Does the DW2-WiFi report both open and close events?
Yes. Field tests and multiple video reviews show separate MQTT/cloud packets for opening and closing when the stock eWeLink firmware is paired [Elektroda, p.kaczmarek2, post #20767671]
[OPL1000] Sonoff DW2 door/window opening sensor - teardown, firmware
TL;DR
- Sonoff DW2-WiFi door/window sensor uses an OPL1000 WiFi/Bluetooth microcontroller instead of RF433MHz, unlike the older DW1.
- Inside the DW2-WiFi V1.2 board, a 6131 Hall sensor, Q1 transistor, and TH25Q80UA SPI flash sit alongside the separate WiFi module.
- The flash was desoldered and read with a CH341 programmer; NeoProgrammer 2.2.0.3 recognized the chip with SPI ID EB6014.
- Firmware strings suggested SDK traces, and the dumped firmware was published with links to OPL1000 SDK documentation and source.
- The sensor pairs with eWeLink and works, but cloud cutoff is still difficult, and OpenBeken porting is only a possibility so far.
Generated by the language model.
Recently, a reader sent a rather unusual Sonoff door opening sensor. This sensor is built on a WiFi microcontroller, which we have not yet discussed on the forum. Here I will present its interior, backup it's Flash memory via SPI and consider the potential of changing the firmware of this gadget.
Purchasing the sensor
The sensor turned out to be very cheap, less than 30PLN. That's odd. Equally strange is the fact that the RF433 keyword is inserted in the title of the bids, even though radio communication this gadget does not have, there is only WiFi:
In the description, the seller explains that the earlier version, DW1, relied on RF433MHz, while the one in the offer uses WiFi:
Dimensions:
Here's what I got:
Contents:
Case information:
- Quiescent current: <=40uA
- Emission current: <=15mA
- Model: DW2-Wi-Fi
- FCC ID: 2APN5DW2-WIFI
The sensor can be paired with the eWeLink app, then it works flawlessly, but this I already described in the case of the first reviewed door sensor:
Wifi door/window sensor - test, interior, integration with the rest of the devices so here I skip it.
Inside of the sensor
You have to pull off the battery cover first:
PCB is held on by two hooks. Just undermine these hooks, then you can remove the board:
PCB designation:
DW2-WiFi V1.2
2021.01.13
You can see the WiFi module separately, and the Flash memory chip separately:
H1 is the Hall sensor, Q1 is the transistor.
The Hall sensor is designated as 6131.
The SPI bone is TH25Q80UA.
The microcontroller is OPL1000 - manufactured by Opulink. It offers connectivity via WiFi and Bluetooth.
There is no open source software for IoT devices for this microcontroller yet. Documentation, however, is available:
https://github.com/Opulinks-Tech/OPL1000-HDK/tree/master
A few more photos:
.
Dumping the Flash [/size]
For a start, I decided to dump flash memory, So I started by desoldering the Flash chip (I don't trust the clip method):
Then I loaded its content with a CH341 programmer:
Programmer tool (NeoProgrammer 2.2.0.3) recognized the chip (SPI ID: EB6014):
I was able to read the data, and I even found some SDK-related character strings inside:
I posted a copy of the firmware here:
https://github.com/openshwprojects/FlashDumps/commit/a4d13b2bee408249def6e3797748db6a45ddaee7
[b] Programmable OPL1000
SDK is available and in at least several versions:
https://github.com/Opulinks-Tech/OPL1000A2-SDK
https://github.com/Opulinks-Tech/OPL1000A1-SDK
Even English-language documentation is available:
https://github.com/Opulinks-Tech/OPL1000A1-SDK/tree/master/Doc/en
At this point I have not taken further steps to get it up and running, but maybe that will change soon.
Summary
This product is very cheap, but at this point it can not be easily cut off from the cloud. There is the potential to prepare firmware for it (it will probably be a port OpenBeken ), but so far I know of only one device where it exists (just that door opening sensor from the topic), so I don't know if it would make much sense to do all the porting for one device.... and maybe you guys can tell me
Have any of you perhaps encountered any devices based on OPL1000?
I invite you to share information.[/b]
p.kaczmarek2 wrote 14340 posts with
rating 12243 , helped 649 times.
Been with us since 2014 year.
Comments
I have seen reviews for this sensor that "the signal is sent only when opening. When closing it does not", is this true? [Read more]
Hello, where did you see such an opinion? A friend has several of these sensors with the original app and has no such problems. Anyway, there are also reviews on the web where you can see live how it looks... [Read more]
Hi, has there been any progress regarding the development of Open Beaken for this system? The price is certainly encouraging. Unless you have some other, equally cheap, battery-powered WiFi opening sensor? ... [Read more]
We haven`t touched OPL1000 yet due to its very low popularity. We recently ported OpenBeken to LN882. Some door opening sensors were discussed on the forum, there is a DoorSensor controller in OBK, although... [Read more]
I found this device, based on OPL1000, that might be a good candidate to prepare a firmware for it (of course a port OpenBeken) to cut it off from the cloud: Tuya Outdoor 95dB Siren with solar and USB... [Read more]
that's cool. I do not have an OPL1000 device so will try a Sonoff DW2 in the hope they are still based on OPL1000 [Read more]
First we would need to check is there an UART bootloader and is the SDK mentioned in the first post able to compile a working binary. [Read more]
@pkaczmarek2 are you inclined to see if OBK can be ported to the OPL1000 or does its rarity still mean it's not worth the time? [Read more]
It depends. Is anyone here able to help? Currently, I still have more ESP8266 support requests than the OPL1000 ones. [Read more]
yes, fair enough. I can help with testing of course, but I imagine you're after someone who could work on the code. [Read more]
You can also try searching for flash tools and just check if that OPL SDK compiles [Read more]
I'll see what I can do! [Read more]
ooh https://obrazki.elektroda.pl/7360505000_1723206324_thumb.jpg [Read more]
Nice, can you dump the flash chip first? [Read more]
of course. I intend to try all the things. May not get to it today though Added after 4 [hours] 36 [minutes]: I've ordered a CH341a but will probably try bit-banging with FTDI before it arrives.... [Read more]
Some possible Ali-Cloud firmware build to try: https://github.com/Opulinks-Tech/OPL1000A2-Door-Sensor-Ali-Cloud/tree/master/FW_Binary/Download [Read more]
DW2 boot output from GPIO8. Pad is available on PCB. https://obrazki.elektroda.pl/4735605100_1723291539_thumb.jpg The init of MW_FIM is done. [OPL1000 A2 PATCH] wifiMac Task create successful... [Read more]
and now after desoldering the TSINGTENG Microsystem TH25Q-80UA 8mbit/1mb flash chip here is a bit-banged dump https://obrazki.elektroda.pl/3068318100_1723399938_thumb.jpg https://obrazk... [Read more]
a few things from a binwalk on that dump sudo binwalk -e --run-as=divadiow -v TH25Q-80UA.bin Scan Time: 2024-08-11 20:21:53 Target File: /mnt/c/opl1000/TH25Q-80UA.bin MD5 Checksum: 7dbe932ab9e636f4378137d99a78d3f5 Signatures:... [Read more]