BRP069C41 reverse engineering

[Sonic-Amiga]

This thread talks about the new cloud-only Daikin controller.

The Big Question: why am i doing this ? Of course i am not interested in the controller itself, but in S21 protocol commands which it supports. We have a simulator, and i am try to use Onecta app on a simulated A/C. And here i hit a brick wall: the controller does not seem to connect to the cloud. "Run" LED is steady on, and from the simulator log i see correct S21 exchange. But the unit keeps showing "offline" in Onecta.

Here i am trying to at least diagnose the problem; and gain more info on what it does on the network.

[Sonic-Amiga]

So far my controller successfully connects to my home LAN, i can see its IP address.

Attempt to access default page via HTTP brings up some licenses. From them, we know that the adapter is running FreeRTOS; and it uses Paho MQTT client. So, it looks like it uses MQTT under the hood. Interesting...

By using Wireshark i have figured out that the controller queries via http:

http://ntp.prod.unicloud.edc.dknadmin.be/common/get_date

And gets this response:

date=2024/10/05,time=17:13:00

Looks familiar, eh ? :)

After doing so my controller simply sits there idle. Something is definitely off...

[Sonic-Amiga]

My B41 controller connects to the cloud with no problem, so i decided to see how it does that.

It works fine. Cloud URL is dx23.prod.unicloud.edc.dknadmin.be, port 443. I guess it's using websockets because the connection is never closed.

Old "Daikin online controller" app contains unencrypted version of the firmware for some other controller type; not BRP. But it contains these addresses:

$ strings dkacstm-wlan-F-cs-4_0_3.bin |grep unicloud
dx23.prod.unicloud.edc.dknadmin.be
ntp.prod.unicloud.edc.dknadmin.be
dx23.preprod.unicloud.edc.dknadmin.be
ntp.preprod.unicloud.edc.dknadmin.be
dx23.staging.unicloud.edc.dknadmin.be
ntp.staging.unicloud.edc.dknadmin.be

[Sonic-Amiga]

069C also has an http interface: https://community.home-assistant.io/t/daikin-airconditioning-wifi-module/142555/68
/config/adapter/err_info for me shows "cnt_net_err":1
/config/adapter/product_info says device_type=1 device_kind=N/A

So for now it's unclear for me what's going on.

[dzungpv]

Do you check this document? https://github.com/revk/ESP32-Faikin/blob/main/Manuals/BRP069C41.pages
It seem for X50a connector. I have a AC control over x50a port too but I am do not have BRP069C41. As document here https://www.daikin.eu/content/dam/document-library/installation-manuals/ctrl/controls/BRP069C51_81_82_Installation%20manual%204PEN567679-2H_English.pdf seem it only support X50a protocol, not S21. I am sure Revk has this module.

[Sonic-Amiga]

Hello! I do have an original paper copy (the whole thing came new in a box). I am also surprised about X50a; and it can be a nice idea to throw this thing at x50a simulator. However, it actually perfectly speaks S21. I see an absolutely correct data exchange in the sim.

There's one more idea... I sniffed a bit more; and i tried to fully reset and re-add it to the account. And at that point it actually makes an HTTPS request to what appears to be an AWS Kinesis entry point. And i know that Amazon liked Mr. Putin's idea and banned Russia on their side. Any attempt to access any AWS-hosted site (e. g. nxp) gives me a boot:

403 ERROR
The request could not be satisfied.
The Amazon CloudFront distribution is configured to block access from your country. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.

Generated by cloudfront (CloudFront)
Request ID: Is6hFf7u8Rg5Y7ZZxiZfNbfQIq9zBhi3QhX37KZMH06GhH93y58iyw==

So, the theory is that the controller tries to sync up with the Net, goes to AWS, gets a boot, and simply stops not having obtained some crucial parameters.
I'll try via VPN, later, no time...

Also i have figured out some UDP API of this controller, and hacked up a tool in python, so that i can get some interesting info and read event log. That could help too.

Attempts to reverse-engineer controller's firmware are no-go because it's encrypted. Their wifi modiles are made by Murata, based on NXP core; and binary files (bundled with the app) have 'SFW' header, which very likely stands for "Secure firmware". Google for "NXP secure firmware" for more info.

[Sonic-Amiga]

To my surprise it indeed knows both protocols. And - to my complete surprise - it works! With x50 sim! It autodetected "Daikin sky air" unit, model FDXM25F3V1B9.

Conclusion: firmware indeed knows both protocols, but apparently network side of the controller is limited. Perhaps artificially limited from the cloud side; which tells it, which units are supported, and which are not.

Sorry @nickbyte; looks like this controller is completely useless for S21 reverse engineering. :( Unless we find a confirmed compatible S21 model. Perhaps there's a whitelist indeed.

[dzungpv]

X50a not complete decode, but I can not do anythings about it. I can now decode Swing mode and some Vane angle but could not send command to control it, I will create PR soon.

[Sonic-Amiga]

Do you have an X50 conditioner ? Which model is that ?

[dzungpv]

Do you have an X50 conditioner ? Which model is that ?

Yes, It is FBA50BVMA