1

So I bought this GVM-560AS LED photography light on Amazon. It is a really good light for the job; but to control it remotely you have to download a really dodgy APK from the GVM website, a package which flagged red across the board on VirusTotal.com

So in the spirit of experimentation I loaded the control app onto the Android emulator and captured the packets it sent to the light over WiFi.

It is sending UDP messages to port 2525 on the broadcast address 192.168.4.255(/24), When I replay these UDP messages with Python it has the desired effect in controlling the light. The issue is that I can't make sense of the message generation mechanism, and enumerating the 65,000 potential states seems a little tedious.

The message to turn the light on is ffffffffffff20720d390dfa0800450000341213400040119e54c0a80402c0a804ff92b009dd00207e4934433534303930303230353730303030303130313338354230333030303000000000900000000000

The message to turn the light off is ffffffffffff20720d390dfa080045000034f14040004011bf26c0a80402c0a804ff83ed09dd00208c0e3443353430393030323035373030303030313030323837417375620b5f6700000000900000000000

The message to set the brightness to 11% at 3200K is ffffffffffff20720d390dfa0800450000340bb640004011a4b1c0a80402c0a804ffb4e809dd002046f03443353430393030323035373030303230313062463737310035002ff1ba00000000900000000000

The message to set the brightness to 63% at 3200K is ffffffffffff20720d390dfa080045000034aee7400040110180c0a80402c0a804ff9cbf09dd002060163443353430393030323035373030303230313366383141360035002fd18cb003ff3f900000000000

I am guessing that this is just a weird encoding scheme that I can't figure out, rather than it being some kind of proprietary RPC. Any suggestions or pointers towards the generation mechanism would be much appreciated!

  • It would be helpful if you extracted the actual payload with wireshark. Then you would not have to put all the Ethernet/IP/UDP headers on stackoverflow. – Mike76 Mar 17 at 0:57
  • @Mike76 This comes from having to feed Python's socket.socket the full UDP frame :( 3443353430393030323035373030303 0 303130 3032383741 Off 3443353430393030323035373030303 0 303130 3133383542 On 3443353430393030323035373030303 2 303130 6246373731 11% @ 3200K 3443353430393030323035373030303 2 303136 3436413338 99% @ 3200K The spaces are not part of the payload, I have added them. – GDev Mar 17 at 2:11
  • I also don't overly mind having the MAC addresses of the emulator and virtual NAT interface on the tinterwebz ^_^ – GDev Mar 17 at 3:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.