ha-ef-ble icon indicating copy to clipboard operation
ha-ef-ble copied to clipboard

V2 (Delta 2/Wave 2) handshake figured out

Open hypercorrection opened this issue 2 months ago • 36 comments

I have figured out (with a large amount of help from LLMs to deobfuscate code) how to successfully establish a connection with either the Delta 2 or Wave 2 running latest firmware.

The session keys and authentication are working.

Based on that, this probably works for anything else using the V2 protocol.

The biggest initial difference is in the v2 vs v3 header, the dsrc and ddst fields are missing.

The key derivation seems to be working exactly the same way.

I haven't started digging into the protocol level messages after that, with things like battery level.

But, we are receiving them, and the connection with the device is staying established. If the Wave or Delta don't authenticate, they close the connection within a few seconds.

I have pushed a version here, which tries to change connect.py as little as possible so it's easier to understand the changeset.

https://github.com/hypercorrection/ef-ble-reverse/commits?author=hypercorrection

I would like to help with getting V2 devices to be supported, and it feels like this is a good starting point.

hypercorrection avatar Oct 07 '25 13:10 hypercorrection