Jump to content

SunSynk WiFi Dongle Hacking.


cyber7

Recommended Posts

As per the subject:

I would like to know if anyone started a project of collecting local data from a SunSynk WiFi Dongle?  I am sick of server-outages and lost data and am thinking of either hi-jacking the traffic (on my router) to SunSynk's cloud storage or cracking open the dongle and re-programming the NCU chip...

My Question:  Has anyone thought or started something like this?

regards

Aubrey (aka cyber7)

ps - as an afterthought, this could even work for that "other" dongle we all got with our systems for free

Edited by cyber7
make the circle bigger
Link to comment
Share on other sites

When you say the "Sunsynk dongle", are you talking about the new Sunsynk dongle or the older Solarman dongle that plusg into the Sunsynk inverters? 

 

I don't know of any projects using the new Sunsynk dongle's as yet

 

There are a number of projects using the Solarman Dongle for connection via Wifi to Home Assistant. 

https://github.com/StephanJoubert/home_assistant_solarman 

 

Otherwise you can bypass the dongle altogether and connect using the RS485 port on the inverter with a USB/RS485 converter to you Home Assistant box.

https://github.com/kellerza/sunsynk 

or you can use the Node Red Flows created by @Bloubul7 

 

Link to comment
Share on other sites

Indeed there are loads of information regarding the Solarman Logger - However, info on the new Sunsynk Data Logger seems impossible to find.

If @cyber7 was talking about the newer logger, then please confirm and we can utilize this thread going forward to explore the possibility of reading and writing data to the Inverter via the Sunsynk Data Logger.

This is what the Sunsynk Data Logger looks like:
 spacer.png

Edited by valienté
Link to comment
Share on other sites

14 hours ago, valienté said:

Indeed there are loads of information regarding the Solarman Logger - However, info on the new Sunsynk Data Logger seems impossible to find.

If @cyber7 was talking about the newer logger, then please confirm and we can utilize this thread going forward to explore the possibility of reading and writing data to the Inverter via the Sunsynk Data Logger.

This is what the Sunsynk Data Logger looks like:
 spacer.png

Confirmed :)

Link to comment
Share on other sites

  • 2 weeks later...
On 2022/06/09 at 11:47 AM, cyber7 said:

If you look at the board and the data-sheet - URL TO PDF - you will see only a few pins are being used...  Should be able to break into the board quite easily by running wireshark and looking at the data coming out of the network...

I briefly used Wireshark back in the day, but that only gave info on the Device it was running on...

How would one get the info from the Logger running on the network?

Link to comment
Share on other sites

  • 4 weeks later...

To confirm do you want to pull the firmware from the nodemcu, or just utilise their API?

 

It might be easier to just write some HA integration which directly talks to the SunSynk cloud APIs to pull the data.

For the SynSynk API see below.

Login and obtain bearer token

https://pv.inteless.com/oauth/token

POST /oauth/token HTTP/2
Host: pv.inteless.com
Content-Length: 103
Accept: application/json
Content-Type: application/json;charset=UTF-8
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Origin: https://sunsynk.net
Referer: https://sunsynk.net/
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8

{"username":"XXXXXX","password":"XXXXXX","grant_type":"password","client_id":"csp-web"}

Some endpoints

api/v1/plants

api/v1/plant/energy/XXXX/flow

api/v1/inverters

api/v1/inverter/XXXX/realtime/output

api/v1/inverter/XXXX/realtime/input

api/v1/inverter/battery/XXXXX/realtime

Then you can utilise the bearer token to extract data from the APIs.

Use the below to obtain your PlantID. Change the XXXXX with your bearer token.

GET /api/v1/plants?page=1&limit=10&name=&status= HTTP/2
Host: pv.inteless.com
Accept: application/json
Authorization: Bearer XXXXXXX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Origin: https://sunsynk.net
Referer: https://sunsynk.net/
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8

The below will give you general FLOW data for a given date e.g. battPower, load etc.

Change the XXXXX with your bearer token and your plantID.

GET /api/v1/plant/energy/XXXXX/flow?date=2022-07-16 HTTP/2
Host: pv.inteless.com
Accept: application/json
Authorization: Bearer XXXXXX
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Origin: https://sunsynk.net
Referer: https://sunsynk.net/
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8

If you want to directly query raw output from your inverter, then you have to obtain the InverterID first.

Change XXXX with your bearer token.

GET /api/v1/inverters?page=1&limit=10&total=0&status=-1&sn=&plantId=&type=-2&softVer=&hmiVer=&agentCompanyId=-1&gsn= HTTP/2
Host: pv.inteless.com
Accept: application/json
Authorization: Bearer XXXXXX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Origin: https://sunsynk.net
Referer: https://sunsynk.net/
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8

Then you can plugin it at several spots in the API. 

Change XXXXX with your inverter ID and your bearer token.

GET /api/v1/inverter/XXXXXX/realtime/output HTTP/2
Host: pv.inteless.com
Accept: application/json
Authorization: Bearer XXXX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Origin: https://sunsynk.net
Referer: https://sunsynk.net/
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8

 

Welcome to msg me if you want to know more. If you do ever do some integration in HACS please share. I've not gone so far as to actually write something, but should be easy. 

Link to comment
Share on other sites

  • 5 weeks later...

Good suggestion @frankie that would be pretty cool  

@kellerza Did a similar Integration for HA for the Solarman Dongle, not sure how similar they are, is way above my paygrade lol

https://github.com/kellerza/sunsynk 

Oops, sry, the KellerZa integration is via the RS485 port. There is one using the Solarman dongle, just need to find it 

Edited by Sc00bs
Link to comment
Share on other sites

  • 5 weeks later...

So the "Sunsynk Data Logger" is basically this product from e-linter ? inteless.com, minus the RJ45/Ethernet

http://e-linter.com/smart-energy/goldfinch

https://doc.inteless.com/page/p/goldfinch/manual/db9/index.html

According to the documentation, the comms between the inverter and the Data Logger is RS-232.

I'm not entirely sure what protocol the RS-232 port on the Sunsynk inverter presents, but I'm going to guess it's probably ModBUS over RS-232. If someone can find a binary blob for the firmware of the dongle, I can probably take a stab at reverse-engineering it. Solarassistant.io seems to be capable of supporting it over RS-232 directly.


Edit: Seems like this document in this thread  confirms that it's modbus over RS-232 at 9600bps.

image.thumb.png.8b2a666c30c0350e92fba1eec76ae369.png

 

 

The cloud API stuff seems like a pretty closed ecosystem, other than the interesting API information that @frankie has posted earlier.  At worst, using those API's might be the best way to get the data logger into Home-Assistant, but I'd prefer something that doesn't depend on inteless's cloud API.

@frankie did you sniff the application traffic on a phone to get a hold of the API calls ? If so, nicely done.

The image that @Sc00bs posted suggest that on the top right hand there are pads for T/R/G which I would assume is the ESP TTL Transmit/Receive/Ground, so in theory those could be used to flash it.

The device's web interface itself doesn't offer more than upgrading software or changing WiFi SSID. There doesn't appear to be any ports open other than http(80).

I might just try and give it an ESPHOME image and see if it's willing to upgrade to a new custom firmware.

 

image.thumb.png.ecad3b167af4f8b742b05e7c4534f519.png

Edited by TheRoDent
Link to comment
Share on other sites

1 hour ago, TheRoDent said:

So the "Sunsynk Data Logger" is basically this product from e-linter ? inteless.com, minus the RJ45/Ethernet

http://e-linter.com/smart-energy/goldfinch

https://doc.inteless.com/page/p/goldfinch/manual/db9/index.html

According to the documentation, the comms between the inverter and the Data Logger is RS-232.

I'm not entirely sure what protocol the RS-232 port on the Sunsynk inverter presents, but I'm going to guess it's probably ModBUS over RS-232. If someone can find a binary blob for the firmware of the dongle, I can probably take a stab at reverse-engineering it. Solarassistant.io seems to be capable of supporting it over RS-232 directly.


Edit: Seems like this document in this thread  confirms that it's modbus over RS-232 at 9600bps.

image.thumb.png.8b2a666c30c0350e92fba1eec76ae369.png

 

 

The cloud API stuff seems like a pretty closed ecosystem, other than the interesting API information that @frankie has posted earlier.  At worst, using those API's might be the best way to get the data logger into Home-Assistant, but I'd prefer something that doesn't depend on inteless's cloud API.

@frankie did you sniff the application traffic on a phone to get a hold of the API calls ? If so, nicely done.

The image that @Sc00bs posted suggest that on the top right hand there are pads for T/R/G which I would assume is the ESP TTL Transmit/Receive/Ground, so in theory those could be used to flash it.

The device's web interface itself doesn't offer more than upgrading software or changing WiFi SSID. There doesn't appear to be any ports open other than http(80).

I might just try and give it an ESPHOME image and see if it's willing to upgrade to a new custom firmware.

 

image.thumb.png.ecad3b167af4f8b742b05e7c4534f519.png

 

 

Whilst it would be great to get this going, as a home-brew, I just took the plunge and installed @SolarAssistant on a Raspberry Pi, with a USB-RS232 adapter.

 

Simplest, easiest integration I've ever done, and solarassistant.io is superbly slick. Well done.

I now have a useless Sunsynk Data Logger, which I shall attempt to brick at my own leisure using ESPHome.

 

Edited by TheRoDent
Link to comment
Share on other sites

18 hours ago, TheRoDent said:

 

 

Whilst it would be great to get this going, as a home-brew, I just took the plunge and installed @SolarAssistant on a Raspberry Pi, with a USB-RS232 adapter.

 

Simplest, easiest integration I've ever done, and solarassistant.io is superbly slick. Well done.

I now have a useless Sunsynk Data Logger, which I shall attempt to brick at my own leisure using ESPHome.

 

wouldnt you  need to keep the dongle for firmware updates? Solar Assistant currently doesn't do that

Link to comment
Share on other sites

  • 2 weeks later...

I pulled the firmware off my dongle, which looks slightly different to the pictures that were posted earlier. My ESP32 is a RISC-V based C3.

I'm happy to share some of the partitions, but a couple of them have my home WIFI details embedded in them.

I had a go at reverse engineering them with Ghidra, but ran into the problem of specifying the memory map, which I am not quite sure how to do.

But yeah, I'd be quite keen to get an ESPHome-based firmware running on the Sunsynk dongle. While kellerza has done a sterling job with the sunsynk plugin, I'm trying to move away from the MQTT server towards native ESPHome protocol.

If I need to do any firmware updates, I can always flash the original firmware back, since I took a copy.

Edited by RoganDawes
Link to comment
Share on other sites

On 2022/05/31 at 5:11 PM, valienté said:

Indeed there are loads of information regarding the Solarman Logger - However, info on the new Sunsynk Data Logger seems impossible to find.

If @cyber7 was talking about the newer logger, then please confirm and we can utilize this thread going forward to explore the possibility of reading and writing data to the Inverter via the Sunsynk Data Logger.

This is what the Sunsynk Data Logger looks like:
 spacer.png

Got a surprise the other day. Previously sunsylk issued a magneto data logger with their inverters (looks like it) . We could not understand why we can not find the client on the sunsylk app. Then saw they gave us a magneto data logger that can only work on solarman. I also ordered an add data logger 6mnths ago. When we wanted to replace the magneto data logger that was issued 2yrs ago with the installation we found out they gave us again a magneto data logger. Still gotto contact the supplier. I want to know how could they sell a magneto data logger to us if the order stupilated  a sunsylk dongle. Anyone else with the same problem? 

Link to comment
Share on other sites

1 hour ago, you1 said:

I can provide a wireshark capture of the logger traffic, if anyone is interested to try and decipher it.

At the moment I'm pulling the modbus data directly from the inverter, so I'm not really motivated to use whatever the logger is pushing out.

I’m running OpenWrt on my router, so have wireshark captures already. I think what I need to do next is capture the serial traffic and the tcp traffic at the same time, to see what the dongle is adding to the connection, or if it is doing any protocol translation.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...