Orvibo S20 wifi power socket

The Orvibo S20 wifi power socket (same as the Aldi/Bauhn Wifi Power Point?) has an Android and iOS app, but no PC app. There are ways to send UDP packets to control a set up e.g. linked off here and for example a perl program here

A bit of wiresharking for the initial configuration shows it sends the wifi password from the app using the length of UDP packets sent on the wifi connection. The unit sniffs for this when in factory reset mode. It sniffs on all wifi connections until it finds a pattern that matches, then logs in to that one with the password it sniffs.

Notes:

The android apps sends the password on the currently connected WiFi by length of packets.

All packets have data filled with 0x05, UDP sent to port 49999 from port 49999, to the network broadcast address.

For example on a WPA2 network with the password “plopplop” here is what is sent (count = number of packets, len = total length of packet, 42 bytes of header, rest is 0x05 data)

count 400 len 118

count 6 len 131
count 2 len 230 p
count 2 len 226 l
count 2 len 229 o
count 4 len 230 pp
count 2 len 226 l
count 2 len 229 o
count 2 len 230 p
count 6 len 128
count 6 len 382 (android app says “checksum 340” – i.e. 340 bytes of data) – for 8 char password, i.e 374 + length of password

(repeat coming up)
count 6 len 131
count 2 len 230 p
count 2 len 226 l
count 2 len 229 o
count 4 len 230 pp
count 2 len 226 l
count 2 len 229 o
count 2 len 230 p
count 6 len 128
count 6 len 382 (checksum 340?) – for 8 char password

data 05 05 05 05 (all 5s) (76 bytes of data for 118 length), i.e. 42 bytes of header

(repeated again and again and again for up to 60s)

OrviboS20_topOrviboS20_bottom1

Random links to the used wifi module:

home page

data sheet

data sheet2

HF-LPB100_User_Manual (local copy)

From their firmware download page it looks as if it might possibly be an esp8266 but with an added processor on the board so probably not trivial to port to Sonoff-Tasmota. On another look a similar module would appear this is just wishful thinking mediatek processor ref