I have a solar inverter which can be queried through mobile apps, eSolar O&M or eSolar SET. My goal is to read values from the inverter (solar power, grid consumption...) by querying the device from a home made program, and possibly implement this on an ESP32.

The communication between the app and the inverter goes through a BLE device, which internally sends and gets information using the Modbus protocol. I've unpacked the apk and every command sent to the module is clearly available as an hexadecimal string, everything is very straightforward, from the string building to the hash applied to it. From the app point of view, this string is sent through BLE using ATT commands, yet when I try to send those commands either with a python script, gatttool or even using the nRF Connect mobile app, I receive an ack from the device (49 04 02 01 00) to the notification handle, but no result.
In order to understand the communication between the app and the device, I've enabled HCI snooping on the Android device and got a clean capture. And while what seems to be an initial setup (BLE characteristics, MTU negocition...) happen using ATT commands, it switches to HCI_ACL to query the device and the communication between the 2 becomes unreadable.
Moreover, grep'ing the initial commands sent by the app in the extracted apk gives no match. I am sure the apk is the one installed.
The more puzzling is that a person from this inverter (SAJ H1) hacking community is able to send ATT commands and receives results, the only difference is that I have a more recent firmware on the BLE module.

Wireshark Capture

Does this rings a bell to anyone? Any idea on how to proceed?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.