Document LiBo/Sistalk Protocol

[denialtek]

Continuing from buttplugio/stpihkal#48

Auth protocol for MonsterPub Gen 2 devices

Read from 0x8001 and you will get back a message like:
01 31 96 8f c3 00 00 00 00 00 00 00 00 00 00 00

Take the first byte and use it to select which key to use:
00 = 32 49 50 4f
01 = 4c 53 42 42
02 = 53 49 53 36
03 = 54 41 4c 4b

Generate a 15 byte response where:
Bytes 1-4 are an XOR of the key and bytes 2-5 of the message.
Bytes 5-15 are the bytes of the key repeating.

Send the response to 0x8001.

ex.
Message: 01 31 96 8f c3 00 00 00 00 00 00 00 00 00 00 00
First byte is 0x01 so the key is 0x4c534242.

0x31968fc3 ^ 0x4c534242 = 0x7dc5cd81

Response: 7d c5 cd 81 4c 53 42 42 4c 53 42 42 4c 53 42

[blackspherefollower]

Name	6013	6014	6015	6016	6017	6001	6002	6003	6004	6005	6006	6031
MonsterPub 1S Health Doctor Whale
MonsterPub 1S Health Master Godzilla
MonsterPub 1S Health Mister Devil	2.2.5	MP_JKS_N_P2	MP_JKS	13	33	WriteWithoutResponse/Read	Read/Write	N/A	Read/Write			Subscribe for pressure LE bytes
MonsterPub 1S Youth Doctor Whale	1.0	MP_S_T_P0	MP_YD	14	0	WriteWithoutResponse	Write
MonsterPub 1S Youth Master Godzilla
MonsterPub 1S Youth Mister Devil
MonsterPub 1X Doctor Whale	1.0.4	MP1SP_QC_TL_P2	MP1SP_QC_JY	10	5	WriteWithoutResponse/Read	Read/Write		Read/Write
MonsterPub 1X Master Godzilla
MonsterPub 1X Mister Devil
MonsterPub 2 Doctor Whale	1.2.6	MP2_JK_N_P1	MP2_JK_N6T_JY	16	2	WriteWithoutResponse	Write	WriteWithoutResponse	Read/Write			Subscribe for pressure LE bytes
MonsterPub 2 Master Godzilla
MonsterPub 2 Mister Devil	5.1	MP2_QC_TL_P1	MP2_QC_N6_EM	40	8	WriteWithoutResponse/Read	Read/Write	WriteWithoutResponse/Read	Read/Write	WriteWithoutResponse/Read/Write	Read/Write
MonsterPub Baby Youth Doctor Whale
MonsterPub Baby Youth Health Master Godzilla	1.5.2	MP_BABY_QC_N_P4	MP_BABY_GSL	35	32	WriteWithoutResponse	Write	WriteWithoutResponse	Read/Write
MonsterPub Baby Youth Mister Devil	1.5.2	MP_BABY_QC_N_P4	MP_BABY_EM	39	32	WriteWithoutResponse	Write	WriteWithoutResponse	Read/Write
MonsterPub BeatHeart	2.7	MP1N_QC_TL_P2	MP1N_QC_YL	10	5	WriteWithoutResponse/Read	Read/Write	N/A	Read/Write
MonsterPub Magic Kiss	1.2.2	MP_MW_TL_P2	MP_MW_GSL	6	4	WriteWithoutResponse/Read	Read/Write	WriteWithoutResponse/Read	Read/Write	WriteWithoutResponse/Read/Write	Read/Write
KiniCat	4.5.0	MP_MXY_N_P1	MP_MXY	36	33	WriteWithoutResponse	Write

[anon1im]

6016 seems to be a power cycle counter, it increments every time the device is turned on

Name	6013	6014	6015	6016	6017	6001	6002	6003	6004	6005	6006	6031
MonsterPub 2 Doctor Whale	1.0.2	MP2_JK_N0_P1	MP2_JK_N6T_JY	111	65	WriteWithoutResponse	Write	WriteWithoutResponse	Read/Write	N/A	N/A	Subscribe for pressure LE bytes
MonsterPub 2 Master Godzilla	1.2.5	MP2_QC_N_P1	MP2_QC_N6_GSL	136	92	WriteWithoutResponse	Write	WriteWithoutResponse	Read/Write	N/A	N/A	N/A

Also my devices are from 2022 and seem like an older generation (newer ones have a different charge port)