Cloud ping packets not working with RM4 pro with firmware 52079

[trancefam]

Hello, I hope this is the correct repo for this. I use Home Assistant and have 2 different broadlinks:

My issue is with the RM4 pro -- it disconnects and reconnects every 3 minutes to my unifi AP. All outbound access for both broadlinks are blocked at my firewall. This seems directly related to this prior issue which aimed to add support for sending cloud ping packets. After reviewing the logs from pfsense, I can see that both of the cloud ping packets are being sent automatically by home assistant. The RM3 mini stays connected; however, the RM4 pro (with newer firmware) does not.

Has anyone run into this issue? Has the cloud ping packet changed? For reference, I think I setup the RM4 Pro with the app, and the RM3 mini without the app. Any help is greatly appreciated.

PFSense logs for RM4 pro below (10.0.1.50=Home assistant, 10.30.4.9=RM4 Pro):

timestamp	pf_ip_source_ip	pf_ip_destination_ip	message	pf_ipv4_protocol	pf_udp_destination_port	pf_action
2021-12-30T02:18:50.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:19:50.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:19:51.000Z		dhcpd[70790]: DHCPACK on 10.30.4.9 to 24:df:a7:f0:ea:e4 via igb2.4000
2021-12-30T02:20:24.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:20:53.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:21:53.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:22:24.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:22:50.000Z		dhcpd[70790]: DHCPACK on 10.30.4.9 to 24:df:a7:f0:ea:e4 via igb2.4000
2021-12-30T02:22:53.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:23:53.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:24:23.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:24:53.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:25:49.000Z		dhcpd[70790]: DHCPACK on 10.30.4.9 to 24:df:a7:f0:ea:e4 via igb2.4000
2021-12-30T02:25:53.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:26:23.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:26:53.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:27:53.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:28:24.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:28:53.000Z		dhcpd[70790]: DHCPACK on 10.30.4.9 to 24:df:a7:f0:ea:e4 via igb2.4000
2021-12-30T02:28:53.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:29:55.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:30:24.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:30:55.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:31:52.000Z		dhcpd[70790]: DHCPACK on 10.30.4.9 to 24:df:a7:f0:ea:e4 via igb2.4000
2021-12-30T02:31:55.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:32:23.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:32:55.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:33:55.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:34:23.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:34:52.000Z		dhcpd[70790]: DHCPACK on 10.30.4.9 to 24:df:a7:f0:ea:e4 via igb2.4000
2021-12-30T02:34:55.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:35:55.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:36:24.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:36:55.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:37:55.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:37:56.000Z		dhcpd[70790]: DHCPACK on 10.30.4.9 to 24:df:a7:f0:ea:e4 via igb2.4000
2021-12-30T02:38:24.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:38:57.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:39:57.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:40:24.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:40:55.000Z		dhcpd[70790]: DHCPACK on 10.30.4.9 to 24:df:a7:f0:ea:e4 via igb2.4000
2021-12-30T02:40:57.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:41:57.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:42:24.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:42:57.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:43:54.000Z		dhcpd[70790]: DHCPACK on 10.30.4.9 to 24:df:a7:f0:ea:e4 via igb2.4000
2021-12-30T02:43:57.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:44:24.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:44:57.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:45:57.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:46:24.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:46:57.000Z	10.0.1.50	10.30.4.9		udp	80	pass
2021-12-30T02:46:58.000Z		dhcpd[70790]: DHCPACK on 10.30.4.9 to 24:df:a7:f0:ea:e4 via igb2.4000

[felipediel]

No idea, but thanks for reporting this. Could you allow internet access and sniff the new ping packet with your firewall?

[mainTAP]

RM4C mini also doesn't work with the current ping packet.
Looking at the heartbeat, there is UDP communication from the RM4C_IP:16385 towards 13.52.64.71:1812 ( 5278v2main.broadlink.com.cn and also 5278v2backup.broadlink.com.cn when the first is not responding )

The UDP payload is changing :

0000   d2 7f df 02 01 00 8c 00 49 5b da 09 99 16 4a 04   ........I[....J.
0010   e9 e4 fe de 1b 82 da 09 48 5b da 0b 13 c7 e5 e4   ........H[......
0020   da 43 5a 59 22 8e 83 8f 15 07 94 63 3b 5d 00 6d   .CZY"......c;].m
0030   99 40 02 63 59 a4 9a e8 c8 98 e6 3e bd 25 17 d7   .@.cY......>.%..
0040   dc 51 98 a5 6a fa fb 95 6f d4 00 13 23 b7 db ac   .Q..j...o...#...
0050   7d 69 9c 2c 36 da 01 61 e3 7e 2a 85 c6 e9 fe 05   }i.,6..a.~*.....
0060   a4 b9 9c fd 14 de 3f cc 31 81 2c c2 9a ba 33 4f   ......?.1.,...3O
0070   87 f8 ed ec df 7f 05 66 22 28 51 7f 57 6d 7b bf   .......f"(Q.Wm{.
0080   a2 f9 33 3a 69 ad 1e 5a 53 d3 f9 c4               ..3:i..ZS...



0000   d2 7f df 02 01 00 8c 00 1a a8 dd 09 f2 e5 4d 04   ..............M.
0010   b8 4f 74 8e 48 71 dd 09 1b a8 dd 0b 40 34 e2 e4   .Ot.Hq......@4..
0020   89 b0 5d 59 71 7d 84 8f 46 f4 93 63 68 ae 07 6d   ..]Yq}..F..ch..m
0030   ca b3 05 63 0a 57 9d e8 9b 6b e1 3e 8e 21 9b 1c   ...c.W...k.>.!..
0040   d4 33 fc cc 58 48 15 ec 30 22 c0 4e c4 27 6d df   .3..XH..0".N.'m.
0050   fc 05 7e 03 d0 3e d0 a7 09 7b ba 32 e0 57 72 37   ..~..>...{.2.Wr7
0060   d0 51 78 46 db df 2d 49 8f 48 22 9b b0 e0 99 98   .QxF..-I.H".....
0070   ea ef 92 e0 a9 4a f0 a8 0b ef 1e 6b a6 00 5c d7   .....J.....k..\.
0080   74 82 a1 19 0d 96 8c 99 14 87 2a b5               t.........*.

[felipediel]

It changes because the message is encrypted. I can't devote myself to this right now, but if anyone is interested, these tools can be used to decrypt the communication.

[Write]

Would love to help more on this but I really don't know how to use my .cap binary files with broadlink-hacktools.
Right now it feels very wrong to have my network open for these devices

[jiehanzheng]

Does anyone happen to have a copy of one of the older firmwares that we could downgrade to?

Running into the same issue :(

[Write]

You can downgrade Broadlink devices ? I would love to do that too honestely it's so annoying.

[jiehanzheng]

You can downgrade Broadlink devices ? I would love to do that too honestely it's so annoying.

I managed to get a previous version firmware URL from Broadlink support, and tried to downgrade 3 times, and all 3 attempts failed.

Feel free to message them on Amazon or via email and see if it works for you. Hope you have better luck :)

[xxyyttxx]

The UDP payload is changing :

0000   d2 7f df 02 01 00 8c 00 49 5b da 09 99 16 4a 04   ........I[....J.

I captured same payloads which start with d2 7f df 02 01 00 8c/9c.
The old-style payloads should start with 5a a5 aa 55 5a a5 aa 55.
It seems that broadlink is using new way to encrypt payloads for its cloud ping.

[Write]

The UDP payload is changing :

0000   d2 7f df 02 01 00 8c 00 49 5b da 09 99 16 4a 04   ........I[....J.

I captured same payloads which start with d2 7f df 02 01 00 8c/9c. The old-style payloads should start with 5a a5 aa 55 5a a5 aa 55. It seems that broadlink is using new way to encrypt payloads for its cloud ping.

Did you use https://github.com/felipediel/broadlink-hacktools to actually decrypt it ? Otherwise it’s normal it’s always different since it’s encrypted.

[xxyyttxx]

The UDP payload is changing :

0000   d2 7f df 02 01 00 8c 00 49 5b da 09 99 16 4a 04   ........I[....J.

I captured same payloads which start with d2 7f df 02 01 00 8c/9c. The old-style payloads should start with 5a a5 aa 55 5a a5 aa 55. It seems that broadlink is using new way to encrypt payloads for its cloud ping.

Did you use https://github.com/felipediel/broadlink-hacktools to actually decrypt it ? Otherwise it’s normal it’s always different since it’s encrypted.

I have tried, and it output:

+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
|                                                                               Header                                                                                | Checksum | Error | Device type | Command | Counter |    MAC address    |  Device ID  | Payload checksum |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Encrypted payload                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Payload |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |  24 2b   | 33 06 |    bb 68    |  cb a0  |  7d f8  | de 38 da 61 92 49 | 54 97 45 c4 |      cc e8       | a5 39 1a 84 44 8d f4 bb 8e f9 64 fc 69 bf b4 bd 20 01 02 b9 81 9e e1 b6 8a da a5 68 a7 83 6c eb f1 66 c8 b5 03 78 b2 f2 fd 0f 4b 77 b0 9d ce 88 74 e0 2c f9 78 e2 d4 dd 59 a1 bc e9 f2 6d 18 7f 54 41 23 16 81 c8 5f 10 d5 8f be ba f1 15 20 ef 6b d0 d3 1f 0e 01 35 39 20 af d5 81 e6 30 86 e4 09 6c 10 59 05 88 a6 01 74 b7 32 00 07 df 1a 2f fa 26 88 5e fa 5b 98 36 c5 27 a9 0c e0 df 8f 83 70 bf 2c 8b 9b 7d 0a 21 5d ca a2 f2 d6 8f 2a ea c9 58 e4 92 7c 81 8a ec 46 fb 37 40 d3 0b 71 2d 71 95 7d 9c 95 49 1b f3 37 95 fa 59 41 3b af 06 a1 b0 d7 e3 13 46 27 51 27 fd 2d db 72 68 30 99 53 48 6f da d7 fd 69 2f 34 ac de 2e 1c aa f3 53 9a a8 35 04 a1 12 2e 3c b6 ec 9b 2e 18 bf 8d e4 20 9d 87 4f 51 c5 c2 11 0c b7 01 c6 49 a8 0b ce 56 88 5b ac 9b b0 fc cf 1f 71 93 75 92 c1 22 22 a3 6c 96 3b 32 eb 65 55 b7 1f 6a 2a 6d 5a ec 73 63 d1 55 a3 e4 ed de 8a 91 2f 9b c4 75 30 1c 9e 35 21 6e bf c4 71 c4 05 a0 63 4a 34 1a 66 f8 49 19 e2 f5 a1 90 de e9 35 95 fa 9b 4a 57 76 a0 d9 6f 7f 6d c0 5a 83 aa 8c |  None   |
| |        Checksum         | GMT offset  | Year  | Seconds | Minutes | Hours | Day of the week | Day in month | Month |   Padding   | Client address | Client port | |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |         |
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |         |
| | 57 f4 81 7e 7d 29 a4 3f | c9 7a 03 42 | c3 01 |   47    |   20    |  8a   |       d9        |      77      |  fd   | a2 b2 d4 3e |  54 bf 8e f7   |    f1 00    | |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |         |
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |         |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
+----+-----+-----+-----+-----+----+-----+----+-----+-----+---+----+-----+---+----+----+-----+-----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+-----+---+-----+-----+----+----+----+---+-----+-----+-----+-----+-----+-----+-----+----+-----+----+-----+----+----+-----+----+-----+-----+-----+----+----+-----+----+----+-----+----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+----+---+---+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+---+-----+-----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+-----+----+----+----+----+-----+-----+----+----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+-----+----+----+---+----+----+----+-----+-----+-----+-----+----+-----+-----+---+-----+----+----+---+-----+-----+---+-----+-----+----+---+---+-----+----+----+-----+----+-----+----+-----+----+-----+----+-----+----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+----+----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+----+----+-----+----+-----+----+-----+-----+-----+-----+-----+----+----+-----+----+-----+-----+----+----+----+-----+---+-----+-----+-----+-----+----+----+----+----+----+-----+----+-----+-----+-----+----+-----+----+----+-----+-----+-----+-----+-----+----+----+-----+-----+----+----+-----+-----+----+-----+-----+----+---+-----+----+----+----+-----+-----+-----+----+----+-----+-----+-----+----+-----+-----+----+----+-----+-----+----+----+-----+---+-----+----+-----+----+-----+----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+----+----+-----+-----+----+-----+----+-----+----+-----+----+-----+-----+----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+----+-----+----+----+-----+-----+-----+-----+-----+---+-----+----+----+----+----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+
| 57 | f4  | 81  | 7e  | 7d  | 29 | a4  | 3f | c9  | 7a  | 3 | 42 | c3  | 1 | 47 | 20 | 8a  | d9  | 77  | fd  | a2  | b2  | d4  | 3e | 54 | bf  | 8e  | f7  | f1  | 0 | 72  | ab  | 24 | 2b | 33 | 6 | bb  | 68  | cb  | a0  | 7d  | f8  | de  | 38 | da  | 61 | 92  | 49 | 54 | 97  | 45 | c4  | cc  | e8  | 4e | 24 | a5  | 39 | 1a | 84  | 44 | 8d  | f4  | bb  | 8e  | f9  | 64  | fc  | 69  | bf  | b4  | bd  | 20 | 1 | 2 | b9  | 81  | 9e  | e1  | b6  | 8a  | da  | a5  | 68  | a7  | 83  | 6c  | eb  | f1  | 66  | c8  | b5  | 3 | 78  | b2  | f2  | fd  | 0f | 4b | 77  | b0  | 9d  | ce  | 88  | 74  | e0  | 2c | f9  | 78  | e2  | d4  | dd  | 59 | a1  | bc  | e9  | f2  | 6d  | 18 | 7f  | 54 | 41 | 23 | 16 | 81  | c8  | 5f | 10 | d5  | 8f  | be  | ba  | f1  | 15 | 20 | ef  | 6b  | d0  | d3  | 1f | 0e | 1 | 35 | 39 | 20 | af  | d5  | 81  | e6  | 30 | 86  | e4  | 9 | 6c  | 10 | 59 | 5 | 88  | a6  | 1 | 74  | b7  | 32 | 0 | 7 | df  | 1a | 2f | fa  | 26 | 88  | 5e | fa  | 5b | 98  | 36 | c5  | 27 | a9  | 0c | e0  | df  | 8f  | 83  | 70  | bf  | 2c | 8b  | 9b  | 7d  | 0a | 21 | 5d | ca  | a2  | f2  | d6  | 8f  | 2a | ea  | c9  | 58 | e4  | 92  | 7c  | 81  | 8a  | ec  | 46 | fb  | 37 | 40 | d3  | 0b | 71  | 2d | 71  | 95  | 7d  | 9c  | 95  | 49 | 1b | f3  | 37 | 95  | fa  | 59 | 41 | 3b | af  | 6 | a1  | b0  | d7  | e3  | 13 | 46 | 27 | 51 | 27 | fd  | 2d | db  | 72  | 68  | 30 | 99  | 53 | 48 | 6f  | da  | d7  | fd  | 69  | 2f | 34 | ac  | de  | 2e | 1c | aa  | f3  | 53 | 9a  | a8  | 35 | 4 | a1  | 12 | 2e | 3c | b6  | ec  | 9b  | 2e | 18 | bf  | 8d  | e4  | 20 | 9d  | 87  | 4f | 51 | c5  | c2  | 11 | 0c | b7  | 1 | c6  | 49 | a8  | 0b | ce  | 56 | 88  | 5b | ac  | 9b  | b0  | fc  | cf  | 1f | 71  | 93  | 75  | 92  | c1  | 22 | 22 | a3  | 6c  | 96  | 3b | 32 | eb  | 65  | 55 | b7  | 1f | 6a  | 2a | 6d  | 5a | ec  | 73  | 63 | d1  | 55 | a3  | e4  | ed  | de  | 8a  | 91  | 2f | 9b  | c4  | 75  | 30 | 1c | 9e  | 35 | 21 | 6e  | bf  | c4  | 71  | c4  | 5 | a0  | 63 | 4a | 34 | 1a | 66  | f8  | 49 | 19 | e2  | f5  | a1  | 90  | de  | e9  | 35 | 95  | fa  | 9b  | 4a | 57 | 76  | a0  | d9  | 6f  | 7f  | 6d  | c0  | 5a | 83  | aa  | 8c  |
+----+-----+-----+-----+-----+----+-----+----+-----+-----+---+----+-----+---+----+----+-----+-----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+-----+---+-----+-----+----+----+----+---+-----+-----+-----+-----+-----+-----+-----+----+-----+----+-----+----+----+-----+----+-----+-----+-----+----+----+-----+----+----+-----+----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+----+---+---+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+---+-----+-----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+-----+----+----+----+----+-----+-----+----+----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+-----+----+----+---+----+----+----+-----+-----+-----+-----+----+-----+-----+---+-----+----+----+---+-----+-----+---+-----+-----+----+---+---+-----+----+----+-----+----+-----+----+-----+----+-----+----+-----+----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+----+----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+----+----+-----+----+-----+----+-----+-----+-----+-----+-----+----+----+-----+----+-----+-----+----+----+----+-----+---+-----+-----+-----+-----+----+----+----+----+----+-----+----+-----+-----+-----+----+-----+----+----+-----+-----+-----+-----+-----+----+----+-----+-----+----+----+-----+-----+----+-----+-----+----+---+-----+----+----+----+-----+-----+-----+----+----+-----+-----+-----+----+-----+-----+----+----+-----+-----+----+----+-----+---+-----+----+-----+----+-----+----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+----+----+-----+-----+----+-----+----+-----+----+-----+----+-----+-----+----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+----+-----+----+----+-----+-----+-----+-----+-----+---+-----+----+----+----+----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+
| 87 | 244 | 129 | 126 | 125 | 41 | 164 | 63 | 201 | 122 | 3 | 66 | 195 | 1 | 71 | 32 | 138 | 217 | 119 | 253 | 162 | 178 | 212 | 62 | 84 | 191 | 142 | 247 | 241 | 0 | 114 | 171 | 36 | 43 | 51 | 6 | 187 | 104 | 203 | 160 | 125 | 248 | 222 | 56 | 218 | 97 | 146 | 73 | 84 | 151 | 69 | 196 | 204 | 232 | 78 | 36 | 165 | 57 | 26 | 132 | 68 | 141 | 244 | 187 | 142 | 249 | 100 | 252 | 105 | 191 | 180 | 189 | 32 | 1 | 2 | 185 | 129 | 158 | 225 | 182 | 138 | 218 | 165 | 104 | 167 | 131 | 108 | 235 | 241 | 102 | 200 | 181 | 3 | 120 | 178 | 242 | 253 | 15 | 75 | 119 | 176 | 157 | 206 | 136 | 116 | 224 | 44 | 249 | 120 | 226 | 212 | 221 | 89 | 161 | 188 | 233 | 242 | 109 | 24 | 127 | 84 | 65 | 35 | 22 | 129 | 200 | 95 | 16 | 213 | 143 | 190 | 186 | 241 | 21 | 32 | 239 | 107 | 208 | 211 | 31 | 14 | 1 | 53 | 57 | 32 | 175 | 213 | 129 | 230 | 48 | 134 | 228 | 9 | 108 | 16 | 89 | 5 | 136 | 166 | 1 | 116 | 183 | 50 | 0 | 7 | 223 | 26 | 47 | 250 | 38 | 136 | 94 | 250 | 91 | 152 | 54 | 197 | 39 | 169 | 12 | 224 | 223 | 143 | 131 | 112 | 191 | 44 | 139 | 155 | 125 | 10 | 33 | 93 | 202 | 162 | 242 | 214 | 143 | 42 | 234 | 201 | 88 | 228 | 146 | 124 | 129 | 138 | 236 | 70 | 251 | 55 | 64 | 211 | 11 | 113 | 45 | 113 | 149 | 125 | 156 | 149 | 73 | 27 | 243 | 55 | 149 | 250 | 89 | 65 | 59 | 175 | 6 | 161 | 176 | 215 | 227 | 19 | 70 | 39 | 81 | 39 | 253 | 45 | 219 | 114 | 104 | 48 | 153 | 83 | 72 | 111 | 218 | 215 | 253 | 105 | 47 | 52 | 172 | 222 | 46 | 28 | 170 | 243 | 83 | 154 | 168 | 53 | 4 | 161 | 18 | 46 | 60 | 182 | 236 | 155 | 46 | 24 | 191 | 141 | 228 | 32 | 157 | 135 | 79 | 81 | 197 | 194 | 17 | 12 | 183 | 1 | 198 | 73 | 168 | 11 | 206 | 86 | 136 | 91 | 172 | 155 | 176 | 252 | 207 | 31 | 113 | 147 | 117 | 146 | 193 | 34 | 34 | 163 | 108 | 150 | 59 | 50 | 235 | 101 | 85 | 183 | 31 | 106 | 42 | 109 | 90 | 236 | 115 | 99 | 209 | 85 | 163 | 228 | 237 | 222 | 138 | 145 | 47 | 155 | 196 | 117 | 48 | 28 | 158 | 53 | 33 | 110 | 191 | 196 | 113 | 196 | 5 | 160 | 99 | 74 | 52 | 26 | 102 | 248 | 73 | 25 | 226 | 245 | 161 | 144 | 222 | 233 | 53 | 149 | 250 | 155 | 74 | 87 | 118 | 160 | 217 | 111 | 127 | 109 | 192 | 90 | 131 | 170 | 140 |
+----+-----+-----+-----+-----+----+-----+----+-----+-----+---+----+-----+---+----+----+-----+-----+-----+-----+-----+-----+-----+----zz+----+-----+-----+-----+-----+---+-----+-----+----+----+----+---+-----+-----+-----+-----+-----+-----+-----+----+-----+----+-----+----+----+-----+----+-----+-----+-----+----+----+-----+----+----+-----+----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+----+---+---+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+---+-----+-----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+-----+----+----+----+----+-----+-----+----+----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+-----+----+----+---+----+----+----+-----+-----+-----+-----+----+-----+-----+---+-----+----+----+---+-----+-----+---+-----+-----+----+---+---+-----+----+----+-----+----+-----+----+-----+----+-----+----+-----+----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+----+----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+----+----+-----+----+-----+----+-----+-----+-----+-----+-----+----+----+-----+----+-----+-----+----+----+----+-----+---+-----+-----+-----+-----+----+----+----+----+----+-----+----+-----+-----+-----+----+-----+----+----+-----+-----+-----+-----+-----+----+----+-----+-----+----+----+-----+-----+----+-----+-----+----+---+-----+----+----+----+-----+-----+-----+----+----+-----+-----+-----+----+-----+-----+----+----+-----+-----+----+----+-----+---+-----+----+-----+----+-----+----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+----+----+-----+-----+----+-----+----+-----+----+-----+----+-----+-----+----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+----+-----+----+----+-----+-----+-----+-----+-----+---+-----+----+----+----+----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+

+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
|                                                                               Header                                                                                | Checksum | Error | Device type | Command | Counter |    MAC address    |  Device ID  | Payload checksum |                                                                                                                                              Encrypted payload                                                                                                                                              | Payload |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |  e0 4c   | 26 65 |    4f 49    |  cf 2f  |  64 13  | 19 93 71 15 3a b1 | 92 62 5f 13 |      a7 28       | 79 8e e0 2c fb 09 d2 66 6b ed d2 74 eb ec 51 e8 51 c4 d8 f0 64 73 49 7d b7 49 a4 48 c4 66 d5 1b 2d 36 0e d8 19 33 90 3f 58 91 5f 39 a9 7b ec f6 96 0f 91 f4 ff 8b c8 81 44 d7 94 1b a0 f5 96 09 f7 38 71 cb 68 2d f3 a4 44 0e 65 f9 40 1b 08 f9 07 1c b2 fc 5a 4d 5a 10 68 8a 81 cb 03 2a ce 29 ff 76 e8 87 |  None   |
| |        Checksum         | GMT offset  | Year  | Seconds | Minutes | Hours | Day of the week | Day in month | Month |   Padding   | Client address | Client port | |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                             |         |
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                             |         |
| | d2 7f df 02 01 00 9c 00 | c0 e8 00 00 | c3 e0 |   90    |   0e    |  fe   |       c0        |      c8      |  fe   | 76 2a 00 00 |  c1 e8 00 02   |    1b de    | |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                             |         |
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                             |         |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
+-----+-----+-----+---+---+---+-----+---+-----+-----+---+---+-----+-----+-----+----+-----+-----+-----+-----+-----+----+---+---+-----+-----+---+---+----+-----+-----+-----+-----+----+----+-----+----+----+-----+----+-----+----+----+-----+-----+----+----+-----+-----+----+----+----+-----+----+-----+---+-----+-----+-----+----+-----+---+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+----+-----+-----+-----+----+----+----+----+-----+----+----+-----+----+----+-----+----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+-----+-----+---+-----+----+-----+-----+-----+----+-----+-----+----+----+-----+-----+----+----+---+-----+---+----+-----+-----+----+----+----+----+-----+-----+-----+-----+---+----+-----+----+-----+-----+-----+-----+
| d2  | 7f  | df  | 2 | 1 | 0 | 9c  | 0 | c0  | e8  | 0 | 0 | c3  | e0  | 90  | 0e | fe  | c0  | c8  | fe  | 76  | 2a | 0 | 0 | c1  | e8  | 0 | 2 | 1b | de  | d1  | 97  | e0  | 4c | 26 | 65  | 4f | 49 | cf  | 2f | 64  | 13 | 19 | 93  | 71  | 15 | 3a | b1  | 92  | 62 | 5f | 13 | a7  | 28 | 7b  | 1 | 79  | 8e  | e0  | 2c | fb  | 9 | d2  | 66  | 6b  | ed  | d2  | 74  | eb  | ec  | 51 | e8  | 51 | c4  | d8  | f0  | 64  | 73  | 49 | 7d  | b7  | 49 | a4  | 48 | c4  | 66  | d5  | 1b | 2d | 36 | 0e | d8  | 19 | 33 | 90  | 3f | 58 | 91  | 5f | 39 | a9  | 7b  | ec  | f6  | 96  | 0f | 91  | f4  | ff  | 8b  | c8  | 81  | 44 | d7  | 94  | 1b | a0  | f5  | 96  | 9 | f7  | 38 | 71  | cb  | 68  | 2d | f3  | a4  | 44 | 0e | 65  | f9  | 40 | 1b | 8 | f9  | 7 | 1c | b2  | fc  | 5a | 4d | 5a | 10 | 68  | 8a  | 81  | cb  | 3 | 2a | ce  | 29 | ff  | 76  | e8  | 87  |
+-----+-----+-----+---+---+---+-----+---+-----+-----+---+---+-----+-----+-----+----+-----+-----+-----+-----+-----+----+---+---+-----+-----+---+---+----+-----+-----+-----+-----+----+----+-----+----+----+-----+----+-----+----+----+-----+-----+----+----+-----+-----+----+----+----+-----+----+-----+---+-----+-----+-----+----+-----+---+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+----+-----+-----+-----+----+----+----+----+-----+----+----+-----+----+----+-----+----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+-----+-----+---+-----+----+-----+-----+-----+----+-----+-----+----+----+-----+-----+----+----+---+-----+---+----+-----+-----+----+----+----+----+-----+-----+-----+-----+---+----+-----+----+-----+-----+-----+-----+
| 210 | 127 | 223 | 2 | 1 | 0 | 156 | 0 | 192 | 232 | 0 | 0 | 195 | 224 | 144 | 14 | 254 | 192 | 200 | 254 | 118 | 42 | 0 | 0 | 193 | 232 | 0 | 2 | 27 | 222 | 209 | 151 | 224 | 76 | 38 | 101 | 79 | 73 | 207 | 47 | 100 | 19 | 25 | 147 | 113 | 21 | 58 | 177 | 146 | 98 | 95 | 19 | 167 | 40 | 123 | 1 | 121 | 142 | 224 | 44 | 251 | 9 | 210 | 102 | 107 | 237 | 210 | 116 | 235 | 236 | 81 | 232 | 81 | 196 | 216 | 240 | 100 | 115 | 73 | 125 | 183 | 73 | 164 | 72 | 196 | 102 | 213 | 27 | 45 | 54 | 14 | 216 | 25 | 51 | 144 | 63 | 88 | 145 | 95 | 57 | 169 | 123 | 236 | 246 | 150 | 15 | 145 | 244 | 255 | 139 | 200 | 129 | 68 | 215 | 148 | 27 | 160 | 245 | 150 | 9 | 247 | 56 | 113 | 203 | 104 | 45 | 243 | 164 | 68 | 14 | 101 | 249 | 64 | 27 | 8 | 249 | 7 | 28 | 178 | 252 | 90 | 77 | 90 | 16 | 104 | 138 | 129 | 203 | 3 | 42 | 206 | 41 | 255 | 118 | 232 | 135 |
+-----+-----+-----+---+---+---+-----+---+-----+-----+---+---+-----+-----+-----+----+-----+-----+-----+-----+-----+----+---+---+-----+-----+---+---+----+-----+-----+-----+-----+----+----+-----+----+----+-----+----+-----+----+----+-----+-----+----+----+-----+-----+----+----+----+-----+----+-----+---+-----+-----+-----+----+-----+---+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+----+-----+-----+-----+----+----+----+----+-----+----+----+-----+----+----+-----+----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+-----+-----+---+-----+----+-----+-----+-----+----+-----+-----+----+----+-----+-----+----+----+---+-----+---+----+-----+-----+----+----+----+----+-----+-----+-----+-----+---+----+-----+----+-----+-----+-----+-----+

+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
|                                                                               Header                                                                                | Checksum | Error | Device type | Command | Counter |    MAC address    |  Device ID  | Payload checksum |                                                                                                                      Encrypted payload                                                                                                                      | Payload |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |  d2 ab   | 73 b8 |    7d ae    |  9a f2  |  56 f4  | 4c 4e 43 f2 6f 6c | a0 85 0a ce |      95 cf       | 4b 69 b5 f1 0b 2a 3f f1 c8 9f f8 d9 ac b5 38 c5 4b 5e 69 ef b8 76 00 51 e1 a2 c9 f8 c8 18 da 71 9c 74 e0 1b 0f 21 ea 93 56 f5 f2 41 c5 a5 15 b2 28 28 fd f3 de be 7e 94 0e 41 32 1d d7 12 75 76 54 f3 5e 60 25 17 f5 b3 9a f3 7d ab be 1d dc 81 39 48 19 6e |  None   |
| |        Checksum         | GMT offset  | Year  | Seconds | Minutes | Hours | Day of the week | Day in month | Month |   Padding   | Client address | Client port | |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                             |         |
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                             |         |
| | d2 7f df 02 01 00 8c 00 | f2 0f 55 dd | ee 07 |   c5    |   d3    |  51   |       d4        |      69      |  b2   | 44 cd 55 dd |  f3 0f 55 df   |    29 39    | |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                             |         |
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                             |         |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
+-----+-----+-----+---+---+---+-----+---+-----+----+----+-----+-----+---+-----+-----+----+-----+-----+-----+----+-----+----+-----+-----+----+----+-----+----+----+-----+----+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+----+----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+-----+----+-----+-----+-----+----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+----+----+-----+-----+-----+-----+---+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+----+----+-----+-----+----+-----+-----+----+-----+-----+----+-----+----+----+-----+-----+-----+-----+-----+-----+----+----+----+----+-----+----+-----+-----+----+-----+----+----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+----+----+----+-----+
| d2  | 7f  | df  | 2 | 1 | 0 | 8c  | 0 | f2  | 0f | 55 | dd  | ee  | 7 | c5  | d3  | 51 | d4  | 69  | b2  | 44 | cd  | 55 | dd  | f3  | 0f | 55 | df  | 29 | 39 | 84  | 4a | d2  | ab  | 73  | b8  | 7d  | ae  | 9a  | f2  | 56 | f4  | 4c | 4e | 43 | f2  | 6f  | 6c  | a0  | 85  | 0a | ce  | 95  | cf  | 2e | dc  | 4b | 69  | b5  | f1  | 0b | 2a | 3f | f1  | c8  | 9f  | f8  | d9  | ac  | b5  | 38 | c5  | 4b | 5e | 69  | ef  | b8  | 76  | 0 | 51 | e1  | a2  | c9  | f8  | c8  | 18 | da  | 71  | 9c  | 74  | e0  | 1b | 0f | 21 | ea  | 93  | 56 | f5  | f2  | 41 | c5  | a5  | 15 | b2  | 28 | 28 | fd  | f3  | de  | be  | 7e  | 94  | 0e | 41 | 32 | 1d | d7  | 12 | 75  | 76  | 54 | f3  | 5e | 60 | 25 | 17 | f5  | b3  | 9a  | f3  | 7d  | ab  | be  | 1d | dc  | 81  | 39 | 48 | 19 | 6e  |
+-----+-----+-----+---+---+---+-----+---+-----+----+----+-----+-----+---+-----+-----+----+-----+-----+-----+----+-----+----+-----+-----+----+----+-----+----+----+-----+----+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+----+----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+-----+----+-----+-----+-----+----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+----+----+-----+-----+-----+-----+---+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+----+----+-----+-----+----+-----+-----+----+-----+-----+----+-----+----+----+-----+-----+-----+-----+-----+-----+----+----+----+----+-----+----+-----+-----+----+-----+----+----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+----+----+----+-----+
| 210 | 127 | 223 | 2 | 1 | 0 | 140 | 0 | 242 | 15 | 85 | 221 | 238 | 7 | 197 | 211 | 81 | 212 | 105 | 178 | 68 | 205 | 85 | 221 | 243 | 15 | 85 | 223 | 41 | 57 | 132 | 74 | 210 | 171 | 115 | 184 | 125 | 174 | 154 | 242 | 86 | 244 | 76 | 78 | 67 | 242 | 111 | 108 | 160 | 133 | 10 | 206 | 149 | 207 | 46 | 220 | 75 | 105 | 181 | 241 | 11 | 42 | 63 | 241 | 200 | 159 | 248 | 217 | 172 | 181 | 56 | 197 | 75 | 94 | 105 | 239 | 184 | 118 | 0 | 81 | 225 | 162 | 201 | 248 | 200 | 24 | 218 | 113 | 156 | 116 | 224 | 27 | 15 | 33 | 234 | 147 | 86 | 245 | 242 | 65 | 197 | 165 | 21 | 178 | 40 | 40 | 253 | 243 | 222 | 190 | 126 | 148 | 14 | 65 | 50 | 29 | 215 | 18 | 117 | 118 | 84 | 243 | 94 | 96 | 37 | 23 | 245 | 179 | 154 | 243 | 125 | 171 | 190 | 29 | 220 | 129 | 57 | 72 | 25 | 110 |
+-----+-----+-----+---+---+---+-----+---+-----+----+----+-----+-----+---+-----+-----+----+-----+-----+-----+----+-----+----+-----+-----+----+----+-----+----+----+-----+----+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+----+----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+-----+----+-----+-----+-----+----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+----+----+-----+-----+-----+-----+---+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+----+----+-----+-----+----+-----+-----+----+-----+-----+----+-----+----+----+-----+-----+-----+-----+-----+-----+----+----+----+----+-----+----+-----+-----+----+-----+----+----+----+----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+----+----+----+-----+

+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
|                                                                               Header                                                                                | Checksum | Error | Device type | Command | Counter |    MAC address    |  Device ID  | Payload checksum |                                                                                                                                              Encrypted payload                                                                                                                                              | Payload |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |  e1 4c   | 26 65 |    4e 49    |  cf 2f  |  65 13  | 19 93 70 15 3a b1 | 93 62 5f 13 |      a6 28       | 78 8e e0 2c 38 cd 6a 2c fb 78 ad 04 9f 52 6d 18 78 b9 3c 32 24 df 65 8d cb 04 16 d0 d8 e8 a6 4c e6 7e ea 09 d9 8a fd 7e bb d6 fd f2 18 f9 f5 f7 2e 7f 98 a6 bf be f9 a2 a4 ed 16 b4 c8 28 f1 d3 c6 a2 6b 49 a4 37 6d 5c 3c f6 27 12 e2 b2 34 ae 3e 90 ed 7f 32 1d 8b 2c 73 96 b0 6a 14 46 42 6c 3c 43 e8 66 |  None   |
| |        Checksum         | GMT offset  | Year  | Seconds | Minutes | Hours | Day of the week | Day in month | Month |   Padding   | Client address | Client port | |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                             |         |
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                             |         |
| | d2 7f df 02 01 00 9c 00 | c1 e8 00 00 | dd e0 |   90    |   0e    |  62   |       33        |      3c      |  6f   | 77 2a 00 00 |  c0 e8 00 02   |    1a de    | |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                             |         |
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                                                                             |         |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
+-----+-----+-----+---+---+---+-----+---+-----+-----+---+---+-----+-----+-----+----+----+----+----+-----+-----+----+---+---+-----+-----+---+---+----+-----+-----+-----+-----+----+----+-----+----+----+-----+----+-----+----+----+-----+-----+----+----+-----+-----+----+----+----+-----+----+-----+---+-----+-----+-----+----+----+-----+-----+----+-----+-----+-----+---+-----+----+-----+----+-----+-----+----+----+----+-----+-----+-----+-----+---+----+-----+-----+-----+-----+----+-----+-----+-----+---+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+-----+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+-----+-----+-----+-----+----+-----+----+-----+----+----+-----+----+----+-----+-----+----+-----+----+-----+-----+-----+----+----+-----+----+-----+-----+-----+-----+----+----+----+-----+----+----+-----+-----+
| d2  | 7f  | df  | 2 | 1 | 0 | 9c  | 0 | c1  | e8  | 0 | 0 | dd  | e0  | 90  | 0e | 62 | 33 | 3c | 6f  | 77  | 2a | 0 | 0 | c0  | e8  | 0 | 2 | 1a | de  | d1  | 97  | e1  | 4c | 26 | 65  | 4e | 49 | cf  | 2f | 65  | 13 | 19 | 93  | 70  | 15 | 3a | b1  | 93  | 62 | 5f | 13 | a6  | 28 | 7b  | 1 | 78  | 8e  | e0  | 2c | 38 | cd  | 6a  | 2c | fb  | 78  | ad  | 4 | 9f  | 52 | 6d  | 18 | 78  | b9  | 3c | 32 | 24 | df  | 65  | 8d  | cb  | 4 | 16 | d0  | d8  | e8  | a6  | 4c | e6  | 7e  | ea  | 9 | d9  | 8a  | fd  | 7e  | bb  | d6  | fd  | f2  | 18 | f9  | f5  | f7  | 2e | 7f  | 98  | a6  | bf  | be  | f9  | a2  | a4  | ed  | 16 | b4  | c8  | 28 | f1  | d3  | c6  | a2  | 6b  | 49 | a4  | 37 | 6d  | 5c | 3c | f6  | 27 | 12 | e2  | b2  | 34 | ae  | 3e | 90  | ed  | 7f  | 32 | 1d | 8b  | 2c | 73  | 96  | b0  | 6a  | 14 | 46 | 42 | 6c  | 3c | 43 | e8  | 66  |
+-----+-----+-----+---+---+---+-----+---+-----+-----+---+---+-----+-----+-----+----+----+----+----+-----+-----+----+---+---+-----+-----+---+---+----+-----+-----+-----+-----+----+----+-----+----+----+-----+----+-----+----+----+-----+-----+----+----+-----+-----+----+----+----+-----+----+-----+---+-----+-----+-----+----+----+-----+-----+----+-----+-----+-----+---+-----+----+-----+----+-----+-----+----+----+----+-----+-----+-----+-----+---+----+-----+-----+-----+-----+----+-----+-----+-----+---+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+-----+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+-----+-----+-----+-----+----+-----+----+-----+----+----+-----+----+----+-----+-----+----+-----+----+-----+-----+-----+----+----+-----+----+-----+-----+-----+-----+----+----+----+-----+----+----+-----+-----+
| 210 | 127 | 223 | 2 | 1 | 0 | 156 | 0 | 193 | 232 | 0 | 0 | 221 | 224 | 144 | 14 | 98 | 51 | 60 | 111 | 119 | 42 | 0 | 0 | 192 | 232 | 0 | 2 | 26 | 222 | 209 | 151 | 225 | 76 | 38 | 101 | 78 | 73 | 207 | 47 | 101 | 19 | 25 | 147 | 112 | 21 | 58 | 177 | 147 | 98 | 95 | 19 | 166 | 40 | 123 | 1 | 120 | 142 | 224 | 44 | 56 | 205 | 106 | 44 | 251 | 120 | 173 | 4 | 159 | 82 | 109 | 24 | 120 | 185 | 60 | 50 | 36 | 223 | 101 | 141 | 203 | 4 | 22 | 208 | 216 | 232 | 166 | 76 | 230 | 126 | 234 | 9 | 217 | 138 | 253 | 126 | 187 | 214 | 253 | 242 | 24 | 249 | 245 | 247 | 46 | 127 | 152 | 166 | 191 | 190 | 249 | 162 | 164 | 237 | 22 | 180 | 200 | 40 | 241 | 211 | 198 | 162 | 107 | 73 | 164 | 55 | 109 | 92 | 60 | 246 | 39 | 18 | 226 | 178 | 52 | 174 | 62 | 144 | 237 | 127 | 50 | 29 | 139 | 44 | 115 | 150 | 176 | 106 | 20 | 70 | 66 | 108 | 60 | 67 | 232 | 102 |
+-----+-----+-----+---+---+---+-----+---+-----+-----+---+---+-----+-----+-----+----+----+----+----+-----+-----+----+---+---+-----+-----+---+---+----+-----+-----+-----+-----+----+----+-----+----+----+-----+----+-----+----+----+-----+-----+----+----+-----+-----+----+----+----+-----+----+-----+---+-----+-----+-----+----+----+-----+-----+----+-----+-----+-----+---+-----+----+-----+----+-----+-----+----+----+----+-----+-----+-----+-----+---+----+-----+-----+-----+-----+----+-----+-----+-----+---+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+-----+----+-----+-----+-----+-----+-----+-----+-----+-----+-----+----+-----+-----+----+-----+-----+-----+-----+-----+----+-----+----+-----+----+----+-----+----+----+-----+-----+----+-----+----+-----+-----+-----+----+----+-----+----+-----+-----+-----+-----+----+----+----+-----+----+----+-----+-----+

+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
|                                                                               Header                                                                                | Checksum | Error | Device type | Command | Counter |    MAC address    |  Device ID  | Payload checksum |                                                                                                                      Encrypted payload                                                                                                                      | Payload |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |  e3 86   | 71 b8 |    4c 83    |  98 f2  |  67 d9  | 4e 4e 72 df 6d 6c | 91 a8 08 ce |      a4 e2       | 7a 44 b7 f1 31 b2 51 b6 e4 fa 52 ab 2c b1 d4 30 93 37 26 5b b3 79 93 46 a8 b0 3e 62 a6 4a b1 e1 7b e4 f1 23 6b b0 f4 e0 fb c9 5b e7 0a 37 47 3c e6 2c 0a 7e b2 8b 96 e0 65 44 dd 3b 19 8d 12 08 cf 6f 2d 10 df 34 4a 47 81 07 39 7e 72 9b 26 11 17 23 04 b8 |  None   |
| |        Checksum         | GMT offset  | Year  | Seconds | Minutes | Hours | Day of the week | Day in month | Month |   Padding   | Client address | Client port | |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                             |         |
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                             |         |
| | d2 7f df 02 01 00 8c 00 | c3 22 57 dd | f6 2a |   c7    |   d3    |  0f   |       19        |      f1      |  f3   | 75 e0 57 dd |  c2 22 57 df   |    18 14    | |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                             |         |
| +-------------------------+-------------+-------+---------+---------+-------+-----------------+--------------+-------+-------------+----------------+-------------+ |          |       |             |         |         |                   |             |                  |                                                                                                                                                                                                                                                             |         |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------+-------------+---------+---------+-------------------+-------------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+---------+
+-----+-----+-----+---+---+---+-----+---+-----+----+----+-----+-----+----+-----+-----+----+----+-----+-----+-----+-----+----+-----+-----+----+----+-----+----+----+-----+----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+---+-----+-----+-----+----+-----+-----+----+-----+-----+----+-----+----+-----+-----+-----+----+-----+----+-----+-----+----+-----+----+----+----+-----+-----+-----+----+-----+-----+----+----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+----+----+----+----+-----+----+----+-----+-----+-----+-----+-----+-----+----+-----+----+----+-----+----+---+-----+-----+----+----+-----+----+----+----+-----+---+----+-----+-----+-----+----+----+----+----+---+-----+
| d2  | 7f  | df  | 2 | 1 | 0 | 8c  | 0 | c3  | 22 | 57 | dd  | f6  | 2a | c7  | d3  | 0f | 19 | f1  | f3  | 75  | e0  | 57 | dd  | c2  | 22 | 57 | df  | 18 | 14 | 86  | 4a | e3  | 86  | 71  | b8  | 4c | 83  | 98  | f2  | 67  | d9  | 4e | 4e | 72  | df  | 6d  | 6c  | 91  | a8  | 8 | ce  | a4  | e2  | 2c | dc  | 7a  | 44 | b7  | f1  | 31 | b2  | 51 | b6  | e4  | fa  | 52 | ab  | 2c | b1  | d4  | 30 | 93  | 37 | 26 | 5b | b3  | 79  | 93  | 46 | a8  | b0  | 3e | 62 | a6  | 4a | b1  | e1  | 7b  | e4  | f1  | 23 | 6b  | b0  | f4  | e0  | fb  | c9  | 5b | e7  | 0a | 37 | 47 | 3c | e6  | 2c | 0a | 7e  | b2  | 8b  | 96  | e0  | 65  | 44 | dd  | 3b | 19 | 8d  | 12 | 8 | cf  | 6f  | 2d | 10 | df  | 34 | 4a | 47 | 81  | 7 | 39 | 7e  | 72  | 9b  | 26 | 11 | 17 | 23 | 4 | b8  |
+-----+-----+-----+---+---+---+-----+---+-----+----+----+-----+-----+----+-----+-----+----+----+-----+-----+-----+-----+----+-----+-----+----+----+-----+----+----+-----+----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+---+-----+-----+-----+----+-----+-----+----+-----+-----+----+-----+----+-----+-----+-----+----+-----+----+-----+-----+----+-----+----+----+----+-----+-----+-----+----+-----+-----+----+----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+----+----+----+----+-----+----+----+-----+-----+-----+-----+-----+-----+----+-----+----+----+-----+----+---+-----+-----+----+----+-----+----+----+----+-----+---+----+-----+-----+-----+----+----+----+----+---+-----+
| 210 | 127 | 223 | 2 | 1 | 0 | 140 | 0 | 195 | 34 | 87 | 221 | 246 | 42 | 199 | 211 | 15 | 25 | 241 | 243 | 117 | 224 | 87 | 221 | 194 | 34 | 87 | 223 | 24 | 20 | 134 | 74 | 227 | 134 | 113 | 184 | 76 | 131 | 152 | 242 | 103 | 217 | 78 | 78 | 114 | 223 | 109 | 108 | 145 | 168 | 8 | 206 | 164 | 226 | 44 | 220 | 122 | 68 | 183 | 241 | 49 | 178 | 81 | 182 | 228 | 250 | 82 | 171 | 44 | 177 | 212 | 48 | 147 | 55 | 38 | 91 | 179 | 121 | 147 | 70 | 168 | 176 | 62 | 98 | 166 | 74 | 177 | 225 | 123 | 228 | 241 | 35 | 107 | 176 | 244 | 224 | 251 | 201 | 91 | 231 | 10 | 55 | 71 | 60 | 230 | 44 | 10 | 126 | 178 | 139 | 150 | 224 | 101 | 68 | 221 | 59 | 25 | 141 | 18 | 8 | 207 | 111 | 45 | 16 | 223 | 52 | 74 | 71 | 129 | 7 | 57 | 126 | 114 | 155 | 38 | 17 | 23 | 35 | 4 | 184 |
+-----+-----+-----+---+---+---+-----+---+-----+----+----+-----+-----+----+-----+-----+----+----+-----+-----+-----+-----+----+-----+-----+----+----+-----+----+----+-----+----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+----+----+-----+-----+-----+-----+-----+-----+---+-----+-----+-----+----+-----+-----+----+-----+-----+----+-----+----+-----+-----+-----+----+-----+----+-----+-----+----+-----+----+----+----+-----+-----+-----+----+-----+-----+----+----+-----+----+-----+-----+-----+-----+-----+----+-----+-----+-----+-----+-----+-----+----+-----+----+----+----+----+-----+----+----+-----+-----+-----+-----+-----+-----+----+-----+----+----+-----+----+---+-----+-----+----+----+-----+----+----+----+-----+---+----+-----+-----+-----+----+----+----+----+---+-----+

I presume that the hacktools cannot deal with it.
what's more, I found that 229 out of 252 payloads in the repo are start with 5aa5, and others are start with 0000, which also support my view.

What about your opinion?

[Write]

@felipediel Please help us, what whould you need ? 😭

[felipediel]

Indeed, the hacktools cannot deal with it, the packets have a different structure. The way is to reverse engineer the new firmware and try to understand the structure of the packets and the type of encryption used. This task takes some time and I cannot dedicate myself to it. If anyone can replicate a working watchdog packet, I'll be happy to turn it into production code.

[pablolucas890]

Same problem for RM4 MINI with V52078 / V52079 Firmware Version =/

[andreluis034]

I bought two rm4c mini both have the firmware 52079 and they periodically ping a http server at http://25913service.ibroadlink.com/devactiva/v2/devactiva After 3 minutes of trying and failing, they reboot.

Unfortunately the content is encrypted with what I assume to be also AES-CBC with a constant IV. This is the captured packet:

The reason I believe they are AES-CBC with a constant IV and key, is that both the initial request only differ at the end, probably due to a timestamp. Logging the requests I get:

::ffff:192.168.99.36 3fe609fc32211da63ec868421ae2d663fea27b780d927f92a3bd5a4e0614b364e764194774086e7f1b09e442e2c5a3aecb9d876116592d725ebe738d5c668bb6c6dac146361abd51d2f9f8dfec591eeb0dd7340986707f30b3285a8881398c70eaf57c4dacf260fdac8249e2a57221749f7e46fe6fc5d55c9baa1ce8a5539859b984efa3b700d4825631bf4da4df71a134af6299c4d51c606593fa0fb2b2405e06ef4188df291a757a5db5c673a718a0c5b47b6d447676180f16f2b0fb8089e730fc4ee3f5941ddffd82bb371e9c97a4e9fd64591151d4d1dafba4c1ffee4acb189691d7924400b080283de56f2202dd245af0949edab4b2d98e74156ea2ab5a2b394d94521b5c54773d5bc2498f81579f05c664b20fff31188098ee28d02868ed156b6f0337b1cd0e8346e11f7f0801
::ffff:192.168.99.36 3fe609fc32211da63ec868421ae2d663fea27b780d927f92a3bd5a4e0614b364e764194774086e7f1b09e442e2c5a3aecb9d876116592d725ebe738d5c668bb6c6dac146361abd51d2f9f8dfec591eeb0dd7340986707f30b3285a8881398c70eaf57c4dacf260fdac8249e2a57221749f7e46fe6fc5d55c9baa1ce8a5539859b984efa3b700d4825631bf4da4df71a134af6299c4d51c606593fa0fb2b2405e06ef4188df291a757a5db5c673a718a0c5b47b6d447676180f16f2b0fb8089e730fc4ee3f5941ddffd82bb371e9c97a4e9fd64591151d4d1dafba4c1ffee4acb189691d7924400b080283de56f2202dd245af0949edab4b2d98e74156ea2ab5a2b394d94521b5c54773d5bc2498f81579f05c664b20fff31188098ee28d028683d22a9ead695dff2f79e5c40c28021a7

I have tried to replay the answer from the server, but after a few seconds, the broadlink device ignores the answer, probably due to it using the timestamp fields as a nonce.

I do not mind trying to reverse engineer the firmware, but before I take apart my units to try and dump the firmware, do you @felipediel, have any way easy way to get the firmware (some download link, or whatever) ?

[felipediel]

Hi @andreluis034. I know a guy who asked their support and they sent him a download link a while ago, but it was the previous version. I think it's worth asking them.

Two other approaches that you can try:

1. Spoofing the response from http://25913service.ibroadlink.com/devactiva/v2/devactiva with an empty packet, just to see if it cools down the watchdog timer.

2. Reseting the device and using this module to provision it. It needs to be removed from the official app before, and never added again.

[Write]

I removed my RM 4c Mini from Broadlink App, and then reset my RM 4c, and provisioned it from my mac, sending the cloud ping to no avail, it still disconnect after 3 min.
Guess there's no other way than to find the latest firmware and reverse engineer it

[andreluis034]

Hi @andreluis034. I know a guy who asked their support and they sent him a download link a while ago, but it was the previous version. I think it's worth asking them.

Thank you for the reply, I will give this one a try. If it does not work, I will try to reverse the android app to see if I can find the functionality to download the update.

1. Spoofing the response from http://25913service.ibroadlink.com/devactiva/v2/devactiva with an empty packet, just to see if it cools down the watchdog timer.

Unfortunately it does not... What happens instead, is that the broadlink device starts making even more requests, one after the another. Under normal circumstances it pings the cloud every ~15s.

2. Reseting the device and using this module to provision it. It needs to be removed from the official app before, and never added again.

I never registered my device with the cloud. The only thing I have done, was take it out of the box and use broadlink.setup to assign it to an AP I have. The only thing that could have happened and still have not checked, was the devices performing some sort of cloud registration, before I could block them on my router's firewall.

[Write]

Good news ! I've managed to downgrade my RM4C Mini, by combining the URL from this dead link : https://www.reddit.com/r/broadlink/comments/hmqh9c/help_me_update_firmware_rm4_mini_v52075/fy7tb9x/

And using the IP from this thread : https://www.reddit.com/r/homebridge/comments/1181ex4/caution_to_people_using_broadlink_rm_plugin/j9eqq0j/

Which made me able to download the v52075 firmware by combining the new host with the path for 52075 : http://124.71.130.238/RMBL4-52075-8710-BL-FC-2900.upd.bin

The firmware is supposedly for RM4 Mini, but I successfully downgraded my RM4c Mini to 52075.

However I can confirm the cloud ping method still doesn't work on this firmware.
But hopefully @andreluis034 can help reverse engineer it !
And of course, the firmware in encrypted.

Binvis.io result on file entropy:

[pablolucas890]

Good news ! I've managed to downgrade my RM4C Mini, by combining the URL from this dead link : https://www.reddit.com/r/broadlink/comments/hmqh9c/help_me_update_firmware_rm4_mini_v52075/fy7tb9x/

And using the IP from this thread : https://www.reddit.com/r/homebridge/comments/1181ex4/caution_to_people_using_broadlink_rm_plugin/j9eqq0j/

Which made me able to download the v52075 firmware by combining the new host with the path for 52075 : http://124.71.130.238/RMBL4-52075-8710-BL-FC-2900.upd.bin

The firmware is supposedly for RM4 Mini, but I successfully downgraded my RM4c Mini to 52075.

However I can confirm the cloud ping method still doesn't work on this firmware. But hopefully @andreluis034 can help reverse engineer it ! And of course, the firmware in encrypted.

Binvis.io result on file entropy:

Hello my friend, I received your response on e-mail and I'll try to do the downgrade for broadlink RM4MINI and RM4PRO, you can help me on this? Do you use a specific program to do the firmaware downgrade?

[Write]

Hello my friend, I received your response on e-mail and I'll try to do the downgrade for broadlink RM4MINI and RM4PRO, you can help me on this? Do you use a specific program to do the firmaware downgrade?

Hi ! You can paste the link directly in the broadlink app. You need to have added it to the broadlink app before. Click on the device, then the 3 dots on the top right, "Property" and firmware update, then an additional button somewhere on the UI where you can input your own custom link.

Unfortunately 52075 doesn't resolve anything. I've found the link for 52074 and 52071, but rollback to 52071 failed, and haven't tried 52074 yet.

I'm pretty sure all devices shipped with the new way for the cloud ping packet to work, so no firmware will solve the issue.

Here's all links :

http://124.71.130.238/RMBL4-52071-8710-BL-FC-2626.upd.bin
http://124.71.130.238/RMBL4-52074-8710-BL-FC-2759.upd.bin
http://124.71.130.238/RMBL4-52075-8710-BL-FC-2900.upd.bin