DIY Kankun Wifi smart-plug-based fog machine.

DIY Kankun Wifi smart-plug-based fog machine.

The following tale is not advised as a good way to do this. Instead get a ESP8266 and hack AT commands at that. This was done purely to see how breakable these things are.

I bought 2 Kankun Small K Smart Plugs at #Kiwicon this year, not knowing a damn thing about them and just planning to pull them to bits anyway, see if I can get an FTDI into them or something.

Of course the instructions were in Chinese - which I don't read nor speak - so not a lot of good.

What's that? A QR code? Excellent - that led me to a website that I was able to get an iOS link from.

Huh. The app is in Chinese too. I see a pattern here. Stuff this, must be a better way.

Oh well, off to that repository of knowledge: Google. The Kankun plugs have quite a community behind them - including this G+ community:
https://plus.google.com/u/0/communities/115308608951565782559 with lots of helpful and interesting tidbits.


OK: First thing. Get the bugger going.

"Amcrest Connect" for iOS. Free from the App store. Sorted in under 2 min.
Or apparently this app for Android (Note: I used iOS, so link is untried): http://kk.huafeng.com:8081/android/Smartwifi.apk

So great: I've got a basic wifi switch which I can turn my ropelight on and off via a phone app. It's a start I guess.

However I know from the G+ community that these things have a SoC running a variation of OpenWRT. It's got a web-server in there. CGI script time!

Again, rather than reinventing the wheel, I grabbed the CGI shell script from here: https://dl.dropboxusercontent.com/u/32357/Kankun/Kankun%20Hacking.pdf
which also has instructions for SSH'ing in (un/pw, etc)
I then hacked it to do what I want - in this case, turning on for 10 sec and then turning off.
Note: I've since found much nicer scripts from the KK switch community here:
  https://github.com/Mattadlard/kankun-2
  https://github.com/mattjoyce/kankun-json


Sweet! Works a treat. Now the fun stuff - pulling it apart and getting the multimeter out.

Spadging and prying at it worked - just popped out, no screws, only clipped in. I unmounted the main board (TEAN E120339 94V-OML1 - general purpose board, used in a few Android Stick processors and cheap tablets, in the configuration in the Kankun it comes with an Atheros wifi chip and an ESMT flash chip). The board was press-mounted by 6 pins - assuming G, VCC and 4 GPIO pins for controlling the two LEDs and the relay, but for my purposes I didn't check as I wasn't going to stuff with that. Instead I hacked at the 240vAC side - it wouldn't be needed as a K plug. I preserved most of it except what I had to de-solder to get at the relay and transformer and remove them, soldering wires in-place to bypass them.

To figure out what voltages, I disconnected the SoC board and used a 12VDC feed from a AT PSU I had lying around from days of yore into the 240v side. PUSH BUTTAN GET POWAH! It was enough to figure out what the step-down on the transformer was with the MM.

So the first version, the low-power side was all off a LiPo battery & step-up. Then I realised: Why? The relay is disconnected from the 240, I've wrapped and isolated everything. Just connect the 240VAC on the Kankun to the back of the IEC socket. Sorted. No voltage mucking required.

I pulled open the fogger until I could see the heater core and pretty simple board inside - 10 min later I knew which two wires I needed to bridge to make the fluid pump trigger - was fairly easy once I'd traced it back to an internal relay triggerable via the radio relay.

Wired the relay in "piggy-back" configuration to optionally bypass the existing relay in the fogger then plugged in the SoC board.

Moment of truth: the 240 is connected.

I wait. No "let the smoke out" smells emit (well, other than the usual for a fogger).

The fogger is up to temp.

I choose the "On 10s" bookmarked URL from my phone.

SUCCESS! A 10 second plume of fog shoots across the room!

Now I've got a fog machine I can use from my phone, from a script, from... pretty much anywhere I like. =-)


Future possibilities:
I'm thinking I'll get a cheap low power PC (maybe a RPi) to act as a control server instead of needing to connect to each Kankun unit individually.
Will take a look into at this scheduling replacement-back-end (to replace the Chinese scheduling server): https://github.com/jdgordon/kankun-magictimer
Also will have a very basic page (or AJAX if I get fancy/bored) so I can control multiple units from the one web-page.

It'd actually be pretty easy to re-assemble it back to stock form at this stage, nothing actually destructive has been done to the plug that a gentle dollop of solder or two wouldn't fix. Ditto the fogger. I suspect that the water based fog is a BAD environment for this, so it's very likely I will pull it apart again.

Cheers!
crocos / @SliceOTrav