Replies: 37 comments 130 replies
-
|
The Zigbee module is one Tuya TYZS4 Zigbee Module. Can also being upgraded with one better module and getting on OK case and power supply (One module from one new IKEA GU 10 CWS with the new silabs module ?). |
Beta Was this translation helpful? Give feedback.
-
|
Hi, get one of this https://www.ebay.com/itm/USB-Programmer-CH341A-Series-Burner-Chip-Writer-25-SPI-EEPROM-BIOS-Flash/254676176158?hash=item3b4be20d1e:g:EsQAAOSwK2VfJ8yQ or you can use Arduino to dump SPI, after we can see what's inside... |
Beta Was this translation helpful? Give feedback.
-
|
I have ordered the last from Youmile with Sop8 Test Clip so i hopefully dont need burning my fingers and its being delivered on friday or monday (company delivering so not on weekend). |
Beta Was this translation helpful? Give feedback.
-
Hope those developers are aware of the similar Open Lumi (OpenLumi) project in #644 discussion? Maybe could work together? OpenLumi project is also based on OpenWRT, however, it currently targeting Zigbee gateways based on NXP i.MX 6 Series (IMX6). Summary: @G1K, @devbis, @kirovilya (from the @diyruz organization on GitHub) have hacked Xiaomi Lumi Gateway MIxx01 Zigbee to WiFi bridges (Xiaomi gateways DGNWG05LM and ZHWG11LM) with an OpenWRT based firmware on its NXP IMX6 SoC and ZiGate firmware on its NXP JN516x chips (JN5168 and JN5169 chip), or you can make use your own DIY hardware. References: |
Beta Was this translation helpful? Give feedback.
-
|
I think the Xiaomi GW is having one other WiFi chip then the Tuya is using (RTL8197EU) but if possible installing OpenWRT its no problem installing ser2net and using it as one "Zigbee2Net" device. |
Beta Was this translation helpful? Give feedback.
-
|
Its looks like its possible getting root access and starting socat in it !! I have soldering the J1 pins and can booting in the boot loader so tomorrow is trying decrypting the root password for getting in the Linux system :-))) |
Beta Was this translation helpful? Give feedback.
-
|
Im being in as root !!! |
Beta Was this translation helpful? Give feedback.
-
|
In Win 10 install python 3.9 in from windows store. Cutting the spaces from the 3 strings you have getting from readings in the boot loader. Open your terminal to the tasmota ZB. Attached the Python script with extension txt (take the .txt away and you is getting the .py : |
Beta Was this translation helpful? Give feedback.
-
|
Hitt ESC then booting and you is landing in the boot loader: Then by the instruction: (With faced strings) Now cutting the spaces from the 3 strings you have getting from readings in the boot loader: KEK hex string: aus-key string line 1: aus-key string line 2: Open your power shell and run the python script Your root password is: Reboot the tuya ZBG and open one terminal. Hitt enter. Next to do is stopping the tuya services and making one socat service for tunneling the EFR32s comport to ZHA. I think we have getting on better remote EZSP coordinator with Ethernet for ZHA then Sonoff Zigbee Bridge !!! |
Beta Was this translation helpful? Give feedback.
-
|
Now you have the root password you can putting it back in the network without serial cable. |
Beta Was this translation helpful? Give feedback.
-
|
Interesting thing in the log: Its must being one reason way tuya is sending |
Beta Was this translation helpful? Give feedback.
-
|
@xromansx I have root access and can see the partitions table then booting and in the dev tree. Partitions from boot log: Listing /dev: ls in the root: ls in /tmp: Here should being safe making temp files (I hope). |
Beta Was this translation helpful? Give feedback.
-
|
@xromansx I have dumped MTD 0 - 4 with: And uploading it to my PC with tftpd64 as TFTP server with: Its one busybox so its having little limited parameters but i can reading the bootloader but its not saying so much. The linux have I have uploaded the boot loader it im my private git and you can downloading if you like (I have sending you one inviting to it). |
Beta Was this translation helpful? Give feedback.
-
|
EFR32 Dumped :-)) Have normal boot loader but i dont knowing the pins for RX. TX. Force boat loader and the reset in the tuya side. And now running bellows !! |
Beta Was this translation helpful? Give feedback.
-
|
@Adminiuga The module is using HW flow control but its not problems then the socat server is configurated for it and is transparent to ZHA. I have finding the pad 15 RXD PA1 and pad 16 TXD PA0 but cant pinpointing one boot loader pin. You have implanting zigpy/bellows#249 but i dont understanding how to using it :-(( Can you explaining how to using it from one ZHA docker installation or implanting it in zha_custom or if its possible executing the command in zha_custom its also OK. Then i can executing The NCP is running OK (only briefly tested) with the factory firmware but its little old 6.5.0.0 so like finding one method upgrading it in one easy way for users (I can doing it with SWD if needed but its not recommended for "normal" users). I still dont knowing if tuya have locked the boot loader but its being next step. My target is making it easy upgrading one standard tuya eth Zigbee GW witth first step rooting =done, Serial over Ethernet = done and also upgrading the EZSP on it to one stable version (6.7.X.X). Advantage with the tuya ZBG is stable Ethernet that is immune from WiFi interference, only need (for the moment) serial-TTL for getting root (no need shouldering but is preferred if possible) and likely firmware updating without SWD (or if needed with one "cheep" probe). Its easy getting "over the desk" for around 20-30 € all over the world without ordering it from china (I was getting my with one "family pack" with tuya TRV). I was getting it from Germany in 4 days and LIDL was having it for 1.5 mouths in the supermarket (they was taking it sway without sale so i think its returned to the online store for 25 €). Can you helping bringing little light in the software part to getting the EFR32 in boot loader that im not so good at the software things? Thanks you for your attention and grate work done with ZHA !!! Mattias |
Beta Was this translation helpful? Give feedback.
-
|
You might find the sequence here more readable: Look at the init function for your EZSP level to reset the stack, then on to init bootloader with On line 292 of the above ncp.py and it will stop when the NCP is in bootloader mode. |
Beta Was this translation helpful? Give feedback.
-
|
The best working is installing HA in one docker container under windows 10. Install ZHA with bellows is installed. And having one USB-serial on the RX and TX pins on the module i getting somthing i like: Now im hitting the wall a gen :-(( Normally only hitting 1 and upload one GBL file but the module is not reacting on wot i sending on the pins from the USB-serial converter. I have trying 2 different that is working with my Billy EZSP that have the same bootloader (generation) but the same no reaction. My theory is that the module is wired for hardware flow control and the bootloader is also configurated for it and bellows dont have any problems with that then the socat is using it on the module side. I can flashing one EZSP with SWD but i like finding one way doing it with no extra hardware for normal users. If bellows CLI was having the possibility sending strings (i only need sending one "1") and also starting xmodem sessions it wold being on easy thing. I have "patching" husbzb-firmware so its running under windows 10 and python 3.7 but having problems sending all things on the comport but i can reading and setting EZSP protocol OK but i dont getting it working all the way. Have installing one "port mapper" in windows and can mapping the IP:8888 to one local com port but its only sending and dont getting any thing back from the module. Do some one have more ideas how getting it working with the hardware flow control without desoldering the module or flashing one new bootloader with SWD ? ? |
Beta Was this translation helpful? Give feedback.
-
|
I don't know if this will be useful to you, but I looked through the scripts on the device briefly, and the I think by running |
Beta Was this translation helpful? Give feedback.
-
|
Sound like on likely working way. Only downloading the GLB and renaming it and before starting the script killing the socat server so it not interfering with the communication to the module. And one large thanks for the hint !!! |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
@puddly I have trying getting the tuya GW updating itself with its "backup OTA file" but i cant verifying if its being done or not but the process is doing "somthing" in some realistic time. Can you pleas taking on look if its one "real" Silabs OTA file ? NcpUpgrade.zip For my its looks little strange in the beginning but the end have references to Simplicity studio files. |
Beta Was this translation helpful? Give feedback.
-
|
Parses and validates fine for me. Didn't need any correction to parse either: $ ipython
In [1]: import pathlib
In [2]: from zigpy.ota.image import parse_ota_image
In [3]: from zigpy.ota.validators import validate_ota_image
In [4]: data = pathlib.Path('~/Downloads/NcpUpgrade.ota').expanduser().read_bytes()
In [5]: image, rest = parse_ota_image(data)
In [6]: rest # no trailing data
Out[6]: b''
In [7]: image.header
Out[7]: OTAImageHeader(upgrade_file_id=200208670, header_version=256, header_length=56, field_control=<FieldControl.0: 0>, manufacturer_id=1, image_type=1, file_version=65544, stack_version=2, header_string='TYZS4 115200 1.0.8 MFTEST', image_size=194230)
In [8]: validate_ota_image(image) # it validates and the firmware is parsed properly
Out[8]: <ValidationResult.VALID: 1>
In [9]: image.serialize() == data # no correction was applied, it serializes to the original file
Out[9]: True
In [10]: pathlib.Path('~/Downloads/NcpUpgrade.bin').expanduser().write_bytes(image.subelements[0].data) # extract the actual firmware file
Out[10]: 194168 |
Beta Was this translation helpful? Give feedback.
-
|
It's a GBL image: $ git clone https://github.com/dac-gmbh/gbl
$ cd gbl
$ cargo run dump ~/Downloads/NcpUpgrade.bin
Finished dev [unoptimized + debuginfo] target(s) in 0.37s
Running `target/debug/gbl dump ~/Downloads/NcpUpgrade.bin`
Gbl {
enc: NotEncrypted {
app_info: AppInfo {
type_: 1,
version: 0,
capabilities: 0,
product_id: 00000000-0000-0000-0000-000000000000,
},
sections: [
ProgramData {
flash_addr: 16384,
data: (172 bytes) [60, 4C, 00, 20, D1, D7, 00, 00, 91, BE, 00, 00, 95, BE, 00, 00, A7, 0A, 0A, 01, 00, 42, 00, 00, 04, 18, 0F, AC, 00, 65, BC, 00, ...],
},
ProgramData {
flash_addr: 16896,
data: (193908 bytes) [60, 4C, 00, 20, D1, D7, 00, 00, 91, BE, 00, 00, 95, BE, 00, 00, 9D, BE, 00, 00, 99, BE, 00, 00, A1, BE, 00, 00, CD, D7, 00, 00, ...],
},
],
},
sig: NotSigned,
} |
Beta Was this translation helpful? Give feedback.
-
|
Thanks very much then then i can trying with one normal OTA file (GBL) and see if the module is accepting it. One more time thanks !! |
Beta Was this translation helpful? Give feedback.
-
|
Not encrypted and only signed = JACKPOT !!!!!!! |
Beta Was this translation helpful? Give feedback.
-
|
Tested with one EZSP 6.0.3.0 by renaming it to So the debugtool have doing "something" but the version is not degraded in the module = not working :-(( |
Beta Was this translation helpful? Give feedback.
-
|
Great thanks !!! The problem with the original socat its blocking the Zigbee module for communicating then hardware pins is being in blocking mode and the original bottloader and NCP is have HW flow control. I trying it out if i can recovering my "bricking" with it after writing one request for new firmware and one new bootloader with SW :-)). I keep you informed of the progress if its positive or negative !! |
Beta Was this translation helpful? Give feedback.
-
|
One Australian firmware request is sent from one Swed in Austria with help from Denmark :-))) |
Beta Was this translation helpful? Give feedback.
-
|
And now from docker CLI: And ZHA is saying: So My tuya ZBGW is not bricked only little degraded to software flow control !! YIPPPPPY !!! |
Beta Was this translation helpful? Give feedback.
-
|
With new Gary EZSP i getting: Attached firmware if some one is brave :-)) Credit for the firmware: our master firmware cooker Gary and the downloading to @Ordspilleren ! ! ! I was trying flashing back the NcpUpgrade.ota but the bootloader was not liking it but i should trying it one more time so knowing if its possible restoring the Zigbee module without activating the tuya app. Edit: Added both HW and SW version of the EZSP 6.7.8.0 in the zip file. |
Beta Was this translation helpful? Give feedback.
-
|
I agree with you @Ordspilleren the HW flow control its better then its already in the hardware design of the PCB and its have zero impact of the speed on the lines (that SW can doing some %). I was little of focus then going thru the hardware pin / pads / ports :-(( You have god eyes and brilliant brain have you finding some hint if tuya have implanting one force bottloader pin / pad / port to the module in the software and hardware ? I have only finding the 4 comport lines and the "2 | FRC_DCLK | I/O | packet trace interface (PTI) | PB11" that looks going to the SOC but is not making any thing then resting the module. Most bootloaaders is configurated without flow control then the NCP is using soft or hardware like the USB stick HUSBZB-1 that is using HW and 57k6 in the EZSP firmware and the normal shipped bootloader is without flow control. As i was saying before the bootloader is not flashing on downloaded firmware if the CRC and header is OK so its only re transmitting the file if its being wrong and the xmodem is also doing checks so its very safe mechanism. |
Beta Was this translation helpful? Give feedback.
-
|
Tuya is rolling the network key !!!! |
Beta Was this translation helpful? Give feedback.
-
|
How is it initiating the network key update? Will it update the network key even if we only run |
Beta Was this translation helpful? Give feedback.
-
|
I think the spec is saying first sending the new key (broad or unicast) and waiting before sending "updating network key" that is doing the roiling and updating the network key cuter. |
Beta Was this translation helpful? Give feedback.
-
|
Lasse its the tuya app that is trying doing "its things" and its complete disabled then running the Socat. For information 6.7.0.0 and newer EZSP is not backwards compatible then the frames format (ASH v8) is changed and cant "talking" the old (ASH v7) frame format (exception is the reset and initiating commands). If the tuya ZBGW is roiling the network key its shall not being any problems going back to ZHA then all devices have (hopefully) getting the new one and its transparent to ZHA. |
Beta Was this translation helpful? Give feedback.
-
|
Great. So if you only run serialgateway, then the network key update will not take place. |
Beta Was this translation helpful? Give feedback.
-
|
The network key saved in the simulated NVRAM in the flash and its the application that is manager it so if not using the "tuya app" (= disabled then starting the Socat) its only ZHA that can doing it (and very likely loosing all Xiaomi devices) but the devs dont like implanting it then its getting to much problems with "some" devices. |
Beta Was this translation helpful? Give feedback.
-
|
I have prepared a script to assist in upgrading the firmware: banksy-git/lidl-gateway-freedom#5. |
Beta Was this translation helpful? Give feedback.
-
|
I was thinking doing one zip or tar file with Socat, HW and SW and the new startup file and Xmodem and the EZSP firmware downloaded to the /tmp and then extracted in the right directorys and the right rights from the script. More or less one "all in one" package. |
Beta Was this translation helpful? Give feedback.
-
|
Great find! I have updated the script, and it now works without bellows. |
Beta Was this translation helpful? Give feedback.
-
|
Great !! |
Beta Was this translation helpful? Give feedback.
-
|
I was trying converting the dumped bin file from the "app" to one GBL file and i can downloading it but the module is rebooting to the bootloader = cant run the APP. Was taking one look on Garys git and hi have adding one 6.5.1.0 and its working booting and enabling tuyas "APP". Its writing little things but is not complaining and i can steering my LIDL LED stripes = working. I shall doing more testing with it and see that it can rebooting and adding and deleting device OK before saying its working 100%. Perhaps i can catching the network key rolling (by "cating" the log but very unlikely not with on real sniffing). By the way nice change in the updating script Lasse !! |
Beta Was this translation helpful? Give feedback.
-
|
Tuya dont like updating the NCP i think they is only comparing the mayor version of the NCP. Bad news for network key rolling is planed before the time is synced so its not being for some years. |
Beta Was this translation helpful? Give feedback.
-
|
Updated "upgrade pack" Tuya_ZBGW_NCP_BL_UPG.ZIP with "manual" triggering bootloader method. 3 different GBLs: I have testing loading booth 6.5.1 and 6.7.8 EZSP with the updated bootloader by software command reboot to bootloader and its works as expected. If not planing going back to "tuya app" i recommending updating the bootloadder so you always can booting in the bootloader also then EZSP is not running OK and you cant reboot to bootloader by software commands. I have not testing grounding the PB11 and tipping the reset pad low but it shall working as expected. |
Beta Was this translation helpful? Give feedback.
-
|
So, with this archive, can I?
I don't want to remove tuya for now, just have a more recent FW version for unsupported devices... |
Beta Was this translation helpful? Give feedback.
-
|
If you like staying tuya cloud dont hack the ZBGW or only extract the root password !! I have 2 tuya ZBGW (one LIIDL and one no named) and both hacked and one restored with the EZSP 6.5.1 and its working OK with tuya cloud then i testing tuya devices if they have getting firmware updates. If you is getting problem it can being you must using SWD probe flashing the firmware but i have not hearing users have needing it. |
Beta Was this translation helpful? Give feedback.
-
|
In fact here the manufacturer of the switch states that to get the power measures, you must have at least 6.7 FW on the gateway... |
Beta Was this translation helpful? Give feedback.
-
|
EZSP 6.6.X if i remember right. It can being that tuya have rolling out updates for some customers but they have not doing it on all devices (ZBGW) then i have not seen report of it and for Matter they is using one newer hardware version that is certificated for some weeks ago. |
Beta Was this translation helpful? Give feedback.
-
|
@Ordspilleren I have some some ideas of using the /dev/ttyS0 for other serial connected hardware (Zigbee sniffing). Some ideas if its possible and if its some no goes to implanting it ?? |
Beta Was this translation helpful? Give feedback.
-
|
Do we have new firmware for EZSP chip in this unit? |
Beta Was this translation helpful? Give feedback.
-
|
I have cooked one six ten for it and have one tuya TBGW running on it but only with few devices for test so its pretty untested but you can try it on own risk. |
Beta Was this translation helpful? Give feedback.
-
|
Battery drain issue? |
Beta Was this translation helpful? Give feedback.
-
|
I have not tested is its helping then i dont have any extreme battery draining in my production system (EZSP 6.7.8.0) and also the test system with all IKEA remotes types i having (was running 6.7.8.0 and now 6.10.0.0), Fixes in the Zigbee stack #595 (comment). I have good routers so the remotes can using then and i have blocking sleeping end device using the coordinator as parent and its working great. |
Beta Was this translation helpful? Give feedback.
-
|
How to flash it on TYGWZ01? |
Beta Was this translation helpful? Give feedback.
-
|
Normal way if you is downloading the GBL file and with one SWD/J-Link probe if you is using the S37 files. |
Beta Was this translation helpful? Give feedback.
-
|
Hello everyone! Thanks for this great project - I'm looking forward to using it. whereas the serialgateway Makefile refers to |
Beta Was this translation helpful? Give feedback.
-
|
Ah! My mistake! I "copied" the binary using |
Beta Was this translation helpful? Give feedback.
-
Great !!I was using TFTP for all my file copy to the device and then doing the copy in the terminal from the tem folder to its real location for not getting problems. So very soon we have one more brave user using it with ZHA or Z2M :-))) |
Beta Was this translation helpful? Give feedback.
-
|
I'm quite interested in this Lidl device. I see that the RTL8196E SOC has USB support, and that there are test pads connected to the USB_DN and USB_DP pins. I wonder if there is USB storage device support compiled in? Will a flash drive be detected if I solder in a USB connector??? |
Beta Was this translation helpful? Give feedback.
-
|
Staying on topic, though, now that I have tftp'd the GBL binaries to the device, it's not clear to me how to replace the bootloader and firmware on the TYGWZ01. |
Beta Was this translation helpful? Give feedback.
-
|
You shall (normally) not writing one new bootloader only triggering the bootloader and uploading the updated firmware for the Zigbee module. I dont remember exactly how we was doing it in the device but it was working well with the script posted in pauls git. |
Beta Was this translation helpful? Give feedback.
-
|
Is any of you are you aware of any new EZSP binary for TYGWZ-01? |
Beta Was this translation helpful? Give feedback.
-
|
I think i have not written that the original firmware is using SSIM2 and the updated using NVM3 so the firmware is deleting the old information if cant upgrading it to the new standard (I have getting one updating but not working and was needing resetting the zigbee module for getting it working). I have not testing if the firmware how stable its then i running "Billy EZSP" in my production system and the test ones is restarted oft. |
Beta Was this translation helpful? Give feedback.
-
|
So the only solution you found for the fast battery draining was to add the remotes to the routers instead of the TYGWZ01 coordinator? |
Beta Was this translation helpful? Give feedback.
-
|
Its can being around up to 10 bugs in the firmware that Silabs have fixing in the last release of there SDK but we is not knowing if IKEA nave implanting some of the fixes then they have one custom version with some extra code / patches. The work case is the battery dead in 48 hour = if the device is doing OTA firmware updating all the time. EZSP 6.7.8.0 is fixing many of the old bugs in the coordinator side so its treating the device better and not getting the bugs trigger so easy and for must user its being better. Some more devs have zero problems with IKEA remotes and i have only seen 2 draining on new battery then changing them and was not doing it at there normal position (remote for bedroom was getting new battery in living room and was jumping to one router in the living room and then putted back to the bed room jumped and drained the battery in one week). Most user with this problem (but not all) is having one SonOff ZBB and no routers but we have seen all Silabs but is being better with updated firmware (6.7.8.0) but also CornBee and the new is that all TI coordinators is having problem with the last firmware updates in there coordinators. The only thing is getting it working good is having good routers around the device and making them using them and not using the coordinator then its can being of line (like updating HA) and can making end devices jumping to one new parent and getting problems. Sorry but we have not finding any 100% working solution only IKEA can making one updated firmware with all bugs fixed (and pleas also the lost group binding) can making it working 100%. But for my its better than Xiaomi sensors that is leaving the network (silent) if they dont like there parent and must being repaired or rejoined but they is working great im my system 2. So have good routers is the best step for getting them working better but not 100% sure. |
Beta Was this translation helpful? Give feedback.
-
|
@MattWestb Thanks for the very in-depth explanation. For me 6.10 made the difference. 16 days now without issues. |
Beta Was this translation helpful? Give feedback.
-
|
Hi all, after a long time in the drawer due to the Ikea battery drain issue, i decided yesterday to givr the 6.10 fw a chance on my lidl/silvercrest gateway after reading all your feedback. |
Beta Was this translation helpful? Give feedback.
-
|
I have not using @Ordspilleren script but you need using the "V8" parameter then its 6.7.8.0 is using V8 protocol and the original tuya is / was using V7 or its not working. If you is getting the module in bot loader mode (with bellows) its also possible sending the firmware with one terminal program like ExtraPuTTY or with local SX commands in the box (the script is killing the serialgateway so need reboot if using external terminal program). |
Beta Was this translation helpful? Give feedback.
-
|
Sure , i will report . As @mihsu81 , i've paired the remote using ZHA and one Ikea bulb , for testing purpose . I don't have router right now in my network . what would be the "cheapest" way to get one router ? is there a simple device that could do the job ? |
Beta Was this translation helpful? Give feedback.
-
|
Normally lights is OK but the some of the last IKEA 3 gen is not so good then the antenna is very badly shielded with metal but the old outlet is pity good. |
Beta Was this translation helpful? Give feedback.
-
|
For now, i have reflashed an old 2531 usb stick with the router FW and added it in the network . I will let the Ikea remote paired to the gateway and see the bat level in a few day , and next test will be to pair the remote to the router instead and start to check again bat level. |
Beta Was this translation helpful? Give feedback.
-
|
This morning, the battery was reported at 100% by ZHA , it tells me 5% 7 hours later :-( ... |
Beta Was this translation helpful? Give feedback.
-
|
@MattWestb I gave up on the Lidl Gateway and went for ZigStar LilyZig with CC2652P. |
Beta Was this translation helpful? Give feedback.
-
|
Just for information , this gateway is now sold at 19€ in France and i saw yesterday a new version at Lidl , which looks like more the rounded version in that post : https://github.com/zigpy/zigpy/discussions/650#discussioncomment-669398 |
Beta Was this translation helpful? Give feedback.
-
|
I think LIDL is trying getting market from IKEA with the price. I was baying 2 Stainless steel Styrbar by IKEA in Montpelier then passing by to Spain and they was only 10€ and in Austria they was 20€. By the way i have putting back the EZSP 6.5.1 on the Zigbee module and copy the original start script and restarting the ZBGW and its have updating the Zigbee module and and the ZBGW firmware and then i must resetting my old account then the token was to old and then all was working OK. Shall doing little more sniffing of TS004F and then looking more how its reversing back to ZHA. |
Beta Was this translation helpful? Give feedback.
-
|
@Ordspilleren and more interested user. My question is if some one is interesting in one RCP firmware for tuya ZBGW so can running EZSP 7.0 in "host mode" (not on the chip in the host system) and Open Thread Boarder Router on the same chip and channel ? The integration and reference design is using hardware flow control and our implementation is doing the same so shall being OK but its best doing testing and having SWD debugger so can recover the module if not working OK. More feed back pleas !!! PS: I have trying doing the same firmware for "IKEA Markus" (The new Silabs MG21 module) but i have not getting it working OK. |
Beta Was this translation helpful? Give feedback.
-
|
One Billy RCP as leader OTBR with one tuya / LIDL ZS3L module RCP as second OTBR and its having one LIDL E14 RGBWW light on the Zigbee network :-))) The big Q is what shall i doing with the Thered network then i have not finding any devices and host system for it ??? |
Beta Was this translation helpful? Give feedback.
-
|
I have I need testing if i can doing firmware updates of EZSP and RCP with software commands safely then i can cooking one RCP for tuya ZBGW with hardware flow control and testing aas is being done in Garys firmware we is using in our ZBGWs. |
Beta Was this translation helpful? Give feedback.
-
|
@MattWestb you write in #650 (reply in thread) press de ESC....where can i find the ESC? I am very confussed. I use termite but can seem to get communication with the zwgateway. |
Beta Was this translation helpful? Give feedback.
-
|
i tryed multple solutions but nothing seem to work. 3 different PC's en 3 different USB serial port adapters . I must be doing something wrong because i can not intercept the bootloader with the ESC key I use termite on windows 7 and windows 10 . Pressing ESC on the keyboard at different times intervals on the PC keyboard has no effect whatsoever. I am very frustrated and feel very stupid. I dont understand what i am doing wrong...... |
Beta Was this translation helpful? Give feedback.
-
|
Your terminal can receiving from the ZBGW = very good !! |
Beta Was this translation helpful? Give feedback.
-
|
I finally succeeded in stoping the boatloader. HOREE.... I now used a fdti233 chip usb controller and i took a Linux Mint machine and installed minicom. ESC aping was very easy now! That DID the TRICK! When i use TUYAZBGWROOTPW.PY i get Can you help me please? |
Beta Was this translation helpful? Give feedback.
-
|
You printout looks little different then i was doing it but it was very early in the hacking process. Great work dune brave user !!! |
Beta Was this translation helpful? Give feedback.
-
|
Is it possible for you to decode my KEK and AUSKEY ?. Is it oke if i send you my 3 lines of code? (may i have other python setting then you?) Thank you very much in your efforts to help me.... |
Beta Was this translation helpful? Give feedback.
-
|
@MattWestb Would you be able to create a router firmware for the Lidl Smart Gateway? |
Beta Was this translation helpful? Give feedback.
-
|
Sorry @mihsu81 i dont have interest doing it then the hardware is not made for that purposes. Information of the module pins and so on you can finding on me git. I can recommending IKEAs Signal Repeater is working OK if you like having one USB powered device that have being around for long time. Normally its the best adding some good routers in the network for getting it extended (i using IKEA Power outlets as "back bone"for my production network) so all your end devices can connecting to them and not need for having them connected direct to the coordinator then its normally one very lazy router (its being one normal router but is doing the coordinator things that is higher priority). |
Beta Was this translation helpful? Give feedback.
-
|
Hi MattWesb
I would like to ask you if you can decode mt KEK en AUS-KEYS?
80000000:5A5AA5A566666666666666676666666680000000:322BC647E282D563971D448202884A6280000010:C1E46A49C5A821773EA0022AF278257A
Is this possible for you.
I am stuck and can't seem to get uasable results
Thanks Constapel Op dinsdag 10 mei 2022 21:55:57 CEST schreef MattWestb ***@***.***>:
You printout looks little different then i was doing it but it was very early in the hacking process.
Look in my post #650 (reply in thread) but the updated script is looking little different but you shall getting the same readings (but different codes) that i was getting from the bootloader.
Great work dune brave user !!!
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you commented.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
Hoera! i retryed and this time a got different KEK en AUSKEY. |
Beta Was this translation helpful? Give feedback.
-
|
I have trying your keys and getting the same error :( Can you doing the commands in the boot loader for getting the keys one more time and copy all in one block and not line by line so you is not getting any strange things from windows and saving it in on TXT fie. Then testing the script if its working or not with the new made keys and if its not working posting the TXT file (attaching it) and i taking one more look on it. |
Beta Was this translation helpful? Give feedback.
-
|
Sorry was missing your lat post the doing dinner :-)) Only reboot the ZBGW and hitting enter then have booting OK and you is getting on login prompt: put |
Beta Was this translation helpful? Give feedback.
-
|
Hi Matt, |
Beta Was this translation helpful? Give feedback.
-
|
Im dont knowing OH so i cant guiding you with it. |
Beta Was this translation helpful? Give feedback.
-
|
Tribute to Matt! I am happy! Thanks to Matt for all his fantastic support ! |
Beta Was this translation helpful? Give feedback.
-
THAT IS GREAT !!!I like brave users that is doing advance things and getting more knowledge :-))) If you looking in the HA -> Settings -> System -> Logs and clinking on And the version of the EmberZNet must being 6.7.0.0 or higher for running other systems then ZHA then they have not implanting the old versions of the protocol but i think you is on 6.7.8.X so shall being OK for Z2M and other systems that is supporting EZSP coordinators. And you can trying adding some device in ZHA and see how its working before "converting" all your nice device to OH ;-) |
Beta Was this translation helpful? Give feedback.
-
|
tuya have certified one updated version of our ZBGW for Matter !!! If looking on the original LIDL ZBGW its having HW ver 100 https://csa-iot.org/csa_product/lidl-home-gateway-2/ and was getting one firmware upgrade https://csa-iot.org/csa_product/gateway/. And its the same as the tuya TYGWZ-01 https://csa-iot.org/csa_product/tuya-smart-gateway-3/ and one hardware updated version for Zigbee https://csa-iot.org/csa_product/tuya-smart-gateway/. So the interesting is some user having one Smart Wired Gateway Pro / THP10-Z-X and can looking in side so we is knowing what hardware tuya have updated and can posting some photos for analyzing ? I think the Zigbee module is being updated then i have my Billy NCP (EFR32MG1P) running RCP firmware so can using it for OTBR and Zigbeed in HA and it working but Silabs have not fixing the EFR32MG1B in the last GSDK so its not possible compiling one working RCP firmware for it. It also can being they is using the same Zigbee module but have implanting the WiFi coexistent that is documented in the tuya dev docks but is not implemented the hardware if the TYGWZ-01. So if some user have one Smart Wired Gateway Pro / THP10-Z-X pleas open it and post some good photos so we can taking one no destructive look inside it !!! |
Beta Was this translation helpful? Give feedback.
-
|
Hi Matt, how cam I use the MG21LD in HA? I got 4 of them, and since i use 2 controllers with 2 led stripes each, i got 2 left... |
Beta Was this translation helpful? Give feedback.
-
|
I was getting 2 of them and using the LED stripes on one controller so one i have modded. Your settings for Silabs Addon looks OK only need adding the network port in the config (9999) so it starts the socat port OK. Before it was problems setting it up if ZHA was not having any working Zigbee network (time outs) but it shall being fixed not but i have not testing it. If timing out load EZSP and adding it in ZHA with normal comport and forming the network. Then take sown ZHA and changing the config (in the HA .config folder) to the addon and starting it and it shall working. If you getting it working you can putting one in the LIDL ZBGW but i think the pinout is not the same but all can being patched with think cables soldered. My controller is for the moment running Open Thread Full future device with CLI connected to the OTBRs network for testing the commissioning devices. Ask more if you need help for getting it working !! |
Beta Was this translation helpful? Give feedback.
-
|
I have this stuff (Smart Wired Gateway Pro / THP10-Z-X) |
Beta Was this translation helpful? Give feedback.
-
EZSP 6.10.3.0 and RCP 4.2.0.0Very untested but posted. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for your hard work and my tygwz-01 works very well. I use " ./firmware_upgrade.sh [gateway_ip] 22 V7 NCP_UHW_MG1B232_678_PA0-PA1-PB11_PA5-PA4.gbl " to upgrade zigbee firmware where V7 is the ezsp version. I want to know if I want to upgrade to 6.10.30, Is there still be V7 or V8? The firmware_upgrade.sh only support V7 and V8. Tks! |
Beta Was this translation helpful? Give feedback.
-
|
Hi. How to decrypt password from fullflash? I read fullflash from my ZHUB and unpack it with binwalk. So i get many files and many catalogs jffs2-root and squashfs-root and many files passwd with different contain. Thank you! |
Beta Was this translation helpful? Give feedback.
-
|
This is a long thread and I've managed to get to the stage of getting root login to the device, I'm just not sure on the next steps to get the device to expose a socket on a port allowing the device to be added in to Zigbee2MQTT |
Beta Was this translation helpful? Give feedback.
-
|
Best is using the Pauls guid if its online but the next step is installing the serial server and getting it auto starting be renaming the tuya starting script and maning one that starting the serial server. |
Beta Was this translation helpful? Give feedback.
-
|
I`m trying to follow the root password process but when I get the password and try to use it says it is an incorrect password. Also when I try to SSH the server is not responding on port 2333 but 22, then login fails with the password I decrypted. ( I`m using Putty on Windows )
|
Beta Was this translation helpful? Give feedback.
-
|
This one help me on my Ubuntu. |
Beta Was this translation helpful? Give feedback.
and others
-
TYGWZ01 Smart Gateway is used from all suppliers of tuyya products and is the ethernet version of there Zigbee GW.
Known rebranded LIDL, Pearl.de, Revolt, Elesion and many more.
Inside.
Some user is trying porting OpenWrt to the rtl8196eu chip so its being possible using it as one EZSP 2 ETH bridge.
Would it work on rtl8196eu ? #3 and Add Support for RTL8196E RTL8197D RTL8197F
On of the devs (@xromansx) is active in our projects and have contributing to getting tuya TRVs to working in our systems.
Do some more users / hackers have interest in getting it up and running with OpenWrt and tunneling the comport from the EZSP over ethernet to ZHA ??
I finding it interesting then it being cheap and easy to get in EU and most other countries and dont have the problems with WiFi interference that can killing the ZHA.
I have one GW that is not in use and is only for testing if tuya have released new firmware for my tuya products but im willing exposing for more brutal attacks for getting it working for our purposes .
I dont have and SPI programmer onls SWD /J-Tags programmers but im interesting if some one can helping getting the EEPROM red with easy hardware for getting some start of trying loading one new firmware on it for our purposes
More input of crazy ideas is more than welcome for getting (un)possible things happening ! !
Beta Was this translation helpful? Give feedback.
All reactions