Connection init workflow

[srenauld]

Hey,

I've had a brief look at the decompiled app and the crypto part is trivial to re-implement (I've done it locally in typescript and verified vs. stock code). However, there is a problem.

The very first thing the app does when connecting to the coffee machine is to send a WifiCommandConnectionSetup command. This can be found in the decompiled code, but the instructions themselves are not decompiled properly, but the flow is relatively simple to follow, at least initially:
a. set buffer to @HP:${getPin()},${getDeviceName(r8).toString('hex')},${getHash(r8)}
b. re-initialize SecurityManager with the following items: ConnectionPriority.CONNECTION_SETUP, getHash(r8), 1, 40
c. Send command

the PIN is obvious (it's set by the user), but the hash is a bit more complicated to find, and there seems to be a bit of processing around getDeviceName(). I'm likely going to need some help in either reverse-engineering the code itself (including where and how this is stored into SecurityManager), or a bunch of different people MITM-ing their machine to figure out the pattern.

[srenauld]

Some progress.

I'm at the point where the coffee machine just closes the connection instead of not even answering. So, we're getting somewhere, and it means there's an auth check going wrong somewhere.

MITM attempts with the app have gone nowhere. I have:

• Replaced the MAC address of my mac to be that of the coffee machine
• Replaced the IP address (or rather, I have inherited the DHCP lease by changing my MAC address) and masquerade as my coffee machine
• Created a very small TCP and UDP listener
• Started the JOE app and scanned (when the coffee machine was already configured)

There is a handshake prior to TCP connection from the app. It sends (at least from my phone) the following: 0010a5f3000000000000000000000000 every second.

I will throw that at the coffee machine tomorrow and see what comes out.

[rmeekers]

I'm following this with great interest. I lack the technical knowledge to help you, but I'm very thankful for your efforts :)
Would be wonderful we could get this working

[COM8]

Thank you very much @srenauld ! This sounds really interesting and I'm looking forward to how this turns out.

[FriedCheese2006]

Time for a resurrection.

I used a rooted Android emulator to perform a MITM attack using PCAPdroid and was able to pull a decrypted packet capture of the app traffic. This has me connecting to the machine and running "hot water" for 25 ml two times. I haven't started trying to pick it apart yet.

https://drive.google.com/file/d/178tR00bpJkq_30_OUTH5-hZ1sJxW3mI2/view?usp=sharing

[FriedCheese2006]

Also noteworthy is that I don't have a user pin setup.

[COM8]

Awesome! Thank you for looking into it further. Feel free to report your findings. I also accept PRs in case you want to document anything.