Carwings API?

[notlh]

i tried both of these - but end up getting - INVALID PARAMS

https://gdcportalgw.its-mo.com/gworchest_0307C/gdc/InitialApp.php?custom_sessionid=&initial_app_strings=geORNtsZe5I4lRGjG9GZiA&RegionCode=US&lg=en-US&DCMID=&VIN=&tz=America/New_York

https://gdcportalgw.its-mo.com/gworchest_0307C/gdc/InitialApp.php?custom_sessionid=&initial_app_strings=geORNtsZe5I4lRGjG9GZiA&RegionCode=US&lg=en-US&DCMID=&VIN=&tz=America/New_York&username=userId&password=password

Tried the same from a rest client also - using basic authentication- it still the same

Any help will be appreciated..

 

[gyathaar]

https://gdcportalgw.its-mo.com/gworchest_0307C/gdc/InitialApp.php
with params
lg=en-US&RegionCode=NNA&initial_app_strings=geORNtsZe5I4lRGjG9GZiA

should work.. but it doesnt accept GET requests any more.. only POST requests

 

[notlh]

Hi gyathaar ,

No difference with POST also...still INVALID PARAMS

Tried all these permutations..

- Added params as a query params
- posted params a part of Request Body
- Basic Authentication

https://gdcportalgw.its-mo.com/gworchest_0307C/gdc/InitialApp.php?lg=en-US&RegionCode=NNA&initial_app_strings=geORNtsZe5I4lRGjG9GZiA

are you able to get a response with the same url like above?

Not sure,where i am trying to do wrong

 

[gyathaar]

curl https://gdcportalgw.its-mo.com/gworchest_0307C/gdc/InitialApp.php --data "lg=en-US&RegionCode=NNA&initial_app_strings=geORNtsZe5I4lRGjG9GZiA"

-->
{"status":200,"message":"success","baseprm":"uyI5Dj9g8VCOFDnBRUbr3g"}

as for the encryption of the password... not sure how to do that on command line in an easy way.. this is the code I have in Leaf Manager (java)

	private static String encryptPassword(String password, String baseprm)
	{
		if ("" == baseprm)
			return password;
		try
		{
			SecretKeySpec secretKeySpec = new SecretKeySpec(baseprm.getBytes(), "Blowfish");
			Cipher cipher = Cipher.getInstance("Blowfish/ECB/PKCS5Padding");
			cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
			byte[] arrayOfByte = cipher.doFinal(password.getBytes());
			String base64 = Base64.encodeToString(arrayOfByte, Base64.DEFAULT);
			return URLEncoder.encode(base64, "utf-8").replaceAll("\\+", "%20");
		}
		catch (Exception e)
		{
			e.printStackTrace();
			return "";
		}
	}

 

[veezer]

@gyathaar, thanks so much for posting this information. I was able to get the proper password encryption working and remotely control my AC again. @notlh FWIW, you can see some python code that does the password encryption and the curl commands I used here: http://virantha.com/2016/04/07/updated-reverse-engineering-nissan-connect-ev-protocol/

 

[notlh]

Hi Gyaathar / Veezer - sorry couldnot respond earlier - i am also able to connect using java api and gettting the responses back...but, iam wondering if Request current status gives the current status...

We have set the car in motion and tried to run the requests with every 15 mins timeframe...the responses has been the same even after an hour

 

[BluesBro]

The are no details, I'm curious how they did it with just a VIN.

That is because the DCMID is not really needed in the requests.. you just need the VIN and region code
At least that is the case for the european server..

(decided not to mention it before, but I guess the cat is out of the bag now.. )

this url seems to be to return the lat and long btw I guess
(but since I have an old car it doesnt support it and only blank values are returned, or maybe its not enabled yet)

https://gdcportalgw.its-mo.com/orchestration_1111/gdc/MyCarFinderLatLng.php?RegionCode=YY&lg=en-US&VIN=XXXX

{"status":200,"message":"success","receivedDate":"","TargetDate":"","lat":"","lng":""}

Is this url active now? Does anyone get the lat/long when use?

 

[irwinr]

The are no details, I'm curious how they did it with just a VIN.

That is because the DCMID is not really needed in the requests.. you just need the VIN and region code
At least that is the case for the european server..

(decided not to mention it before, but I guess the cat is out of the bag now.. )

this url seems to be to return the lat and long btw I guess
(but since I have an old car it doesnt support it and only blank values are returned, or maybe its not enabled yet)

https://gdcportalgw.its-mo.com/orchestration_1111/gdc/MyCarFinderLatLng.php?RegionCode=YY&lg=en-US&VIN=XXXX

{"status":200,"message":"success","receivedDate":"","TargetDate":"","lat":"","lng":""}

Is this url active now? Does anyone get the lat/long when use?

Yes it is, but you have to use POST instead of GET now (To the new endpoint) to access it. And It does not return (at least any time I've tried it) any lat/lng info for my vehicle, so I'm not really sure what this is for.

-Jeremy

 

[joshperry]

They changed the url to /gworchest_0307C/gdc/* instead of /orchestration_1111/gdc/*

there are some changes to the login procedure though.. you need to first do a call to
InitialApp.php
with the param
initial_app_strings=geORNtsZe5I4lRGjG9GZiA (this param needs to also be added to all further requests)

to retrieve a key to encrypt the password with (baseprm)

you then use this key to encrypt the password using Blowfish ECB PKCS5Padding
You then Base64 encode the encrypted string.. and then urlencode the base64 encoded string

the login call is then as before (except the changed url and the added param)

If login is successful you will then find a custom_sessionid in the response that you pass along with further requests

I was just working on updating my code to use this new login procedure. I really appreciate you posting this info.

Out of curiosity, might I ask how you figured out the encryption method and settings for the new login flow?

Josh

 

[gyathaar]

Out of curiosity, might I ask how you figured out the encryption method and settings for the new login flow?

Josh

Reverse engineering