Decrypting the payload of KM200 (Buderus, Bosch) devices

decrypt-km200-output.ps1

function Get-Md5Hash
{
    param([byte[]]$InputBytes)
    (Get-FileHash -InputStream ([System.IO.MemoryStream] ($InputBytes)) -Algorithm MD5).Hash.ToLower()
}

function Get-BuderusKey
{
    param($PrivatePassword, $GatewayPassword)
    $MagicBytes = [byte[]](0x86, 0x78, 0x45, 0xe9, 0x7c, 0x4e, 0x29, 0xdc, 0xe5, 0x22, 0xb9, 0xa7, 0xd3, 0xa3, 0xe0, 0x7b, 0x15, 0x2b, 0xff, 0xad, 0xdd, 0xbe, 0xd7, 0xf5, 0xff, 0xd8, 0x42, 0xe9, 0x89, 0x5a, 0xd1, 0xe4)

    $Part1 = [System.Text.Encoding]::UTF8.GetBytes($GatewayPassword) + $MagicBytes
    $Part2 = $MagicBytes + [System.Text.Encoding]::UTF8.GetBytes($PrivatePassword)

    [byte[]](Convert-HexStringToByteArray ((Get-MD5Hash $Part1) + (Get-MD5Hash $Part2)))
}

function Convert-HexStringToByteArray {
    param(
        [string]$hexString
    )

    # Remove any non-hex characters and convert to uppercase
    $hexString = $hexString -replace '[^0-9A-Fa-f]', ''
    $hexString = $hexString.ToUpper()

    # Convert each pair of hexadecimal characters to a byte
    $byteArray = for ($i = 0; $i -lt $hexString.Length; $i += 2) {
        [byte]::Parse($hexString.Substring($i, 2), 'Hex')
    }

    return $byteArray
}

function Decrypt-AES256ECB {
     param (
         [Parameter(Mandatory=$true)]
         [byte[]]$Key,

         [Parameter(Mandatory=$true)]
         [string]$Base64EncodedString
     )

     # Convert base64 string to byte array
     $cipherText = [System.Convert]::FromBase64String($Base64EncodedString)

     # Create AES object with ECB mode
     $aes = New-Object System.Security.Cryptography.AesCryptoServiceProvider
     $aes.Mode = [System.Security.Cryptography.CipherMode]::ECB
     $aes.Key = $Key
     $aes.Padding = [System.Security.Cryptography.PaddingMode]::None

     # Create decryptor
     $decryptor = $aes.CreateDecryptor()

     # Decrypt the data
     $decryptedBytes = $decryptor.TransformFinalBlock($cipherText, 0, $cipherText.Length)

     # Convert decrypted bytes to string
     $decryptedString = [System.Text.Encoding]::UTF8.GetString($decryptedBytes)

     Write-Output $decryptedString
}

### Sample usage
$sampleUrl = "<KM200URL>/heatingCircuits/hc1/operationMode"
$buderusKey = Get-BuderusKey -GatewayPassword "<GATEWAY_PASSWORD>" -PrivatePassword "<YOUR_APP_PASSWORD>"; 
$base64Data = (Invoke-WebRequest -Uri $sampleUrl -UserAgent "TeleHeater").Content.Split("`n")[1]

Decrypt-AES256ECB -Key $buderusKey -Base64EncodedString $base64Data