From 2388808f413f6be0f478c8f7e807d21d1bdbfe76 Mon Sep 17 00:00:00 2001
From: wind-rider <hansmbakker+github@gmail.com>
Date: Sat, 4 Feb 2017 14:43:06 +0100
Subject: [PATCH] Add device type mapping to protocol

---
 protocol.md | 41 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 36 insertions(+), 5 deletions(-)

diff --git a/protocol.md b/protocol.md
index 1888a19..7a9e234 100644
--- a/protocol.md
+++ b/protocol.md
@@ -6,6 +6,11 @@ Encryption
 
 Packets include AES-based encryption in CBC mode. The initial key is 0x09, 0x76, 0x28, 0x34, 0x3f, 0xe9, 0x9e, 0x23, 0x76, 0x5c, 0x15, 0x13, 0xac, 0xcf, 0x8b, 0x02. The IV is 0x56, 0x2e, 0x17, 0x99, 0x6d, 0x09, 0x3d, 0x28, 0xdd, 0xb3, 0xba, 0x69, 0x5a, 0x2e, 0x6f, 0x58.
 
+Checksum
+--------
+
+Construct the packet and set checksum bytes to zero. Add each byte to the starting value of 0xbeaf, wrapping after 0xffff.
+
 Network discovery
 -----------------
 
@@ -30,12 +35,38 @@ To discover Broadlink devices on the local network, send a 48 byte packet with t
 |0x26|06|
 |0x27-0x2f|00|
 
-Send this packet as a UDP broadcast to 255.255.255.255 on port 80. Bytes 0x3a-0x40 of any unicast response will contain the MAC address of the target device.
+Send this packet as a UDP broadcast to 255.255.255.255 on port 80.
 
-Checksum
---------
+Response (any unicast response):
+| Offset  | Contents |
+|---------|----------|
+|0x34-0x35|Device type as a little-endian 16 bit integer (see device type mapping)|
+|0x3a-0x40|MAC address of the target device|
+
+Device type mapping:
+| Device type in response packet | Device type | Treat as |
+|---------|----------|----------|
+|0|SP1|SP1|
+|0x2711|SP2|SP2|
+|0x2719 or 0x7919 or 0x271a or 0x791a|Honeywell SP2|SP2|
+|0x2720|SPMini|SP2|
+|0x753e|SP3|SP2|
+|0x2728|SPMini2|SP2
+|0x2733 or 0x273e|OEM branded SPMini|SP2|
+|>= 0x7530 and <= 0x7918|OEM branded SPMini2|SP2|
+|0x2736|SPMiniPlus|SP2|
+|0x2712|RM2|RM|
+|0x2737|RM Mini / RM3 Mini Blackbean|RM|
+|0x273d|RM Pro Phicomm|RM|
+|0x2783|RM2 Home Plus|RM|
+|0x277c|RM2 Home Plus GDT|RM|
+|0x272a|RM2 Pro Plus|RM|
+|0x2787|RM2 Pro Plus2|RM|
+|0x278b|RM2 Pro Plus BL|RM|
+|0x278f|RM Mini Shate|RM|
+|0x2714|A1|A1|
+|0x4EB5|MP1|MP1|
 
-Construct the packet and set checksum bytes to zero. Add each byte to the starting value of 0xbeaf, wrapping after 0xffff.
 
 Command packet format
 ---------------------
@@ -132,4 +163,4 @@ Todo
 ----
 
 * Support for other devices using the Broadlink protocol (various smart home devices)
-* Figure out what the format of the data packets actually is.
\ No newline at end of file
+* Figure out what the format of the data packets actually is.