Maximilian Golla (@m33x) • Jan. 4, 2022
A friend owns a heat pump. It reports sensor readings via a web interface. The problem? It's a Java applet 💩 and worse, it only supports Java 7 (seriously, FML). It was installed in 2010, and never received an update (I checked, there is none). So I installed Java 7 and FF 51.
Maximilian Golla (@m33x) • Jan. 4, 2022
Next, we download and decompile the applet using JD-GUI. Known form other IoT devices (cc: @internetofshit) the applet authenticates the user locally, there is no backend involved (so we can skip auth completely) 🤦 The applet connects to the heat pump using a TCP socket.
Maximilian Golla (@m33x) • Jan. 4, 2022
Next, we waste 4h to remind ourselves that Java uses big-endianness 😅 and that you are sending the correct value but in the wrong order, you idiot! 😬 Meanwhile we have some fun with the hardcoded secrets 😂, and we waste hours to figure out which value represents which sensor.
Maximilian Golla (@m33x) • Jan. 4, 2022
Finally, we integrate everything into #HomeAssistant using a command_line sensor that updates every 60 seconds. Now my friend can enjoy all important heat pump sensor readings on his phone and can finally uninstall Java 🥳