Undiscovered commands (LOCATE, cleaning-preset room names) — ideas & findings welcome

[jan-tdy]

Two features aren't implemented because no working local device call for them has been found:

1. LOCATE ("find me" / beep) — a native Home Assistant vacuum feature, but no TPAP equivalent has turned up.
2. Resolving a schedule's custom_rule_id back to actual room names — when a Tapo-app schedule is built from a saved "cleaning preset" instead of picking rooms directly, we can see the preset's ID but not what rooms it covers.

What's been tried

• Guessed several plausible method names via vacuum.send_command against a real TPAP-transport RV30 Max: setRobotFindMe, setFindMe, playFindMe, get_custom_clean_rules (with/without a start_index param). All four returned the identical Device error -1002 — most likely a generic "unrecognized method" response, not a near-miss.
• Captured real traffic from the official Tapo app (Android, PCAPdroid, connection-level metadata only — no TLS payload decryption) while using the app's locate and room/preset-editing screens. Result: zero connections to port 4433 (the local TPAP port this integration uses) — nearly all traffic went to TP-Link's cloud (euw1-app-server.iot.i.tplinkcloud.com and similar). This suggests these two features are likely handled via TP-Link's cloud API, not the local protocol.
• Local UDP discovery broadcasts (ports 20004/9999/9998) fired but got no replies during capture — most likely an Android VPN-capture limitation with broadcast/multicast, not proof the device doesn't respond to them.

An untried angle

Instead of watching the phone's outbound traffic (which mostly goes to the cloud and is hard to intercept cleanly), it might be more fruitful to watch traffic arriving at the vacuum itself — the device has to receive the command from somewhere eventually, even if the app sends it via the cloud. Options: port mirroring on your router (if supported), or ARP-spoofing just the vacuum's IP specifically (more surgical than intercepting the whole phone). If the cloud relays back to the device locally, this could reveal it without needing to break TLS on the phone side at all.

Want to help?

• Have a working command? Open a PR.
• Got a lead or a capture worth discussing? Reply here or open an issue.
• New idea entirely (room presets, path/trajectory tracking, anything else)? Post it here.

[Lenger34]

Does the Tapo RV50 Pro Omni expose the OtaSoftwareUpdateRequestor cluster to the Matter controller, or not? If it does, wouldn’t it be worth trying to install one of the many internal debug firmwares released by TP-Link for this robot vacuum by utilizing Matter, after wrapping the TP-Link-signed debug firmware in a Matter .ota header? There's a possibility that when updating via Matter, the firmware is only checked to see if it's signed and not too old, but not whether it's a debug build or not. These debug releases often come with Telnet enabled by default, and it’s definitely easier to explore the API with root access. First, of course, you need to decrypt the firmware, unpack the squashfs, and compare the two systems to make sure that the binaries are identical, except that the debug version includes telnet and other diagnostic utilities. You don't want to install an unstable/alpha version. I don’t have a Tapo robot vac, but I do have an H200 Smart Hub with Matter support, and after many attempts to spoof the TP-Link OTA server in hopes of flashing the hub, I had the idea to try Matter. And voilà, it was successfully flashed with firmware that still had Telnet enabled, along with diagnostic software containing a list of API calls for the hub and its supported cameras.

Tapo devices often use nearly identical firmware. For example: the Tapo T100 and S200B, the Tapo H200, and the cameras it supports. The Tapo H100 hub and the Tapo L535E light bulb—if I'm not mistaken—use the same chips. So it's worth giving it a try.

Here’s the list and links to the firmware, thanks to @cavefire
Example of an .ota header :

connectedhomeip/src/app/ota_image_tool.py create \
  --vendor-id 0x1392 \
  --product-id 0x0402 \
  --version 99999 \
  --version-str "1.7.99 Build 260515 rel.61602" \
  --digest-algorithm sha256 \
  "H200-DEBUG-up-ver1-7-99-P1[20260515-rel61602]-signed_1779697204482.bin" \
   "H200-up-ver1-7-99-P1[20260515-rel61602]-signed_1779697204482.ota"

Don't use Matter-JS for the flashing; it worked for me on iobroker.

I think I’ll set up a repository with instructions soon.

Details

api.html

[jan-tdy]

I'd rather not risk bricking my vacuum that is working...

[Lenger34]

As the saying goes, 'seek and you shall find.' Here is the unencrypted firmware for the RV30 model:

The keys used to encrypt squashfs images for other models might be buried in there somewhere.

Unpack with:

7z x "MD5_021DD0B5EE561BF3E0C71D4201366F41_RVSD30_1.0.0_Build_250925_Rel.51498.bin_1758849428515.gz" && binwalk -e SStarOta.bin

Open the squashfs-root folder

List some API commands with:

strings usr/bin/VAC | grep -E --color=always "^(get_|set_)"

Some API commands without payloads:

get_min_size(extra_hdr_bytes) <= segment_size
get_json_stringvalue
get_json_intvalue
get_json_boolvalue
get_json_array
get_json_object
set_enable
get_state
get_info
get_intl_fw_list
get_device_all_off_status
get_pairing_device_list
get_paired_device_list
get_fw_download_state
get_latest_fw
get_device_list
get_device_number
set_device_paired
get_paired_device_info_list
get_support_sub_device_category
get_sub_device_component_list
get_sub_device_id_list
get_device_id_list
get_fw_download_state
get_download_state
set_auto_update_info
get_auto_update_info
get_intl_fw_list
get_intl_fw_list
get_skill_services
get_ca_certificate_parse
get_ca_certificate_cb
get_stainfo
get_stainfo_internal
get_wifi_conn_status
get_area_info
get_rules_info
get_rules_valid
get_rule_data
set_iot_check_flag
set_select_audio
get_current_voice_language
set_dust_switch
get_state
set_config
get_map_info
set_map_info
get_map_data
get_path_data
set_auto_area_data
get_area_info
set_area_info
set_furniture_info
get_furniture_info
get_upgrade_state
get_download_state
set_auto_update_info
get_auto_update_info
set_voice_language
get_voice_downloadstate
get_intl_fw_list
set_volume
get_volume
set_fan_level
get_fan_level
set_child_lock
get_child_lock
set_carpet_clean
get_carpet_clean
set_auto_boost
get_auto_boost
get_mop_state
get_consumables_info
get_battery_info
set_dust_info
get_dust_info
set_sweep_walk
get_sweep_walk
set_clean_attr
get_clean_attr
get_pause_time
get_clean_status
get_clean_info
get_vac_status
get_donot_disturb
set_donot_disturb
set_auto_change_map
get_auto_change_map
get_device_state
get_error_state
get_rule_data
set_switch_clean
get_switch_clean
set_switch_charge
set_robot_pause
get_map_br_process
get_validate_config
get_cloud_maplist_cb
get_validate_config_cb
set_lidar_enabled
get_lidar_freq_percent
set_device_info
set_switch_clean
set_robot_state
get_map_info
get_donot_disturb
set_config
get_config
get_map_info_cb
get_donot_disturb_cb
get_rule_ymd_form_weekday
get_rules_valid
get_schedule_rules
set_schedule_all_enable
get_next_event
get_countdown_rules
get_antitheft_rules
set_antitheft_all_enable
get_schedule_rules
set_schedule_all_enable
get_next_event
get_countdown_rules
get_antitheft_rules
set_antitheft_all_enable
get_connect_state
get_device_info
get_device_usage
get_connect_cloud_state
get_paired_device_list
set_config
get_config
get_device_info
set_device_info
get_sub_device_id_list
set_dst
set_time_diff
get_time_diff
set_device_time
get_device_time
get_connect_cloud_state
get_wireless_scan_info
set_wireless_info
get_wifi_conn_status
get_onboarding_display_info
get_device_info
get_device_running_info
set_qs_info
set_qs_extra_info
set_device_info
set_inherit_info
get_inherit_info
get_latest_fw
get_fw_download_state
get_device_usage
get_factory_mode
set_factory_mode
set_forwarding
get_button_detect_status
set_button_detect_status
get_ble_rssi
get_auto_update_info
set_auto_update_info
get_next_event
get_schedule_rules
set_schedule_all_enable
get_countdown_rules
get_antitheft_rules
set_antitheft_all_enable
set_wifi_info
get_config_encrypted
set_dst
get_dst_epoch
set_time_diff
get_time_diff
get_device_info
set_device_info
set_time_epoch
set_account_info
get_info
get_stainfo
get_wifi_list
get_wifi_conn_status
get_intl_fw_list
get_download_state
get_auto_update_info
set_auto_update_info
get_config
get_crypto
get_device_info
get_connect_state
get_server_info
set_server_info
get_config
get_schedule_rules
set_schedule_all_enable
get_countdown_rules
get_antitheft_rules
set_antitheft_all_enable
get_next_event
set_info
get_info
get_adc_raw_data
get_paired_device_info_list
get_sub_device_component_list
set_account_info
set_time_diff
get_config
get_stainfo
set_config
get_config
set_config
get_clean_records
get_clean_record_extra_info
get_rules_info
get_rule_data
set_select_audio
get_current_voice_language
set_dust_switch
set_iot_check_flag
get_map_info
set_map_info
get_map_data
get_path_data
set_auto_area_data
get_area_info
set_area_info
set_furniture_info
get_furniture_info
get_map_br_process
set_auto_change_map
get_auto_change_map
get_donot_disturb
set_donot_disturb
get_pause_time
get_clean_status
get_clean_info
get_vac_status
get_clean_attr
set_clean_attr
get_battery_info
get_consumables_info
set_sweep_walk
get_sweep_walk
get_child_lock
set_child_lock
get_volume
set_volume
get_dust_info
set_dust_info
get_mop_state
get_carpet_clean
set_carpet_clean
get_auto_boost
set_auto_boost
get_switch_clean
set_switch_clean
set_robot_pause
set_switch_charge
set_voice_language
get_voice_downloadstate
get_upgrade_state
get_auto_update_info
set_auto_update_info
set_lidar_enabled
get_lidar_freq_percent
get_config
get_config
get_intl_fw_list
get_connect_state
get_server_info
set_server_info
get_config
get_internal_config
get_validate_config
set_account_info
set_bind_token
get_skill_services
set_auto_update_info
get_auto_update_info
set_info
get_info
get_device_info
get_device_content_info
get_stainfo
get_download_state
get_device_info
set_dst
get_download_state
get_intl_fw_list
get_inherit_info
set_inherit_info
get_config
get_stainfo
get_error_state
get_next_event
get_device_state
set_switch_charge
set_time_diff
set_config
get_schedule_rules
get_countdown_rules
get_antitheft_rules
get_intl_fw_list
get_config
set_dst
get_dst_epoch
set_time_diff
get_time_diff
set_time_epoch
get_time
set_time
set_dst_cb
set_time_diff_cb
set_time_epoch_cb
set_time_cb
get_config
set_config
get_clean_records
get_clean_record_extra_info
set_timer to %d ms

[jan-tdy]

So if the commands are in the file (then why did you say earlier that it is encrypted?), why do we need to install it?

[Lenger34]

Answer to question 1 (why did I say earlier that it is encrypted): Because I found firmware from over a thousand identical ones that they forgot to encrypt

Answer to Question 2 (why I said it’s worth trying to install it): Because in the post’s title, you said you were looking for specific API calls. In most cases, debug firmware provides a list or reference guide of all API calls for that model. Installing such firmware will therefore help you find what you were looking for.

Here's what a real API call reference guide looks like:

api.html

[jan-tdy]

Great, can i have some more questions?

1. In your previus comments, you alyeade send some list (like set_enable), so why i need to install it if you already got the list?
2. Is there any chance that installing that filmware will brick the device?
3. How to install it?
4. Cannot i somehow create an RV30 Max simulator (with an dump of real filmware) in witch i will run it?
5. And if we have found an unencrypted filmware, cannot we just look at it without installing it?
6. I am not sure if i will try those commands (but someone has to...), because the last time i tried, the vacuum performed an factory reset.

Btw: @coderabbitai take a look.

[jan-tdy]

Hi all!
I found something that may help with reverse engineering (thanks to @cavefire for the list of downloadable filmwares)
The firmware includes ?>ldrobot.scv<?!, which means TP-Link is using an LDRobot platform as the base OEM for this vacuum!

[jan-tdy]

Update: I just did a deeper analysis on the 1.2.1_Debug firmware build.
A signature scan with binwalk returned absolutely nothing, and an entropy check shows a flatline at 0.995211 from byte 0.
This confirms that even the internal 'Debug' builds are fully encrypted right out of the gate. Since static analysis of the OTA files is blocked by a solid crypto wall, our best bet to get a decryption key or a plaintext root filesystem is going to be a hardware breakout.
Has anyone cracked open their RV30 Max yet to locate the UART pins or attempt an SPI flash dump of the bootloader?