#AutoHaus / ScapeMobile Reverse Engineering

Reverse engineering of the ScapeMobile Android app (v2.2.5) by HomeSystems (Brazil), a home automation system used in residential buildings. The goal is to understand the proprietary communication protocols and build independent tools to control lights, dimmers, doors, and other devices without depending on the vendor's closed-source app.

#Background

ScapeMobile connects to embedded controllers installed in apartment buildings. These controllers manage lighting, dimmers, motorized curtains, smart doors, HVAC (via IR), and multimedia scenes. The app downloads its UI configuration from the controller as a ZIP file containing XML and PNG assets, then communicates over the local network (or remotely via MQTT) to send commands and receive state updates.

The original APK was decompiled using jadx to extract the Java source code. While the decompiled output is incomplete and not recompilable, it was sufficient to fully reverse-engineer all three communication protocols and the configuration format.

#Key Findings

#No Encryption Anywhere

The most significant finding: none of the protocols use any form of encryption or authentication.

Commands to control lights, open doors, and disarm security are sent as plain text over the local network. Anyone on the same network segment can eavesdrop, replay, or forge commands.

#Three Controller Types

The app supports three communication backends, selected based on the controller hardware:

• SystemBox — TCP-based, plain ASCII commands like 5S1*100* (set unit 1 to ON). Used by older/wired controllers. Default port: 2000.
• SmartHub / GreenPlug — UDP-based, binary packets prefixed with HSN_ (hex 48 53 4E 5F). Two modes: listen (port 3006, push updates) and poll (port 2006, request/response). Used by newer/wireless controllers.
• MQTT — Remote access via a public broker at tcp://homesystems.net.br:1883. Topics follow hs/<id>/<serial>/.... Commands are 12-byte binary payloads. Activated when the app has HomeSystems cloud credentials.

#XML Configuration Format

The controller serves a scapemobile.zip file over HTTP containing android.xml (UI definition) and image assets. The XML defines pages, objects (buttons, sliders, labels, cameras, etc.), and their mappings to physical unit addresses. Object types include ON/OFF toggles, dimmers, image buttons, LCD displays, camera views, and virtual thermostats.

#Unit Address Space

#Documentation

Detailed technical documentation extracted from the decompiled source:

#Proof of Concept Scripts

Python 3 scripts that replicate the app's core functionality. No external dependencies required (stdlib only).

#poc/autohaus_systembox.py — SystemBox TCP Client

Sends plain ASCII commands over TCP. Supports polling, toggling, dimming, and procedure calls.

# Poll unit states
./poc/autohaus_systembox.py --host 192.168.0.245 poll 1 2 3 33 34

# Turn on unit 1
./poc/autohaus_systembox.py --host 192.168.0.245 on 1

# Set dimmer to 75%
./poc/autohaus_systembox.py --host 192.168.0.245 dimmer 33 75

# Execute a scene/procedure
./poc/autohaus_systembox.py --host 192.168.0.245 procedure 5

#poc/autohaus_smarthub.py — SmartHub UDP Client

Binary UDP protocol with HSN_ packet framing. Supports both listen-mode and legacy-mode commands.

# Send a command (unit 1, value 100 = ON)
./poc/autohaus_smarthub.py --host 192.168.0.245 set 1 100

# Turn off
./poc/autohaus_smarthub.py --host 192.168.0.245 set 1 0

# Listen for state changes (push mode on port 3006)
./poc/autohaus_smarthub.py --host 192.168.0.245 listen

#poc/autohaus_config_parser.py — XML Config Parser

Parses android.xml config files to extract pages, objects, unit mappings, and thermostat definitions.

# Parse and display config summary
./poc/autohaus_config_parser.py config/casa/android.xml

# Extract unit-to-label mapping
./poc/autohaus_config_parser.py config/casa/android.xml --units

# JSON output
./poc/autohaus_config_parser.py config/casa/android.xml --json

#poc/autohaus_discover.py — Device Discovery

Broadcasts UDP discovery packets to find SmartHub controllers on the local network, and probes specific IPs for AutoHaus services.

# Broadcast discovery
./poc/autohaus_discover.py

# Probe a specific IP
./poc/autohaus_discover.py --probe 192.168.0.245

#poc/autohaus_network_scan.py — Network Scanner

Comprehensive scanner to locate controllers that may have changed IPs. Runs broadcast discovery, probes priority IPs, then sweeps the entire subnet.

# Full auto-scan
./poc/autohaus_network_scan.py

# Probe specific IPs only
./poc/autohaus_network_scan.py --only .127 .238 .245

# Verbose output (shows all devices)
./poc/autohaus_network_scan.py -v

#poc/my_home.py — Named Unit Controller

Convenience wrapper with human-readable names for specific apartment units. Maps room/fixture names to unit addresses.

# List all known units
./poc/my_home.py list

# Turn on a light by name
./poc/my_home.py lights sala_pendente on

# Set dimmer by name
./poc/my_home.py dimmer sala_sofa 60

# Open door
./poc/my_home.py door open

# Activate a scene
./poc/my_home.py scene all_off

#Protocol Quick Reference

#SystemBox TCP Commands

5S<unit>*<value>*        Set unit value (e.g., 5S1*100* = unit 1 ON)
5G*<u1>*<u2>*...**       Poll units (response: <unit>-<value>* pairs)
mP<id>*                  Execute procedure/scene
vS<var>*<value>*         Set variable
vG*<v1>*<v2>*...**       Poll variables

#SmartHub UDP Packets

All packets start with HSN_ (bytes 48 53 4E 5F):

HSN_START\x00              Handshake (initiates connection)
HSN_ALIVE\x00              Keepalive
HSN_ALIVE-CMD (20 bytes)   Unit command (listen mode)
HSN_ALIVE-SET (21 bytes)   Unit set with value (listen mode)
HSN_S-UDP     (13+ bytes)  Legacy poll-mode command

#MQTT Topics

hs/<id>/<serial>/cmd/      Publish commands (12-byte binary)
hs/<id>/<serial>/units/#   Subscribe for state updates

#Methodology

1. APK Decompilation — jadx was used to extract Java source from the APK
2. Source Analysis — Systematic reading of all classes in br.com.homesystems.ScapeMobile, focusing on devinterface/, model/, network/, and HsObjectManager/
3. Config Parsing — Extracted and analyzed the XML configuration files served by the controller
4. Protocol Documentation — Mapped every command format, packet structure, and state machine from the decompiled code
5. PoC Implementation — Built Python scripts to independently communicate with the controllers using only the standard library

#Project Structure

autohaus/
  docs/                          # Technical documentation (8 files)
    01-overview.md
    02-xml-config-format.md
    03-protocol-systembox-tcp.md
    04-protocol-smarthub-udp.md
    05-protocol-mqtt-remote.md
    06-unit-mapping.md
    07-security-analysis.md
    08-command-reference.md
  poc/                           # Proof of concept scripts
    autohaus_systembox.py        # SystemBox TCP client
    autohaus_smarthub.py         # SmartHub UDP client
    autohaus_config_parser.py    # XML config parser
    autohaus_discover.py         # Device discovery
    autohaus_network_scan.py     # Full network scanner
    my_home.py                   # Named unit controller

Not included in the repository (gitignored):

• AutoHaus_v2.2.5_apkpure.com.apk — Original APK binary
• output/ — Decompiled Java source (jadx output)
• config/ — Personal apartment configuration (XML + images)

#License

This project is for educational and personal use. The reverse engineering was performed on a commercially available APK for the purpose of interoperability with hardware the author owns, in accordance with fair use principles.