I managed to get around to playing with the Ennio wifi doorbell a little more, trying to figure out how all of it works. It seems I have to learn a few things about UDP, however with a quick and dirty tcpdump on my openwrt router (which I was hacking in other ways earlier) to an NFS share on my RAID I managed to collect a chunk of worthwhile data while my phone interacted with the camera.
As far as I can tell without capturing all of the data of all of the interactions it goes something like this:
- Phone sends a broadcast request of some kind and the doorbell responds with a packet with it’s name to the UDP port specified by the initial contact.
- The phone logs into the device using the username and password provided by doing by sending a hex encoded ASCII string, with some preamble bytes: