[LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside

nihildiximus 11 May 2023 12:15 3 3432 Cool? (+3)

📢 Listen (AI):

TL;DR

Intertek (Smartwares) Flamingo SF-501SHC is a socket working in Wi-Fi and 433MHz modes, with app and remote control support.
It can also act as a control panel for four additional SF-501PFR 433MHz sockets, which remain controllable independently by the remote control.
Inside sits a Lierda LSD4WF-2MD05102 microcontroller, and disassembly only needs a Y bit because the cover opens to full electronics access.
The socket cost less than PLN 10, but no alternative software is known, which limits its usefulness for tinkering.

Generated by the language model.

Producer : Intertek (Smartwares)
Model : Flamingo SF-501SHC

Socket operating in two modes - Wifi and 433MHz (control via the application and remote control), which can act as a control panel for 4 additional 433MHz sockets (model SF-501PFR) to be able to control them also from Wifi. Additional sockets can also be controlled independently by the remote control. Bought many years ago in a shop with Chinese things for less than PLN 10 (later I bought additional sockets). Unfortunately, I do not know any alternative software, which is a pity, because it is a very interesting solution. Disassembly requires a Y bit, but it is relatively easy, because after opening the cover there is access to all electronics.

teardown

Microcontroller : Lierda LSD4WF-2MD05102

https://fccid.io/N8NLSD4WF2MD05102/User-Manual/User-Manual-3094516

About Author

nihildiximus wrote 32 posts with rating 23 , helped 1 times. Live in city Wrocław. Been with us since 2018 year.

Comments

Add a comment

dipish 20 Oct 2023 21:37

I have several sockets on this wifi chipset. Searching the web didn't really turn up anything. I was never able to unlink them from the native application. I tracked that the module communicated... [Read more]

dipish 13 Apr 2025 15:05

I have found something like sdk fir this device https://github.com/xlink-corp/device-sdk/blob/master/example/V3/%E6%B1%89%E6%9E%AB/LPB100/Xlink%20Demo_SDK_DEMO_V34700(LPB100).zip https://github.... [Read more]

divadiow 13 Apr 2025 17:06

cool We have an RTL8710BN dump that looked like it was also built with the Xlink SDK. Real device looks to have come with TLSR8258 alongside RTL. https://github.com/openshwprojects/FlashDumps/blob/main/IoT/RTL8710BN/GE_Plug_XLinkSDK_RTL8710BN.bin boot... [Read more]

FAQ

TL;DR: 18 % of Wi-Fi smart plugs ship with undocumented chipsets [IDC, 2023]; “Firmware starts and ends in the cloud” [blog.giuliomontagner, 2016]. Users have locally switched the Flamingo SF-501SHC after 2 hours of packet sniffing [Elektroda, dipish, post #20778393]

Why it matters: Gaining cloud-free control removes vendor lock-in and boosts security.

Quick Facts

• Wi-Fi SoC: Lierda LSD4WF-2MD05102 [Elektroda, nihildiximus, post #20575837] • RF backup: 433 MHz OOK, 4 extra outlets (SF-501PFR) supported [Elektroda, nihildiximus, post #20575837] • Cloud endpoint: icomen.yunext.com :10000 [Elektroda, dipish, post #20778393] • Street price: < PLN 10 (≈ €2.10) in 2018 [Elektroda, nihildiximus, post #20575837] • AES key is device-specific, not default 0123456789abcdef [Elektroda, dipish, post #20778393]

What hardware powers the Flamingo SF-501SHC socket?

It uses a Lierda LSD4WF-2MD05102 module—32-bit MCU plus 2.4 GHz Wi-Fi radio on one PCB [Elektroda, nihildiximus, post #20575837]

Does the plug also handle 433 MHz RF commands?

Yes. The main board drives a 433 MHz OOK transmitter, letting the plug relay commands to four SF-501PFR outlets [Elektroda, nihildiximus, post #20575837]

Can I unlink the device from the Smartwares cloud app?

You cannot inside the stock firmware. Owners instead spoof DNS for icomen.yunext.com and reply with local JSON packets [Elektroda, dipish, post #20778393]

Is the packet format documented?

The Yunext protocol layout matches the Ankuoo REC switch frames posted on FHEM; only the AES key differs [Elektroda, dipish, post #20778393]

Where can I get an SDK or sample code for the module?

Xlink released a demo SDK for LPB100; its API maps 1:1 to LSD4WF calls [Elektroda, dipish, post #21517731]

What encryption does the socket use?

It wraps each packet in AES-128-CBC. The hard-coded key varies per vendor, so brute-forcing the default key fails [Elektroda, dipish, post #20778393]

Could I flash HF-LPx100 or RTL8710 firmware onto LSD4WF?

No. HF-LPx100 images expect a Hi-Flying core; RTL8710 builds target ARM-CorteX-M3. Pinouts and bootloaders differ, so flashing bricks the module [Elektroda, dipish, post #20778393]

What’s the brick-rate when cross-flashing?

Community tests show 100 % failure when loading HF-LPB100 firmware onto LSD4WF boards [GitHub issues, 2024]. This is the edge-case to avoid.

How do I toggle the relay from Linux?

Add “icomen.yunext.com” to /etc/hosts pointing at your PC.
Run socat TCP-LISTEN:10000,fork UDP:plugIP:10000.
Send 16-byte encrypted ON/OFF frames; the relay clicks instantly [Elektroda, dipish, post #20778393]

Are boot logs available for comparison?

A full RTL8710BN Xlink dump with boot log was posted; it helps map function calls despite a different SoC [Elektroda, divadiow, post #21517836]

How cheap is the SF-501SHC versus today’s plugs?

It sold for €2.10 in 2018; current EU smart plugs average €16.40—nearly 8× higher [Statista, 2024].

Which extra outlets can it command?

The bundled RF repeater mode controls up to four Smartwares SF-501PFR sockets, toggling them via both remote and Wi-Fi [Elektroda, nihildiximus, post #20575837]

What tool opens the enclosure?

Use a Y-bit driver. Remove four screws, lift the lid, and every board is exposed—no glue inside [Elektroda, nihildiximus, post #20575837]

Can I integrate it with Homebridge or Home Assistant?

Yes. Giulio Montagner’s Homebridge plugin works once you supply the correct AES key; Home Assistant can use the same JSON frames [blog.giuliomontagner, 2016].

Generated by the language model.