[原创]趣智校园 app 分析-Android安全-看雪安全社区

笔者由于学校热水器费用过高 :( 所以想看看热水器是如何工作的 :D ，故有此篇文章

JEB 使用无静态读取解密

*~~不知道为什么程序采用了非 BLE 的蓝牙（普通蓝牙），所以程序代码要看 bt 的而不是 ble 的~~*

似乎是 `bt` 和 `BLE` 的代码写反了（？

## 广告位：

特别感谢：

<a href="elink@e9fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6J5k6i4q4S2j5X3I4W2i4K6u0W2j5$3!0E0i4K6u0r3P5X3S2Q4x3X3c8o6e0W2)9J5c8R3`.`.">e1eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6J5k6i4q4S2j5X3I4W2i4K6u0W2j5$3!0E0i4K6u0r3P5X3S2Q4x3X3c8o6e0W2)9J5c8R3`.`.</a> 提供的免费支持！（好用）

# API

## 登录

### wx 登录

使用 wx sdk，获取 code 之后访问 oauth2 获取 identifier 值登录

```java
POST /user/login HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: v3-api.china-qzxy.cn
User-Agent: okhttp/4.2.2

identifier=oxxxxx-PXXXX&password=98ECF8427E&phoneSystem=android&type=1&version=<hide>
```

### 账密登录

```java
POST /user/login HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: v3-api.china-qzxy.cn
User-Agent: okhttp/4.2.2

identifier=&password=XXXXXXXXXX&phoneSystem=android&telephone=1xxxxxxxxxx&type=0&version=<hide>
```

### password 算法

`MD5(input)` 后取后十位

### 返回数据

```cpp
{
 "success": true,
 "errorCode": 0,
 "errorMessage": "成功",
 "data": {
 "userId": <hide>,
 "telephone": "<hide>",
 "alias": "<hide>",
 "loginCode": "<hide>",
 "tags": "<hide>",
 "ioaw": 0,
 "userAccount": {
 "projectId": <hide>,
 "accountId": <hide>,
 "userId": <hide>,
 "name": null,
 "gender": 0,
 "genderName": "未知",
 "idCardNumber": null,
 "gradeId": null,
 "gradeName": null,
 "deptType": null,
 "classId": null,
 "className": null,
 "gradeClassFullName": "",
 "oneCardAuthInfo": null,
 "accountStatus": 0,
 "accountRealMoney": <hide>,
 "accountGivenMoney": 0,
 "isCard": 0,
 "cardStatus": -1
 },
 "quZhiCoin": null,
 "aliPayAccount": null,
 "aliPayName": null,
 "loginType": 1,
 "loginTime": "<hide>",
 "phoneSystem": "android",
 "version": "<hide>",
 "loginIp": "<hide>"
 }
}
```

## 查询设备信息

```cpp
GET /device/info/mac?macAddress=<hide>&phoneSystem=android&loginCode=<hide>&projectId=<hide>&version=<hide>&userId=<hide> HTTP/1.1
Host: v3-api.china-qzxy.cn
User-Agent: okhttp/4.2.2

>>>
{
 "success": true,
 "errorCode": 0,
 "errorMessage": "成功",
 "data": {
 "deviceId": <hide>,
 "deviceName": "<hide>",
 "deviceDesc": "<hide>",
 "areaId": 1,
 "areaName": "<hide>",
 "buildingId": <hide>,
 "buildingName": "<hide>",
 "floorId": <hide>,
 "floorName": "<hide>",
 "roomId": <hide>,
 "roomName": "<hide>",
 "isUse": 1,
 "smallTypeId": 1,
 "smallTypeName": "<hide>",
 "bigTypeId": 4,
 "bigTypeName": "<hide>",
 "projectId": <hide>,
 "projectName": "<hide>",
 "ownStatusId": 0,
 "isUpdateProtocol": null,
 "isNewDryer": 0,
 "snCode": "<hide>",
 "macAddress": "<hide>",
 "communicationTypeId": 0,
 "onlineStatusId": 0,
 "keyStatus": null,
 "keyNo": null,
 "deductionMethod": 0,
 "withholdMoney": <hide>,
 "modelCode": null,
 "imei": null,
 "isMigrated": 1,
 "bindDeviceSnCode": null,
 "leftGoodsId": null,
 "rightGoodsId": null,
 "leftGoodsMiss": null,
 "leftGoodsVol": null,
 "leftCodeNo": null,
 "rightCodeNo": null,
 "rightGoodsMiss": null,
 "rightGoodsVol": null,
 "timestamp": "<hide>",
 "modeId": null,
 "modeTime": null,
 "deviceOrderPagePromptText": null,
 "DevID": <hide>
 }
}
```

## 下订单

```java
POST /order/downRate/bluetooth/rateOrder HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: v3-api.china-qzxy.cn
User-Agent: okhttp/4.2.2

macType=0001&signature=<hide>&loginCode=<hide>&telephone=<hide>&protocolType=<hide>&deviceId=<hide>&userId=<hide>&version=<hide>&xfModel=0&bigTypeId=4&accountId=<hide>&macAddress=<hide>&telPhone=<hide>&phoneSystem=android&smallTypeId=1&randomNumber=<hide>&projectId=<hide>

>>>
{
 "success": true,
 "errorCode": 0,
 "errorMessage": "成功",
 "data": {
 "accountId": <hide>,
 "realMoney": "<hide>",
 "givenMoney": "0.0",
 "preDeductMoney": "<hide>",
 "useCount": 1,
 "downData": "<hide>",
 "rate": <hide>,
 "minTime": 0,
 "minMoney": 0,
 "chargeMethod": <hide>,
 "minChargeUnit": <hide>,
 "autoDisConTime": <hide>,
 "consumeDate": "<hide>",
 "liquidOrderNo": null,
 "orderNo": null,
 "preDeductMoneySend": "<hide>"
 }
}
```

## 上传数据

```java
POST /order/upload/bluetooth/data HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: v3-api.china-qzxy.cn
User-Agent: okhttp/4.2.2

accountId=<hide>&telPhone=<hide>&signature=<hide>&phoneSystem=android&randomNumber=<hide>&loginCode=<hide>&telephone=<hide>&protocolType=<hide>&xfData=<hide>&projectId=<hide>&userId=<hide>&version=<hide>

>>>
{
 "success": true,
 "errorCode": 0,
 "errorMessage": "成功",
 "data": {
 "consumeTime": "<hide>",
 "preDeductMoney": <hide>,
 "preDeductMoneyAfter": <hide>,
 "consumeMoney": <hide>,
 "orderAccountId": <hide>,
 "clData": "<hide>",
 "telephone": "<hide>",
 "createTime": "<hide>",
 "modeName": null,
 "liquidModeName": null,
 "liquidConsumeMoney": null,
 "deviceSnCode": "<hide>",
 "orderNo": "<hide>",
 "leftModeMoney": null,
 "rightModeMoney": null,
 "leftModeName": null,
 "rightModeName": null
 }
}
```

# 算法

## signature 算法

以以下字段举例，首先键需要按照字典序进行排序，然后字符串拼接，`<>` 是不需要的

| LoginCode | <hide> |
| --- | --- |
| Phone | <hide> |
| xfData | <hide> |

```cpp
loginCode<LoginCode>telephone<Phone>xfData<xfData>&key=<LoginCode>
```

以上文本做一次 md5 后再做一次 md5，其中两次 md5 都是小写 32 长度

| Md5 | <hide> |
| --- | --- |
| Key | <hide> |

```cpp
<Md5><Key>
```

## clData 算法

| clData | <hide> | native aes 解密（见下） | <hide>-<hide> |
| --- | --- | --- | --- |

## Java_com_klcxkj_jni_JniUtils_decryptByAES

| Mode | ECB |
| --- | --- |
| Key | <hide> |
| IV | <hide> |

# 抓包

广告屏蔽

```python
# API Docs: https://reqable.com/docs/capture/addons

from reqable import *
import re

ad_regex_list = [
    r'.*\.anythinktech.com',
    r'.*-toutiao.*\.com',
    r'.*\.umeng.com',
    r'.*\.umengcloud.com',
    r'.*\.yfanads.com',
    r'.*\.gdt.qq.com',
    r'.*\.netease.im',
    r'.*\.beizi.biz',
    r'.*\.zijieapi.com',
    r'.*yunxin.*\.com',
    r'open.e.kuaishou.c.*',
    r'open.kuaishouzt.com',
    r'open.kwaizt.com',
    r'w1.kskwai.com',
    r'webcast-open.douyin.com',
    r'lf-cdn-tos.bytescm.com',
    r'sdk.e.qq.com',
    r'sdktmp.hubcloud.com.cn',
    r'mdap.mpaas.cn-hangzhou.aliyuncs.com',
    r'sdkoptedge.chinanetcenter.com', # 网宿
    r'pgdt.ugdtimg.com',
    r'mssdk.volces.com' # 字节
]

def onRequest(context, request):
  # 获取当前请求的域名
  host = context.host
  
  # 遍历正则列表进行匹配
  for pattern in ad_regex_list:
      # 使用 re.search 查找匹配项
      if re.search(pattern, host):
          # 【关键点】
          # 这里可以打印日志方便调试（在Reqable控制台查看）
          print(f"Blocked Domain: {host} (Matched: {pattern})")
          
          # 返回 None 表示中断请求，不再向服务器发送
          # 客户端会收到连接断开或类似的错误
          return None
          
          # 备选方案：如果你不想断开连接，而是想返回一个 404 或空数据，可以用下面这行代替：
          # return Response(404, headers=[], body=b'')

# Print url to console
  # print('request url ' + context.url)

# Update or add a query parameter
  # request.queries['foo'] = 'bar'

# Update or add a http header
  # request.headers['foo'] = 'bar'

# Replace http body with a text
  # request.body = 'Hello World'

# Map with a local file
  # request.body.file('~/Desktop/body.json')

# Convert to dict if the body is a JSON
  # request.body.jsonify()
  # Update the JSON content
  # request.body['foo'] = 'bar'

# Done
  return request

def onResponse(context, response):
  # Update status code
  # response.code = 404

# APIs are same as `onRequest`

# Done
  return response
```

## 蓝牙

开发者开启 HCI 蓝牙日志，kill 一下蓝牙的进程，看看有没有该文件

`/data/misc/bluetooth/logs/btsnoop_hci.log`

提取出来之后放到 wireshark 里面，可能需要安装 <a href="elink@dd7K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8Y4A6Z5i4K6u0V1j5$3&6Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0V1K9r3q4J5k6s2N6S2M7X3g2Q4x3V1k6V1M7X3W2$3k6i4u0K6i4K6u0r3j5X3I4#2k6i4c8G2L8%4c8Z5i4K6u0r3N6r3g2K6N6r3W2F1k6#2)9J5k6r3u0@1M7q4)9J5k6s2y4W2N6s2g2H3i4K6u0V1M7r3q4U0K9$3q4Y4k6b7`.`.">637K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6D9k6h3q4J5L8W2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8Y4A6Z5i4K6u0V1j5$3&6Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6u0V1K9r3q4J5k6s2N6S2M7X3g2Q4x3V1k6V1M7X3W2$3k6i4u0K6i4K6u0r3j5X3I4#2k6i4c8G2L8%4c8Z5i4K6u0r3N6r3g2K6N6r3W2F1k6#2)9J5k6r3u0@1M7q4)9J5k6s2y4W2N6s2g2H3i4K6u0V1M7r3q4U0K9$3q4Y4k6b7`.`.</a>、wireshark，使用 `"C:\BTP\v1.14.0\x86\btvs.exe"` 工具打开进行分析

---

wireshark 筛选通信

`bluetooth.dst==<hide> || bluetooth.src == <hide>`

# 分析

没什么难点，主要是代码量确实大

## 开启

`BathingBtActivity.r3` 重写 `com.klcxkj.zqxy.ui.device.base.BaseDeviceActivity.r3`

1. 设置蓝牙设备的接收数据回调为 `this.handleD_`
2. 设置 `AnalyTools` 的回调函数为 `this`

![upload/attach/202511/1022681_54VUMG4N8JWXQYJ.png](upload/attach/202511/1022681_54VUMG4N8JWXQYJ.png)

```java
public BathingBtActivity() {
    super();
    this.protocolType = "";
    this.x0 = false;
    this.y0 = false;
    this.z0 = false;
    this.exist_deviceInfoKeyNo = false;
    this.B0 = new c(this);
    this.handleD_ = new Handler(new handleD(this));
    this.mayAccountId_ = 0L;
    this.K0 = 0;
}
```

```java
public class handleD implements Handler.Callback {
    public final BathingBtActivity n;

public handleD(BathingBtActivity bathingBtActivity0) {
        this.n = bathingBtActivity0;
        super();
    }

@Override  // android.os.Handler$Callback
    public boolean handleMessage(@NonNull Message message0) {
        switch(message0.what) {
            case 1: {
                switch(message0.arg1) {
                    case 2: {
                        this.n.K5(37);
                        return false;
                    }
                    case 3: {
                        this.n.D5();
                        this.n.K5(34);
                        return false;
                    }
                    case 4: {
                        this.n.K5(38);
                        return false;
                    }
                    case 5: {
                        this.n.K5(33);
                        return false;
                    }
                    default: {
                        return false;
                    }
                }
            }
            case 2: {
                AnalyTools.analyWaterDatas(((byte[])message0.obj));
                return false;
            }
            case 6: {
                if(this.n.blueService != null && this.n.blueService.getState() == 3) {
                    this.n.blueService.stop();
                    this.n.z = 0;
                    return false;
                }

return false;
            }
            case 20: {
                this.n.F5(false);
                return false;
            }
            default: {
                return false;
            }
        }
    }
}
```

最主要的处理接收数据的地方是 case 2，即 `AnalyTools.analyWaterDatas`

```java
public class AnalyTools {
    private static WaterCodeListener waterCodeListeners;
    private static int projectId;
    private static int deviceId;
    private static int lastAccoundId;
    private static byte[] snCode;
    private static byte[] randomNumber;
    private static int failedUnpackCount;

private static byte[] removeStartEndAndUnpackPayload(byte[] arr_b) {
        String s = DigitalTrans.bytesToHexStringLower(arr_b);
        return !s.startsWith("23") || !s.endsWith("0a") ? AnalyTools.unpackData(DigitalTrans.AsciiStringToString(null)) : AnalyTools.unpackData(DigitalTrans.AsciiStringToString(s.substring(2, s.length() - 2)));
    }

public static void analyWaterDatas(byte[] arr_b) {
 String partConsumeDate;
 boolean z1;
 int accountType;
 int consumeMoney;
 int v37;
 int v36;
 String s2;
 int v31;
 int v10;
 int v9;
 int v8;
 int v7;
 int v6;
 int v30;
 int v29;
 int mayDeviceType2;
 int mayDeviceType;
 boolean querySuccess;
 String protocolType;
 int deviceState;
 byte[] payload = AnalyTools.removeStartEndAndUnpackPayload(arr_b);
 byte[] twoComplement = AnalyTools.removeStartEndAndConvTwoComplement(arr_b);
 if (twoComplement != null && payload != null) {
 String s = "";
 int v = 0;
 if (twoComplement[4] == 35) {
 if (payload.length <= 0 || payload[0] != 0xFFFFFF80) {
 label_195:
 protocolType = "";
 querySuccess = false;
 deviceState = 0;
 label_198:
 mayDeviceType = 0;
 mayDeviceType2 = 0;
 v29 = 0;
 v30 = 0;
 } else {
 switch (payload.length) {
 case 23: {
 byte[] arr_b9 = new byte[4];
 for (int v11 = 0; v11 < 4; ++v11) {
 arr_b9[v11] = payload[v11 + 1];
 }

AnalyTools.projectId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b9));
 byte[] arr_b10 = new byte[4];
 for (int v12 = 0; v12 < 4; ++v12) {
 arr_b10[v12] = payload[v12 + 5];
 }

AnalyTools.deviceId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b10));
 byte[] arr_b11 = new byte[4];
 for (int v13 = 0; v13 < 4; ++v13) {
 arr_b11[v13] = payload[v13 + 9];
 }

AnalyTools.lastAccoundId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b11));
                            AnalyTools.snCode = new byte[6];
                            for (int v14 = 0; true; ++v14) {
                                byte[] arr_b12 = AnalyTools.snCode;
                                if (v14 >= arr_b12.length) {
                                    break;
                                }

arr_b12[v14] = payload[v14 + 13];
                            }

AnalyTools.randomNumber = new byte[2];
                            for (int v15 = 0; true; ++v15) {
                                byte[] arr_b13 = AnalyTools.randomNumber;
                                if (v15 >= arr_b13.length) {
                                    break;
                                }

arr_b13[v15] = payload[v15 + 21];
                            }

deviceState = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[19]}));
 protocolType = "";
 querySuccess = true;
 mayDeviceType = 0;
 mayDeviceType2 = 0;
 v29 = 0;
 v30 = 0;
 }
 case 28: {
 byte[] arr_b14 = new byte[4];
 for (int v17 = 0; v17 < 4; ++v17) {
 arr_b14[v17] = payload[v17 + 1];
 }

AnalyTools.projectId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b14));
 byte[] arr_b15 = new byte[4];
 for (int v18 = 0; v18 < 4; ++v18) {
 arr_b15[v18] = payload[v18 + 5];
 }

AnalyTools.deviceId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b15));
 byte[] arr_b16 = new byte[4];
 for (int v19 = 0; v19 < 4; ++v19) {
 arr_b16[v19] = payload[v19 + 9];
 }

AnalyTools.lastAccoundId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b16));
                            AnalyTools.snCode = new byte[6];
                            for (int v20 = 0; true; ++v20) {
                                byte[] arr_b17 = AnalyTools.snCode;
                                if (v20 >= arr_b17.length) {
                                    break;
                                }

arr_b17[v20] = payload[v20 + 13];
                            }

AnalyTools.randomNumber = new byte[2];
                            for (int v21 = 0; true; ++v21) {
                                byte[] arr_b18 = AnalyTools.randomNumber;
                                if (v21 >= arr_b18.length) {
                                    break;
                                }

arr_b18[v21] = payload[v21 + 21];
                            }

v6 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[19]}));
 v7 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[23]}));
 v8 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[24]}));
 v9 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[25]}));
 byte[] arr_b19 = new byte[2];
 while (v < 2) {
 arr_b19[v] = payload[v + 26];
 ++v;
 }

v10 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b19));
 deviceState = v6;
 mayDeviceType = v7;
 mayDeviceType2 = v8;
 v29 = v9;
 protocolType = s;
 v30 = v10;
 querySuccess = true;
 break;
 }
 case 0x30: {
 byte[] arr_b20 = new byte[4];
 for (int v22 = 0; v22 < 4; ++v22) {
 arr_b20[v22] = payload[v22 + 1];
 }

AnalyTools.projectId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b20));
 byte[] arr_b21 = new byte[4];
 for (int v23 = 0; v23 < 4; ++v23) {
 arr_b21[v23] = payload[v23 + 5];
 }

AnalyTools.deviceId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b21));
 byte[] arr_b22 = new byte[4];
 for (int v24 = 0; v24 < 4; ++v24) {
 arr_b22[v24] = payload[v24 + 9];
 }

AnalyTools.lastAccoundId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b22));
                            AnalyTools.snCode = new byte[6];
                            for (int v25 = 0; true; ++v25) {
                                byte[] arr_b23 = AnalyTools.snCode;
                                if (v25 >= arr_b23.length) {
                                    break;
                                }

arr_b23[v25] = payload[v25 + 13];
                            }

s = DigitalTrans.bytesToHexStringLower(new byte[]{payload[19]});
                            AnalyTools.randomNumber = new byte[4];
                            for (int v26 = 0; true; ++v26) {
                                byte[] arr_b24 = AnalyTools.randomNumber;
                                if (v26 >= arr_b24.length) {
                                    break;
                                }

arr_b24[v26] = payload[v26 + 24];
                            }

v6 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[28]}));
 v7 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[29]}));
 v8 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[30]}));
 v9 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[0x1F]}));
 byte[] arr_b25 = new byte[2];
 while (v < 2) {
 arr_b25[v] = payload[v + 0x20];
 ++v;
 }

v10 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b25));
 label_187:
 deviceState = v6;
 mayDeviceType = v7;
 mayDeviceType2 = v8;
 v29 = v9;
 protocolType = s;
 v30 = v10;
 querySuccess = true;
 break;
 }
 default: {
 if (payload.length >= 49) {
 byte[] arr_b3 = new byte[4];
 for (int v1 = 0; v1 < 4; ++v1) {
 arr_b3[v1] = payload[v1 + 1];
 }

AnalyTools.projectId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b3));
 byte[] arr_b4 = new byte[4];
 for (int v2 = 0; v2 < 4; ++v2) {
 arr_b4[v2] = payload[v2 + 5];
 }

AnalyTools.deviceId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b4));
 byte[] arr_b5 = new byte[4];
 for (int v3 = 0; v3 < 4; ++v3) {
 arr_b5[v3] = payload[v3 + 9];
 }

AnalyTools.lastAccoundId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b5));
                                AnalyTools.snCode = new byte[6];
                                for (int v4 = 0; true; ++v4) {
                                    byte[] arr_b6 = AnalyTools.snCode;
                                    if (v4 >= arr_b6.length) {
                                        break;
                                    }

arr_b6[v4] = payload[v4 + 13];
                                }

s = DigitalTrans.bytesToHexStringLower(new byte[]{payload[19]});
                                AnalyTools.randomNumber = new byte[4];
                                for (int v5 = 0; true; ++v5) {
                                    byte[] arr_b7 = AnalyTools.randomNumber;
                                    if (v5 >= arr_b7.length) {
                                        break;
                                    }

arr_b7[v5] = payload[v5 + 24];
                                }

v6 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[28]}));
 v7 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[29]}));
 v8 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[30]}));
 v9 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[0x1F]}));
 byte[] arr_b8 = new byte[2];
 while (v < 2) {
 arr_b8[v] = payload[v + 0x20];
 ++v;
 }

v10 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b8));
                                deviceState = v6;
                                mayDeviceType = v7;
                                mayDeviceType2 = v8;
                                v29 = v9;
                                protocolType = s;
                                v30 = v10;
                                querySuccess = true;
                                break;
                            } else {
                                protocolType = "";
                                querySuccess = false;
                                deviceState = 0;
                                label_198:
                                mayDeviceType = 0;
                                mayDeviceType2 = 0;
                                v29 = 0;
                                v30 = 0;
                            }
                        }
                    }
                }

WaterCodeListener waterCodeListener0 = AnalyTools.waterCodeListeners;
 if (waterCodeListener0 != null) {
 waterCodeListener0.chaxueNewshebeiOnback(querySuccess, // arg1:boolean
 deviceState, // arg2:int
 AnalyTools.deviceId, // arg3:int
 AnalyTools.projectId, // arg4:int
 AnalyTools.lastAccoundId, // arg5:int
 AnalyTools.snCode, // arg6:byte[]
 AnalyTools.randomNumber, // arg7:byte[]
 mayDeviceType, // arg8:int
 mayDeviceType2, // arg9:int
 v29, // arg10:int
 v30, // arg11:int
 protocolType // arg12:java.lang.String
 );
 }
 } else {
 switch (twoComplement[4]) {
 case -8: {
 if (payload.length <= 0 || payload[0] != 0xFFFFFF80) {
 v31 = 0;
 } else {
 byte[] arr_b26 = new byte[1];
 System.arraycopy(payload, 1, arr_b26, 0, 1);
 v31 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b26));
 byte[] arr_b27 = new byte[1];
 System.arraycopy(payload, 2, arr_b27, 0, 1);
 s = DigitalTrans.bytesToHexStringLower(arr_b27);
 v = 1;
 }

AnalyTools.waterCodeListeners.settingKeyCallback(v != 0, v31, s);
                        return;
                    }
                    case -6: {
                        if (payload.length > 0 && payload[0] == 0xFFFFFF80) {
                            v = 1;
                        }

AnalyTools.waterCodeListeners.fanhuicunchuOnback((v != 0));
 return;
 }
 case -5: {
 if (payload.length <= 0 || payload[0] != 0xFFFFFF80) {
 errPath:
 partConsumeDate = null;
 z1 = false;
 accountType = 2;
 consumeMoney = 0;
 } else if (payload.length == 42) {
 byte[] arr_b28 = new byte[6];
 for (int v32 = 0; v32 < 6; ++v32) {
 arr_b28[v32] = payload[v32 + 1];
 }

s2 = DigitalTrans.bytesToHexStringLower(arr_b28);
 byte[] arr_b29 = new byte[4];
 for (int v33 = 0; v33 < 4; ++v33) {
 arr_b29[v33] = payload[v33 + 7];
 }

AnalyTools.projectId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b29));
 byte[] arr_b30 = new byte[4];
 for (int v34 = 0; v34 < 4; ++v34) {
 arr_b30[v34] = payload[v34 + 11];
 }

AnalyTools.deviceId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b30));
 byte[] arr_b31 = new byte[4];
 for (int v35 = 0; v35 < 4; ++v35) {
 arr_b31[v35] = payload[v35 + 15];
 }

AnalyTools.lastAccoundId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b31));
 v36 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[19]}));
 byte[] arr_b32 = new byte[4];
 while (v < 4) {
 arr_b32[v] = payload[v + 28];
 ++v;
 }

v37 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b32));
 consumeMoney = v37;
 accountType = v36;
 z1 = true;
 partConsumeDate = s2;
 AnalyTools.waterCodeListeners.caijishujuOnback(z1, partConsumeDate, AnalyTools.projectId, AnalyTools.lastAccoundId, accountType, consumeMoney, payload);
 return;
 } else {
 if (payload.length >= 62) {
 byte[] arr_b33 = new byte[6];
 for (int v38 = 0; v38 < 6; ++v38) {
 arr_b33[v38] = payload[v38 + 1];
 }

s2 = DigitalTrans.bytesToHexStringLower(arr_b33);
 byte[] arr_b34 = new byte[4];
 for (int v39 = 0; v39 < 4; ++v39) {
 arr_b34[v39] = payload[v39 + 7];
 }

AnalyTools.projectId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b34));
 byte[] arr_b35 = new byte[4];
 for (int v40 = 0; v40 < 4; ++v40) {
 arr_b35[v40] = payload[v40 + 11];
 }

AnalyTools.deviceId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b35));
 byte[] arr_b36 = new byte[4];
 for (int v41 = 0; v41 < 4; ++v41) {
 arr_b36[v41] = payload[v41 + 15];
 }

AnalyTools.lastAccoundId = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b36));
 v36 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(new byte[]{payload[19]}));
 byte[] arr_b37 = new byte[4];
 while (v < 4) {
 arr_b37[v] = payload[v + 28];
 ++v;
 }

v37 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b37));
                                label_298:
                                consumeMoney = v37;
                                accountType = v36;
                                z1 = true;
                                partConsumeDate = s2;
                                AnalyTools.waterCodeListeners.caijishujuOnback(z1, partConsumeDate, AnalyTools.projectId, AnalyTools.lastAccoundId, accountType, consumeMoney, payload);
                                return;
                            }
                            partConsumeDate = null;
                            z1 = false;
                            accountType = 2;
                            consumeMoney = 0;
                        }

AnalyTools.waterCodeListeners.caijishujuOnback(z1, partConsumeDate, AnalyTools.projectId, AnalyTools.lastAccoundId, accountType, consumeMoney, payload);
                        return;
                    }
                    case 33: {
                        if (payload.length > 0 && payload[0] == 0xFFFFFF80) {
                            v = 1;
                        }

AnalyTools.waterCodeListeners.xiafafeilvOnback(v != 0, payload);
                        return;
                    }
                    case 34: {
                        if (payload.length > 0 && payload[0] == 0xFFFFFF80) {
                            v = 1;
                        }

AnalyTools.waterCodeListeners.jieshufeilvOnback(v != 0, AnalyTools.lastAccoundId);
                        return;
                    }
                    case 49: {
                        if (payload.length > 0 && payload[0] == 0xFFFFFF80) {
                            v = 1;
                        }

AnalyTools.waterCodeListeners.startDeal(v != 0, payload);
                        return;
                    }
                    case 50: {
                        if (payload.length > 0 && payload[0] == 0xFFFFFF80) {
                            v = 1;
                        }

AnalyTools.waterCodeListeners.stopDeal(v != 0);
                        return;
                    }
                    case 80: {
                        byte[] arr_b38 = new byte[1];
                        System.arraycopy(payload, 1, arr_b38, 0, 1);
                        int v44 = DigitalTrans.hexStringToAlgorism(DigitalTrans.bytesToHexStringLower(arr_b38));
                        byte[] arr_b39 = new byte[1];
                        System.arraycopy(payload, 2, arr_b39, 0, 1);
                        String s4 = DigitalTrans.bytesToHexStringLower(arr_b39);
                        AnalyTools.waterCodeListeners.settingKeyCallback(true, v44, s4);
                        break;
                    }
                }
            }
        }
    }

private static byte[] removeStartEndAndConvTwoComplement(byte[] arr_b) {
        String s = DigitalTrans.bytesToHexStringLower(arr_b);
        return !s.startsWith("23") || !s.endsWith("0a") ? DigitalTrans.hexStringToByte(DigitalTrans.AsciiStringToString(null)) : DigitalTrans.hexStringToByte(DigitalTrans.AsciiStringToString(s.substring(2, s.length() - 2)));
    }

private static byte[] unpackData(String s) {
 byte[] arr_b = DigitalTrans.hexStringToBytes(s);
 if (arr_b != null && arr_b.length >= 9) {
 int v = ((arr_b[1] & 0xFF) << 8 | arr_b[2] & 0xFF) - 3;
 if (v > 0) {
 byte[] arr_b1 = new byte[v];
 int v2 = 0;
 for (int v1 = 0; v1 < v; ++v1) {
 arr_b1[v1] = arr_b[v1 + 6];
 v2 += arr_b[v1 + 6];
 }

if (((byte) (v2 + arr_b[3] + arr_b[4] + arr_b[5] & 0xFF)) != arr_b[arr_b.length - 2]) {
                    int v3 = AnalyTools.failedUnpackCount + 1;
                    AnalyTools.failedUnpackCount = v3;
                    return v3 >= 5 ? arr_b1 : new byte[0];
                }

return arr_b1;
            }

return new byte[0];
        }

return null;
    }

public static void setWaterCodeListener(WaterCodeListener waterCodeListener0) {
        AnalyTools.waterCodeListeners = waterCodeListener0;
    }
}
```

通过分析，我们可以解析蓝牙设备返回的数据

![upload/attach/202511/1022681_54VUMG4N8JWXQYJ.png](upload/attach/202511/1022681_STE82Y36D7T2BZT.png)

解析完成之后，大多数都会执行 `waterCodeListener0` 的函数，这些函数定义在上面的 `BathingBtActivity` 类中

以查询设备信息举例，当 `AnalyTools.analyWaterDatas` 分析完查询设备的数据之后会调用

`chaxueNewshebeiOnback` ，该函数会按照 `deviceState` 和 `mayDeviceType` 的值来执行不同的功能（逻辑派发）

```java
@Override  // com.klcxkj.bluesdk.utils.WaterCodeListener
public void chaxueNewshebeiOnback(boolean querySuccess, int deviceState, int deviceId, int projectId, int mayAccountId, byte[] snCode, byte[] randomNumber, int mayDeviceType, int mayDeviceType2, int v29, int v30, String protocolType) {
    this.ui_q3();
    if(querySuccess) {
        this.D5();
        this.mayDeviceType_ = mayDeviceType;
        this.mayDeviceType2_ = mayDeviceType2;
        this.mayAccountId_ = (long)mayAccountId;
        this.randomNumber = randomNumber;
        this.protocolType = protocolType;
        if(projectId == 0) {
            this.ui_TipsDeviceIsChanged();
            return;
        }

if(this.userInfo.getProjectId() != projectId) {
            this.ui_TipsDeviceIsChanged();
            return;
        }

switch(mayDeviceType) {
            case 0: {
                label_16:
                switch(deviceState) {
                    case 0: {
                        goto deviceState0;
                    }
                    case 1: {
                        goto deviceState1;
                    }
                    case 2: {
                        this.K4(this.getString(0x7F1104C6));  // string:no_interrupt_tips "设备正在刷卡消费，请更换其他设备"
                        return;
                    }
                    case 3: {
                        this.K5(36);
                        CmdBtUtils.caijishuju(this.blueService);
                        return;
                    }
                    case 5: {
                        this.K4(this.getString(0x7F1101A3));  // string:device_control_model_tips "设备已进入远程控制模式，如需使用请联系管理员！"
                        return;
                    }
                }

return;
                deviceState1:
                if(((long)mayAccountId) != this.userInfo.getAccountId()) {
                    if(this.G == 1) {
                        this.H5();
                        return;
                    }

this.K5(52);
                    return;
                }

if(this.z0) {
                    this.w5();
                    return;
                }

this.K5(35);
                this.h4(this.deviceInfo.getDevMac(), 0);
                return;
                deviceState0:
                this.K5(40);
                if(this.G == 1) {
                    this.p.setVisibility(0);
                    this.requestRateOrder(4, this.mayDeviceType_, this.mayDeviceType2_, this.deviceInfo.getDevID(), this.randomNumber, this.protocolType);
                    return;
                }

return;
            }
            case 1:
            case 3: {
                break;
            }
            default: {
                if(mayDeviceType != 4) {
                    this.I4(this.getString(0x7F1101AB));  // string:device_type_error "设备类型错误!请联系管理员进行设备登记。"
                    return;
                }

goto label_16;
            }
        }

switch(deviceState) {
            case 0: {
                goto label_63;
            }
            case 1: {
                goto label_51;
            }
            case 2: {
                this.K4(this.getString(0x7F1104C6));  // string:no_interrupt_tips "设备正在刷卡消费，请更换其他设备"
                return;
            }
            case 3: {
                this.K5(36);
                CmdBtUtils.caijishuju(this.blueService);
                return;
            }
            case 5: {
                this.K4(this.getString(0x7F1101A3));  // string:device_control_model_tips "设备已进入远程控制模式，如需使用请联系管理员！"
                return;
            }
        }

return;
        label_51:
        if(((long)mayAccountId) != this.userInfo.getAccountId()) {
            if(this.G == 1) {
                this.G5();
                return;
            }

this.K5(52);
            return;
        }

if(this.z0) {
            this.w5();
            return;
        }

this.K5(35);
        this.h4(this.deviceInfo.getDevMac(), 0);
        return;
        label_63:
        this.K5(40);
        if(this.G == 1) {
            this.p.setVisibility(0);
            this.requestRateOrder(4, this.mayDeviceType_, this.mayDeviceType2_, this.deviceInfo.getDevID(), this.randomNumber, this.protocolType);
        }
    }
    else {
        this.I4(this.getString(0x7F1101AA));  // string:device_query_fail "查询设备失败，请稍后重试"
    }
}
```

例如当 `deviceState` 为 0 且 `mayDeviceType` 为 0 时，下订单然后开启设备（开启热水），即

```java
this.requestRateOrder(4, this.mayDeviceType_, this.mayDeviceType2_, this.deviceInfo.getDevID(), this.randomNumber, this.protocolType);
```

api 请求均在 `BaseDeviceActivity` 中实现

```java
public void requestRateOrder(int apiSelector, int mayDeviceType, int mayDeviceType2, int deviceId, byte[] randomNumber, String protocolType) {
    public class com.klcxkj.zqxy.ui.device.base.BaseDeviceActivity.f extends ug.b {
        public final int mayDeviceType;
        public final int mayDeviceType2;
        public final int deviceId;
        public final byte[] randomNumber;
        public final String protocolType;
        public final BaseDeviceActivity ac;

public com.klcxkj.zqxy.ui.device.base.BaseDeviceActivity.f(BaseDeviceActivity baseDeviceActivity0, int mayDeviceType, int mayDeviceType2, int deviceId, byte[] randomNumber, String protocolType) {
            this.ac = baseDeviceActivity0;
            this.mayDeviceType = mayDeviceType;
            this.mayDeviceType2 = mayDeviceType2;
            this.deviceId = deviceId;
            this.randomNumber = randomNumber;
            this.protocolType = protocolType;
            super();
        }

@Override  // ug.a
        public void b(int v, String s) {
            this.ac.d0(v + s);
        }

@Override  // ug.a
        public void c(int v, String s) {
            this.ac.Q3(this.mayDeviceType, this.mayDeviceType2, this.deviceId, this.randomNumber, this.protocolType);
        }

@Override  // ug.b
        public void e(Object object0) {
            this.f(((DownRateResponse)object0));
        }

public void f(DownRateResponse downRateResponse0) {
            try {
                switch(downRateResponse0.getErrorCode()) {
                    case 0: {
                        try {
                            this.ac.parseDownRate(downRateResponse0);
                        }
                        catch(Exception exception0) {
                            exception0.printStackTrace();
                        }

return;
                    }
                    case 204: {
                        this.ac.ui_q3();
                        this.ac.Q4();
                        this.ac.c5();
                        return;
                    }
                    case 220: {
                        this.ac.ui_q3();
                        this.ac.S4(downRateResponse0.getMessage());
                        return;
                    }
                    case 0xDD: {
                        this.ac.ui_q3();
                        this.ac.T4();
                        return;
                    }
                    case 311: {
                        String s = this.ac.getString(0x7F1104C6);  // string:no_interrupt_tips "设备正在刷卡消费，请更换其他设备"
                        this.ac.K4(s);
                        return;
                    }
                    case 8:
                    case 10000: {
                        this.ac.ui_q3();
                        a.k(this.ac.n, downRateResponse0.getMessage());
                        return;
                    }
                    default: {
                        this.ac.ui_q3();
                        this.ac.H4(downRateResponse0.getMessage());
                    }
                }
            }
            catch(Exception unused_ex) {
                String s1 = this.ac.getString(0x7F110363);  // string:json_error "服务器繁忙,请稍后重试"
                this.ac.H4(s1);
            }
        }
    }

String api;
    if(!a.h(this.n)) {
        a.l(this.r, this.n);
        return;
    }

switch(apiSelector) {
        case 4: {
            api = apiUtils.getRateOrderOrApartmentWater();
            break;
        }
        case 5: {
            api = apiUtils.getRateOrder();
            break;
        }
        default: {
            api = "";
        }
    }

if(TextUtils.isEmpty(api)) {
        return;
    }

this.ui_TipsConnecting();
    String macAddress = this.deviceInfo.getDevMac();
    byte[] macTypeArr = {((byte)mayDeviceType), ((byte)mayDeviceType2)};
    HashMap hashMap0 = new HashMap();
    if(MyApp.notBLE) {
        HashMap hashMap1 = new HashMap();
        hashMap1.put("telephone", this.userInfo.getTelPhone());
        hashMap1.put("deviceId", String.valueOf(deviceId));
        hashMap1.put("xfModel", "0");
        hashMap1.put("randomNumber", DigitalTrans.bytesToHexStringLower(randomNumber));
        String s3 = x.getSign(hashMap1);
        hashMap0.put("deviceId", String.valueOf(deviceId));
        hashMap0.put("macAddress", macAddress.replaceAll(":", ""));
        hashMap0.put("macType", DigitalTrans.bytesToHexStringLower(macTypeArr));
        hashMap0.put("bigTypeId", String.valueOf(this.deviceInfo.getDsbtypeid()));
        hashMap0.put("smallTypeId", String.valueOf(this.deviceInfo.getDevTypeID()));
        hashMap0.put("protocolType", protocolType);
        hashMap0.put("randomNumber", DigitalTrans.bytesToHexStringLower(randomNumber));
        hashMap0.put("signature", s3);
        hashMap0.put("xfModel", "0");
        long v4 = this.M;
        if(v4 > 0L) {
            hashMap0.put("couponId", String.valueOf(v4));
        }
    }
    else {
        HashMap hashMap2 = new HashMap();
        hashMap2.put("telPhone", this.userInfo.getTelPhone());
        hashMap2.put("deviceId", String.valueOf(deviceId));
        hashMap2.put("xfModel", "0");
        hashMap2.put("randomNumber", DigitalTrans.bytesToHexStringLower(randomNumber));
        String s4 = x.getSign(hashMap2);
        hashMap0.put("deviceId", String.valueOf(deviceId));
        hashMap0.put("deviceMac", macAddress.replaceAll(":", ""));
        hashMap0.put("macType", DigitalTrans.bytesToHexStringLower(macTypeArr));
        hashMap0.put("mainTypeId", String.valueOf(this.deviceInfo.getDsbtypeid()));
        hashMap0.put("smallTypeId", String.valueOf(this.deviceInfo.getDevTypeID()));
        hashMap0.put("protocolType", protocolType);
        hashMap0.put("randomNumber", DigitalTrans.bytesToHexStringLower(randomNumber));
        hashMap0.put("signature", s4);
        hashMap0.put("xfModel", "0");
    }

this.D0(api, hashMap0, new com.klcxkj.zqxy.ui.device.base.BaseDeviceActivity.f(this, mayDeviceType, mayDeviceType2, deviceId, randomNumber, protocolType), false);
}
```

请求无误后执行 `this.ac.parseDownRate(downRateResponse0);`

该函数位于 `BathingBtActivity`

```java
@Override  // com.klcxkj.zqxy.ui.device.base.BaseDeviceActivity
public void parseDownRate(DownRateResponse downRateResponse0) {
    try {
        this.downRateResp_ = downRateResponse0;
        if(this.exist_deviceInfoKeyNo && this.protocolType.equals("20")) {
            CmdBtUtils.settingKey(this.blueService, this.deviceInfo.getKeyType(), this.deviceInfo.getKeyNo());
            return;
        }

this.sendCommandOpenWater();
    }
    catch(IOException iOException0) {
        iOException0.printStackTrace();
    }
}
```

可以看到接收到数据之后执行 `sendCommandOpenWater()`

```java
private void sendCommandOpenWater() {
    CmdBtUtils.downFateToDev(this.blueService, this.protocolType, this.downRateResp_.getData().getDownData());
    this.handleD_.sendEmptyMessageDelayed(20, 5000L);
}
```

最终我们定位到一个发送数据的类，这里定义了数据如何被发送

```java
import java.io.IOException;
import java.util.ArrayList;

public class CmdBtUtils {
    public CmdBtUtils() {
        super();
    }

public static void caijishuju(BluetoothService bluetoothService0) {
        String s = "23" + DigitalTrans.StringToAsciiString(DigitalTrans.bytesToHexStringLower(BlueUtils.sendCommendBuffer(0x85, DigitalTrans.hexStringToBytes(DigitalTrans.toHexStringWithSepcLen_Upper(0L, 2))))) + "0a";
        if(bluetoothService0 != null && bluetoothService0.getState() == 3) {
            bluetoothService0.write(DigitalTrans.hexStringToByte(s));
        }
    }

public static void chaxueshebei(BluetoothService bluetoothService0) {
        String s = "23" + DigitalTrans.StringToAsciiString(DigitalTrans.bytesToHexStringLower(BlueUtils.sendCommendBuffer(35, DigitalTrans.hexStringToBytes(DigitalTrans.toHexStringWithSepcLen_Upper(0L, 2))))) + "0a";
        if(bluetoothService0 != null && bluetoothService0.getState() == 3) {
            bluetoothService0.write(DigitalTrans.hexStringToByte(s));
        }
    }

public static void dealFinish(BluetoothService bluetoothService0, int v, int v1) throws IOException {
        byte[] arr_b = DigitalTrans.hexStringToByte(DigitalTrans.toHexStringWithSepcLen_Upper(0L, 2));
        byte[] arr_b1 = DigitalTrans.hexStringToByte(DigitalTrans.toHexStringWithSepcLen_Upper(v, 2));
        byte[] arr_b2 = DigitalTrans.hexStringToByte(DigitalTrans.toHexStringWithSepcLen_Upper(v1, 2));
        ArrayList arrayList0 = new ArrayList();
        arrayList0.add(arr_b);
        arrayList0.add(arr_b1);
        arrayList0.add(arr_b2);
        String s = "23" + DigitalTrans.StringToAsciiString(DigitalTrans.bytesToHexStringLower(BlueUtils.sendCommendBuffer(50, DigitalTrans.copyByte(arrayList0)))) + "0a";
        if(bluetoothService0 != null && bluetoothService0.getState() == 3) {
            bluetoothService0.write(DigitalTrans.hexStringToByte(s));
        }
    }

public static void dealStart(BluetoothService bluetoothService0, String s) {
        String s1 = "23" + DigitalTrans.StringToAsciiString(DigitalTrans.bytesToHexStringLower(BlueUtils.sendCommendBuffer(49, DigitalTrans.hexStringToBytes(s)))) + "0a";
        if(bluetoothService0 != null && bluetoothService0.getState() == 3) {
            bluetoothService0.write(DigitalTrans.hexStringToByte(s1));
        }
    }

public static void downFateToDev(BluetoothService bluetoothService0, String s, String downData) {
        byte[] arr_b = DigitalTrans.hexStringToBytes(downData);
        s.equals("20");
        String s2 = "23" + DigitalTrans.StringToAsciiString(DigitalTrans.bytesToHexStringLower(BlueUtils.sendCommendBuffer(33, arr_b))) + "0a";
        if(bluetoothService0 != null && bluetoothService0.getState() == 3) {
            bluetoothService0.write(DigitalTrans.hexStringToByte(s2));
        }
    }

public static void fanhuicunchu(BluetoothService bluetoothService0, String s, String s1) {
        if(s1 != null && !s1.equals("")) {
            byte[] arr_b = DigitalTrans.hexStringToBytes(s1);
            s.equals("20");
            String s2 = "23" + DigitalTrans.StringToAsciiString(DigitalTrans.bytesToHexStringLower(BlueUtils.sendCommendBuffer(0x86, arr_b))) + "0a";
            if(bluetoothService0 != null) {
                bluetoothService0.write(DigitalTrans.hexStringToByte(s2));
            }
        }
    }

public static void jieshufeilv(BluetoothService bluetoothService0) {
        String s = "23" + DigitalTrans.StringToAsciiString(DigitalTrans.bytesToHexStringLower(BlueUtils.sendCommendBuffer(34, DigitalTrans.hexStringToBytes(DigitalTrans.toHexStringWithSepcLen_Upper(0L, 2))))) + "0a";
        if(bluetoothService0 != null && bluetoothService0.getState() == 3) {
            bluetoothService0.write(DigitalTrans.hexStringToByte(s));
        }
    }

public static void settingKey(BluetoothService bluetoothService0, int v, String s) throws IOException {
        byte[] arr_b = DigitalTrans.hexStringToByte(DigitalTrans.toHexStringWithSepcLen_Upper(v, 2));
        byte[] arr_b1 = DigitalTrans.hexStringToBytes(s);
        ArrayList arrayList0 = new ArrayList();
        arrayList0.add(arr_b);
        arrayList0.add(arr_b1);
        String s1 = "23" + DigitalTrans.StringToAsciiString(DigitalTrans.bytesToHexStringLower(BlueUtils.sendCommendBuffer(0x88, DigitalTrans.copyByte(arrayList0)))) + "0a";
        if(bluetoothService0 != null && bluetoothService0.getState() == 3) {
            bluetoothService0.write(DigitalTrans.hexStringToByte(s1));
        }
    }
}
```

当向热水器设备发送 `downFateToDev` 生成的数据之后，热水器被开启

---

## 结束

同理，调用 `caijishuju` 获取返回数据之后上传数据到 upload api 即可结束计费

## 以 chaxueshebei 为例分析蓝牙传输

```java
public static void chaxueshebei(BluetoothService bluetoothService0) {
    String s = "23" + DigitalTrans.StringToAsciiString(DigitalTrans.bytesToHexStringLower(BlueUtils.sendCommendBuffer(35, DigitalTrans.hexStringToBytes(DigitalTrans.toHexStringWithSepcLen_Upper(0L, 2))))) + "0a";
    if(bluetoothService0 != null && bluetoothService0.getState() == 3) {
        bluetoothService0.write(DigitalTrans.hexStringToByte(s));
    }
}
```

s 固定为

```java
233630303030343830323330303030613331360a
```

![upload/attach/202511/1022681_54VUMG4N8JWXQYJ.png](upload/attach/202511/1022681_BXM2XPK3KSGWVR5.png)

---

**返回数据**

```java
<hide>
```

# OSINT（但是好像没啥用）

<a href="elink@074K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6b7$3!0V1K9h3&6Y4b7X3!0&6P5g2)9J5c8V1E0x3b7#2S2w2d9W2)9J5k6q4N6S2N6r3g2J5i4K6u0r3j5X3I4G2j5W2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8W2)9J5y4f1f1^5i4K6t1#2z5e0y4Q4x3U0f1&6c8q4)9J5y4f1f1%4i4K6t1#2z5o6W2Q4x3U0f1&6z5g2)9J5y4f1f1$3i4K6t1#2z5e0y4Q4x3U0f1^5c8q4)9J5y4f1f1@1i4K6t1#2b7V1c8Q4x3U0f1&6b7#2)9J5y4f1f1^5i4K6t1#2b7f1k6Q4x3U0g2n7y4q4)9J5y4f1f1$3i4K6t1#2z5e0S2Q4x3U0f1^5c8g2)9J5k6i4c8^5N6l9`.`.">78aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6A6b7$3!0V1K9h3&6Y4b7X3!0&6P5g2)9J5c8V1E0x3b7#2S2w2d9W2)9J5k6q4N6S2N6r3g2J5i4K6u0r3j5X3I4G2j5W2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8R3`.`.蓝牙操作说明.txt</a>

回复或点赞可查看完整内容

传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！！

最后于 2025-11-29 22:48 被YuHuanTin编辑，原因：

#逆向分析 #协议分析

最新回复 (50) 1 2 3 ▶
mb_vhwdzyqo 雪币： 215 活跃值： (245) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 15 粉丝 12 关注私信	mb_vhwdzyqo 2 楼来了 2025-11-29 22:58 0
mb_ldbucrik 雪币： 6 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 708 粉丝 7 关注私信	mb_ldbucrik 3 楼感谢分享 2025-11-30 10:11 0
mb_qimctavn 雪币： 5329 活跃值： (6790) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 402 粉丝 1 关注私信	mb_qimctavn 4 楼 6 2025-11-30 12:49 0
院士雪币： 7244 活跃值： (7749) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 263 粉丝 5 关注私信	院士 5 楼来看看，学习。 2025-11-30 14:36 0
wx_Timedout 雪币： 0 活跃值： (90) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 17 粉丝 0 关注私信	wx_Timedout 6 楼 6 2025-11-30 14:48 0
KanXue_NG 雪币： 679 能力值： ( LV1，RANK：0 ) 在线值：发帖 7 回帖 100 粉丝 66 关注私信	KanXue_NG 7 楼学习学习 2025-11-30 15:19 0
xiaotuo 雪币： 200 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 20 粉丝 0 关注私信	xiaotuo 8 楼 666 2025-11-30 15:24 0
柳絮初飘雪币： 397 活跃值： (40) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 26 粉丝 0 关注私信	柳絮初飘 9 楼看看分析过程，学习一下 2025-11-30 16:04 0
Ms135 雪币： 9 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 89 粉丝 0 关注私信	Ms135 10 楼 666 2025-11-30 19:40 0
mb_ykavguun 雪币： 1313 活跃值： (1830) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 166 粉丝 0 关注私信	mb_ykavguun 11 楼 66 2025-11-30 20:13 0
cpannn 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 75 粉丝 0 关注私信	cpannn 12 楼 666 2025-11-30 22:20 0
Mindedness 雪币： 857 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	Mindedness 13 楼大佬tql 2025-11-30 22:33 0
mb_srmwcgoy 雪币： 200 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 17 粉丝 0 关注私信	mb_srmwcgoy 14 楼太强了 2025-11-30 22:49 0
mb_dmryhnwz 雪币： 10 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 92 粉丝 0 关注私信	mb_dmryhnwz 15 楼 6666 2025-12-1 08:22 0
五彩斑斓的黑雪币： 153 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 56 粉丝 0 关注私信	五彩斑斓的黑 16 楼 666 2025-12-1 09:01 0
mb_wqvhhpxn 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 10 粉丝 0 关注私信	mb_wqvhhpxn 17 楼 666 2025-12-1 09:47 0
guijingwen 雪币： 7377 活跃值： (7605) 能力值： ( LV2，RANK：10 ) 在线值：发帖 13 回帖 312 粉丝 0 关注私信	guijingwen 18 楼 66 2025-12-1 10:35 0
不具名的悲伤雪币： 3 活跃值： (1835) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 126 粉丝 0 关注私信	不具名的悲伤 19 楼 6 2025-12-1 11:37 0
iBa0 雪币： 1901 活跃值： (5928) 能力值： ( LV4，RANK：40 ) 在线值：发帖 6 回帖 490 粉丝 37 关注私信	iBa0 20 楼 666 2025-12-1 16:00 0
mb_wzlywroj 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 2 粉丝 0 关注私信	mb_wzlywroj 21 楼 6 2025-12-1 16:37 0
云南第一深情雪币： 200 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	云南第一深情 22 楼 666 2025-12-1 17:09 0
大魔头雪币： 178 活跃值： (3916) 能力值： ( LV6，RANK：80 ) 在线值：发帖 18 回帖 167 粉丝 80 关注私信	大魔头 23 楼 2025-12-1 17:11 0
mb_cbgtaveo 雪币： 292 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 259 粉丝 0 关注私信	mb_cbgtaveo 24 楼 6666666666 2025-12-1 17:41 0
sgdc51 雪币： 13 活跃值： (55) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	sgdc51 25 楼感谢分享 2025-12-1 20:13 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复