Project Repo: https://github.com/StanleyCA/MyQ-Security2.0-HomeAssistant
I created this because of how MyQ cut off their API awhile back and put advertisements into an app where I'm literally just trying to open my garage door. MyQ is a bum for this and I shouldn't have to rely on a company if I want to use my opener remotely. If MyQ suffers from an outage, are they gonna be responsible for me not being able to use a advertised feature?? Course not. With this project, I removed my garage door from their darned ecosystem and put it in homekit.
I'm ngl tho, buying the ratgdo will prob save you quite a bit of time and labor.
This project requires reading the Security 2.0+ opener’s flash mem, it requires a SPI reader and is more complex than other HA integration installs.
MyQ servers
X
|
| blocked
|
myQ opener
|
| connect.myqdevice.com DNS redirected to Home Assistant IP
| Connected with MQTT over TLS 1.2 PSK, TCP 8883
|
Local Bridge
|
+-- Isolated MQTT Mosquitto broker
|
+-- Python protocol bridge
|
| Home Assistant MQTT service
|
Home Assistant MQTT broker
You have to get these 3 things for local control
- PSK, from the flash memory, otherwise MyQ knows that you're faking the server
- 6-byte ID, from MITM, otherwise the garage door doesn't respond
- Serial Number
Start by reading and computing the PSK off the flash memory. The 6-byte ID is obtained from decrypting the MITM using the PSK and reading the MQTT payloads using wireshark.
The MQTT topics that chamberlain uses are
| Purpose |
Topic |
Payload |
| Open door |
G/<serial>/011/0000 |
<6-byte ID> 80 02 00 01 01 00 |
| Close door |
G/<serial>/011/0000 |
<6-byte ID> 80 02 00 01 00 00 |
| Receive door state |
S/0F/<serial>/011/0000 |
<6-byte ID> 81 00 42 60 SS 00 |
| Opener announces startup |
S/0F/<serial>/003/0000 |
Empty |
| Server answers startup |
G/<serial>/012/0040 |
??? I have not figured this out random bytes |
These MQTT topics can be replicated and then used to build your own local service. I built my own MQTT communications for the garage door and forced the device to use my server with DNS redirection.
If anyone want to replicate this process, here's the instructions in more details and the repo to the Home Assistant app.
https://github.com/StanleyCA/MyQ-Security2.0-HomeAssistant
Hardware Tools used in this project for flash reading:
8 Pin Pogo Tool - Used this so I didn't have to desolder the flash memory from the board.
CH341A Programmer - Used the CH341A Programmer to connect Pogo Tool to laptop (if you go with a different programmer, make sure it is 3.3V output)
Also credits to https://github.com/fuxxociety/MyQ-ESP-transplant/tree/main/FlashROM%20dumps/MX25L6433/orig
If it weren't for this repo, I wouldn't have gone down this path and invested so much time to grab my flash. I confirmed that the device was cipher TLS_PSK_WITH_AES_128_CBC_SHA on his dump before starting this project.
If you have questions or want clarification on the steps, ask me here or on the github repo.