Reverse engineering
The analysis this project is built on: the A/C’s RS-485 protocol, the stock dongle’s firmware, and how an A/C advertises which features it has. Read this if you want to port the work to another Hisense unit, or to check the claims rather than take them on trust.
Table of contents
- Hardware
- Matter local control (preferred path)
- RS-485 A/C protocol (ESP32 replacement path)
- Cloud endpoints & firewalling
- ESP32 replacement: command ↔ A/C function mapping
- Firmware update (OTA) & custom-firmware feasibility
- "Be the cloud": MITM / API-replay feasibility
- Hisense AEH-W41H1 Stock Firmware: Initialization & A/C-Bus Communication (Unified Reference)
- Stock W41H1: device-type → model capability map (how features are gated per A/C model)
- Stock firmware feature map (fw1, dumps/w41h1dump1.bin)