336b0dc46f
- Confirmed working on TP-Link Archer C9 on both W-LAN and LAN - Changed -c switch to allow arbitrary two-character hex commands to be sent, e.g. -c 0E - Preliminary Archer C9 commands and return data documented in comments |
||
|---|---|---|
| .. | ||
| LICENSE.txt | ||
| README.md | ||
| pyDes.py | ||
| tddp-client.py | ||
README.md
TP-Link Device Debug Protocol (TDDP) Client
A proof-of-concept python client to talk to a TP-Link device using the TP-Link Device Debug Protocol (TDDP).
TDDP is implemented across a whole range of TP-Link devices including routers, access points, cameras and smartplugs. TDDP can read and write a device's configuration and issue special commands. On the HS110 SmartPlug it uses UDP port 1040, but might use different ports on other devices.
TDDP is a binary protocol documented in patent CN102096654A.
Commands are issued by setting the appropriate values in the Type and SubType header fields. Data is returned DES-encrypted and requires the username and password of the device to decrypt. Likewise, configuration data to be written to the device needs to be sent encrypted. The DES key is constructed by taking the MD5 hash of username and password concatenated together, and then taking the first 8 bytes of the MD5 hash.
Usage
./tddp-client.py -t <ip> -u username -p password -c [test1|test2|test3]
Provide the target IP using -t. You can provide a username and password, otherwise admin/admin is used as a default. They are necessary to decrypt the data that is returned.
Only three basic data readout commands (test1, test2, test3) are implemented. They are named test since it is unclear what type of data they might read out on different type of devices.