> I've successfully downgraded my mac when it softbricked, the solution was not easy to find. That's why I'm posting all-in-one tutorial here.

After flashing MacOS 12 (Developer beta) I've experienced issues with my XCode and homebrew. I needed to go back asap, beacause I need XCode for my school project.

I was dumb enough to not download big sur from app store while I was on the MacOS 12, I directly went to restore mode and erased my disk...

Then I discovered that I can't choose which MacOS version I will install, the only option was to reinstall the developer beta one.

After installing it again I was not able to create account, so I softlocked myself. Without a second mac I couldn't make a installation USB.

## Downgrade from MacOS 12 to Big Sur

1. Turn off your mac and then hold the power button until the "options" button shows. Click on it.

2. Erase the main disk using disk utility

3. Connect a removable drive (could be SSD or a USB Flash drive)

4. Enter the following commands in the terminal

   - `cd '/Volumes/<name of your removable drive>'`

   - `mkdir -p private/tmp`

   - `cp -R '/Install macOS 12 Beta.app' private/tmp`

   - `cd 'private/tmp/Install macOS 12 Beta.app`

   - `mkdir Contents/SharedSupport`

   - `curl -L -o Contents/SharedSupport/SharedSupport.dmg http://swcdn.apple.com/content/downloads/55/59/071-00696-A_4T69TQR1VO/9psvjmwyjlucyg708cqjeaiylrvb0xph94/InstallAssistant.pkg`

   - `./Contents/MacOS/InstallAssistant_springboard`

5. Something strange will happen. It looks like you are reinstalling beta version, but actually it will install Big Sur.

6. After Installing it, turn off the computer and go back to the recovery options

7. Open terminal and enter:

   - `resetpassword`

8. Dialog window will appear, in the bar select erase mac and then confirm it (blue link)

9. Computer will reboot back to restore mode.

10. Install our "fake" big sur again

    - `cd '/Volumes/<name of your removable drive>/private/tmp/Install macOS 12 Beta.app'`

    - `./Contents/MacOS/InstallAssistant_springboard`

11. After installing you can finally log in and create recovery usb (You need to reinstall the system again to get rid of "Reinstall MacOS 12" in the recovery menu)

### Thanks to

- [Support Apple article (Or use Terminal to reinstall)](https://support.apple.com/en-us/HT211983)

- [Kay V's answer on stackoverflow](https://apple.stackexchange.com/a/410064)


I've successfully downgraded my mac when it softbricked, the solution was not easy to find. That's why I'm posting all-in-one tutorial here.

Downgrade MacOS without second mac (M1)

## Plain HTTP and own encryption method.

The TAPO app communicates using two methods. Bluetooth and HTTP.
Bluetooth is used to connect with unpaired devices (Exchange wifi ssid&psk etc).
HTTP is used for every other request after the initial pairing process (get/set plug state and settings, update firmware, etc).

## My goal

Be able to turn my plug on/off using an HTTP request.

## HTTP requests

TAPO App sends all the requets to the `http://<ip-of-the-tapo-device>/app`.

### Handshake

The app sends two (session init) requests on the app start, the first one is the `handshake` request.

`POST http://192.168.137.203/app HTTP/1.1`

```json
{
  "method": "handshake",
  "params": {
    "key": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCiHkY5laTugGN1Hf/sBHiiw6mnnkohmvVHHHGJqwRx59RjQaL/SPBoLpeNRgN3B/uykzYTLUVMpTcWSZHsS6FfhdoOkJ1B6nit6nheIfltbP99uJduP1JQ44S9dqUr73w++Lpl6TKrzK3KOc5z/vc9xmqiKK6PYbFZu2evCsL19wIDAQAB-----END PUBLIC KEY-----\n"
  },
  "requestTimeMils": 0
}
```

The fields are self-explanatory, this request sends a public key generated by the app to the TAPO device.

#### TAPO App implementation - handshake generation

After recompiling the Android TAPO app we can see how this public key is generated:

```java
public String getPublicKey() {
    /* Not relevant code, omitted */
    return "-----BEGIN PUBLIC KEY-----\n" + this.f20965b.get(0) + "-----END PUBLIC KEY-----\n";
}
```

`f20965b` is a HashMap containing the public and the private key (`i=0` is the public key and `i=1` is the private key).
Futher research brang me to the function where the keys were generated:

```java
public void mo35029c() {
    KeyPairGenerator instance = KeyPairGenerator.getInstance("RSA");
    instance.initialize(1024, new SecureRandom());
    KeyPair generateKeyPair = instance.generateKeyPair();
    String str = new String(Base64.encode(((RSAPublicKey) generateKeyPair.getPublic()).getEncoded(), 0));
    String str2 = new String(Base64.encode(((RSAPrivateKey) generateKeyPair.getPrivate()).getEncoded(), 0));
    this.f20965b.put(0, str);
    this.f20965b.put(1, str2);
}
```

It's an `RSA 1024 bit` key pair which is Base64 encoded.
After (re)implementing this function in java, I'm able to generate my own (valid) key pair.

#### Reponse

Ok so back to the `handshake` request. After sending it to the TAPO device we will get (if everything goes well) the following response body:

```java
{
   "error_code":0,
   "result":{
      "key":"ZvHUZ2EZ1LLkrh9YG0ShBINL59Rna1++j8iW2r44klFseH17A6C8HH2TqN8UkNpi+MHxFgQ4Jvs/nvz8QoNPgVxWCsgVBI01GTtDdwHtaRXRNh2VuIp6NDUJ0/1NSydiMfeUs1AZT2vwxSg7/cI1DVHFzL7jNr1WNHEsDiYtm48="
   }
}
```

and an `Set-Cookie` header with the `TP_SESSIONID`: `TP_SESSIONID=D31BB81A0B0A3...EF0A790A150AD60A;TIMEOUT=1440` (Which is needed for the next requests)

As you can see the handshake request lasts for 24 hours.

#### TAPO App implementation - decryption of the key

TAPO app decrypts device's key in this function, I've (re)implemented it like this:

```java
public void mo35024a(String tapokey) {
    byte[] decode = KspB64.decode(key.getBytes("UTF-8"));
    byte[] decode2 = KspB64.decode(keyPair.getPrivateKey());
    Cipher instance = Cipher.getInstance("RSA/ECB/PKCS1Padding");
    instance.init(2, (RSAPrivateKey) KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(decode2)));
    byte[] doFinal = instance.doFinal(decode);
    byte[] bArr = new byte[16];
    byte[] bArr2 = new byte[16];
    System.arraycopy(doFinal, 0, bArr, 0, 16);
    System.arraycopy(doFinal, 16, bArr2, 0, 16);
    return new C658a(bArr, bArr2);
}
```

This block of code generates Cipher with `RSA/NONE/PKCS1Padding` and then manipulates and executes more methods.

On the last line of this function a `C6586a` object is defined:

```java
public class C658a {

    Cipher f21776a_enc;
    Cipher f21777b_dec;

    public C658a(byte[] bArr, byte[] bArr2) throws Exception {
        SecretKeySpec secretKeySpec = new SecretKeySpec(bArr, "AES");
        IvParameterSpec ivParameterSpec = new IvParameterSpec(bArr2);
        f21776a_enc = Cipher.getInstance("AES/CBC/PKCS7Padding");
        f21776a_enc.init(1, secretKeySpec, ivParameterSpec);
        f21777b_dec = Cipher.getInstance("AES/CBC/PKCS7Padding");
        f21777b_dec.init(2, secretKeySpec, ivParameterSpec);


    }

    /* more code */
}
```

Here we can see that the `bArr` is a secret key spec for the `AES`. And the `bArr2` is the `iv`.

After this constructor there are two functions which are handling the encryption and the decryption of the param content:

```java
public String mo38009b_enc(String str) throws Exception {
    byte[] doFinal;
    doFinal = this.f21776a_enc.doFinal(str.getBytes());
    String encrypted = KspB64.encodeToString(doFinal);
    return encrypted.replace("\r\n","");
}

public String mo38006a_dec(String str) throws Exception{
    byte[] doFinal;
    doFinal = this.f21777b_dec.doFinal(KspB64.decode(str.getBytes("utf-8")));
    return new String(doFinal);
}
```

With these two functions we can encrypt the requests we will send to the TAPO device and decrypt the responses!

### First securePassthrough

The second request sent to the device is a universal request with a method: `securePassthrough`. It will be later used for every other request like changing the plug state, getting info, etc.

The request body from the TAPO App looks like this:

```json
{
  "method": "securePassthrough",
  "params": {
    "request": "vQewGPIlmr3G2l8uL0O3Yjnxc6dKUAMBzOA4xGwJe81N4iYrFzEEoLxY2Jxr5qxQ5uE84gMgQVHJ\nT174Z6z1/lDglp0FOtcFdXw6lUsvj5hcgjpHjaD+6CxcA5z1XF4xyfDJIIBcb5eJ+ZCyiw9wO+WN\nNnBg5SH6Lmq06+AzbP8I6R6X8SgrEt2OUjclJWnuYjJlxffwFD243VU30fKhjMthzGo0+UU+bXgA\nEE/LITY=\n"
  }
}
```

As you can see, everything is readable but the `params.request`. As we know, it is encrypted using `mo38009b_enc` from the `C658a` object, created a step before.
The plain `params.request` looks like this:

```json
{
  "method": "login_device",
  "params": {
    "password": "ITcyNjU....",
    "username": "MzhhNTk2NT..."
  },
  "requestTimeMils": 0
}
```

So we can see that the second request is the authorization attempt with the TP-Link credentials.

#### TAPO App implementation - encoding the login data

As you can see the password and the username are not in plain text. They are encoded. Both in different ways.

Password is encoded using B64 encode and the username uses `MessageDigest` of `SHA1`:

```java
public static String shaDigestUsername(String str) throws NoSuchAlgorithmException {
    byte[] bArr = str.getBytes();
    byte[] digest = MessageDigest.getInstance("SHA1").digest(bArr);

    StringBuilder sb = new StringBuilder();
    for(byte b : digest){
        String hexString = Integer.toHexString(b & 255);
        if(hexString.length() == 1){
            sb.append("0");
            sb.append(hexString);
        } else {
            sb.append(hexString);
        }
    }
    return sb.toString();
}
```

And after this username is also B64 encoded.

#### Reponse

```json
{
  "error_code": 0,
  "result": {
    "response": "zQMfnu0DQcB9xaJ9srqWVqbxC/2vuKnDT4jyFVqKyCb4GBas06djUCchwdwbp8iFr9Z5gFtrMmy/SHVjKl3eruAqe+vzVtgQtWUjeVrhSyE="
  }
}
```

This response can be decrypted and after decryption, we will see:

```json
{
  "error_code": 0,
  "result": {
    "token": "E0AA81A79277AA712...BF127322B523"
  }
}
```

And there it is, the next token which will be needed for the next requests. At this point, we are authenticated to do other requests.

## My goal implementation

After sniffing the first, two requests we can sniff the last one, the bulb state request.
It looks like this, decrypted:

```json
{
  "method": "set_device_info",
  "params": {
    "device_on": false
  },
  "requestTimeMils": 1602840338865,
  "terminalUUID": "88-54-DE-AD-52-E1"
}
```

Most of the fields are self-explanatory, `terminalUUID` is the MAC Address of the plug.

This `params.request` can be inserted into request with method `securePassthrough`.

## Summary

So with this information, it is possible to make a library to control TP-Link TAPO devices.

For now, I've only implemented `set_device_info`, but at this point, I can just sniff every other request the app makes and decrypt it and finally implement it.

I will post PoC written in Java later.

## PS

To decrypt unknown requests (without RE) you will need to patch `mo35029c`, so it puts your own private & public key.


I've reverse engineered smart plug, TP-Link Tapo. This is my writeup describing my work.

Reverse Engineering TP-Link TAPO

How to use Google Pay on WearOS in unsupported country

> I could not find information about doing it in one place, so I decided to gather all info needed and make a post of it.

We will need to encrypt the private key and bind it to your repo in TravisCI and register the public key to your remote VPS. When it is saved there, the build bot can securely access it while it's needed.

## Requirements (local machine)

- **ruby-dev**: `apt-get install ruby-dev`
- **travis**: `gem install travis`

## Generating SSH key and pushing it to Travis CI

1. Go to the directory of your repository and `sudo travis login --com` (`com` if your repo is private and you are using `travis.com` and not `travis.org`, otherwise use `org`)
   > When you have enabled 2FA on your GitHub account, you will need to generate token and provide it like this:
   >
   > `sudo travis login --com --github-token <YOUR TOKEN HERE>`
2. Generate SSH key: `ssh-keygen -t rsa -b 4096 -C 'build@travis-ci.org' -f ./deploy_rsa` (create key without password)

3. Encrypt private key and add it to travis: `sudo travis encrypt-file deploy_rsa -add`

4. Copy public key to the destination server and add it to authorized keys: `ssh-copy-id -i deploy_rsa.pub username@hostip`

5. **Remove `deploy_rsa` from your repository!** Everyone with this key can get access to your server without a password!

6. Add the following lines to your `.travis.yml`:

   ```yaml
   before_deploy:
     - openssl aes-256-cbc -K $encrypted_?_key -iv $encrypted_?_iv -in deploy_rsa.enc -out /tmp/deploy_rsa -d
     - eval "$(ssh-agent -s)"
     - chmod 600 /tmp/deploy_rsa
     - ssh-add /tmp/deploy_rsa

   deploy:
     - provider: script
       skip_cleanup: true
       script: scp -r ./directory_to_copy username@hostip:/dest/dir

   addons:
     ssh_known_hosts:
       - hostip
   ```

   Where **?** in encrypted keys, look at **Settings->Environment Variables** of your repository in Travis

7. Now all succeeded builds will be deployed


I've created a script that deploys TravisCI builds via SSH. This is my writeup describing my work.

Blog

Downgrade MacOS without second mac (M1)

Reverse Engineering TP-Link TAPO

How to use Google Pay on WearOS in unsupported country

Deploy TravisCI builds via SSH