Better way to get the local key #345

csobrinho · 2020-08-02T23:06:21Z

I believe there is a better and faster way to get the local key. You can open the manufacturer app, link the device and then dump the memory of the process using:

adb shell am dumpheap {package_name}

Then open this on Android Studio and search for allocations of either byte[8] or SecretKeySpec. The key will present itself.

I believe it should also work with non rooted phones but haven't tested it

The text was updated successfully, but these errors were encountered:

Apollon77 · 2020-08-03T05:15:06Z

But this would be android only, or?!

codetheweb · 2020-08-03T15:40:07Z

Whether this is faster and better is a matter of opinion. As Ingo said, this would only work on Android. And many users might find the current recommend method easier. Having said that, I'm happy to accept a PR for this that adds it to the docs.

…

On Aug 3, 2020, at 00:15, Ingo Fischer ***@***.***> wrote: But this would be android only, or?! — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

ProPuke · 2020-08-09T22:34:32Z

Unless I'm mistaken the current method seems to be signing up for a developer account, which costs $300 a year after the first 3 months?

If so a better method would be much appreciated.

alanfoster99 · 2020-08-13T03:00:13Z

@ProPuke that seems to be the case; the developer account apparently was free previously, but I can find no way to follow the workflow described anymore, and the $300 seems required now

alanfoster99 · 2020-08-13T03:38:21Z

@ProPuke I spoke too soon. I went back and created another account directly from iot.tuya.com and this time was able to get into the free portion. The first time I created the account from their main page. Hope the same works for you.

geoffwoollams · 2020-09-03T12:14:20Z

Just tried this, worked perfectly. No root required on Android 10 (Lineage OS 17.1). Got confirmed working keys for my 8 new lights! My steps:

Install your Tuya app. I used the Kogan SmarterHome app. Add your devices to the app.
With usb debugging enabled and cable connected, get the memory dump (replacing com.kogan.smarterhome if you use something else):
adb shell am dumpheap com.kogan.smarterhome /data/local/tmp/tuya.hprof
adb pull /data/local/tmp/tuya.hprof %USERPROFILE%\Desktop\tuya.hprof

Now run the file through hprof-conv (Installed with Android Studio).
hprof-conv %USERPROFILE%\Desktop\tuya.hprof %USERPROFILE%\Desktop\tuya-conv.hprof

Open tuya-conv.hprof in Eclipse Memory Analyzer.
There may be a quicker way of doing this part but open the Histogram, scroll to the bottom of the list to the bold 'Total' and right click then expand all.
Sort by class name then scroll to com.tuya.sdk.device.presenter.TuyaDeviceMonitorManager. Right click it and click List Object -> outgoing.
This should list an instance for each of your devices.
Under mIDevListener.b you will find devId, localKey, name, mac.

Edit 2021: The Kogan app no longer allows debugging so this method doesn't work. Altering the app to enable debugging doesn't work either as it crashes when you login. I did however manage to get the keys using with a rooted device setting the global debugging flag instead.

tomporter518 · 2020-09-04T15:59:16Z

I have tried the approach and it does NOT work with the Smart Life app (com.tuya.smartlife). That application does not allow attaching to the process for debugging as the appropriate flag appears to not be set.

MagneFire · 2020-09-04T16:57:22Z

Just tried the method described by @geoffwoollams, it works perfectly. Initially I tried the method described by @csobrinho, but I couldn't find the keys, even though there were multiple instances of SecretKeySpec.

I am using the LSC smart app for Android which is not debuggable. Following this guide: https://gist.github.com/nstarke/615ca3603fdded8aee47fab6f4917826 allowed the app to become debuggable. @tomporter518 this may be helpful to you.

rootik · 2020-09-09T21:13:28Z

Just tried this, worked perfectly. No root required on Android 10 (Lineage OS 17.1). Got confirmed working keys for my 8 new lights! My steps:

Install your Tuya app. I used the Kogan SmarterHome app. Add your devices to the app.
With usb debugging enabled and cable connected, get the memory dump (replacing com.kogan.smarterhome if you use something else):
adb shell am dumpheap com.kogan.smarterhome /data/local/tmp/tuya.hprof
adb pull /data/local/tmp/tuya.hprof %USERPROFILE%\Desktop\tuya.hprof

Now run the file through hprof-conv (Installed with Android Studio).
hprof-conv %USERPROFILE%\Desktop\tuya.hprof %USERPROFILE%\Desktop\tuya-conv.hprof

Open tuya-conv.hprof in Eclipse Memory Analyzer.
There may be a quicker way of doing this part but open the Histogram, scroll to the bottom of the list to the bold 'Total' and right click then expand all.
Sort by class name then scroll to com.tuya.sdk.device.presenter.TuyaDeviceMonitorManager. Right click it and click List Object -> outgoing.
This should list an instance for each of your devices.
Under mIDevListener.b you will find devId, localKey, name, mac.

Cheers
I was able to get the local device key with this method, using Android Studio, instead of Eclipse, and the same Kogan Smarter Home app, you mentioned, running in an emulator.

codetheweb · 2020-10-09T15:49:14Z

Closing for now, still happy to accept a PR for the docs if someone wants to edit them.

Gigadoc2 · 2023-12-06T13:56:33Z

For future readers (I hope this is an appropriate place to put that information), for the current Tuya Smart App (and probably the SDK in general) the objects you are looking for are of the class com.thingclips.smart.sdk.bean.DeviceBean.

fume · 2024-12-16T21:02:45Z

For future readers (I hope this is an appropriate place to put that information), for the current Tuya Smart App (and probably the SDK in general) the objects you are looking for are of the class com.thingclips.smart.sdk.bean.DeviceBean.

for the people like me who weren't able to renew the free IoT Core plan on the Tuya Developer Console, i can confirm that taking the heap dump via adb shell (on a rooted device or rooted emulator) for the Smart Life app (com.tuya.smartlife) and searching for the class com.thingclips.smart.sdk.bean.DeviceBean is the way to go.

JsSusenka · 2024-12-25T14:23:38Z

@fume Had you faced this error when dumping memory of the application? Just to note, I tried both rooted device and rooted emulator, but faced the same issue. Can you perhaps give me a little hint, on how to take the heapdump? Thanks

-> ~/Developer/tmp/android_dump adb shell am dumpheap com.tuya.smartlife
File: /data/local/tmp/heapdump-20241225-152014.prof

Exception occurred while executing 'dumpheap':
java.lang.SecurityException: Process not debuggable: com.tuya.smartlife
	at com.android.server.am.ActivityManagerService.enforceDebuggable(ActivityManagerService.java:6203)
	at com.android.server.am.ActivityManagerService.dumpHeap(ActivityManagerService.java:17953)
	at com.android.server.am.ActivityManagerShellCommand.runDumpHeap(ActivityManagerShellCommand.java:1343)
	at com.android.server.am.ActivityManagerShellCommand.onCommand(ActivityManagerShellCommand.java:291)
	at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97)
	at android.os.ShellCommand.exec(ShellCommand.java:38)
	at com.android.server.am.ActivityManagerService.onShellCommand(ActivityManagerService.java:10471)
	at android.os.Binder.shellCommand(Binder.java:1230)
	at android.os.Binder.onTransact(Binder.java:1043)
	at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:5675)
	at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2812)
	at android.os.Binder.execTransactInternal(Binder.java:1505)
	at android.os.Binder.execTransact(Binder.java:1444)```

fume · 2024-12-26T21:42:36Z

@fume Had you faced this error when dumping memory of the application? Just to note, I tried both rooted device and rooted emulator, but faced the same issue. Can you perhaps give me a little hint, on how to take the heapdump? Thanks

-> ~/Developer/tmp/android_dump adb shell am dumpheap com.tuya.smartlife
File: /data/local/tmp/heapdump-20241225-152014.prof

Exception occurred while executing 'dumpheap':
java.lang.SecurityException: Process not debuggable: com.tuya.smartlife
	at com.android.server.am.ActivityManagerService.enforceDebuggable(ActivityManagerService.java:6203)
	at com.android.server.am.ActivityManagerService.dumpHeap(ActivityManagerService.java:17953)
	at com.android.server.am.ActivityManagerShellCommand.runDumpHeap(ActivityManagerShellCommand.java:1343)
	at com.android.server.am.ActivityManagerShellCommand.onCommand(ActivityManagerShellCommand.java:291)
	at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97)
	at android.os.ShellCommand.exec(ShellCommand.java:38)
	at com.android.server.am.ActivityManagerService.onShellCommand(ActivityManagerService.java:10471)
	at android.os.Binder.shellCommand(Binder.java:1230)
	at android.os.Binder.onTransact(Binder.java:1043)
	at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:5675)
	at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2812)
	at android.os.Binder.execTransactInternal(Binder.java:1505)
	at android.os.Binder.execTransact(Binder.java:1444)```

HI @JsSusenka, yes i had the same exact error in the beginning, but then i tried it on a rooted emulator (BlueStack 5) and worked as expected. Can you confirm that adb is connected to the right device/emulator?

geoffwoollams · 2024-12-26T23:11:55Z

Hi! I got that error too and sorted it with the global debuggable flag. I can’t find any info on that now but I found this which looks like it might be helpful for you: https://www.apriorit.com/dev-blog/736-mobile-a-brief-guide-to-making-any-android-application-debuggable

Follow the guide and hopefully it’ll help. It suggests the builds from android studio should work ootb:

We should note that Android Studio provides an engineering build of a system image for emulators by default. Such a build has root access and enables the debugging of processes and applications regardless of the android:debuggable flag’s state in the AndroidManifest.xml file.

piyushgarg · 2025-01-09T14:54:27Z

For heapdump exception install https://github.com/Mygod/debuggable.prop

codetheweb closed this as completed Oct 9, 2020

torbjornaxelsson mentioned this issue Dec 30, 2020

Instructions in SETUP.md for iot.tuya.com no longer working #395

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Better way to get the local key #345

Better way to get the local key #345

csobrinho commented Aug 2, 2020

Apollon77 commented Aug 3, 2020

codetheweb commented Aug 3, 2020 via email

ProPuke commented Aug 9, 2020

alanfoster99 commented Aug 13, 2020

alanfoster99 commented Aug 13, 2020

geoffwoollams commented Sep 3, 2020 •

edited

Loading

tomporter518 commented Sep 4, 2020

MagneFire commented Sep 4, 2020

rootik commented Sep 9, 2020

codetheweb commented Oct 9, 2020

Gigadoc2 commented Dec 6, 2023

fume commented Dec 16, 2024

JsSusenka commented Dec 25, 2024

fume commented Dec 26, 2024

geoffwoollams commented Dec 26, 2024

piyushgarg commented Jan 9, 2025

Better way to get the local key #345

Better way to get the local key #345

Comments

csobrinho commented Aug 2, 2020

Apollon77 commented Aug 3, 2020

codetheweb commented Aug 3, 2020 via email

ProPuke commented Aug 9, 2020

alanfoster99 commented Aug 13, 2020

alanfoster99 commented Aug 13, 2020

geoffwoollams commented Sep 3, 2020 • edited Loading

tomporter518 commented Sep 4, 2020

MagneFire commented Sep 4, 2020

rootik commented Sep 9, 2020

codetheweb commented Oct 9, 2020

Gigadoc2 commented Dec 6, 2023

fume commented Dec 16, 2024

JsSusenka commented Dec 25, 2024

fume commented Dec 26, 2024

geoffwoollams commented Dec 26, 2024

piyushgarg commented Jan 9, 2025

geoffwoollams commented Sep 3, 2020 •

edited

Loading