ct-open-source / tuya-convert Goto Github PK
View Code? Open in Web Editor NEWA collection of scripts to flash Tuya IoT devices to alternative firmwares
License: MIT License
A collection of scripts to flash Tuya IoT devices to alternative firmwares
License: MIT License
Vendor: Unknown
Area: EU
Device Name: WiFi Smart Plug
Vendors device ID: BSD23
GPIOs:
GPIO12 = Relay1 (+ blue LED, lights when relay is on)
GPIO4 = Led1 (Red LED, lights when relay is off)
GPIO13 = Button1
Notes: Tasmota Module type: Generic
Flash size/mode: 1M QIO
Looks like this:
https://www.ebay.co.uk/itm/948C-Smart-Wi-Fi-Socket-Voice-Control-for-Smart-Life-Smart-Plug/123540078228
READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: 5f3896
MAC: XX:XX:XX:XX:XX:XX
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M QIO @ 40MHz
FlashChipId: 1440a1
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 0
system_upgrade_userbin_check: user2 0x81000
The sonoff-classic firmware goes into WPS config when it does not have any access point SSID and not into AP mode. This will cause problems for users whose router doesn't support this.
The sonoff.bin v6.4.1 firmware is to large and will be rejected.
I had the same issues when developing my own OTA process. In the end I had to go back to previous versions of sonoff.bin and settled on sonoff.bin v6.2.1 which is small enough to be loaded.
I would recommend you did the same.
The vtrust-flash network only appears irregularly on my Raspberry Pi 3 (with the built-in WLAN adapter and a clean Raspbian Stretch). The best chances are after a fresh reboot. But even then my phone can connect to the wifi but immediately disconnects afterwards. Any help is welcome. Here is my wifi log:
wlan0: interface state ENABLED->DISABLED
wlan0: AP-DISABLED
nl80211: deinit ifname=wlan0 disabled_11b_rates=0
Backing up /etc/dnsmasq.conf...
Writing dnsmasq config file...
Creating new /etc/dnsmasq.conf...
Writing hostapd config file...
Configuring AP interface...
Applying iptables rules...
Starting DNSMASQ server...
RTNETLINK answers: File exists
Starting AP on wlan0 in screen terminal...
Configuration file: /etc/hostapd/hostapd.conf
Failed to create interface mon.wlan0: -95 (Operation not supported)
wlan0: Could not connect to kernel driver
Using interface wlan0 with hwaddr b8:27:eb:e8:55:5a and ssid "vtrust-flash"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED
Backing up /etc/dnsmasq.conf...
Writing dnsmasq config file...
Creating new /etc/dnsmasq.conf...
Writing hostapd config file...
Configuring AP interface...
Applying iptables rules...
Starting DNSMASQ server...
Starting AP on wlan0 in screen terminal...
Configuration file: /etc/hostapd/hostapd.conf
Failed to create interface mon.wlan0: -95 (Operation not supported)
wlan0: Could not connect to kernel driver
Using interface wlan0 with hwaddr b8:27:eb:e8:55:5a and ssid "vtrust-flash"
random: Cannot read from /dev/random: Resource temporarily unavailable
random: Only 0/20 bytes of strong random data available from /dev/random
random: Not enough entropy pool available for secure operations
WPA: Not enough entropy in random pool for secure operations - update keys later when the first station connects
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED
random: Cannot read from /dev/random: Resource temporarily unavailable
I did a video walk through of the entire process of a blank SD card to a flashed Tasmota device. This might help cut down on some of the issues people are having as more and more people try the process out.
Edit: Livestream where I showed how to setup two plugs and figure out the in's and out's of things of what pins go to which switches/buttons/relays etc..
I'm afraid this isn't resolved with the latest changes to the version/bin of tasmota.
I tried again today with a new bulb and it seems that it's not actually being flashed with anything. You can see below I initiated flash3, the bulb didn't seem to flash anything/restart and I was able to even undo and return this one to the original firmware.
I think the first bulb might be stuck with the flash loader on it still but it's not reconnecing to the AP unfortunately.
HAVE FUN!
pi@raspberrypi:~/tuya-convert $ curl http://10.42.42.42/flash2
Device is allready booting from userspace 2 (0x81000)pi@raspberrypi:~/tuya-convert $ curl http://10.42.42.42/flash3
Device should flash http://10.42.42.1/files/thirdparty.bin and restartpi@raspberrypi:~/tuya-convert $ curl http://10.42.42.42/flash2
Device is allready booting from userspace 2 (0x81000)pi@raspberrypi:~/tuya-convert $ curl http://10.42.42.42
VTRUST-FLASH 1.0
(c) VTRUST GMBH https://www.vtrust.de/35c3/
READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: 3a717d
MAC: 80:7D:3A:3A:71:7D
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M QIO @ 40MHz
FlashChipId: 1440c8
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 0
system_upgrade_userbin_check: user2 0x81000
pi@raspberrypi:~/tuya-convert $ ls
2019-01-23_15-13-50_readout.bin config.txt files LICENSE scripts stop_flash.sh
2019-01-25_07-18-30_readout.bin device-info.txt install_prereq.sh README.md start_flash.sh
pi@raspberrypi:~/tuya-convert $ curl http://10.42.42.42/backup
File Not Found
pi@raspberrypi:~/tuya-convert $ cd files
pi@raspberrypi:~/tuya-convert/files $ ls
1.bin esp8266-ota-flash-convert.ino-0x81000.bin esp8266-ota-flash-convert_upg.bin thirdparty.bin user2.bin
pi@raspberrypi:~/tuya-convert/files $ cd ..
pi@raspberrypi:~/tuya-convert $ curl http://10.42.42.42/flash2
Device is allready booting from userspace 2 (0x81000)pi@raspberrypi:~/tuya-convert $ curl http://10.42.42.42/flash3
Device should flash http://10.42.42.1/files/thirdparty.bin and restartpi@raspberrypi:~/tuya-convert $ curl http://10.42.42.42/undo
Removing esp8266-ota-flash-convert and reboot
```''
For the wiki: Gosund WP3
Generic Module
GPIO4: Switch1
GPIO12: LED2i
GPIO13: LED1i
GPIO14: Relay1
Backup wird gemacht
ip 10.42.42.42 wird zugewiesen
wird aber nicht geflashed
ping 10.42.42.42 ist ok
curl http://10.42.42.42/flash2
device is already booting from userspace 2 (0x81000)
curl http://10.42.42.42/flashURL?url=http://10.42.42.1/files/thirdparty.bin
Device should flash http://10.42.42.1/files/thirdparty.bin and restart
passiert nix
curl http://10.42.42.42/flash3
auch nicht
any ideas?
No issue at all.
I have successfully flashed the Woox R4028 Smart Power Strip EU Type 16 A 3 Ports (https://www.amazon.de/dp/B07GFNL67Z/).
VTRUST-FLASH 1.0
(c) VTRUST GMBH https://www.vtrust.de/35c3/
READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: d69d9d
MAC: DC:4F:22:D6:9D:9D
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M DOUT @ 40MHz
FlashChipId: 144051
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 3
system_upgrade_userbin_check: user2 0x81000
My tasmota config is
https://cdn.pbrd.co/images/HXZlVnH.png
Some of these Python scripts use tabs, spaces, or worse, a mix in the same file. Let us pick an indentation and apply it consistently.
Hi,
I was trying to use my phone to connect to the wifi AP using the credential given
WIFI: vtrust-flash
PASS: flashmeifyoucan
IP: 10.42.42.42
but it shows "unable to join the network"
Any idea what i need to do?
Thanks!
Device info:
READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: XXXXXX
MAC: xx:yy:xx:yy:xx:yy:xx:yy
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M QIO @ 40MHz
FlashChipId: 1440c8
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 0
system_upgrade_userbin_check: user2 0x81000
After trying to flash.
curl http://10.42.42.42/flash3
And got the following response:
Device should flash http://10.42.42.1/files/user2.bin and restart
Device went to 100% brightness but never seemed to restart. The ESP SSID didn't show up and the device no longer responds when I attempt to put it into pairing mode.
Succesfully flashed my plugs and make them run with the generic module:
GPIO1 = Button1
GPIO13 = Led1i
GPIO14 = Relay1
n.n. there's a typo in the list of compatible devices:
It's not Maxico but Maxcio.
thirdparty.bin -> sonoff-basic.bin
but sonoff-basic.bin does not exist (as of 3b3a716).
Hi there,
flash process was successful.
I'm running Sonoff-Tasmota (basic) on my RGB LED bulb.
(MAXCIO RGB LED BULB)
I can't switch/toggle to ON or OFF - the bulb is off.
I tried with "Generic" and "Sonoff B1" and other Module Types.
Played with GPIOs but nothing worked for me.
Any suggestions for this issue?
Another question: how to flash the original firmware back to the bulb?
Is it possible to use the upload option from Tasmota?
Device-Info:
VTRUST-FLASH 1.0
(c) VTRUST GMBH https://www.vtrust.de/35c3/
READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: e325fb
MAC: 68:C6:3A:E3:25:FB
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M QIO @ 40MHz
FlashChipId: 1440a1
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 0
system_upgrade_userbin_check: user2 0x81000
Thanks for any help...
Successfully flashed BW-SHP2 clones 2x ablue SP1 & 2x Gosund SP1 with pi zero w. Only problem was with the prereq, nodejs binaries and libs not installed in armv6 versions, so i had to do this manually. Also network-manager was missing, so i installed it and AP started. Thank you!
Heya,
Million thanks for great development. You guys rock.
Successfully flashed this smart plug, EU:
https://www.aliexpress.com/item/UK-US-EU-WiFi-Smart-Socket-Power-Plug-Outlet-Remote-Control-Works-with-Amazon-Alexa-Google/32954272490.html
GPIO12 = Relay
GPIO5= Led, Inverted
Hi,
no issue .. just a success message ....
Successfully flashed some Gosund SP1 devices.
Alexander
I followed the guide on heise. I already got the device info:
======================================================
Getting Info from IoT-device
VTRUST-FLASH 1.0
(c) VTRUST GMBH https://www.vtrust.de/35c3/READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: xxxxxx
MAC: YY:YY:YY:XX:XX:XX
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M DOUT @ 40MHz
FlashChipId: 144051
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 3
system_upgrade_userbin_check: user2 0x81000======================================================
After this I try to get tasmota:
And got the following response:
Device should flash http://10.42.42.1/files/user2.bin and restart
Tasmota never started. Instead I see a SSID named ESP_XXXXXX
. Connecting to it gives me the IP 192.168.4.2 and a default gateway on 192.168.4.1. I can ping the device on that address, but it didn't reply to http requests.
Because user2.bin is linked to esp8266-ota-flash-convert.ino-0x81000.bin
: What is it? Why the command don't install sonoff-minimal.bin
?
Do anybody have some hints for me, what I did wrong or some advises how I can continue without opening the device? Maybe this is also connected to issue #2?!
here is log after flashing:
VTRUST-FLASH 1.0
(c) VTRUST GMBH https://www.vtrust.de/35c3/
READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: 43d1cc
MAC: 2C:3A:E8:43:D1:CC
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M QIO @ 40MHz
FlashChipId: 1440e0
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 0
system_upgrade_userbin_check: user1 0x01000
URI:/gw.json?a=s.gw.token.get&gwId=012005132c3ae843d1cc&other={"token":"00000000","region":"EU","tlinkStat":{"configure":"smartconfig","time":8,"source":"ap","path":"broadcast"}}&t=8&v=3.0&sign=13f055737f99ca2b82add6fbdd34a8a1
Answer s.gw.token.get
�[32m[I 190127 08:39:20 web:2162]�[m� 200 POST /gw.json?a=s.gw.token.get&gwId=012005132c3ae843d1cc&other={"token":"00000000","region":"EU","tlinkStat":{"configure":"smartconfig","time":8,"source":"ap","path":"broadcast"}}&t=8&v=3.0&sign=13f055737f99ca2b82add6fbdd34a8a1 (10.42.42.12) 0.59ms
URI:/gw.json?a=s.gw.dev.pk.active&gwId=012005132c3ae843d1cc&other={"token":"00000000"}&t=7&v=3.0&sign=b865a96f66a474027130865de25de4fd
Answer s.gw.dev.pk.active
READ GW ID 012005132c3ae843d1cc
TRIGGER UPGRADE IN 10 SECONDS
�[32m[I 190127 08:39:21 web:2162]�[m� 200 POST /gw.json?a=s.gw.dev.pk.active&gwId=012005132c3ae843d1cc&other={"token":"00000000"}&t=7&v=3.0&sign=b865a96f66a474027130865de25de4fd (10.42.42.12) 8.04ms
Trigger upgrade in 10 seconds
URI:/gw.json?a=s.gw.update&gwId=012005132c3ae843d1cc&t=10&v=2.0&sign=17d74a0c863c7e36dbccea4088ceeb28
Answer s.gw.update
�[32m[I 190127 08:39:24 web:2162]�[m� 200 POST /gw.json?a=s.gw.update&gwId=012005132c3ae843d1cc&t=10&v=2.0&sign=17d74a0c863c7e36dbccea4088ceeb28 (10.42.42.12) 2.57ms
URI:/gw.json?a=s.gw.dev.update&gwId=012005132c3ae843d1cc&t=8&v=2.0&sign=2eda8f6c8763b98a9a1fbdd08ac017d4
Answer s.gw.update
�[32m[I 190127 08:39:26 web:2162]�[m� 200 POST /gw.json?a=s.gw.dev.update&gwId=012005132c3ae843d1cc&t=8&v=2.0&sign=2eda8f6c8763b98a9a1fbdd08ac017d4 (10.42.42.12) 1.97ms
URI:/gw.json?a=atop.online.debug.log&gwId=012005132c3ae843d1cc&t=8&sign=7c4076ba2302dfc40e1e68713dae491c
Answer atop.online.debug.log
�[32m[I 190127 08:39:27 web:2162]�[m� 200 POST /gw.json?a=atop.online.debug.log&gwId=012005132c3ae843d1cc&t=8&sign=7c4076ba2302dfc40e1e68713dae491c (10.42.42.12) 2.89ms
URI:/gw.json?a=tuya.device.dynamic.config.get&gwId=012005132c3ae843d1cc&t=7&v=1.0&sign=3e4877a1b0b5b193976ce93ed1d0d769
WARN: unknown request: tuya.device.dynamic.config.get (/gw.json?a=tuya.device.dynamic.config.get&gwId=012005132c3ae843d1cc&t=7&v=1.0&sign=3e4877a1b0b5b193976ce93ed1d0d769)
�[32m[I 190127 08:39:27 web:2162]�[m� 200 POST /gw.json?a=tuya.device.dynamic.config.get&gwId=012005132c3ae843d1cc&t=7&v=1.0&sign=3e4877a1b0b5b193976ce93ed1d0d769 (10.42.42.12) 0.71ms
437213e8010938d96e0fccf3b1184caa
b'2.1010938d96e0fccf3t5inCMDHpcJKQpxfOe2RbRJQzq/8g9mFpomEPpw6F4r+CnlIYZNKR5d4Pa/nSetXJsm5uMafEvnzLLz/1MQ4v8xa0Zm6fetNRMAjbEOLCBHdg4SXZL9kLEC9aqKXAOwI'
URI:/gw.json?a=s.gw.upgrade&gwId=012005132c3ae843d1cc&t=10&sign=840cf218e207096f6efc7eb76a39a750
Answer s.gw.upgrade
b'{"result":{"auto":3,"fileSize":"508475","etag":"0000000000","version":"9.0.0","url":"http://10.42.42.1/files/1.bin","md5":"88eaa4b09dc5a493a77adf0a41c87ba0"},"t":100,"e":false,"success":true}'
�[32m[I 190127 08:39:31 web:2162]�[m� 200 POST /gw.json?a=s.gw.upgrade&gwId=012005132c3ae843d1cc&t=10&sign=840cf218e207096f6efc7eb76a39a750 (10.42.42.12) 14.21ms
URI:/gw.json?a=s.gw.upgrade.updatestatus&gwId=012005132c3ae843d1cc&t=100&sign=0626f8711c5498fbdd454fc20aba3e90
Answer s.gw.upgrade
b'{"result":{"auto":3,"fileSize":"508475","etag":"0000000000","version":"9.0.0","url":"http://10.42.42.1/files/1.bin","md5":"88eaa4b09dc5a493a77adf0a41c87ba0"},"t":100,"e":false,"success":true}'
�[32m[I 190127 08:39:31 web:2162]�[m� 200 POST /gw.json?a=s.gw.upgrade.updatestatus&gwId=012005132c3ae843d1cc&t=100&sign=0626f8711c5498fbdd454fc20aba3e90 (10.42.42.12) 6.13ms
�[32m[I 190127 08:39:37 web:2162]�[m� 206 GET /files/1.bin (10.42.42.12) 11.43ms
�[32m[I 190127 08:39:38 web:2162]�[m� 206 GET /files/1.bin (10.42.42.12) 1499.07ms
�[32m[I 190127 08:43:53 web:2162]�[m� 200 GET /files/user2.bin (10.42.42.42) 7718.20ms
�[32m[I 190127 08:44:09 web:2162]�[m� 200 GET /files/thirdparty.bin (10.42.42.42) 8874.73ms
I guess firmware sonoff-basic was transferred successfully to device but it can't boot. Device is now reboot loop. I can hear the switch on and off repeat.
Any advice, please?
Thank you
Hi fellas, looks like you've developed an alternate project in parallel with TuyOTA by SynAckFin and MockTuyaCloud by kueblc.
A few people have been having discussion in here about it with respect to several devices and getting the Tasmota firmware loaded.
Figured you guys might be interested in what others have been doing along the same lines.
Would be nice if a shared list of supported devices could be contributed to :)
Never mind.. I'm dumb. Just look in config.txt!
I'm attempting to run this script on a Linux Mint 18.3 laptop. It doesn't have a "wlan0" wireless interface. Instead, it's called "wlp2s0". The scripts seem to be inferring or assuming that my interface is "wlan0". I've tried hacking a few scripts to set the $WLAN variable, but I still get this when attempting to actually flash.
======================================================
Starting pairing procedure in screen
Cannot find device "wlan0"
With my hacked-in variable, the log file looks much better and references the correct interface, but it still won't flash. Where does the script come up with "wlan0"? I can't find out where it gets this name from.
******** SUCCESS *********************
I have been trying all day long and no success.
Using older HP PC, installed latest Kali, Ubunto Mint.
Edited config.txt, swapped wlan0/wlan1.
using built in WIFI and USB one.
I can not make the AP appear
is this command suppose to trigger AP correct for Ubuntu?
echo " Starting AP in a screen"
$screen_with_log smarthack-wifi.log -S smarthack-wifi -m -d ./setup_ap.sh
No issues.
Initially tried with old RPI (v 1.2?), script displayed some error message related to arm processor.
Switched to latest RPI B+, flashed tasmota without any issues.
At the end, had to remove my wifi router password to see sonoff.
Link to the device: https://www.amazon.com/Assistant-Required-Enabled-Control-Gosund/dp/B072ZX8RTZ
Successfully flashed my Zhilde ZLD-44EU-W with the espurna bin file for the device. No issues! https://github.com/xoseperez/espurna/wiki/Hardware-Zhilde-ZLD-44EU-W
This is no issue at all - I just wanted to let you know that I just successfully flashed one of Gosund SP111
First I tried it with a Dell XPS on Ubuntu 18.04 - but didn´t get this to work. The WLAN didn´t seem to come up.
Second try: raspberry pi B3+
The WLAN came up the device was recognized immediatly.... but the dump of the original firmware got stuck... I tried this ~~8 times - every time the process hang at another adress. I could attach a log later if interested.
Then I had the idea perhaps the WLAN connection might not be stable enough (plug was in another room). When I places the plug next to the raspberry it finally worked. Perhaps there is some space for error-handling on downloading the firmware..!?
It rebooted with a WLAN "sonoff-2152", I configured my AP-parameters, then switched the mode to "Blitzwolf SHP2" and then it worked like a charm (see https://www.bastelbunker.de/gosund-sp111-mit-tasmota/).
I didn´t calibrate measurement because currently not interested in it.
You can close the "issue" - just wanted to say thank you. No soldering needed - china-cloud eliminated.
Maybe it's worth taking a look at https://unix.stackexchange.com/questions/27428/what-does-backquote-backtick-mean-in-commands
I successfully flashed this device with tuya-convert but now it is not working.
I setup the "Module type" to be "Tuya Dimmer (54)" but Tasmota will not talk to the switch. The buttons on the front of the switch still work but no connection to the Tasmota interface. Tasmota does not see any change from the buttons. Also, the green led is constantly flashing.
Any help would be great. And thanks for the hard work on this project!!
CE Costco Dimmers
Flushed successfully Gosund SP111 with Raspberry Pi 3B with Raspbian Stretch but it worked only one way, I could not undo. Also button does not work any more? Any ideas?
Successfully flashed this smart plug, EU:
https://www.amazon.de/gp/product/B07D5V139R/
Used default Teckin module available in Tasmota.
The sonoff-minimal firmware isn't intended as an initial install.
The documentation on the site states:
sonoff-minimal.bin = The Minimal version allows intermediate OTA uploads
to support larger versions and does NOT change any persistent parameter.
This version should NOT be used for initial installation.
I think the minimal gets all of its configuration information from the previous install of a sonoff-tasmota firmware but since at this point there is no previous install it wont do anything and as a result the device may get bricked.
I successfully flashed three of these...
https://www.amazon.com/gp/product/B07GRLQV47/ref=ppx_yo_dt_b_asin_title_o02__o00_s00?ie=UTF8&psc=1
However, I bricked the third one when I selected "Generic" module type and saved. It never recovered from the reboot.
Lesson learned. I will wait right here until I understand better how to pick which module type.
Thanks in advance!
After the restart the bulb is flashing on and off. No sonoff-xx AP but the bulb is still connecting to the AP. Have attempted to reset it using the turn off and on process but it does do anything.
Device Flash Log
...
b'read 0x000FF800 to 0x000FFBFF'
b'read 0x000FFC00 to 0x000FFFFF'
~/src/tuya-convert
======================================================
Getting Info from IoT-device
VTRUST-FLASH 1.0
(c) VTRUST GMBH https://www.vtrust.de/35c3/
READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: 3a709f
MAC: 80:7D:3A:3A:70:9F
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M QIO @ 40MHz
FlashChipId: 1440c8
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 0
system_upgrade_userbin_check: user2 0x81000
======================================================
Please make sure to note the correct SPI flash mode!
Installing an alternative firmware with the wrong flash mode will leave the ESP unable to boot!
Next steps:
1. To go back to the orginal software
# curl http://10.42.42.42/undo
2. Be sure the conversion software runs in user2
# curl http://10.42.42.42/flash2
3. Flash a third party firmware to the device
BE SURE THE FIRMWARE FITS THE DEVICE AND USES THE CORRECT FLASH MODE!
MAXIMUM SIZE IS 512KB
put or link it to ./files/thirdparty.bin
A minimal build of Sonoff-Tasmota v6.4.1 is already included in this repository.
# curl http://10.42.42.42/flash3
Alternatively let the device download and flash a file via HTTP:
# curl http://10.42.42.42/flashURL?url=http://10.42.42.1/files/thirdparty.bin
HAVE FUN!
pi@raspberrypi:~/src/tuya-convert $ curl http://10.42.42.42/flash2
Device is allready booting from userspace 2 (0x81000)pi@raspberrypi:~/src/tuya-convert $ curl http://10.42.42.42/flash3
Device should flash http://10.42.42.1/files/thirdparty.bin and restart
Web Log after restart
root@raspberrypi:~# screen -r
There are several suitable screens on:
18855.smarthack-smartconfig (24/01/19 09:16:18) (Detached)
18828.smarthack-mqtt (24/01/19 09:15:30) (Attached)
18722.smarthack-web (24/01/19 09:15:29) (Detached)
18599.smarthack-wifi (24/01/19 09:15:28) (Detached)
Type "screen [-d] -r [pid.]tty.host" to resume one of them.
root@raspberrypi:~# screen -r 18722
d3a3ac5d9&t=1451&sign=fa9b8c5bfa1ade0bb18ddab4544168fb (10.42.42.39) 7.60ms
URI:/gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1466&sign=746562e93cd5d1d6fe7755146caf19b1
WARN: unknown request: s.gw.dev.timer.count (/gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1466&sign=746562e93cd5d1d6fe7755146caf19b1)
[I 190124 09:35:49 web:2162] 200 POST /gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1466&sign=746562e93cd5d1d6fe7755146caf19b1 (10.42.42.39) 5.29ms
URI:/gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1481&sign=2a2a4877765edb38ec500e8a450b7264
WARN: unknown request: s.gw.dev.timer.count (/gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1481&sign=2a2a4877765edb38ec500e8a450b7264)
[I 190124 09:36:04 web:2162] 200 POST /gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1481&sign=2a2a4877765edb38ec500e8a450b7264 (10.42.42.39) 5.34ms
URI:/gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1496&sign=a8a30b0b117b79db84431592801688d3
WARN: unknown request: s.gw.dev.timer.count (/gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1496&sign=a8a30b0b117b79db84431592801688d3)
[I 190124 09:36:19 web:2162] 200 POST /gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1496&sign=a8a30b0b117b79db84431592801688d3 (10.42.42.39) 5.10ms
URI:/gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1511&sign=fa6315e64c5fbe594b4f0ea1ce0059c2
WARN: unknown request: s.gw.dev.timer.count (/gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1511&sign=fa6315e64c5fbe594b4f0ea1ce0059c2)
[I 190124 09:36:34 web:2162] 200 POST /gw.json?a=s.gw.dev.timer.count&gwId=14682127807d3a3ac5d9&t=1511&sign=fa6315e64c5fbe594b4f0ea1ce0059c2 (10.42.42.39) 5.33ms
mqtt log after restart
1548322179: Sending PINGRESP to 14682127807d3a3ac5d9
1548322239: Received PINGREQ from 14682127807d3a3ac5d9
1548322239: Sending PINGRESP to 14682127807d3a3ac5d9
1548322299: Received PINGREQ from 14682127807d3a3ac5d9
1548322299: Sending PINGRESP to 14682127807d3a3ac5d9
1548322359: Received PINGREQ from 14682127807d3a3ac5d9
1548322359: Sending PINGRESP to 14682127807d3a3ac5d9
1548322419: Received PINGREQ from 14682127807d3a3ac5d9
1548322419: Sending PINGRESP to 14682127807d3a3ac5d9
1548322479: Received PINGREQ from 14682127807d3a3ac5d9
1548322479: Sending PINGRESP to 14682127807d3a3ac5d9
1548322539: Received PINGREQ from 14682127807d3a3ac5d9
1548322539: Sending PINGRESP to 14682127807d3a3ac5d9
1548322599: Received PINGREQ from 14682127807d3a3ac5d9
1548322599: Sending PINGRESP to 14682127807d3a3ac5d9
1548322659: Received PINGREQ from 14682127807d3a3ac5d9
1548322659: Sending PINGRESP to 14682127807d3a3ac5d9
1548322719: Received PINGREQ from 14682127807d3a3ac5d9
wifi log
Failed to create interface mon.wlan0: -95 (Operation not supported)
wlan0: Could not connect to kernel driver
Using interface wlan0 with hwaddr b8:27:eb:c4:1f:ad and ssid "vtrust-flash"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED
wlan0: STA 80:7d:3a:3a:c5:d9 IEEE 802.11: associated
wlan0: AP-STA-CONNECTED 80:7d:3a:3a:c5:d9
wlan0: STA 80:7d:3a:3a:c5:d9 RADIUS: starting accounting session 5C498231-00000000
wlan0: STA 80:7d:3a:3a:c5:d9 WPA: pairwise key handshake completed (RSN)
wlan0: STA <my mobile mac address> IEEE 802.11: associated
wlan0: AP-STA-CONNECTED <my mobile mac address>
wlan0: STA <my mobile mac address> RADIUS: starting accounting session 5C498231-00000001
wlan0: STA <my mobile mac address> WPA: pairwise key handshake completed (RSN)
wlan0: STA <my mobile mac address> WPA: group key handshake completed (RSN)
wlan0: STA 80:7d:3a:3a:c5:d9 WPA: group key handshake completed (RSN)
wlan0: STA 80:7d:3a:3a:c5:d9 WPA: group key handshake completed (RSN)
I successfully flashed Tasmota onto a Geekbes plug. Model is: YM-WS-1. I bought it in the US.
In the Tasmota Configuration I used the Generic module and set:
GPIO 14: Relay1 (21)
I'm having trouble getting the device button to work to turn outlet on/off.
Flash size is 1024kB
I've seen a couple people stating they put in the wrong password or SSID in their plug which caused the plug get stuck looking for this wrong WiFi network. To fix this issue I would suggest that the sonoff-basic.bin not be used from Tasmota's page and a similar bin be used for this.
Compile the bin file with the sonoff-basic options is fine except in the my_user_config.h the line
#define WIFI_CONFIG_TOOL WIFI_RETRY
Needs to be changed to
#define WIFI_CONFIG_TOOL WIFI_MANAGER
This will effectively stop people from "bricking" their devices (I use the term loosely as technically it is alive, just looking for the wrong wifi)
Successfully flashed BlitzWolf® BW-SHP6 . Internally same as BlitzWolf® BW-SHP2 and Gosund-SP1. Espurna has working binaries. for BW-SHP2 which can be flashed to the BW-SHP6.
Currently I have 4 BW-SHP6 working.
Hi, I was messing with my tuya light bulb and this project and after a few failed attempts I managed to stop the script while it was running...
Log from smarthack-web.log
Listening on port 80
Listening on port 80
URI:/gw.json?a=s.gw.token.get&gwId=02200075dc4f220c2fcb&other={"token":"00000000","region":"EU","tlinkStat":{"configure":"smartconfig","time":6,"source":"ap","path":"broadcast"}}&t=372&v=3.0&sign=c99de4d3461f3b466efd1ba0f1a55a88
Answer s.gw.token.get
[I 190130 10:50:10 web:2162] 200 POST /gw.json?a=s.gw.token.get&gwId=02200075dc4f220c2fcb&other={"token":"00000000","region":"EU","tlinkStat":{"configure":"smartconfig","time":6,"source":"ap","path":"broadcast"}}&t=372&v=3.0&sign=c99de4d3461f3b466efd1ba0f1a55a88 (10.42.42.28) 3.29ms
URI:/gw.json?a=s.gw.dev.pk.active&gwId=02200075dc4f220c2fcb&other={"token":"00000000"}&t=7&v=3.0&sign=c118cf20102a5f8332b4d3ace55b47e7
Answer s.gw.dev.pk.active
READ GW ID 02200075dc4f220c2fcb
TRIGGER UPGRADE IN 10 SECONDS
[I 190130 10:50:10 web:2162] 200 POST /gw.json?a=s.gw.dev.pk.active&gwId=02200075dc4f220c2fcb&other={"token":"00000000"}&t=7&v=3.0&sign=c118cf20102a5f8332b4d3ace55b47e7 (10.42.42.28) 8.43ms
Trigger upgrade in 10 seconds
URI:/gw.json?a=s.gw.update&gwId=02200075dc4f220c2fcb&t=9&v=2.0&sign=a60943c2c321ea7665207279b6a01925
Answer s.gw.update
[I 190130 10:50:13 web:2162] 200 POST /gw.json?a=s.gw.update&gwId=02200075dc4f220c2fcb&t=9&v=2.0&sign=a60943c2c321ea7665207279b6a01925 (10.42.42.28) 6.36ms
URI:/gw.json?a=atop.online.debug.log&gwId=02200075dc4f220c2fcb&t=7&sign=96197508b3e60f9247b28388107ca6b1
Answer atop.online.debug.log
[I 190130 10:50:14 web:2162] 200 POST /gw.json?a=atop.online.debug.log&gwId=02200075dc4f220c2fcb&t=7&sign=96197508b3e60f9247b28388107ca6b1 (10.42.42.28) 6.89ms
80db9143c2545851906b78fc76881a36
b'2.1c2545851906b78fct5inCMDHpcJKQpxfOe2RbXd/UiyzGDknxQnzqPqY7WDxwxjl9xf/QJTcIYRl2uIkJsm5uMafEvnzLLz/1MQ4vzedtTfWe7urVb6lQlYZk0Xdg4SXZL9kLEC9aqKXAOwI'
URI:/gw.json?a=s.gw.upgrade&gwId=02200075dc4f220c2fcb&t=14&sign=3b2c9f635db708460e020f7c94c59da7
Answer s.gw.upgrade
b'{"result":{"auto":3,"fileSize":"508475","etag":"0000000000","version":"9.0.0","url":"http://10.42.42.1/files/1.bin","md5":"88eaa4b09dc5a493a77adf0a41c87ba0"},"t":100,"e":false,"success":true}'
[I 190130 10:50:21 web:2162] 200 POST /gw.json?a=s.gw.upgrade&gwId=02200075dc4f220c2fcb&t=14&sign=3b2c9f635db708460e020f7c94c59da7 (10.42.42.28) 32.80ms
URI:/gw.json?a=s.gw.upgrade.updatestatus&gwId=02200075dc4f220c2fcb&t=100&sign=c0c7f5c0fb3e10b9406a861be62eace1
Answer s.gw.upgrade
b'{"result":{"auto":3,"fileSize":"508475","etag":"0000000000","version":"9.0.0","url":"http://10.42.42.1/files/1.bin","md5":"88eaa4b09dc5a493a77adf0a41c87ba0"},"t":100,"e":false,"success":true}'
[I 190130 10:50:21 web:2162] 200 POST /gw.json?a=s.gw.upgrade.updatestatus&gwId=02200075dc4f220c2fcb&t=100&sign=c0c7f5c0fb3e10b9406a861be62eace1 (10.42.42.28) 7.36ms
[I 190130 10:50:28 web:2162] 200 GET /files/1.bin (10.42.42.28) 4871.93ms
^CTraceback (most recent call last):
File "./fake-registration-server.py", line 132, in <module>
main()
File "./fake-registration-server.py", line 128, in main
tornado.ioloop.IOLoop.current().start()
File "/usr/local/lib/python3.5/dist-packages/tornado/platform/asyncio.py", line 132, in start
self.asyncio_loop.run_forever()
File "/usr/lib/python3.5/asyncio/base_events.py", line 421, in run_forever
self._run_once()
File "/usr/lib/python3.5/asyncio/base_events.py", line 1388, in _run_once
event_list = self._selector.select(timeout)
File "/usr/lib/python3.5/selectors.py", line 445, in select
fd_event_list = self._epoll.poll(timeout, max_ev)
KeyboardInterrupt
The bulb isn't giving any life signs. Is there any way I can unbrick it?
I'm trying to use this project, but I get stuck at the step where I need to connect to the vtrust-flash network. Using a couple different phones and a couple different computers, I'm never able to see the network listed.
I've tried running tuya-convert on an rPi 3 as well as an old netbook running Ubuntu. Never see the wifi network appear on any device when I'm scanning.
hello, thank you for this effort,
I started the process, bit i think i bricked my devices (i tried with tow)
first o had to modify the start_flash.sh, because there was an error in the 'screen' log, i changed
sudo screen -L -Logfile smarthack-wifi.log -S smarthack-wifi -m -d ./setup_ap.sh FOR
screen -L smarthack-wifi.log -S smarthack-wifi -m -d ./setup_ap.sh
then
./start_flash.sh with this result
OKVTRUST-FLASH 1.0
(c) VTRUST GMBH https://www.vtrust.de/35c3/
READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: c8fa34
MAC: 68:C6:3A:C8:FA:34
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M QIO @ 40MHz
FlashChipId: 1440a1
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 0
system_upgrade_userbin_check: user2 0x81000
curl http://10.42.42.42 with this result
then
curl http://10.42.42.42/flash2
and then the device die and no answer to any bottom :)
Any suggestion ... thank you
Hi,
I successfully flashed this Lyasi bulb: Amazon Link
Tosmota requires small adaptations (GPIO pins have a different mapping to the LED controller) that I'm trying to get in, see arendst/Tasmota#1822
Some details for the Wiki:
Vendor | Socket-Type | Device Name | Vendors device ID | GPIOs | Notes | 2nd MCU | Flash size/mode |
---|---|---|---|---|---|---|---|
Lyasi | E27 | ?? | ?? | DI=GPIO4,DCKI=GPIO5 | https://www.amazon.de/gp/product/B07KYGDS3P | ? | 1048576/1M QIO |
I have two "utorch LE7" ->https://www.gearbest.com/smart-lighting/pp_009633100556.html
They can be configured via the tuya app. When I start the flash ("start_flash.sh"), the bulb leaves the configuration state (red blinking turns into constant white) but the script does not progress any further. It keeps printing dots.
Has anyone the same problem, with other brands?
My intent was to use one of my existing pi's. Of the three, I choose the one running node-red. Not a huge deal, I monitored my node-red env to ensure no conflicts happened. Well, I do have a conflict, it's my existing mqtt broker that runs within node-red.
Please advise which resolution / option would be better:
The ability to back up and undo is fantastic, great work. Do you plan on open sourcing 1.bin?
There is no need to change this firmware -> if you have used the basic build and just hard coded the wifi credentials. Setup wifi ssid2 and wifi pwd2 with needed values in web console.
After restart Tasmota will try to connect to both APs. Even changing ssid1 and pwd1 is possible
but not recommended if you do a typo error you are unlucky...
If the user wants to reflash with a other build there is still NO need to flash minimal version.
Just do a OTA upgrade from http://thehackbox.org/tasmota/release/sonoff.bin
Tasmota loads itself the needed minimal version and finally the target firmware.
Just let the device alone and wait until webfrontend is back again (OTA magic).
curl http://10.42.42.42/flash3
in der Konsole aus. Die vorläufige Firmware lädt die Datei herunter und schreibt sie in den Flash-Speicher. Aufgrund der limitierten Größe der möglichen Firmwares, stellen wir zur Installation eine speziell angepasste Variante von Sonoff-Tasmota bereit. Diese Variante verbindet sich nach dem erfolgreichen Flashen zunächst mit dem Access-Point des Raspi.
Um die IP-Adresse des Tuya-Gerätes nach dem Flash-Vorgang zu identifizieren, bietet sich ein Netzwerkscanner fürs Smartphone wie etwa die HE.NET Network Tools oder Fing. Haben Sie die IP herausgefunden, greifen Sie auf das Webinterface des Geräts zu und können von dort ein Sonoff-Tasmota Minimal-Image flashen um schlussendlich ein normales Tasmota-Image aufzuspielen. Wir arbeiten noch einer Vereinfachung dieser Prozedur.
These were flashed successfully. https://www.amazon.com/gp/product/B07GRLQV47/
Note: Doing three in a row, it didn't appear as if the 2nd and 3rd plug was backed up. I wasn't sure if that was intended, just wanted to raise that scenario here.
Successfully flashed Tasmota onto Hama 176533, which is a 16A socket outlet.
With the Sonoff Basic module configuration everything works fine, except the button on the device has no function.
I have tried some other profiles. When using ESP Switch (50)
the button does toggle on and off. But the state is inverted, and besides that this profile seems to provide 4 toggles in the UI. The 4. one is the one that reacts (inverted). I think this might be the relevant code in Tasmota: https://github.com/arendst/Sonoff-Tasmota/blob/dc75b473cff67320292eb8e3e7e5830e2b5850b1/sonoff/sonoff_template.h#L1474
Does this information help to get the device fully functional? Which other steps can I take to provide more useful information?
I followed all the steps described in this video to flash this firmware to one of my outlets (looks like this)
sudo apt-get update
sudo apt-get dist-upgrade
sudo apt-get install network-manager
sudo apt install git
wget https://nodejs.org/dist/v10.15.0/node-v10.15.0-linux-armv6l.tar.xz (to install npm as install_prereq script requires this)
tar -xJf node-v10.15.0-linux-armv6l.tar.xz
pi@raspberrypi:~/node-v10.15.0-linux-armv6l $ sudo cp -R * /usr/local/
git clone https://github.com/ct-Open-Source/tuya-convert
cd tuya-convert
./install_prereq.sh
./start_flash.sh
Connected to 'vtrust-flash' access point
Paired the outlet
curl http://10.42.42.42/flash3
connected to sonoff-xxxx access point from another device
browsed to 192.168.4.1
scan for wifi networks
selected my router's Wifi access point
At the last step I accidentally forgot to enter password (I thought password was populated in the API Password field) and clicked 'Save'
Now I can't ping to 10.42.42.42.
I tried all following methods but none worked.
Addl info:
Starting pairing procedure in screen
RTNETLINK answers: File exists
Waiting for the upgraded device to appear
If this does not work have a look at the '*.log'-files in the 'scripts' subfolder!
.............................
IoT-device is online with ip 10.42.42.42
Fetching firmware backup
Create backup of entire FLASH from 10.42.42.42
Connected... Flashsize= 1048576
======================================================
Getting Info from IoT-device
VTRUST-FLASH 1.0
(c) VTRUST GMBH https://www.vtrust.de/35c3/
READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: 4ce0c0
MAC: xx:xx:xx:xx:xx:xx
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M DOUT @ 40MHz
FlashChipId: 1440a1
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 3
system_upgrade_userbin_check: user2 0x81000
pi@raspberrypi:~/tuya-convert/scripts $ uname -a
Linux raspberrypi 4.14.79-v7+ #1159 SMP Sun Nov 4 17:50:20 GMT 2018 armv7l GNU/Linux
pi@raspberrypi:~/tuya-convert/scripts $ npm -v
6.4.1
pi@raspberrypi:~/tuya-convert/scripts $ node -v
v10.15.0
I noticed this message when I ran install_prereq.sh script. This message was still shown even after I installed node-v10.15.0-linux-armv6l.tar.xz binary.
You appear to be running on ARMv6 hardware. Unfortunately this is not currently supported by the NodeSource Linux distributions. Please use the 'linux-armv6l' binary tarballs available directly from nodejs.org for Node.js 4 and later.
Is this outlet dead in the water?
Thank you !
i checked with 2 different devices, newest git.
changed ssid, password in the config.txt
client device (iphone, notebook) says : bad password
using kali-linux to flash
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.