I have bought some SOLIX E1600 which are ready to test. As of my understanding, solar power banks aren't really the main goal here, but as far as I can see the security protocol is exactly the same. I already tried out the test script using unknown which results in this output:
DEBUG:SolixBLE.device:Initializing Solix device 'Anker SOLIX E1600' withaddress 'E8:EE:CC:9D:C3:D0' and details 'RawAdvData(adv=<winrt._winrt_windows_devices_bluetooth_advertisement.BluetoothLEAdvertisementReceivedEventArgs object at 0x0000017F4D6ACBB0>, scan=None)'
DEBUG:bleak_retry_connector:E8:EE:CC:9D:C3:D0 - E8:EE:CC:9D:C3:D0: Connection attempt: 1
DEBUG:bleak.backends.winrt.client:Connecting to BLE device @ E8:EE:CC:9D:C3:D0
DEBUG:bleak.backends.winrt.client:getting services (service_cache_mode=None, cache_mode=None)...
DEBUG:bleak.backends.winrt.client:session_status_changed_event_handler: id: BluetoothLE#BluetoothLE50:bb:b5:85:c6:91-e8:ee:cc:9d:c3:d0, error: <BluetoothError.SUCCESS: 0>, status: <GattSessionStatus.ACTIVE: 1>
DEBUG:bleak.backends.winrt.client:max_pdu_size_changed_handler: 256
DEBUG:bleak.backends.winrt.client:E8:EE:CC:9D:C3:D0: services changed
DEBUG:bleak.backends.winrt.client:E8:EE:CC:9D:C3:D0: services changed
DEBUG:bleak_retry_connector:E8:EE:CC:9D:C3:D0 - E8:EE:CC:9D:C3:D0: Connected after 1 attempts
DEBUG:SolixBLE.device:Established initial connection to 'Anker SOLIX E1600' on attempt 1!
DEBUG:SolixBLE.device:Subscribing to notifications from device 'Anker SOLIX E1600'!
DEBUG:SolixBLE.device:Sending negotiation initiation request to 'Anker SOLIX E1600'...
DEBUG:SolixBLE.device:The client the notification is from is: BleakClient, E8:EE:CC:9D:C3:D0
DEBUG:SolixBLE.device:Received notification from 'Anker SOLIX E1600'. length: 14, packet: 'ff090e00030001080100a1010152'
DEBUG:SolixBLE.device:Pattern: 030001
DEBUG:SolixBLE.device:CMD: 0801
DEBUG:SolixBLE.device:Payload: 00a10101
DEBUG:SolixBLE.device:Payload length: 4
DEBUG:SolixBLE.device:Received encryption negotiation message!
DEBUG:SolixBLE.device:Entered negotiation stage 1 due to response from device!
DEBUG:SolixBLE.device:Parameters: {'a1': '01'}
DEBUG:SolixBLE.device:Sending stage 1 response message...
DEBUG:SolixBLE.device:The client the notification is from is: BleakClient, E8:EE:CC:9D:C3:D0
DEBUG:SolixBLE.device:Received notification from 'Anker SOLIX E1600'. length: 27, packet: 'ff091b00030001080300a10102a202fd00a30144a40101a50102ff'
DEBUG:SolixBLE.device:Pattern: 030001
DEBUG:SolixBLE.device:CMD: 0803
DEBUG:SolixBLE.device:Payload: 00a10102a202fd00a30144a40101a50102
DEBUG:SolixBLE.device:Payload length: 17
DEBUG:SolixBLE.device:Received encryption negotiation message!
DEBUG:SolixBLE.device:Entered negotiation stage 2 due to response from device!
DEBUG:SolixBLE.device:Parameters: {'a1': '02', 'a2': 'fd00', 'a3': '44', 'a4': '01', 'a5': '02'}
DEBUG:SolixBLE.device:Sending stage 2 response message...
DEBUG:SolixBLE.device:The client the notification is from is: BleakClient, E8:EE:CC:9D:C3:D0
DEBUG:SolixBLE.device:Received notification from 'Anker SOLIX E1600'. length: 56, packet: 'ff093800030001082900a10103a2054553503332a307302e302e302e33a410415a5636593630443332323030353834a506e8eecc9dc3d01e'
DEBUG:SolixBLE.device:Pattern: 030001
DEBUG:SolixBLE.device:CMD: 0829
DEBUG:SolixBLE.device:Payload: 00a10103a2054553503332a307302e302e302e33a410415a5636593630443332323030353834a506e8eecc9dc3d0
DEBUG:SolixBLE.device:Payload length: 46
DEBUG:SolixBLE.device:Received encryption negotiation message!
DEBUG:SolixBLE.device:Entered negotiation stage 3 due to response from device!
DEBUG:SolixBLE.device:Parameters: {'a1': '03', 'a2': '4553503332', 'a3': '302e302e302e33', 'a4': '415a5636593630443332323030353834', 'a5': 'e8eecc9dc3d0'}
DEBUG:SolixBLE.device:Sending stage 3 response message...
DEBUG:SolixBLE.device:The client the notification is from is: BleakClient, E8:EE:CC:9D:C3:D0
DEBUG:SolixBLE.device:Received notification from 'Anker SOLIX E1600'. length: 11, packet: 'ff090b00030001080500f2'
DEBUG:SolixBLE.device:Pattern: 030001
DEBUG:SolixBLE.device:CMD: 0805
DEBUG:SolixBLE.device:Payload: 00
DEBUG:SolixBLE.device:Payload length: 1
DEBUG:SolixBLE.device:Received encryption negotiation message!
DEBUG:SolixBLE.device:Entered negotiation stage 4 due to response from device!
DEBUG:SolixBLE.device:Parameters: {}
DEBUG:SolixBLE.device:Sending stage 4 response message...
DEBUG:SolixBLE.device:The client the notification is from is: BleakClient, E8:EE:CC:9D:C3:D0
DEBUG:SolixBLE.device:Received notification from 'Anker SOLIX E1600'. length: 77, packet: 'ff094d00030001082100a1404c8cd214e1886dfa9aa22da85579166a8b8eb57a4e238dea6025ff19c236bf039cd8bef8067371bd3e0e88b4ea90e58a573326aca556d2a9953c89068e490c85e3'
DEBUG:SolixBLE.device:Pattern: 030001
DEBUG:SolixBLE.device:CMD: 0821
DEBUG:SolixBLE.device:Payload: 00a1404c8cd214e1886dfa9aa22da85579166a8b8eb57a4e238dea6025ff19c236bf039cd8bef8067371bd3e0e88b4ea90e58a573326aca556d2a9953c89068e490c85
DEBUG:SolixBLE.device:Payload length: 67
DEBUG:SolixBLE.device:Received encryption negotiation message!
DEBUG:SolixBLE.device:Entered negotiation stage 5 due to response from device!
DEBUG:SolixBLE.device:Parameters: {'a1': '4c8cd214e1886dfa9aa22da85579166a8b8eb57a4e238dea6025ff19c236bf039cd8bef8067371bd3e0e88b4ea90e58a573326aca556d2a9953c89068e490c85'}
DEBUG:SolixBLE.device:Public key of device: 044c8cd214e1886dfa9aa22da85579166a8b8eb57a4e238dea6025ff19c236bf039cd8bef8067371bd3e0e88b4ea90e58a573326aca556d2a9953c89068e490c85
DEBUG:SolixBLE.device:Shared secret: a985ca66e79304923f717fcfd95b084a62cf7e0c3bb1f243ef520e339fc0e10f
DEBUG:SolixBLE.device:AES key: a985ca66e79304923f717fcfd95b084a
DEBUG:SolixBLE.device:AES IV: 62cf7e0c3bb1f243ef520e339fc0e10f
DEBUG:SolixBLE.device:Sending stage 5 response message...
DEBUG:SolixBLE.device:Negotiations with 'Anker SOLIX E1600' succeeded!
==== REMOTE STATE CHANGE DETECTED ====
Generic(
ADDRESS: E8:EE:CC:9D:C3:D0,
AVAILABLE: False,
CONNECTED: True,
LAST_UPDATE: None,
NAME: Anker SOLIX E1600,
NEGOTIATED: True,
)
==== END OF STATE CHANGE REPORT ====
State changes aren't displayed in the debug info, at least the output power changing isn't displayed. Maybe someone else with a better understanding of what they are doing has an idea how to continue.
I have bought some SOLIX E1600 which are ready to test. As of my understanding, solar power banks aren't really the main goal here, but as far as I can see the security protocol is exactly the same. I already tried out the test script using unknown which results in this output:
State changes aren't displayed in the debug info, at least the output power changing isn't displayed. Maybe someone else with a better understanding of what they are doing has an idea how to continue.