Tuya device firmware read from WR3 can't be analyzed in UPK2ESPHome #12
Comments
|
Realtek isn't officially supported for UPK2ESPHome, only Beken is confirmed/designed. When it comes to Realtek, it can only work when a couple conditions are met. The first being the SDK is new enough and uses the same encrypted storage schema as the Beken SDKs, and the second being the device has a configuration and isn't an MCU or device-specific firmware. In this case, the firmware type is |
|
Thank you. I'm new to this and trying to understand how I should proceed to eventually be able to flash a working ESPHome config. From reading through the different docs of libretiny, libchiptool, etc. it seems like a way forward could be to:
Really appreciate any guidance how to continue. Thank you. |
|
Usually when there is a TuyaMCU, all of the IO is connected to the TuyaMCU, not the wifi module. Kickstart doesn't really help a lot for that since you know the pins the TuyaMCU would be connected to. You'd need to install regular ESPHome with a Sometimes there us a TuyaMCU + IO on the wifi, but that is quite rare. |
|
I think I've now understood better, thank you. So the WR3 (RTL8710B) on the board is only acting as WiFi interface and a different chip on one of the boards (this humidifier has several) would actually act as the controlling device. The WR3 has only TX and RX pins connected. I disassembled two more humidifiers and discovered WBR3 (RTL8720CF) chipsets. One of these seemed to have more pins involved than TX and RX which might be then one with TuyaMCU + IO on the wifi, the other seemed to also only use TX and RX. The WR3 based humidifier from which I now managed to read the flash memory is actually available in two versions, one with wifi and one without (https://eurom.nl/en/product/climate-control/humidifiers/oasis-303-wifi/ vs https://eurom.nl/en/product/climate-control/humidifiers/oasis-303/ ). So if I understood you right and the TuyaMCU is a separate chip besides the WR3 in my case then this would make even more sense that the WR3 only communicates through TX/RX. Assuming this is the case I wasn't able though to identify the TuyaMCU. The text on the other chips was not readable (but the one labeled with U4 close the TX/RX cable would maybe make sense). As a next step I will flash ESPHome as you suggested. These are pictures of the boards in the device:
|
|
All modules need 3 pins to power on, 3.3V, EN (CEN), and Ground. Beyond that, any TuyaMCU needs an RX/TX, and anything else needs one or multiple GPIO. Yes, the last image the chip labeled Here is the schema/dpid info that Tuya provides for the device. With ESPHome and the {
"activeResponse": {
"schema": [
{
"mode": "rw",
"property": {
"type": "bool"
},
"id": 10,
"type": "obj"
},
{
"mode": "ro",
"property": {
"range": [
"0",
"1"
],
"type": "enum"
},
"id": 101,
"type": "obj"
},
{
"mode": "rw",
"property": {
"range": [
"cancel",
"1",
"2",
"3"
],
"type": "enum"
},
"id": 102,
"type": "obj"
},
{
"mode": "rw",
"property": {
"type": "bool"
},
"id": 103,
"type": "obj"
},
{
"mode": "rw",
"property": {
"type": "bool"
},
"id": 104,
"type": "obj"
},
{
"mode": "rw",
"property": {
"range": [
"0",
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8"
],
"type": "enum"
},
"id": 105,
"type": "obj"
},
{
"mode": "rw",
"property": {
"range": [
"1",
"2",
"3",
"4"
],
"type": "enum"
},
"id": 106,
"type": "obj"
},
{
"mode": "ro",
"property": {
"range": [
"0",
"1"
],
"type": "enum"
},
"id": 107,
"type": "obj"
},
{
"mode": "rw",
"property": {
"range": [
"0",
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12"
],
"type": "enum"
},
"id": 108,
"type": "obj"
},
{
"mode": "ro",
"property": {
"min": 0,
"max": 100,
"scale": 0,
"step": 1,
"type": "value"
},
"id": 109,
"type": "obj"
}
],
"schemaId": "0000002v5g",
},
"modelResponse": {
"model": {
"modelId": "0000002v5g",
"services": [
{
"actions": [],
"code": "",
"description": "",
"events": [],
"name": "\u9ed8\u8ba4\u670d\u52a1",
"properties": [
{
"abilityId": 10,
"accessMode": "rw",
"code": "switch",
"description": "",
"extensions": {
"iconName": "icon-dp_power2"
},
"name": "\u603b\u5f00\u5173",
"typeSpec": {
"type": "bool"
}
},
{
"abilityId": 101,
"accessMode": "ro",
"code": "watershort",
"description": "",
"name": "\u6c34\u4f4d\u72b6\u6001",
"typeSpec": {
"type": "enum",
"range": [
"0",
"1"
]
}
},
{
"abilityId": 102,
"accessMode": "rw",
"code": "nightlight",
"description": "",
"name": "\u591c\u706f",
"typeSpec": {
"type": "enum",
"range": [
"cancel",
"1",
"2",
"3"
]
}
},
{
"abilityId": 103,
"accessMode": "rw",
"code": "sleepmode",
"description": "",
"name": "\u7761\u7720\u6a21\u5f0f",
"typeSpec": {
"type": "bool"
}
},
{
"abilityId": 104,
"accessMode": "rw",
"code": "automode",
"description": "",
"name": "\u8fd0\u884c\u6a21\u5f0f",
"typeSpec": {
"type": "bool"
}
},
{
"abilityId": 105,
"accessMode": "rw",
"code": "humidityset",
"description": "",
"name": "\u6e7f\u5ea6\u8bbe\u5b9a",
"typeSpec": {
"type": "enum",
"range": [
"0",
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8"
]
}
},
{
"abilityId": 106,
"accessMode": "rw",
"code": "foglevel",
"description": "",
"name": "\u96fe\u91cf",
"typeSpec": {
"type": "enum",
"range": [
"1",
"2",
"3",
"4"
]
}
},
{
"abilityId": 107,
"accessMode": "ro",
"code": "replace",
"description": "",
"name": "\u5438\u6c34\u68c9\u63d0\u9192",
"typeSpec": {
"type": "enum",
"range": [
"0",
"1"
]
}
},
{
"abilityId": 108,
"accessMode": "rw",
"code": "timer",
"description": "",
"name": "\u5012\u8ba1\u65f6",
"typeSpec": {
"type": "enum",
"range": [
"0",
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12"
]
}
},
{
"abilityId": 109,
"accessMode": "ro",
"code": "roomhumidifier",
"description": "",
"name": "\u5ba4\u5185\u6e7f\u5ea6",
"typeSpec": {
"type": "value",
"max": 100,
"min": 0,
"scale": 0,
"step": 1,
"unit": ""
}
}
]
}
]
}
},
"detailsResponse": {
"category": "jsq",
"category_name": "Humidifier",
"icon": "smart/icon/ay15570525518720HELj/1559701980125d3648fa0.jpg",
"model": "Oasis 303 Wi-Fi",
"name": "Oasis 303 Wi-Fi",
"product_id": "qcg6n0da0lnkuvkf",
"product_name": "Oasis 303 Wi-Fi",
},
} |
|
Thank you! I tried to flash the WR3 today, optimistic that it would easily boot again into flash mode. Unfortunately it didn't work out. I also tried with a bench power supply but I'm not sure if I connected everything correctly. Eventually I tried connecting the appliance to the 12V power supply to ensure a stable power supply from the appliance itself. This looked promising, in the terminal the WR3 displayed the Tuya boot data as as long as I would not try to reset it. Then at some point I made a wrong move with my equipment and accidentially touched with one of the test probes the power pins and damaged something on the board. So I'll have to give up for now and consider ordering another one later. There are two more humidifiers I've ordered and I want to check inside for which Tuya wifi chipset they use. Maybe I'm lucky and it's one of the Beken ones... Thank you again for your support and apologies that I've failed bringing it to a success! Maybe some other folks will find this thread and try their luck as well. |
Hi,
the firmware file for this humidifier device https://eurom.nl/en/product/climate-control/humidifiers/oasis-303-wifi/ (original manufacturer: https://www.globalsources.com/product/evaporator-humidifiers_1192004025f.htm ) is not readable in UPK2ESPHome. I never booted the device before reading the flash memory, so the file attached is original without any personal settings.
When I open the file in text editor I can see Tuya references and generally there's a lot of of readable text.
Luftbefeuchter ebay ltchiptool_ambz_2024-04-02_00-45-27.zip
Thanks,
Helge
The text was updated successfully, but these errors were encountered: