Are there any vendor public or reverse engineered data about the protocol used to pair new device to the Tyua app (using the "easy" mode)?
As I understand the process, it is needed to:
- enter the device into pairing mode and wait to receive the SSID/password
- share local AP name (SSID) and password with the device by the app
- let the device connect to the AP
I have found some info about ESP Touch or Tuya EZ Mode which broadcast UDP packets on MAC layer and the effective payload is the packet length itself (and the actual packet data is just bunch of zeros). This way the SSID and password is broadcasted to ANYONE interested in plain text (including your neighbors running wireshark).
On the other hand, my experiments shown the Tuya app really broadcasts something, but it starts with sort of "triangular beacon" (packets with lengths of 1, 3, 6, 10) and then (when there is a device in pairing mode) it repeats the additional sequence of the packets with higher lengths. Still these numbers (often higher than 255) can't be simply treated as bytes. So I guess, there is some encoding performed. Additionally some "security by obscurity" or even encryption might get introduced?
As the initial method is super insecure, it would make sense the current one is somehow improved. Anyway, any hints or resources welcome.
