@ecopoesis/homebridge-dmx 0.1.0

package/tools/test-udp-dmx.ts

@@ -0,0 +1,324 @@
+import * as net from 'net';
+import * as dgram from 'dgram';
+import * as crypto from 'crypto';
+
+const STICK_HOST = '192.168.96.2';
+const STICK_PORT = 2431;
+const MAGIC_CLIENT = Buffer.from('LSAG_ALL');
+const MAGIC_STICK = Buffer.from('Stick_3A');
+
+function hexDump(label: string, buf: Buffer, maxLen = 128) {
+  console.log(`\n--- ${label} (${buf.length} bytes) ---`);
+  const len = Math.min(buf.length, maxLen);
+  for (let i = 0; i < len; i += 16) {
+    const hex = [];
+    for (let j = 0; j < 16; j++) {
+      if (i + j < len) hex.push(buf[i + j].toString(16).padStart(2, '0'));
+      else hex.push('  ');
+    }
+    console.log(`  ${i.toString(16).padStart(4, '0')}  ${hex.join(' ')}`);
+  }
+}
+
+class StickConnection {
+  private sock: net.Socket;
+  private recvBuf = Buffer.alloc(0);
+  private resolveRead: ((buf: Buffer) => void) | null = null;
+  private readTarget = 0;
+  buffered = 0;
+
+  constructor() {
+    this.sock = new net.Socket();
+    this.sock.on('data', (data) => {
+      this.recvBuf = Buffer.concat([this.recvBuf, data]);
+      this.buffered = this.recvBuf.length;
+      this.checkRead();
+    });
+  }
+
+  private checkRead() {
+    if (this.resolveRead && this.recvBuf.length >= this.readTarget) {
+      const result = this.recvBuf.subarray(0, this.readTarget);
+      this.recvBuf = this.recvBuf.subarray(this.readTarget);
+      this.buffered = this.recvBuf.length;
+      const resolve = this.resolveRead;
+      this.resolveRead = null;
+      resolve(result);
+    }
+  }
+
+  read(n: number, timeout = 5000): Promise<Buffer> {
+    if (this.recvBuf.length >= n) {
+      const result = this.recvBuf.subarray(0, n);
+      this.recvBuf = this.recvBuf.subarray(n);
+      this.buffered = this.recvBuf.length;
+      return Promise.resolve(result);
+    }
+    return new Promise((resolve, reject) => {
+      this.readTarget = n;
+      this.resolveRead = resolve;
+      const timer = setTimeout(() => {
+        this.resolveRead = null;
+        reject(new Error(`timeout reading ${n} bytes, have ${this.recvBuf.length}`));
+      }, timeout);
+      this.resolveRead = (buf) => {
+        clearTimeout(timer);
+        resolve(buf);
+      };
+    });
+  }
+
+  async readMessage(): Promise<{ opcode: number; seq: number; payload: Buffer }> {
+    const header = await this.read(10);
+    const opcode = header.readUInt8(8) | (header.readUInt8(9) << 8);
+    if (opcode === 0xc9) {
+      const data = await this.read(48);
+      return { opcode, seq: 0, payload: data };
+    } else if (opcode === 0x25) {
+      const data = await this.read(30);
+      return { opcode, seq: 0, payload: data };
+    } else if (opcode === 0x47) {
+      const data = await this.read(44);
+      return { opcode, seq: data.readUInt16LE(0), payload: data.subarray(8) };
+    } else if (opcode === 0x48) {
+      const data = await this.read(12);
+      return { opcode, seq: data.readUInt16LE(0), payload: data.subarray(8) };
+    } else if (opcode === 0x011c) {
+      const ack = await this.read(12);
+      const payloadLen = ack.readUInt16LE(8);
+      const payload = await this.read(payloadLen);
+      return { opcode, seq: ack.readUInt16LE(0), payload };
+    } else {
+      const data = await this.read(8);
+      return { opcode, seq: data.readUInt16LE(0), payload: data.subarray(6) };
+    }
+  }
+
+  connect(): Promise<void> {
+    return new Promise((resolve, reject) => {
+      this.sock.connect(STICK_PORT, STICK_HOST, resolve);
+      this.sock.once('error', reject);
+    });
+  }
+
+  send(data: Buffer) { this.sock.write(data); }
+  close() { this.sock.destroy(); }
+}
+
+function buildPacket(magic: Buffer, opcode: number, seq: number, payload?: Buffer): Buffer {
+  const header = Buffer.alloc(18);
+  magic.copy(header, 0);
+  header.writeUInt16LE(opcode, 8);
+  header.writeUInt16LE(seq, 10);
+  if (payload) return Buffer.concat([header, payload]);
+  return header;
+}
+
+async function doHandshake(conn: StickConnection): Promise<Buffer> {
+  // Hello
+  const helloPacket = buildPacket(MAGIC_CLIENT, 0x47, 1);
+  conn.send(helloPacket);
+
+  let helloResp = await conn.readMessage();
+  while (helloResp.opcode === 0x25) {
+    helloResp = await conn.readMessage();
+  }
+  if (helloResp.opcode !== 0x47) throw new Error(`Expected 0x47, got 0x${helloResp.opcode.toString(16)}`);
+
+  const stickPubKey = helloResp.payload.subarray(4, 36);
+  console.log(`Stick pubkey: ${stickPubKey.toString('hex')}`);
+
+  // ECDH
+  const clientKeys = crypto.generateKeyPairSync('x25519');
+  const clientPubRaw = clientKeys.publicKey.export({ type: 'spki', format: 'der' });
+  const clientPubKey = clientPubRaw.subarray(clientPubRaw.length - 32);
+
+  const stickPubKeyObj = crypto.createPublicKey({
+    key: Buffer.concat([Buffer.from('302a300506032b656e032100', 'hex'), stickPubKey]),
+    format: 'der',
+    type: 'spki',
+  });
+  const sharedSecret = crypto.diffieHellman({
+    privateKey: clientKeys.privateKey,
+    publicKey: stickPubKeyObj,
+  });
+  console.log(`Shared secret: ${sharedSecret.toString('hex')}`);
+
+  // Key exchange
+  const softwareName = Buffer.alloc(32);
+  Buffer.from('software').copy(softwareName);
+  const keyExPayload = Buffer.concat([softwareName, stickPubKey, clientPubKey]);
+  conn.send(buildPacket(MAGIC_CLIENT, 0x48, 7, keyExPayload));
+  const keyExResp = await conn.readMessage();
+  console.log(`Key exchange: opcode=0x${keyExResp.opcode.toString(16)}`);
+
+  // Init
+  conn.send(Buffer.from([...MAGIC_STICK, 0x46, 0x00, 0x00, 0x00, 0x00, 0x00]));
+
+  // Device query
+  conn.send(Buffer.from([...MAGIC_STICK, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00]));
+  const devResp = await conn.readMessage();
+  console.log(`Device: opcode=0x${devResp.opcode.toString(16)}`);
+
+  // Session setup
+  conn.send(buildPacket(MAGIC_STICK, 0x011c, 8, Buffer.from([0x15, 0x00, 0x16, 0x00])));
+  const sessResp = await conn.readMessage();
+  console.log(`Session: opcode=0x${sessResp.opcode.toString(16)}`);
+
+  // Drain extras
+  await new Promise(r => setTimeout(r, 500));
+  while (conn.buffered > 0) {
+    await conn.readMessage().catch(() => null);
+  }
+
+  return sharedSecret;
+}
+
+function buildDmxFrame(
+  seq: number,
+  counter: number,
+  dmx: Buffer, // 512-byte DMX universe
+  key: Buffer, // 32-byte AES-256 key
+  ivStrategy: string,
+): Buffer {
+  const frame = Buffer.alloc(576);
+
+  // Header (bytes 0-31, plaintext)
+  MAGIC_STICK.copy(frame, 0);         // 0-7: "Stick_3A"
+  frame.writeUInt16LE(0x19, 8);       // 8-9: opcode
+  frame.writeUInt16LE(seq, 10);       // 10-11: sequence
+  // 12-17: zeros (reserved)
+  frame[18] = 0x00;
+  frame[19] = 0x00;
+  frame[20] = 0x00;
+  frame[21] = 0x02;
+  frame[22] = 0x64;                   // 0x64 = 100
+  frame[23] = counter & 0xFF;         // incrementing counter
+
+  // Plaintext for encryption (bytes 32-575 = 544 bytes)
+  // First 32 bytes: header/metadata within encrypted region
+  // Then 512 bytes: DMX universe
+  const plaintext = Buffer.alloc(544);
+  // The first 16 bytes of plaintext might be a timestamp or sequence info
+  // Try different layouts
+  dmx.copy(plaintext, 32); // DMX data at offset 32 within encrypted region
+
+  // Generate IV based on strategy
+  let iv: Buffer;
+  switch (ivStrategy) {
+    case 'zeros':
+      iv = Buffer.alloc(16);
+      break;
+    case 'header':
+      // Use bytes 8-23 of the frame header as IV
+      iv = frame.subarray(8, 24);
+      break;
+    case 'counter':
+      // IV = sequence number padded to 16 bytes
+      iv = Buffer.alloc(16);
+      iv.writeUInt16LE(seq, 0);
+      break;
+    case 'counter-be':
+      iv = Buffer.alloc(16);
+      iv.writeUInt32BE(seq, 12);
+      break;
+    case 'bytes24-31':
+      // Maybe bytes 24-39 of the frame are the IV (not encrypted, just overwritten)
+      iv = Buffer.alloc(16);
+      break;
+    default:
+      iv = Buffer.alloc(16);
+  }
+
+  // AES-128-CBC encrypt (16-byte key)
+  const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
+  cipher.setAutoPadding(false); // No padding, exact 544 bytes
+  const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  encrypted.copy(frame, 32);
+
+  return frame;
+}
+
+const SERIAL = '685678';
+const PASSWORD = '%$uy}g!B';
+
+// AES-128 → 16-byte keys
+const sha16 = (b: Buffer) => crypto.createHash('sha256').update(b).digest().subarray(0, 16);
+const md5b = (b: Buffer) => crypto.createHash('md5').update(b).digest();
+const S = Buffer.from(SERIAL);
+const P = Buffer.from(PASSWORD);
+
+function deriveKeys(sharedSecret: Buffer): { name: string; key: Buffer }[] {
+  return [
+    { name: 'shared[:16]', key: sharedSecret.subarray(0, 16) },
+    { name: 'md5(shared)', key: md5b(sharedSecret) },
+    { name: 'sha16(shared)', key: sha16(sharedSecret) },
+    { name: 'md5(shared+serial)', key: md5b(Buffer.concat([sharedSecret, S])) },
+    { name: 'md5(shared+pwd)', key: md5b(Buffer.concat([sharedSecret, P])) },
+    { name: 'md5(shared+serial+pwd)', key: md5b(Buffer.concat([sharedSecret, S, P])) },
+    { name: 'md5(shared+pwd+serial)', key: md5b(Buffer.concat([sharedSecret, P, S])) },
+    { name: 'md5(serial+shared)', key: md5b(Buffer.concat([S, sharedSecret])) },
+    { name: 'md5(pwd+shared)', key: md5b(Buffer.concat([P, sharedSecret])) },
+    { name: 'sha16(shared+serial)', key: sha16(Buffer.concat([sharedSecret, S])) },
+    { name: 'sha16(shared+pwd)', key: sha16(Buffer.concat([sharedSecret, P])) },
+    { name: 'sha16(shared+pwd+serial)', key: sha16(Buffer.concat([sharedSecret, P, S])) },
+    { name: 'hmac-md5(pwd,shared)', key: crypto.createHmac('md5', P).update(sharedSecret).digest() },
+    { name: 'hmac-md5(shared,pwd)', key: crypto.createHmac('md5', sharedSecret).update(P).digest() },
+    { name: 'hmac-sha256(pwd,shared)[:16]', key: crypto.createHmac('sha256', P).update(sharedSecret).digest().subarray(0, 16) },
+    { name: 'shared_xor_md5pwd', key: (() => {
+      const h = md5b(P);
+      const r = Buffer.alloc(16);
+      for (let i = 0; i < 16; i++) r[i] = sharedSecret[i] ^ h[i];
+      return r;
+    })() },
+  ];
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const keyName = args[0] || 'all';
+  const ivStrategy = args[1] || 'zeros';
+
+  console.log('Connecting to Stick...');
+
+  const conn = new StickConnection();
+  await conn.connect();
+  console.log('Connected. Doing handshake...');
+
+  const sharedSecret = await doHandshake(conn);
+  console.log(`Shared secret: ${sharedSecret.toString('hex')}`);
+
+  const allKeys = deriveKeys(sharedSecret);
+
+  const dmx = Buffer.alloc(512);
+  dmx[5] = 255;  // ch6 = intensity
+  dmx[8] = 255;  // ch9 = saturation
+  dmx[9] = 85;   // ch10 = hue (green)
+
+  const udp = dgram.createSocket('udp4');
+
+  const keysToTry = keyName === 'all' ? allKeys : allKeys.filter(k => k.name === keyName);
+
+  for (const { name, key } of keysToTry) {
+    console.log(`\n--- Trying key: ${name} (iv=${ivStrategy}) ---`);
+    console.log(`  key: ${key.toString('hex')}`);
+
+    let seq = 0;
+    let counter = 0;
+    for (let i = 0; i < 200; i++) { // ~5 seconds worth at 40fps
+      const frame = buildDmxFrame(seq, counter, dmx, key, ivStrategy);
+      udp.send(frame, 0, 576, STICK_PORT, STICK_HOST);
+      seq = (seq + 4) & 0xFFFF;
+      counter = (counter + 1) & 0xFF;
+      await new Promise(r => setTimeout(r, 25));
+    }
+    console.log(`  Sent 200 frames. Check light for GREEN.`);
+    await new Promise(r => setTimeout(r, 2000));
+  }
+
+  console.log('\nAll keys tried.');
+  udp.close();
+  conn.close();
+}
+
+main().catch(console.error);

package/tools/test-x25519.mjs

@@ -0,0 +1,87 @@
+// Test the hypothesis: the hardcoded 33-byte secret is the client's static
+// X25519 private key (32 bytes + 1 flag/version byte). If so, the client
+// public key sent in msg#3 should equal X25519(priv, base_point).
+
+import * as crypto from 'node:crypto';
+
+const HARDCODED = Buffer.from('527a5b46c56f3a5e670b4f0e338727d94737ec0fc4af0dba93a51d93965191d08f', 'hex');
+
+// From captured handshake msg#2 (Stick→Client, opcode 0x47, bytes +0x16..+0x36)
+const STICK_PUB = Buffer.from('966cb0a9667596d27c12abd2fe36ba95e390558bd9d072d5158cf7d7e1cea6d2', 'hex');
+
+// From captured handshake msg#3 (Client→Stick, opcode 0x48, bytes +0x52..+0x72)
+const CLIENT_PUB = Buffer.from('973a20b248501227162a0ad004836a015d76ade1c2186e20965ccb3d259d7ba0', 'hex');
+
+console.log('HARDCODED (33B):');
+console.log(' ', HARDCODED.toString('hex'));
+console.log('  first 32B (candidate priv key):', HARDCODED.subarray(0, 32).toString('hex'));
+console.log('  byte 33 (flag?):                0x' + HARDCODED[32].toString(16));
+console.log();
+console.log('STICK pubkey from msg#2:   ', STICK_PUB.toString('hex'));
+console.log('CLIENT pubkey from msg#3:  ', CLIENT_PUB.toString('hex'));
+console.log();
+
+// Test 1: derive pubkey from hardcoded priv using X25519
+// Node's crypto module: X25519 keys must be PKCS8 DER. Manual key gen.
+function derivePub_x25519(priv32) {
+  // Node 16+ supports X25519 via crypto.createPrivateKey with raw key import.
+  const privKey = crypto.createPrivateKey({
+    key: Buffer.concat([
+      Buffer.from('302e020100300506032b656e04220420', 'hex'),  // PKCS8 X25519 header
+      priv32,
+    ]),
+    format: 'der',
+    type: 'pkcs8',
+  });
+  // Export public via key derivation
+  const pubKey = crypto.createPublicKey(privKey);
+  const der = pubKey.export({ format: 'der', type: 'spki' });
+  // Last 32 bytes of SPKI DER = raw public key
+  return der.subarray(der.length - 32);
+}
+
+console.log('=== Test 1: X25519 — derive pub from hardcoded priv ===');
+try {
+  const pub = derivePub_x25519(HARDCODED.subarray(0, 32));
+  console.log('  derived pub:   ', pub.toString('hex'));
+  console.log('  client pub:    ', CLIENT_PUB.toString('hex'));
+  console.log('  MATCH?         ', pub.equals(CLIENT_PUB) ? '✓ YES — X25519 confirmed' : '✗ NO');
+  if (pub.equals(CLIENT_PUB)) {
+    // Compute shared secret
+    const sharedKey = crypto.diffieHellman({
+      privateKey: crypto.createPrivateKey({
+        key: Buffer.concat([Buffer.from('302e020100300506032b656e04220420','hex'), HARDCODED.subarray(0,32)]),
+        format: 'der', type: 'pkcs8',
+      }),
+      publicKey: crypto.createPublicKey({
+        key: Buffer.concat([Buffer.from('302a300506032b656e032100','hex'), STICK_PUB]),
+        format: 'der', type: 'spki',
+      }),
+    });
+    console.log('\n=== SHARED SECRET (X25519 ECDH) ===');
+    console.log('  shared:        ', sharedKey.toString('hex'));
+    console.log('  SHA-256(shared)[:16] (candidate AES key):',
+                crypto.createHash('sha256').update(sharedKey).digest().subarray(0, 16).toString('hex'));
+    console.log('  raw shared[:16] (candidate AES key):     ', sharedKey.subarray(0, 16).toString('hex'));
+  }
+} catch (e) {
+  console.log('  error:', e.message);
+}
+
+console.log();
+console.log('=== Test 2: same with reverse byte order ===');
+try {
+  const priv = Buffer.from(HARDCODED.subarray(0, 32)).reverse();
+  const pub = derivePub_x25519(priv);
+  console.log('  derived pub:   ', pub.toString('hex'));
+  console.log('  match client?: ', pub.equals(CLIENT_PUB) ? '✓ YES' : '✗ no');
+} catch (e) {
+  console.log('  error:', e.message);
+}
+
+console.log();
+console.log('If Test 1 matches, the static-RE hardcoded secret IS the client priv key.');
+console.log('From there, every session: shared = X25519(hardcoded_priv, stick_pub_from_msg2),');
+console.log('then AES key = some_hash(shared) [TBD: SHA-256[:16], HKDF, raw[:16]…].');
+console.log("If neither matches, ECC is on a different curve (P-256, Curve448) or priv");
+console.log("isn't the hardcoded secret.");

package/tools/try-decrypt.ts

@@ -0,0 +1,144 @@
+import * as crypto from 'crypto';
+
+const frameHex =
+  '53746963 6b5f3341 19009600 00000000' +
+  '00000000 00026400 a683d3d3 ca57966b' +
+  '9eff43dc 8db5464f c0afc785 5bb424ad' +
+  'fdb6a0ee 24df6433 cc952097 e1784c09' +
+  'cd3c7b8b 83d5bdd3 ba136145 d4ff845a' +
+  '23bd8d28 d218a5df 4c784c8b caee7100' +
+  '0d586311 0e45051b edf184d4 23447235' +
+  '1ee2acbd 21eb8db0 76c54d53 f45b3706' +
+  '00445512 79ccf175 793483d9 98b6e1cb' +
+  '47733211 1e602f0e aa460c71 7bfc62b8' +
+  '9cc446b7 3db8a8bf 016de03b 8eed3e30' +
+  'f9da8771 d263483e 4060b081 181edcd0' +
+  '4ebc3994 48d5b784 0d42355a 32851c65' +
+  '7ef9375f 841a93a1 8b3e3355 8c4f4cb6' +
+  'a5d7824f ca89c958 97e787f0 ac0c7fcc' +
+  '4ee08dcb 0e10eb40 43f35441 6bca415d' +
+  '2a56502a 6c590b6b f7efe715 cba281ff' +
+  'd0a123e7 c19d9fab 6a0f9d0c 285f3d58' +
+  'ed34ac7d 0b555d78 9027f807 7b311b6a' +
+  '9f0d4f1c 485c1742 84dc0c32 48e370d6' +
+  '35cae307 bc5a7f9a f46132fc 15116b2a' +
+  '9ef095bd b18d244a b15d9b3f 599250cd' +
+  '72afb805 e987b4a0 45f8d417 2b3590a3' +
+  '6b594f4a ed96fd0f e1bf3501 d1fb9df9' +
+  '119a35a3 8195a827 0f064df5 1f629e0c' +
+  'cb8ec788 28b31b78 005dd41a e40520b8' +
+  '5905a399 7dbb18ba 49372652 7b34fba4' +
+  'fd206b5d a6dab5ab e3ef6cb5 efbd4de8' +
+  '3cbd6439 d41b45cf 77a5158a 901b68f6' +
+  '99a2a8cb 7919b848 a5dd0b4d 40cbe049' +
+  '6e500d65 ae1bc5d2 4fcf5b14 dbfc8f3d' +
+  '44ceb25a 4f6a1685 ecc5467c 2d6c62c0' +
+  'd4e079f2 25362b08 4f31924b e4eef009' +
+  '37f7dc2b c03f0358 b7207ded 659d6388' +
+  'b3261cb1 0774cafb 214c63db 95e9ad41' +
+  '5ecb2455 7d54eb1c 9c03a27d 154e68b0';
+const frame = Buffer.from(frameHex.replace(/ /g, ''), 'hex');
+console.log(`Frame size: ${frame.length} bytes`);
+
+const ciphertext = frame.subarray(32); // 544 bytes
+
+const serial = '685678';
+const password = '%$uy}g!B';
+
+// AES-128 → all keys MUST be 16 bytes
+const sha16 = (s: string | Buffer) => crypto.createHash('sha256').update(s).digest().subarray(0, 16);
+const md5 = (s: string | Buffer) => crypto.createHash('md5').update(s).digest(); // 16 bytes
+const pad16 = (s: string) => Buffer.concat([Buffer.from(s), Buffer.alloc(16)]).subarray(0, 16);
+
+const keys: { name: string; key: Buffer }[] = [
+  { name: 'NIST128 test (00-0f)', key: Buffer.from('000102030405060708090a0b0c0d0e0f', 'hex') },
+  { name: 'MD5(password)', key: md5(password) },
+  { name: 'MD5(serial)', key: md5(serial) },
+  { name: 'MD5(serial+password)', key: md5(serial + password) },
+  { name: 'MD5(password+serial)', key: md5(password + serial) },
+  { name: 'MD5(serial+":"+password)', key: md5(serial + ':' + password) },
+  { name: 'MD5(password+":"+serial)', key: md5(password + ':' + serial) },
+  { name: 'SHA256(password)[:16]', key: sha16(password) },
+  { name: 'SHA256(serial)[:16]', key: sha16(serial) },
+  { name: 'SHA256(serial+password)[:16]', key: sha16(serial + password) },
+  { name: 'SHA256(password+serial)[:16]', key: sha16(password + serial) },
+  { name: 'password padded16', key: pad16(password) },
+  { name: 'serial padded16', key: pad16(serial) },
+  { name: 'password+serial padded16', key: pad16(password + serial) },
+  { name: 'MD5(serial_hex)', key: md5(Buffer.from('685678', 'hex')) },
+  { name: 'SHA256(serial_hex)[:16]', key: sha16(Buffer.from('685678', 'hex')) },
+];
+
+// IV strategies
+function tryDecrypt(key: Buffer, iv: Buffer, label: string) {
+  try {
+    const decipher = crypto.createDecipheriv('aes-128-cbc', key, iv);
+    decipher.setAutoPadding(false);
+    const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+
+    // Check if result looks like valid plaintext
+    // DMX data should be at offset 32 within plaintext (512 bytes)
+    // Most bytes should be 0 for an idle universe
+    const dmxRegion = plain.subarray(32);
+    let zeroCount = 0;
+    for (let i = 0; i < dmxRegion.length; i++) {
+      if (dmxRegion[i] === 0) zeroCount++;
+    }
+    const zeroPct = Math.round(100 * zeroCount / dmxRegion.length);
+
+    // Show first 64 bytes of plaintext
+    console.log(`\n${label}:`);
+    console.log(`  zeros in DMX region: ${zeroCount}/${dmxRegion.length} (${zeroPct}%)`);
+    console.log(`  first 64 bytes: ${plain.subarray(0, 64).toString('hex')}`);
+    if (zeroPct > 80) {
+      console.log(`  *** LIKELY VALID! ***`);
+      console.log(`  full plaintext:`);
+      for (let i = 0; i < plain.length; i += 32) {
+        console.log(`    ${i.toString(16).padStart(4, '0')}: ${plain.subarray(i, Math.min(i + 32, plain.length)).toString('hex')}`);
+      }
+    }
+  } catch (e: any) {
+    console.log(`  ${label}: ERROR ${e.message}`);
+  }
+}
+
+for (const { name, key } of keys) {
+  const headerBytes = frame.subarray(24, 32); // bytes 24-31 from frame
+
+  // Try various IVs
+  tryDecrypt(key, Buffer.alloc(16), `${name} + IV=zeros`);
+  tryDecrypt(key, Buffer.concat([headerBytes, Buffer.alloc(8)]), `${name} + IV=bytes24-31+zeros`);
+  tryDecrypt(key, Buffer.concat([Buffer.alloc(8), headerBytes]), `${name} + IV=zeros+bytes24-31`);
+
+  // IV from frame header fields
+  const ivFromHeader = Buffer.alloc(16);
+  frame.copy(ivFromHeader, 0, 8, 24); // bytes 8-23
+  tryDecrypt(key, ivFromHeader, `${name} + IV=bytes8-23`);
+
+  // IV = first 16 bytes of encrypted region (then decrypt remaining 528)
+  const iv16 = ciphertext.subarray(0, 16);
+  try {
+    const decipher = crypto.createDecipheriv('aes-128-cbc', key, iv16);
+    decipher.setAutoPadding(false);
+    const plain = Buffer.concat([decipher.update(ciphertext.subarray(16)), decipher.final()]);
+    let zeroCount = 0;
+    for (let i = 32; i < plain.length; i++) if (plain[i] === 0) zeroCount++;
+    const zeroPct = Math.round(100 * zeroCount / (plain.length - 32));
+    console.log(`\n${name} + IV=first16cipher (decrypt remaining 528):`);
+    console.log(`  zeros: ${zeroCount}/${plain.length - 32} (${zeroPct}%)`);
+    console.log(`  first 64: ${plain.subarray(0, 64).toString('hex')}`);
+    if (zeroPct > 80) console.log(`  *** LIKELY VALID! ***`);
+  } catch {}
+
+  // Counter-based IV
+  const seq = frame.readUInt16LE(10);
+  const ivSeq = Buffer.alloc(16);
+  ivSeq.writeUInt16LE(seq, 0);
+  tryDecrypt(key, ivSeq, `${name} + IV=seq(${seq})`);
+
+  ivSeq.fill(0);
+  ivSeq.writeUInt32BE(seq, 12);
+  tryDecrypt(key, ivSeq, `${name} + IV=seq_be(${seq})`);
+}
+
+console.log('\nDone.');

package/tools/try-hardcoded-key.mjs

@@ -0,0 +1,86 @@
+// Try decrypting a captured 576-byte DMX frame using the hardcoded 33-byte
+// secret discovered by Ghidra static RE.
+//
+// See tools/try-hardcoded-key.ts (TS twin) for the full backstory. This .mjs
+// version is plain Node so it runs without tsx.
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+
+const KEY = Buffer.from('527a5b46c56f3a5e670b4f0e338727d9', 'hex');
+const IV  = Buffer.from('4737ec0fc4af0dba93a51d93965191d0', 'hex');
+
+if (process.argv.length < 3) {
+  console.error('usage: node tools/try-hardcoded-key.mjs <captured-576B-frame.bin>');
+  process.exit(1);
+}
+
+const frame = fs.readFileSync(process.argv[2]);
+if (frame.length !== 576) {
+  console.error(`expected exactly 576 bytes, got ${frame.length}`);
+  process.exit(1);
+}
+
+const header = frame.subarray(0, 0x20);
+const body   = frame.subarray(0x20, 0x240);
+
+console.log('clear header (32B):');
+console.log(' ', header.toString('hex').match(/../g).join(' '));
+console.log(`  session_magic[0..8]    = ${header.subarray(0, 8).toString('hex')}`);
+console.log(`  opcode/ver[8..a]       = 0x${header.readUInt16LE(8).toString(16)}`);
+console.log(`  field[a..12]           = ${header.subarray(0x0a, 0x12).toString('hex')}`);
+console.log(`  field[12..14]          = 0x${header.readUInt16LE(0x12).toString(16)}`);
+console.log(`  channel count[14..16]  = ${header.readUInt16LE(0x14)}`);
+console.log(`  const100[16]           = 0x${header[0x16].toString(16)}`);
+console.log(`  seq_counter[17]        = ${header[0x17]}`);
+console.log(`  nonce[18..20]          = ${header.subarray(0x18, 0x20).toString('hex')}`);
+console.log();
+
+function score(buf) {
+  let zeros = 0;
+  for (const b of buf) if (b === 0) zeros++;
+  return {
+    zeroRatio: zeros / buf.length,
+    sample: buf.subarray(0, 48).toString('hex'),
+  };
+}
+
+function tryDecrypt(label, algo, key, iv) {
+  try {
+    const d = crypto.createDecipheriv(algo, key, iv);
+    d.setAutoPadding(false);
+    const out = Buffer.concat([d.update(body), d.final()]);
+    const s = score(out);
+    console.log(`${label}:`);
+    console.log(`  zero ratio: ${(s.zeroRatio * 100).toFixed(1)}%   (DMX with mostly off lights should be ~95%)`);
+    console.log(`  first 48B:  ${s.sample}`);
+  } catch (e) {
+    console.log(`${label}: error: ${e.message}`);
+  }
+}
+
+console.log('=== Variant A: hardcoded key + hardcoded IV ===');
+tryDecrypt('AES-128-CBC', 'aes-128-cbc', KEY, IV);
+tryDecrypt('AES-128-CFB', 'aes-128-cfb', KEY, IV);
+
+console.log();
+console.log('=== Variant B: hardcoded key + nonce-as-IV (frame[+0x18..+0x20] zero-padded) ===');
+const nonceIv = Buffer.concat([header.subarray(0x18, 0x20), Buffer.alloc(8)]);
+tryDecrypt('AES-128-CBC', 'aes-128-cbc', KEY, nonceIv);
+tryDecrypt('AES-128-CFB', 'aes-128-cfb', KEY, nonceIv);
+
+console.log();
+console.log('=== Variant C: hardcoded key + full clear-header[16..32] as IV ===');
+const headerTailIv = header.subarray(0x10, 0x20);
+tryDecrypt('AES-128-CBC', 'aes-128-cbc', KEY, headerTailIv);
+tryDecrypt('AES-128-CFB', 'aes-128-cfb', KEY, headerTailIv);
+
+console.log();
+console.log('=== Variant D: hardcoded IV used as the key, hardcoded key used as IV ===');
+tryDecrypt('AES-128-CBC', 'aes-128-cbc', IV, KEY);
+tryDecrypt('AES-128-CFB', 'aes-128-cfb', IV, KEY);
+
+console.log();
+console.log('If any variant above shows zero-ratio > 85% + plausible DMX values,');
+console.log('the hardcoded secret IS the key/IV. If none works, the handshake');
+console.log("derives the key per-session (cipher's vt[4/5/6] = opcodes 0xF/0x10/0x11).");