Some Question

[Droccal]

Hey nougad/Florian,

first of all thanks very much for this cli tool, it was a great help for me to integrate it as a homebridge plugin (which I'm currently still refining => https://github.com/Droccal/homebridge-velux-active, it is not yet available for homebridge users to install)

I have some questions to the api, would be cool if you could help me out.

Do you know that the "Retrieve Key" does? as when I use it it just answers with "status": "ok".

I'm trying to integrate to open a window with the api, but for that there are some security features implemented. I tried to decompile the android app to understand how it is done but unfortunately I didn't find any clue how.

I intercepted the request from the iOS app to open my window and got the following request data:

{ "home": {
"id": "$homeid",
"modules": [
{
"bridge": "$bridgeId",
"sign_key_id": "$signKey",
"target_position": 18,
"hash_target_position": "$hashedPosition",
"id": "$deviceId",
"timestamp": 1666247623,
"nonce": 0
}
]
},
"app_version": "1.10.0"
}

They use a signing key and hash the target position. I thought maybe with the retrieve key I could also create that hash to control my window.

Best Regards
Thomas

[nougad]

Hey. I'm sorry. I only own rollershutters and don't know how the protocol for opening windows looks like. As far as I know there are some additional security features involved, to exchange a crypto key upfront. This avoids that someone without the key can open windows and can get access to the room.

I was successful back then to intercept the traffic of the app by adding a mtimproxy. But it requires removal of the certificate pinning of the app which is not straight forward either.