Home Automation with the Orvibo S20 WiFi Socket 14

The Orvibo S20 WiFi is really a nifty device. Relatively inexpensive from various online sites, this device connects through your WiFi network enabling you to control and power various home appliances up to 10 Amps. The manufacturer offers a smart phone app which permits you to control the socket and also set up timers via the app. However, it just so happens that this device has been reversed engineered and as such makes it that much more interesting for the do-it-yourselfer (if that’s even a word). Interestingly enough, I’ve integrated this device into my own home automation project.

In this blog post, I’ll share how I go this working. More importantly, you’ll learn how to set up the socket without the app. Finally I provide a script that allows you to control the socket from the command line – without the app. Let
s do it!

Orvibo S20 WiFi Socket

Motivation

I’m always a bit weary when it comes to proprietary apps, especially those from China – sorry for the generalization – but I just can’t trust whether my personal information is being sent along the internet to some data center across the world. I’ve also read that the S20 may in fact transmit your WiFi password via the mobile app when you pair it with your WiFi. Whether that’s true or not, I cannot say, but I’d rather be on the safe side. I also wanted to integrated this device into my home setup without use of the mobile app.

First and foremost, full credit for this goes to this particular blog post by Andrius Štikonas, the smart individual who reversed engineered the device. Ok, so let’s begin.

Paring the Device with your WiFi

Once connected to a power outlet, you’ll see a flashing read LED. This indicates that the S20 is not connected to WiFi. Now, press and hold the socket button for a few seconds and you’ll notice it switches to a rapidly blinking red LED mode, press and hold the button once more, and changes to a rapidly blinking blue LED. This indicates that the switch has created an unencrypted wifi network, called WiWo-S20. We’ll connect to this network to begin our work.

Unfortunately, according to Andrius, it appears that your WPA password is transferred in an insecure way, i.e. the socket is not able to use any public key cryptography. A slightly safer way to do it is to first change your WPA key in your router’s settings to something temporary and pair the socket. Then use AT+ commands to change the WPA password to the real one and change your router’s WPA password back.

Step: 1 Connect to the WiWo-S20 Network

As discussed above put your device in the rapidly blinking blue LED mode. Use a computer or laptop and connect to the WiWo-S20 network. Disable all other network connections like local/LAN temporarily.

Step: 2 Change your WiFi WPA Key in your Router

Change your WiFi WPA Key to something simple temporarily and save your existing key somewhere. We’ll change it back shortly.

Step: 3 Download Helper Application

Download the s20.exe console application from Andrius’ blog post (bottom of page) and put it on your desktop. There’s a pre-compiled 64-bit and 32-bit version. Double click the app and you’ll see this:

s20.exe Menu

Hit ‘a’.

a - add unpaired socket (WiFi needed)

Enter your SSID and your temporary password. The S20 should now be connected to your WiFi. Test it out by toggling the power state with ‘p’.

p - toggle power state (there are also "on" and "off" commands)

You can also change the remote password if you like as well, with ‘P’.

P - change remote password (max 12 characters)

You can also change the socket name, timezone, etc. Go crazy.

With any luck, you’ll be connected to your network. Now, all communication with the S20 will be encrypted through your network and we can now breathe a sigh of relief. Now connect to your private WiFi and continue below.

Step: 5 Change WiFi Key

Now comes the tricky part. Andrius’ executable does not provide a mechanism to change the WPA key while connected to your network, at least I couldn’t figure it out. You’ll need to download another application called Packet Sender from here to send AT+ commands directly to the S20. FYI, AT commands are instructions used to control a modem. AT is the abbreviation of ATtention. Every command line starts with “AT” or “at”.

Packet Sender Response

• Begin by sending the string “HF-A11ASSISTHREAD” in the ASCII field on UDP port 48899 to the IP address of the S20 (don’t include the double quotes in the message). You should get a response as seen in the above screenshot. If not try again. Keep on trying as if this doesn’t work, you may not be able to continue.
• S20 will reply with “IP address,MAC Address,Hostname”. The socket always replies to the same port as the source port of your message.
• Acknowledge that you got the previous message by sending “+ok”.
• Send “AT+WSSSID=ssid\r” where you replace ssid with your WiFi network name. \r is the carriage return (CR) symbol.
• The socket will reply with “+ok\n\n” (\n in this case is carriage return + line feed) if everything is correct or “+ERR\n\n” if something is wrong.
• Send your original WiFi password by replacing password in the following: “AT+WSKEY=WPA2PSK,AES,password\r”. The socket will again reply with “+ok\n\n”.
• Switch HF-A11 chip to station mode by sending “AT+WMODE=STA\r”. Again, wait for “+ok\n\n” (not sure if this is necessary)
• Restore your original WiFi key in your router’s settings.
• Reboot your socket with “AT+Z\r”.

Hopefully after rebooting your S20 you should see the LED go from blinking red to solid red. Great work!

Controlling the S20 with a Script

Now the fun part. Below is a short Bash script that you can use to toggle the S20 socket from the command line and incorporate into your projects as I have done. Credit goes to the user Mightyman over here. The script expects three arguments: on/off, MAC address, and the IP address of your S20.

Save the following into file and call it s20_toggle.sh and make it executable.

#!/bin/bash

if [ $# -ne 3 ]; then
    echo "Requires three arguments: <on|off> <MAC> <IP>"
    exit 1
fi

if ! type xxd > /dev/null; then
    echo "Requires xxd binary"
    exit 1
fi

if ! type nc > /dev/null; then
    echo "Requires nc binary"
    exit 1
fi

ACTION=$1
MAC=$2
IP=$3
REVERSEDMAC=${MAC:10:1}${MAC:11:1}${MAC:8:1}${MAC:9:1}${MAC:6:1}${MAC:7:1}${MAC:4:1}${MAC:5:1}${MAC:2:1}${MAC:3:1}${MAC:0:1}${MAC:1:1}

# Subscribe to the device:
echo '6864001e636c'$MAC'202020202020'$REVERSEDMAC'202020202020' | xxd -r -p | nc -u -w1 -p10000 $IP 10000 | xxd -p 2>&1

case $ACTION in
off)
        # Switch Off
        echo "Switching off: $MAC $IP"
        echo '686400176463'$MAC'2020202020200000000000' | xxd -r -p | nc -u -w1 -p10000 $IP 10000 | xxd -p
        ;;
on)
        # Switch On
        echo "Switching on: $MAC $IP"
        echo '686400176463'$MAC'2020202020200000000001' | xxd -r -p | nc -u -w1 -p10000 $IP 10000 | xxd -p
        ;;
esac

exit;

Test it out!

./s20_toggle.sh <ON|OFF> <MAC> <IP>

There’s also a python implementation with more functions found here.

Conclusion

Well I hope this was useful in your home automation endeavors. I welcome the reader to take a look at my home automation project where I have incorporated this and many other sensors.

Thank for stopping by!