0

I got a Greenlite AIRZ thermostat which connects to my home wifi so that I can change the settings remotely on my phone. The Android app is, however, difficult to use, so I'm thinking about making my own. I found its IP address, put it in a browser, and it said verbatim File / not_found. The thermostat also rejects my request to connect to port 21/22. How should I proceed from here? Is the underscore between not and found a quirk of a specific server that would allow me to probe further?

  • This is not really about information security. If you are trying to reverse engineer how the device works better ask at Reverse Engineering. – Steffen Ullrich Sep 12 at 5:49
  • Without more specific details, I think this question boils down to "how to reverse engineer this system" which is probably better answered in book format. That said, you could be on the right track using those artifacts to learn more about the system. – multithr3at3d Sep 12 at 16:53
  • 1
    Good start point would be decompiling the android application and checking how does it perform settings change – morsisko Sep 12 at 18:29
0

You have to debug its hardware.

Search for its serial port. Look into UART. https://www.societyofrobots.com/microcontroller_uart.shtml

You have to do a boundary scan, and figure out its hardware boundries. You can do that through JTAG https://www.jtag.com/boundary-scan/

| improve this answer | |
0

The best approach here would be to look at the App, that way you know exactly what to send (especially when they add some encryption or signing). The second best option would be to look at the network traffic and hope that it's easy to figure out how it works from that. If that also doesn't work the last option in my opinion would be to attack the device itself: As mentioned in other responses you are looking for UART, JTAG or other debug ports. Also you can look for SPI Flashes, NAND Flashes, eMMC Memory and read those out then. But this is the most difficult method which should only be followed when the other methods don't work or you have a good reason to do so (to discover "secret" functionality for example).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy