custom_match = lambda e: \
usb.util.endpoint_direction(e.bEndpointAddress) == \
usb.util.ENDPOINT_OUT)
assert ep is not None

cmd_off = b'\x14\x23\x08\x20\x60\x0c\x18\x00'
cmd_on = b'\x14\x23\x88\x20\x60\x0c\x18\x00'

if sys.argv[1] == "on":
ep.write(cmd_on)
elif sys.argv[1] == "off":
ep.write(cmd_off)

[/code]

gbwelly

761 posts

Ultimate Geek
+1 received by user: 323

Subscriber

Reply # 2167411 25-Jan-2019 12:51

Is there any sort of pairing process between the plug and dongle? If so does re-pairing them change the sequence? I am asking as it says on the packet that it can control up to 7 switches.

If they don't pair then this leads me to question:

1. Is the sequence the same on all plugs and all 7 turn off/on together with 1 dongle?

2. Is the sequence different on each and you'd need to plug all 7 dongles into your computer turn the switches off/on individually? Surely not?

If they are all the same this is a bit of a security blunder.

MurrayM

1616 posts

Uber Geek
+1 received by user: 235

Reply # 2167426 25-Jan-2019 13:28

gbwelly:

Is there any sort of pairing process between the plug and dongle? If so does re-pairing them change the sequence? I am asking as it says on the packet that it can control up to 7 switches.

I noticed this too. Bunnings don't seem to be selling the plugs by themselves, only in packs with the controller.

mcgavinp

10 posts

Wannabe Geek
+1 received by user: 5

Reply # 2167441 25-Jan-2019 14:30

gbwelly: Is there any sort of pairing process between the plug and dongle?

Yes there is a pairing process that I followed using the supplied SmartRF.exe in Windows. I repeated this two or three times and the USB On/Off sequences for my plug didn't change.

SmartRF.exe supports multiple plugs using one controller. Sorry I don't have a second plug to try.

There is a sticker on my controller - 1422/300912

SmartRF.exe says it identifies the (controller?) device as hex 4132-88

USB id is: 0c45:7463 (Microdia)

chiefie

I iz your trusted friend
5827 posts

Uber Geek
+1 received by user: 143

Mod Emeritus

Trusted

Lifetime subscriber

Reply # 2167499 25-Jan-2019 17:19

Cool. Thanks for the great work... might give this a go at some point. Great find!

Internet is my backyard...

«Geekzone blog: Tech 'n Chips Takeaway» «Personal blog: And then...»

Please read the Geekzone's FUG

mcgavinp

10 posts

Wannabe Geek
+1 received by user: 5

Reply # 2168528 27-Jan-2019 17:17

OK, I bought another controller/plug to experiment.

Without even running WireShark again, here's what I figured out:

Each time you press an On/Off button in SmartRF.exe, the status bar displays the first 3 bytes of the corresponding 8-byte sequence, but with nybbles reversed. The remaining 5 bytes appear to stay the same.

For example, if the status bar says "Send Data 43C4-80 Hex" after clicking an On/Off button, then the corresponding sequence is:

(hex) 34 4C 08 20 60 0c 18 00

Looks like each controller has a different ID which is coded in the first 2 bytes.

Following the pairing process, it's the pairing position that counts. That is, codes for the plug paired in position n appear to be always the same, regardless of which plug was paired in position n.

Initially I ran the Python scripts on a PC with Ubuntu. Just tested they work unchanged on a Raspberry Pi.

1 | 2