ECU-R TCP Protocol question

[Rimapus]

Hello 👋,

I recently had an APsystems PV installed at home with an ECU-R. And since then, I'm tinkering with it to get some data locally (I'm bothered by the fact that it sends them to a remote server, anyway).

I was just wondering how you reverse engineered the TCP communication protocol detailled in the wiki.

I'm quite tempted by inspecting the EMA App to see what requests it makes, but I'm 99% sure it will be a very deep rabbit hole leading to nothing 😂.

Anyway, thanks a lot for this repo, I'm pleased to see that people invest time in this quite niche thing 😄.

[HAEdwin]

I currently have one ECU-R (6120) which is not registered at EMA but does work perfectly so you could try unregister the ECU and see what it does. Don't register it as being replaced because APsystems will not help you reconnect it. Only disadvantage is that you won't get any firmware updates, but if it ain't broke don't fix it might apply.

[Rimapus]

Yeah, that's one solution.

I realized I can just decompile the EMA (Manager) App to see what request it makes to the ECU, and it's all I needed.
The code is clear enough to see what does what and the response content:

Again, thank you really much for your contributions ❤️. I never experimented with hardware communication protocols of this sort, It's a great learning experience 🙂.

[HAEdwin]

Great, you will see that most of it will also be present in the integration. If a function is not, feel free to contribute or ask me. In the beginning we started with "listening" to the EMA app by rerouting the traffic. It's not encrypted so that's easy ;)

[Rimapus]

Well, I'm happy I found some other calls:

Calls

0001 = getSystemInfo
0002 = getEcuInvertersOutputData
0003 = getPowerOfDay
0004 = getEnergyOfWeekMonthYear
0005 = setInverterUidList
0006 = time setting management ?
0007 = set ip, dns, gateway etc... !
0008 = get status of wireless connection ?
0009
0010 = setEcuApPassword
0011 = getInverterUidList
0012 = get ecu time !
0013
0014 = lan network info get !
0015
0016
0017
0018 = getInverterConnectionData
0019
0020 = getEcuConnectedAp
0021 = setEcuConnectAp
0022 = scan wireless networks !
0023 = getEcuFunction & getEcuServerStatus
0024
0025
0026
0027
0028
0029 = related to grid profile ?
0030 = getInverterSignalData
0031
0032
0033
0034
0035
0036
0037
0038
0039 = launch / prepare ecu firmware update !
0040 = file check for related to firmware update ?!
0041 = related to firmware update !
0042
0043 = related to firmware update !
0044
0045
0046
0047
0048
0049
0050
0051
0052 = get / set timezone !
0053 = disable (0) / enable (1) / view (2) ecu service mode !
0054 = getSystemAlarmData
0055
0056
0057
0058 = updateFlag / updateRestTime ??
0059 = getEcuRThirdMeterConfigDataApi
0060 = getEcuRMeterDataApi
0061 = getModBus
0062 = getMasterSlave
0063
0064
0065
0066 = get / set grid profile ?!

"?" means I'm not really sure, "!" means it's that.
I did not really paid too much attention to setters because I don't want to break my install again (did you know that calling 0005 without any ids just resets your inverters id and you have to resync them 😅).

Nothing really significant apart from getSystemAlarmData (0054) which could be useful in case of problems.
There is also getEcuFunction (0023) which returns a long string of characters, each one representing a state?, feature?. The one at index 2 represents the "ecu server status" (I suppose to APsystems servers).

I want to believe that the empty call code exists but are just not used by the EMA Manager App.

[HAEdwin]

Nice! I will look into it. I'm particularly interested in 0007 (a smart plug might no longer be needed for the ECU-R that starts with 2160), 0039 for firmware downloads, after which you could block everything again. If I have time, I'll experiment with it. Caution is indeed advised. Did you decompile the APK for the source? I've done it that way a long while ago but other things keep me busy also so I forget things.

[Rimapus]

On android, I've use an app called "APK Extractor" to get the APKs, I then used a program called "jadx-gui" on Windows to decompile and analyze the source code.
It's quite straightforward since the decompiled code is very readable.

In the meantime, I (finally) found a way to decompile the firmware running on the ECU-R. It's more messy but works great and it covers all cases, not just the one used by the mobile apps.

[HAEdwin]

Yes, thanks I remember, I can again look at the APK source code. From past experience, I know that querying the ECU should be done with some caution (don't over-query, and be careful with some commands, as you'll then indeed have to re-add the inverters). In any case, we stopped with the basic queries in the past because they were sufficient and moved on to getting the integration more stable. The other commands were less interesting at that time. After all, the historical data would also be compiled by HA. But now that I look at it again, I might add some features if it doesn't cause instability for the continuity of the integration.