Goal: Replace Post request "Aqara Home" app on HomeAssistant

• note:
  • this flow is example and was developed for Aqara Hub G3 camera
    • for Aquara FP2 see Darafei Praliaskouski page

• Your value from POST Request Aqara app:
  • appid ( XXXXXXAPPIDXXXXXXXXXXX )
  • token ( XXXXXXTOKENXXXXXXXXXXX )
  • subjectId ( lumi1.XXXXXXXXXXXX ) usually MAC-ADDRESS
  • aqara url ( rpc-ger.aqara.com ) Host
    • list aqara url
  • timezone ( it-IT ) -> es-ES/en-UK/de-DE/it-IT/pt-PT/en-US...
  • userid ( automatic, enter manual if not work )

• Method 1 NodeRed (recommended, required NodeCompanion):

  • Import flow Aqara_G3_nodered.json
  • Replace your value "config" node
  • Deploy
    • note: you can use the script to generate your NoderRed json
    • generatejson

• Method 2 RestFul (without NodeRed):

  • Replace your value Aqara_G3_without_nodered.txt
  • Copy and paste Aqara_G3_without_nodered.txt on configuration.yaml
  • Restart HomeAssistant

• Python script:

  from Wh1terat's python script you can find your values ​​from your username and password Aqara account

  • GenerateToken

• Use BurpSuite or ZAP or similar:

  • Follow BurpSuite Guide
  • Follow ZAP Guide
    • free dowload
  • Download AqaraHome apk mod:
    • AqaraHome 3.0.6 (old Android)
    • AqaraHome 4.0.2

I have an Aqara Hub G3 camera on HomeAssistant but I can't control it, with the homekit connection I only have the alarm function.

This is the beauty of it: no modifications to the device are necessary.

You can delete AqaraHome_mod app it without logging out, otherwise the token values ​​​​are expired.

AqaraHome apk mod includes acceptance of the user-installed certificate, (to see the http requests in burp).

• add automation every 1 minute:

    description: Update Aqara G3
    mode: single
    trigger:
     - platform: time_pattern
       minutes: /1
    condition: []
    action:
      - service: button.press
        metadata: {}
        data: {}
        target:
          entity_id: button.camera_g3_log
  

  or change inject node:

  

for a successful update of the existing flow without changing the entities in HomeAssistant, follow the steps:

• import new json

  

• delete old flow (complete flow card)

  

• deploy
  !! do not deploy without deleting the old !!

• Turns the camera into an NGINX-cgi PHP server and much more...:

  • AqaraG3-armv7-binary

    

• HomeKit alarm function HomeAssistant:

  • autodiscovery, insert qrcode number

    port change every reboot of device, replace into

    "/config/.storage/core.config_entries"

    

• Live video:
  • hack G3 (delete authentication rtsp):

    • Manual downgrade firmware 3.3.4 (post_init.sh enable)

    • Open telnet QR method aQRootG3 (create post_init.sh)

    • Manual update firmware 3.3.9 (post_init.sh enable)

    • Update last firmware from command custom firmware

      • hack done! (post_init.sh enable)

    • Add /data/scripts/post_init.sh from telnet

      killall -9 rtsp && rtsp >/dev/null 2>&1 &
      

      or you can see rtsp user/pass (change every boot)

      from telnet command:

      agetprop sys.camera_rtsp_url  # agetprop full (list all prop.)

      

      rtsp:https://192.168.1.4:8554/360p (/720p /1080p /1296p)

      rtsp:https://USER:[email protected]:8554/360p (/720p /1080p /1296p)

ko-fi.com https://ko-fi.com/davide70304

AqaraG3-armv7-binary AqaraG3 extra command

go2rtc RTSP Proxy (HomeKit supported)

WebRTC Card RTSP

AqaraCameraHubfw HACK

m3u8-HLS-Homeassistant

EPGItaly-Homeassistant