Add Tuya TYGWZ-01 / TuyaGo TYGWZ01 pictures and links to project website #11
Comments
|
I bought this from aliexpress but I can not get the root password from the device @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ---RealTek(RTL8196E)at 2019.01.23-17:03+0800 v3.4T-pre2 16bit ---Escape booting by user ---Ethernet init Okay! The result is all FFFFFFFF which it seem the address of tuya label is not correct therefore no flash content in that location so it get all FFFFFFF. I can not decode it with the python scripts. the script throw exception with these input string. |
|
If you allow the device to boot completely do you see somewhere in the console output a table like this: I think it happens when Linux loads the MTD driver and it will say where the tuya-label is. |
|
Booting... @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize @ 0000000h 0c84018h 00000c8h 0000040h 0000018h 0000000h 0000018h 1000000h @ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName @ 0010000h 0000100h 0001000h 0001000h 0000100h 0000010h 000004eh GD25Q128 @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ DDR1:32MB ---RealTek(RTL8196E)at 2019.01.23-17:03+0800 v3.4T-pre2 16bit P0phymode=01, embedded phy check_image_header return_addr:05010000 bank_offset:00000000 no sys signature at 00010000! P0phymode=01, embedded phy ---Ethernet init Okay! tuya:start receive production test frame ... Jump to image start=0x80c00000... decompressing kernel:
|
|
FYI, I do not actually have a TYGWZ-01 myself but @MattWestb made it sound like TYGWZ01 works in zigpy/zigpy#650 discussion? |
|
Interesting. Has it ever been connected to Tuya cloud or is it straight from the shop? 😄 |
|
If someone has a full original flash dump I'll take a look to see what's changed. I'm wondering if the first connect to the cloud initializes the tuya-label data. Or perhaps they just moved it? Hard to guess. |
|
I have dumped (from Linux shell not boot loader) one TYGZ01 and one LIDL ZBGW but both was having contact with the cloud before dumping them and i have getting the password from both (but messed up the LIDL one). But most interesting is if some one can sharing on dumped flash that is strange with @banksy-git !! |
|
My device never contact to the cloud or include in the official app yet. out of the box I did dump_flash.py according to the guide python dump_flash.py --serial-port /dev/ttyUSB0 --output-file rootfs.bin --start-addr 0x200000 --end-addr 0x400000 then perform step to gain access to root but still out of luck. I still get invalid logon for the original |
|
@chaisaeng - I replied in other forum but change your passwd file so it uses /bin/sh instead of /bin/bash. :) |
|
@MattWestb - Mine was also connected to Tuya first. Could this be the missing link! |
|
You is the master mind but its sounds very likely that the "clean device" is getting the keys from the server so tuya is knowing all and can putting custom parameters in it if they like (or if LIDL have paying for it or not). |
|
@banksy-git Do you have reading from the Realteck source if its being one "default" password or "root root" if not being sett in the custom way ? |
|
I already try the default root/root after I failed to get the password decode from key that all FF. It definitely not root/root for sure. also during boot following message show that it have some mechanism to change the root password on the device as well, see the following part of the boot log. |
|
Maybe try :
;-) Can you post the contents of your /tuya/config/passwd after it's been set by tuya_start? |
|
I
I already flashed the device with modified roofts already. not sure how to reverse back to the stock rootfs. I'm sorry can not fulfill your request. BTW. the current conteent in that directory which I'm think it was changed once as followed |
|
Can you sharing your original dumped files that was not working = is not having your device root password with @banksy-git ? I think its one very interesting opening to rooting devices without have connecting it to tuya cloud. |
|
|
Thanks very much i hope maestro @banksy-git have time looking in it. |
tuya-label.zip boot+cfg and linux partition was not successfully dumps as it failed for some reason the last partion take too long time so I abandon it as i though it not needed in gaining root access. The reason that I have tried that because I thought it'd be a good idea to have a complete backup of flash but eventually I can not achieved that goal. |
|
That file has the auzkey in plain text right at the top! :) I wonder if the password was derived from it in the same way? |
|
That weird, I can confirm that it have the auzkey and uuid in plain text |
|
If you post your /tuya/config/passwd (that's different from the one you changed in the root-fs which is /etc/passwd) we can check! :) |
|
|
Sweet. The password for that hash is:
:-) I'll amend the guide to suggest people try that first! |
|
Nice one but little short for my taste of passwords ;-))) So very likely ist tuya "factory password" before connecting to cloud and downloading new firmware and setting individual root password. Perhaps no need hacking if not connecting to the cloud. 12 points to Milano !! |
Great work @banksy-git ! I've just realised something too which you should also say - don't connect it to the internet! By looking at my jffs image, I realised that the password was changed multiple times. And one of those password corresponds to the last 8 characters of the auzkey which So it seems that I did originally have a root password on the device that corresponded (almost) to the key it is possible read out with your python routine. But that password was changed when the box booted when connected to the tuya cloud. |
|
I was using one USB-Eth adapter for uploading the dumped flash with no internet access for the ZBGW and still hocked up with serial console so tuya was not connecting to the cloud after starting hacking it. By the way in the tuya app directory its one updating program for the zigbee module but i was not getting it working then i was already on the latest tuya version (EZSP 6.5.x) and is one images for the zigbee module in my 2 ZBGW but it can being its coming with the update from the cloud. And if you is having older EZSP you need using one different command for rebooting the zigbee module in to bootloader mode then its using one older version of the protocol but you can finding it in NCP.PY that is used of Silabs and the community for updating EM35X devices that i was taking the commands used in the updating script (version 7 and 8 is in the script 4-6 is not). |
Great work @banksy-git ! |
Other than the two images from the first post of the original Tuya TYGWZ-01 / TuyaGo TYGWZ01 might also want to add some of these additional pictures taken from online stores as well as mention that other than under the name "Lidl Silvercrest" it is also sold under many different rebranded names such as example; Lonsonho, Moes, BENEXMART, Kstyhome, Moniclern, OWSOO, Zemismart, plus the fact that the bridge/gateway is sold both seperate and in combination with other Zigbee devices:
|
|
hi, iam still faciong the same issue i went through all the conversation and tried to follow the steps but i kind of didnt understand in between since iam not an experienced coder. But the problem is where i live the only available device is Tuya TYGWZ-01 (with a different name but same model ) i tried using 'Putty' to get into terminal using USB TTL. at first i got the codes but when i tried to decode it didnt work using python script. Now the device doesnt show anymore on Putty and iam unable to get into the terminal to upload the script given by banksy-git. Please help as i have just this device to work with since none of the courier is getting my conbee device or anyother zigbee communicating device that could work with Home assistant. There are many more people here stucked with the same issue. |
|
Some is using the 3.3 V from the USB-TTL converter and its working OK without using the UBS power (I have doing 2.5 with it). Also then repower the board it can being that the USB-TTL converter is hanging so need being reconnected for working. You was having it working landing in the bootloader so if the board is not being broken (from 5 V) it shall being possible getting inside it one more time and getting the keys bring read. And have the USB-TTL adapter connected all the time then you is doing the rest things so you can using the local terminal if getting problems with SSH connection then ding the configuration and testing. |
|
Sorry for digging on old thread but I think it's still the best place for such information,
I connected board to flash to eeprom reader and dumped content (faster than via UART), changed root password hash, logged in, then yet again reverted original flash and extracted hash for root account which is: Maybe someone find this useful and confirm that it's default password for this revision or startup for this version is different, without AUSKEY and partition init and root password is changed in system partition. @banksy-git - have You updated page for tuya123 password? If so then You can add mine there too ;) |
|
Hello Guys, I did little research on tuyamd executable and I have succesfully extracted (or decoded) auzkey.
Hope it will be helpful for someone. |
|
Guys, spent some more time on bootloader. Indeed it is locked, however, it can be unlocked using a wire. |
|
@parasite85 thanks for sharing, is password just digits? if it's 8-digits only then it's easy to decode that just from hash. |
|
Hey @parasite85, great job on unlocking your box and finding the way to get at the key. Thanks so much for sharing! |
Yes, i did little research in firmware binaries. At least for my gateway, password is 8 chars. I cannot say if it is a general rule for all gateway firmware. |
|
@parasite85 - of course I was able to get into my gateway and do needed changes, but this required disassembly and UART interface. The whole point of this question was to try to find out factory password for root. On some gateways jffs2 partition was not initialised and root password just not set up. I'm trying now to find out how this looks in different boards/revisions. Do You have original has for root? |
|
@dominch: Well, my device was initialized/connected to tuya. If you / anyone reading this message have access to uninitialized device then please do dump using boot prompt. We can go further with this dump. |
|
@parasite85 My gateway was not initilized, jffs2-fs was all in zeros so I could read password hash from rootfs. You could read original hash file from it even efter initialization (new password is mounted on top of that). |
|
@dominch: According to this, in my case, Squashfs requires JFFS2 to be initialized. I do not know the details about your gateway. |
Pictures of Tuya TYGWZ-01 / TuyaGo TYGWZ01 and links to official product page is missing project website:
https://paulbanks.org/projects/lidl-zigbee/
Suggest mention "Tuya TYGWZ-01 (also known as TuyaGo TYGWZ01)" as well as add links plus one or a few images:
Product dimensions：90x90x23mm (Package dimensions：1000x1000x50mm)
https://go.tuya.com/en/productDetail?code=83jt6kkktau3
https://zigbeealliance.org/zigbee_products/tuya-smart-gateway/
The obvious advantage of the original TYGWZ-01 (non-Lidl/Silvercrest) gateway is its availability outside of Europe.
Such wide availability should benefit all people and project whose goal it is to hack it for other purposes than its intended use.
It is also sold under different rebranded names such as Lonsonho, Moes, BENEXMART, Kstyhome, Moniclern, OWSOO, Zemismart, as well as in combination with Zigbee devices:
https://www.amazon.com/Zigbee-Switch-standard-Control-gateway/dp/B082B2FT6V
https://www.amazon.com/Gateway-Control-Temperature-humidity-gateway/dp/B083PRPYQ8/
https://www.amazon.com/OWSOO-Gateway-Wireless-Control-Compatible/dp/B08YNG15XQ
https://www.amazon.com/Moniclern-Powered-Gateway-Connection-Products/dp/B08HV1BNLG
https://www.amazon.com/Kstyhome-Powered-Gateway-Connection-Products/dp/B08XY37L49/
https://www.amazon.com/OWSOO-Powered-Gateway-Connection-Products/dp/B08768DMJJ/
https://www.amazon.com/OWSOO-Temperature-Humidity-Automation-Security/dp/B0868QJ1NV/
https://www.amazon.com/OWSOO-Temperature-Humidity-Automation-Security/dp/B0868NZHJZ/
As you all probably already know TYGWZ01 is also available in online stores in the European Union and the United Kingdom:
https://www.amazon.de/ZigBee-Gateway-zentraler-Controller-Hub-ZigBee-Ger%C3%A4te/dp/B083584M99/
https://www.amazon.co.uk/Zigbee-Gateway-Central-Controller-Devices/dp/B083584M99/
https://www.amazon.co.uk/TYGWZ-01-Gateway-Central-Controller-Devices/dp/B07N65MXD4/
https://www.amazon.de/BENEXMART-PIR-Sensor-Temperatur-Feuchtigkeitssensor-Combination/dp/B07SCXNG14/
https://www.amazon.co.uk/BENEXMART-PIR-Sensor-Temperatur-Feuchtigkeitssensor-Combination/dp/B07SCXNG14/
It can of course be ordered from Chinese stores like BangGood, Gearbest, or Aliexpress, but shipping from China is slow now.
https://www.gearbest.com/other-car-gadgets/pp_3008504694819915.html?wid=2000001
https://www.banggood.com/Zemismart-Tuya-ZB-Gateway-Hub-Smart-Home-Bridge-Smart-Life-APP-Wireless-Remote-Controller-Works-with-Alexa-Google-Home-p-1837198.html
https://www.aliexpress.com/item/1005002441359324.html
https://www.aliexpress.com/item/4000071525839.html
https://www.aliexpress.com/item/1005002340919938.html
https://www.aliexpress.com/item/1005002007026244.html
https://www.aliexpress.com/item/1005002341316609.html
https://www.aliexpress.com/item/4001263689776.html
https://www.aliexpress.com/item/4001263868157.html
https://www.aliexpress.com/item/1005002545821613.html
You just have to do a little research before placing an order to really get the Ethernet ("wired") version and not the WiFi version.
The text was updated successfully, but these errors were encountered: