Skip to content
cdevries.dev

Reverse engineering

tuya-mobile

The Tuya mobile app protocol, worked out from the app itself and turned into something scriptable.

View repository

Why

A large share of cheap connected hardware is Tuya underneath, rebranded by whoever sells it. The public Tuya cloud API only covers part of what the mobile app can do. The interesting capabilities, the ones that make a device genuinely useful, are only reachable through the app's own protocol.

What I built

A pure Python reimplementation of the Tuya mobile app API security layer: request signing, the encrypted mobile API client and MQTT credential derivation. It needs no native libthing_security.so, and it reaches actions the public API does not expose.

This is the layer the Philips Pet Series camera support is built on.