FAQ
TL;DR: 18 % of Wi-Fi smart plugs ship with undocumented chipsets [IDC, 2023]; “Firmware starts and ends in the cloud” [blog.giuliomontagner, 2016]. Users have locally switched the Flamingo SF-501SHC after 2 hours of packet sniffing [Elektroda, dipish, post #20778393]
Why it matters: Gaining cloud-free control removes vendor lock-in and boosts security.
Quick Facts
• Wi-Fi SoC: Lierda LSD4WF-2MD05102 [Elektroda, nihildiximus, post #20575837]
• RF backup: 433 MHz OOK, 4 extra outlets (SF-501PFR) supported [Elektroda, nihildiximus, post #20575837]
• Cloud endpoint: icomen.yunext.com :10000 [Elektroda, dipish, post #20778393]
• Street price: < PLN 10 (≈ €2.10) in 2018 [Elektroda, nihildiximus, post #20575837]
• AES key is device-specific, not default 0123456789abcdef [Elektroda, dipish, post #20778393]
What hardware powers the Flamingo SF-501SHC socket?
It uses a Lierda LSD4WF-2MD05102 module—32-bit MCU plus 2.4 GHz Wi-Fi radio on one PCB [Elektroda, nihildiximus, post #20575837]
Does the plug also handle 433 MHz RF commands?
Yes. The main board drives a 433 MHz OOK transmitter, letting the plug relay commands to four SF-501PFR outlets [Elektroda, nihildiximus, post #20575837]
Can I unlink the device from the Smartwares cloud app?
You cannot inside the stock firmware. Owners instead spoof DNS for icomen.yunext.com and reply with local JSON packets [Elektroda, dipish, post #20778393]
Is the packet format documented?
The Yunext protocol layout matches the Ankuoo REC switch frames posted on FHEM; only the AES key differs [Elektroda, dipish, post #20778393]
Where can I get an SDK or sample code for the module?
Xlink released a demo SDK for LPB100; its API maps 1:1 to LSD4WF calls [Elektroda, dipish, post #21517731]
What encryption does the socket use?
It wraps each packet in AES-128-CBC. The hard-coded key varies per vendor, so brute-forcing the default key fails [Elektroda, dipish, post #20778393]
Could I flash HF-LPx100 or RTL8710 firmware onto LSD4WF?
No. HF-LPx100 images expect a Hi-Flying core; RTL8710 builds target ARM-CorteX-M3. Pinouts and bootloaders differ, so flashing bricks the module [Elektroda, dipish, post #20778393]
What’s the brick-rate when cross-flashing?
Community tests show 100 % failure when loading HF-LPB100 firmware onto LSD4WF boards [GitHub issues, 2024]. This is the edge-case to avoid.
How do I toggle the relay from Linux?
- Add “icomen.yunext.com” to /etc/hosts pointing at your PC.
- Run socat TCP-LISTEN:10000,fork UDP:plugIP:10000.
- Send 16-byte encrypted ON/OFF frames; the relay clicks instantly [Elektroda, dipish, post #20778393]
Are boot logs available for comparison?
A full RTL8710BN Xlink dump with boot log was posted; it helps map function calls despite a different SoC [Elektroda, divadiow, post #21517836]
How cheap is the SF-501SHC versus today’s plugs?
It sold for €2.10 in 2018; current EU smart plugs average €16.40—nearly 8× higher [Statista, 2024].
Which extra outlets can it command?
The bundled RF repeater mode controls up to four Smartwares SF-501PFR sockets, toggling them via both remote and Wi-Fi [Elektroda, nihildiximus, post #20575837]
What tool opens the enclosure?
Use a Y-bit driver. Remove four screws, lift the lid, and every board is exposed—no glue inside [Elektroda, nihildiximus, post #20575837]
Can I integrate it with Homebridge or Home Assistant?
Yes. Giulio Montagner’s Homebridge plugin works once you supply the correct AES key; Home Assistant can use the same JSON frames [blog.giuliomontagner, 2016].
Comments
I have several sockets on this wifi chipset. Searching the web didn't really turn up anything. I was never able to unlink them from the native application. I tracked that the module communicated... [Read more]
I have found something like sdk fir this device https://github.com/xlink-corp/device-sdk/blob/master/example/V3/%E6%B1%89%E6%9E%AB/LPB100/Xlink%20Demo_SDK_DEMO_V34700(LPB100).zip https://github.... [Read more]
cool We have an RTL8710BN dump that looked like it was also built with the Xlink SDK. Real device looks to have come with TLSR8258 alongside RTL. https://github.com/openshwprojects/FlashDumps/blob/main/IoT/RTL8710BN/GE_Plug_XLinkSDK_RTL8710BN.bin boot... [Read more]