Hitachi air conditionner controller hack - ESP01

The purpose of this project is to manage my hitachi air conditionners with the Home Assistant using low cost ESP-01.

Similar projects worth following
I have 3 hitachi Air conditionner (RAF-35RXE) that are managed seperatly with 3 remote control. That's not a easiest way to get the right temperature in the right room.
The goal here is to hack the SPX-WAG01 gateway connected wirelessly to the Hi-kumo app and connected with serial intergace to the A/C unit.
The work done by Florian was a very good starting point ( but we went to seperate way when it comes to integration.

I heard a lot of very bad feedback about the SPX-WFG01 and Hi-kumo app.

But after the full reset, I was able to create the new account and to connect the gataway to the A/C. The app works well
I don't understand all the critics on play store ...

  • Nice progress...

    Vince05/21/2021 at 09:40 0 comments

    After many hours spend to snif the paquets here the first sharing. It was quite easy so far with the basic functions. I found 7 commands/informations out of 15. I add my investigation file

    First we can find below the regular exchanged paquets every 6 sec. (Without any command)

    Send by the SPX-WFG01 :

    The A/C feedback

    And now the command

    So to here the list of adresses and content that I was able to catch.

    There are still some question marks that have to be confirmed. And also 8 unkown information in the paquet. Maybe you have an idea ?

    There are some functions that combined several of the command.

    • The Leave Home function swith the A/C in heating mode, with 10°C  and Low fan
    • Auto operating mode switch Operating mode and fan mode to auto

    In addition, all the timer functions are managed by the the remote control itself. So only the basic commands (On/Off) are send by the remote control as scheduled previously.

    According to the Hi-humo App description I should find also adresses releated to alarm functions. At this stage I'm not able to figure out how to trigger any alam from the A/C

  • First analysis

    Vince05/18/2021 at 17:39 0 comments

    First thing first

    Here the first analysis of the serial communication between the SPX-WFG01 and the A/C catch with 2 serial adaptators connected to my laptop.

    The communication consist of ;

    - A paquet sent by the gateway containing 15 lines starting with MT, where P is the adress.

    - The response from the gateway containing 15 lines starting all with OK and where P is the containt at this adress.

    My assumption is that the last line (adress 0900) contains the A/C serial n° (hidden)

    in addition :

    • - Carriage return is 0x0D 0x00
    • - C is simply = P XOR 0xFF

    Now start playing ...

    I connect my smartphone to the Hi-humo app and try to catch some commands between

    In this case a very diffrent paquet is sent to the A/C containing 12 lines staring all with ST, P contains the adress followed by the value.

    4 adress are missing and one (0007) is not only use in this message frame. I noticed that some adress are used several time in the same paquet and the adress sequence is also not the same.

    If everything works well the A/C should asnwer
    At this stage I noticed that the communication for this A/C unit is very similar to the one used and hacked by Florian in this project (thks to him). There are more containt, more lines in the paquet and probably at the end more function to manage.

    One setp further !

    I made some additionnal test with the IR remote control. Of course since the receiver is located directly inside the A/C housing the communication will not pass through the SPX-WFG01 and I'll not be able to get the content.
    But the good news is that the  the A/C continues to send the ACK on his serial port so I was able to made some interesting comparisons.

    ... stay tuned !

  • Very first step

    Vince05/17/2021 at 14:43 0 comments

    My first step was to open the gateway and to check the pinout.

    I can confirm the pinout posted by Florian (

    Nevertheless the function of pin N°6 is still unclear for me. Let's check that later.

    I mesured 5V for Rx & Tx echanges.

    Every thing is ready to use my own tools that I've made to monitor and hack serial communication.

    I'll come up soon with the first paquets...

View all 3 project logs

Enjoy this project?



Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates