{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/AboveColin/tuya-mobile/blob/86301173cb3c9fc543841f269805438151460dad/pyproject.toml"
  ],
  "category": "reconstruction-cases",
  "description_en": "tuya-mobile reconstructs Tuya mobile-app request signing, encrypted API calls and MQTT signaling credential derivation in Python. It replaces the app's native libthing_security.so signing step with HMAC-SHA256, SHA256 and MD5 calculations and includes versioned Smart Life and Tuya Smart profiles.",
  "description_zh": "tuya-mobile 以 Python 重建 Tuya 移动应用的请求签名、加密 API 调用和 MQTT 信令凭据派生。它用 HMAC-SHA256、SHA256 和 MD5 计算替代应用原生 libthing_security.so 的签名步骤，并提供 Smart Life 与 Tuya Smart 的版本化配置。",
  "entry_url": "https://awesomerea.org/resources/tuya-mobile-security-layer-case/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/tuya-mobile-security-layer-case/",
  "evidence_url": "https://github.com/AboveColin/tuya-mobile/blob/86301173cb3c9fc543841f269805438151460dad/README.md",
  "group": "cases",
  "id": "tuya-mobile-security-layer-case",
  "json_url": "https://awesomerea.org/resources/tuya-mobile-security-layer-case/record.json",
  "kind": "case-study",
  "markdown_url": "https://awesomerea.org/resources/tuya-mobile-security-layer-case/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/tuya-mobile-security-layer-case/index.md",
  "name": "tuya-mobile: a Python reconstruction of Tuya app signing and API calls",
  "name_zh": "tuya-mobile：Tuya 应用签名与 API 调用的 Python 重建",
  "record_type": "resource",
  "relationship": "independent-reconstruction",
  "requirement_facets": [
    "prerequisites",
    "prerequisites",
    "limits",
    "license"
  ],
  "requirements": [
    "Python 3.9 or newer with aiohttp and cryptography is required.",
    "Authenticated calls require application signing constants and account authentication; password login uses a selected application profile and account credentials.",
    "Interactive captcha, MFA, QR and social logins raise typed exceptions instead of completing login.",
    "MIT license."
  ],
  "requirements_zh": [
    "需要 Python 3.9 或更新版本，以及 aiohttp 和 cryptography。",
    "经过身份验证的调用需要应用签名常量和账户身份验证；密码登录需要选定应用配置并提供账户凭据。",
    "交互式验证码、MFA、二维码和社交登录会抛出特定类型的异常，客户端不会完成这些登录流程。",
    "采用 MIT 许可证。"
  ],
  "targets": [
    "app",
    "protocol"
  ],
  "url": "https://github.com/AboveColin/tuya-mobile",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06"
}