Message 3 (04 02 00) decoded - Retrieve and Set WIFI and GPRS Parameters

[lwoggardner]

So more TCP dumping, spotted my wifi password in the output.... which lead to decoding the 04 02 00 message
I'm working with a SolarRiver TL-D device which reports versions as 'V1.30', and Solar Power Browser running under wine on linux.

Format of the 04 02 00 payload is

• 1 byte - installed comms module, 1 = GPRS, 2 = WIFI, 3 = 'No Module' [1]
• 35 char WIFI SSID
• 60 char WIFI Password [2]
• 4 char GPRS PIN
• 30 char GPRS Centre Number
• 30 char GPRS Customer Number
• 1 byte - 'OK to Save' - 0 is ok, non-zero is false

Total 161 bytes of payload

[1] - '1','2' enable the WIFI/GPRS input fields in Browser, 0 or >3 seems to display some kind of error code.
[2] - the wifi password shows as '*********' in the app, but is communicated in the clear on the wire - which apart from being useless to customer, means any passer-by with an ethernet cable can read the WIFI password!!

Setting WIFI and GPRS values

Messsage to set parameters coming out of SolarPower Browser are 05 0x.

If 'OK to Save' is non zero in the 04 02 payload, then these messages will not be sent.
Note Browser prompts for an input password - 'samilpower88' seems to be hard coded into the app in that if you get it wrong nothing is sent.

Request payloads

• WIFI 05 00 00 - payload SSID (35 char), Password 60 (char)
• GPRS 05 01 00 - payload PIN (4 char), Centre(30 char), Customer (20 char)

Response is the same identifier as the request with a 1 byte payload containing the value 0x06

• WIFI 05 00 00 00 01 06 01 0b
• GPRS 05 01 00 00 01 06 01 0c

If the source of https://mhvis.github.io/solar/ is here somewhere, I'm happy to send a PR to update this info.

[mhvis]

Oh wow amazing! Very cool

I believe my inverter unit does not have GPRS or WIFI so I probably couldn't have figured this out. Very nice to add this info.

The source of the protocol doc is also in this repo, in a different branch: https://github.com/mhvis/solar/blob/gh-pages/index.md. It should be possible to open a PR against the branch. I can also make a start later if I have some time.

[lwoggardner]

If the data on that page is your inverter then it suggests you do have a wifi module. (First payload byte is 0x02). And SP Browser app will also show 'WIFI' and let you type in ssid/password. (The "write" password is "samilpower88" for me, found on some internet forum).

But you would probably also have noticed the wifi antenna sticking down next to the ethernet port.

My inverter is River4500TLD, reports version 1.50, and has 'SE' serial.

[mhvis]

Interesting! Then we might have the wifi module indeed and completely missed it 😄 . That's nice, I'm going to check that later. We didn't really look into this because we did have an ethernet connection nearby.

[lwoggardner]

PR sent to ghpages branch.

I'm actually writing my own module for this in ruby because, well just because. So I'll be able to set the wifi parameters from that anyway if I ever need to.

That capability isn't very useful since you can't update the parameters unless connected via ethernet, which means you either don't need it, or you are already at the inverter and could set it via the display / SPB.