First venture into MODBUS, how to send a password?

Since the App is terrible and slow, I have no problem removing the Wi-Fi module. Would have been nice with a direct MQTT output though :)
It seems that the WiFi module and Aqua Temp app may already communicate MQTT to the vendor's cloud server. Many cloud servers have API's that allow other devices and clouds access to the data. On the Home Assistant forums, it seems someone has written a script to do exactly this.

Take a look here:
@jschulze You're completly spot-on.
The Wi-Fi module (mine is a HF-LPB100-0) does use MQTT to communicate with a server (in China). Well spotted!
Using Wireshark I can see that the MQTT Topic is easy, payload needs quite a lot of digging into as it's 210 bytes long.
If I can recirect the traffic to my own MQTT server, then I see possibilities. If I need to query an API in China, I think your Mirius suggestion might be better :)
They have 2 version's of the WiFi module, old V1 and new V2. The Home Assistant scripts is for the new V2 version, and ofcourse we have the V1 version. :(

We are now testing the MQTT from the V1 it is usable.
@jschulze No luck with MQTT so far... :(

Still trying to get something with modbus now.

I can't get any data in modbus slave, I can see in the Communication window there is dat flowing. But can't get is to show...

Also tried pyModSlave. Same result.

So now only data in Simply Modbus slave, and qModMaster. But no sending of commands.

Any thing other to try ?
Or maybe you can directly do some testing with a Teamviewer or similar session. I have connected a standalone Windows PC to it now.
I was able to simulate this successfully and can use the Modbus Slave software to both see broadcasts (register addresses 2001 - 2090) and send data (register addresses 3001 - 3090).

Here is how I have Modbus Slave configured

Perform this test with both the display and WiFi module DISCONNECTED from the network.

You may first want to configure the Slave ID to something other than 1 or 2 (say 3, for example) to confirm that Modbus Slave is successfully receiving the broadcast data in register addresses 2001 - 2090. Then you can change the Slave ID to 1 or 2 so it will send the register values from register addresses 3001 - 3090.

Again, though, you may have to pre-populate the values for the 3001 - 3090 registers with the values that the display would send when the display is connected. Follow my instructions from post #50 to read the data from the display (with only the display connected to your computer).