Discover articles, books and research

This thesis systematically documents the architectural and protocol layers of the MTTL-W01 smart power strip (Tonly / LG U+ ecosystem, Realtek RTL8711AF) and compares the trust models of the official cloud control path against community-available local control paths. The research combined live network capture, firmware image disassembly, experimental local server reconstruction, and comparison of static analysis results with later publicly released source code (October 2026). The device operates across four relatively independent layers:1. Local provisioning via SoftAP and a closed binary protocol on TCP port 30300.2. Cloud registration and runtime based on MEF/HTTP interfaces and MQTT over TLS within the oneM2M framework.3. Over-the-air (OTA) updates involving version checks, XOR-obfuscated images, integrity checks, and boot-path signature verification.4. Hardware outlet control that does not drive relays directly from per-outlet GPIO, but through a two-wire bus (Clock/Data on PB2/PB3) to an external driver at address 0xA8, register 0x13. Main conclusion: Security, permissions and subscription enforcement on the official cloud path are largely server-centric. Local control paths shift trust to the home network, firmware integrity and local key management, with clear trade-offs in authentication, scalability and service continuity. All experiments were performed exclusively on devices owned by the researcher. No third-party infrastructure identifiers are included.

This thesis systematically documents the architectural and protocol layers of the MTTL-W01 smart power strip (Tonly / LG U+ ecosystem, Realtek RTL8711AF) and compares the trust models of the official cloud control path against community-available local control paths. The research combined live network capture, firmware image disassembly, experimental local server reconstruction, and comparison of static analysis results with later publicly released source code (October 2026). The device operates across four relatively independent layers:1. Local provisioning via SoftAP and a closed binary protocol on TCP port 30300.2. Cloud registration and runtime based on MEF/HTTP interfaces and MQTT over TLS within the oneM2M framework.3. Over-the-air (OTA) updates involving version checks, XOR-obfuscated images, integrity checks, and boot-path signature verification.4. Hardware outlet control that does not drive relays directly from per-outlet GPIO, but through a two-wire bus (Clock/Data on PB2/PB3) to an external driver at address 0xA8, register 0x13. Main conclusion: Security, permissions and subscription enforcement on the official cloud path are largely server-centric. Local control paths shift trust to the home network, firmware integrity and local key management, with clear trade-offs in authentication, scalability and service continuity. All experiments were performed exclusively on devices owned by the researcher. No third-party infrastructure identifiers are included.