£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

divadiow 05 May 2026 18:47 24 1413 Cool? (+6)

📢 Listen (AI):

TL;DR

A Re-Use shop haul turned up four smart bulbs: IKEA Tradfri E27 LED2003G1, Ener-J SHA5262 WiFi A60, an unmarked PIR E27/A60, and an unbranded RGBWW BLE+2.4G.
The unbranded bulb is a Zengge design using a YiChip YC1166 MCU, an SM2135EH LED driver, and a BY4-M5 V1.1 module.
The shop sold the bulbs for £1 for 4, or 25p each.
Pairing was unreliable: rapid on-off-on-off-on-off sometimes enabled setup, only the Zengge app found it, and it stopped responding after a couple of toggles.

Generated by the language model.

In the city where I live we have "Re-Use" shops alongside standard recycling centres (aka tips, dumps, household waste disposal facilities). These re-use centres are packed with donations and finds that would otherwise have gone into the general waste or recycled. Of course there's some stuff for sale that should probably have been binned, but a lot is fairly decent.

This Re-Use centre in particular has 6 drawers of light bulbs.

and at £1 for 4 bulbs, £0.25p each, there's potential to find some interesting smart bulbs in amongst the boring fluorescent or incandescent mix for a bargain price

I found my 4. There didn't appear to be any more worth having.

1 Ikea Tradfri E27 LED2003G1
1 Ener-J Smart WiFi A60 SHA5262 9w
1 unmarked E27/A60 with PIR dome
1 unbranded 10w RGBWW BLE+2.4G

I started with the generic RGBWW BLE+2.4G

This is Zengge device with YiChip YC1166 MCU at its heart on a module marked

BY4-M5 V1.1

.

YC1166 Yichip Microelectronics (Hangzhou) Co., Ltd.

Radio:
Bluetooth 5.0 BR/EDR/BLE
Also described as supporting proprietary 2.4 GHz operation
2.4 GHz ISM band, single-ended RFIO
Advertised data rates: 250 kbps, 1 Mbps, 2 Mbps, 3 Mbps
BLE sensitivity quoted around -95 dBm
TX power quoted up to +9 dBm

CPU / architecture:
Dual-core digital architecture
Application core: ARM Cortex-M0, up to 48 MHz
Link-management core: 32-bit custom/RISC core
M0 memory listed as 16 KB Data RAM + 16 KB cache / code RAM
Link core memory listed as 80 KB ROM, 64 Kbit OTP, 8 KB patch RAM and 8 KB data RAM

Flash / storage:
Internal QSPI-connected 4 Mbit/512 KB internal flash

On the LED disc we have an SM2135EH - a 5-channel intelligent dimming LED constant current driver for low power LEDs. The DAT/CLK pads on the rear of the bulb's main PCB unfortunately go to the SM2135H and don't appear to be for use in programming the YC1166, which seems to use some proprietry single-wire protocol. Yichip bluetooth MCUs are programmed through the dedicated ICE/IO31 pin.

I've not found much about this ICE pin apart from that a Yichip programmer has appeared on Ali Express before https://www.digitalworldz.co.uk/threads/yichip-programming.477322/post-2786057

To my surprise IO31 had a debug log out at 921600 baud:

interesting, "PPlus_SUCCESS" is seen in PHY code.

For the bulb's operation, pairing mode seem to be achievable with rapid on-off-on-off-on-off action, but even then it was pretty hit-and-miss.

Only the "Zengge" named app of all the Zengge-made apps seemed to pick it up. It would stop responding after a couple of on/offs.

nRF Connect

other markings:
ZJ-PWH-RGBWW-L2 V1.1
CH-323L-009A
ZJ-LB-BWPWH-RGBWW-L1

I'll work through the others next and post further updates as and when I can

Attachments:

YiChip_YC1166.pdf (1.27 MB) You must be logged in to download this attachment.

About Author

divadiow wrote 4912 posts with rating 873 , helped 430 times. Live in city Bristol. Been with us since 2023 year.

Comments

Add a comment

divadiow 06 May 2026 08:24

second bulb. let's get this potentially non-smart one out of the way. and .. it's a basic PIR LED bulb :( https://obrazki.elektroda.pl/6867927100_1778006288_thumb.jpg https://obrazki.elektroda.pl/4925990200_1778006289_thumb.jpg... [Read more]

p.kaczmarek2 06 May 2026 20:58

Very interesting, we don't have such place in my city. So, since YC1166 is Bluetooth chip, can our OBK BT ESP gateway see it? Was WB3L bulb already paired before? [Read more]

divadiow 06 May 2026 21:14

good question. I didn't check. I should play with btproxy release because I'm a little unclear of its setup/use, what its limitations are etc. yes the previous owner's AP SSID and password are... [Read more]

p.kaczmarek2 06 May 2026 23:37

I'm curious to see what you''find there! For those prices, it seems like a great deal. Do they have other smart devices, too? [Read more]

divadiow 07 May 2026 06:29

yes. bulbs seemed particularly cheap at that centre. Probably they needed to make them an attractive price so they aren't kept around for long, and the smart ones were just thrown in with the less interesting... [Read more]

p.kaczmarek2 07 May 2026 17:36

This way you can get WiFi modules cheaper with whole bulb than buying a WiFi module separately. Cool, did you find anything more interesting? [Read more]

divadiow 07 May 2026 18:01

Negative. One sad tray of standard bulbs today. Hardly any electronics. Disappointing. [Read more]

divadiow 08 May 2026 19:48

The TRÅDFRI LED2003G10 (Zigbee, E27 globe, 1055lm, 9.5W, white spectrum) was a pain to get into. I had to get brutal and the externals of the device suffered for it. https://obrazki.elektroda.pl/4331128500_1778255391_thumb.jpg... [Read more]

divadiow 09 May 2026 19:52

1 find today in amongst all these bulbs https://obrazki.elektroda.pl/3809610700_1778344540_bigthumb.jpg A Teckin SB50 - ESP8266EX 1mb RGBW E27 bulb https://obrazki.elektroda.pl/1868892700_1778344583_thumb.jpg... [Read more]

p.kaczmarek2 09 May 2026 22:35

I didn't know there are EFR32MG21-based Zigbee chips! That's a very interesting read. I did some EFR32 experiments in the past, or... I think it was EFM32ZG222F32 . -> https://www.elektroda.pl/rtvforum/topic3861433.html Regarding... [Read more]

divadiow 10 May 2026 08:02

I think it's because they're initialised one by one and not in a group at once testing https://github.com/openshwprojects/OpenBK7231T_App/compare/main...divadiow:OpenBK7231T_App:8266_pwm#diff-8d6dbc8137c71c27180a169e3af3756ac03e60a57480fd07d81efeab410c3d2eR453 ... [Read more]

p.kaczmarek2 10 May 2026 09:28

To be sure, I can still change PWM roles at runtime? Is there live-rebuild? [Read more]

divadiow 10 May 2026 15:05

yes and yes. let me prove/demonstrate in a couple of hours Added after 5 [hours] 34 [minutes]: hmm not quite. changing PWM assignments will flash LEDs on save. Changes are effective but the flashing... [Read more]

p.kaczmarek2 10 May 2026 15:27

If it's just single LED flash on config save, then there is no issue, I guess? No one changes the device config during normal runtime/usage [Read more]

divadiow 10 May 2026 15:49

depends how many PWM changes are being saved at once. it's also different for template import, which sets each individually. I think it's fine, and to be honest, maybe not many people will be looking to... [Read more]

divadiow 11 May 2026 08:30

yeh, not going to pursue that further. it's already better now. It'll just have flashing LEDs on initial config if there are multiple PWMs being set. new branch, back to main fixes so multi-PWM works.... [Read more]

p.kaczmarek2 11 May 2026 11:26

Can we merge ESP8266 PWM fix? EFR, with R, probably stands for Radio? [Read more]

divadiow 11 May 2026 11:32

I'm petty happy with it. It's probably not perfect but it's functonal. Are you happy with the code? https://github.com/openshwprojects/OpenBK7231T_App/pull/2107 [Read more]

divadiow 17 May 2026 17:57

no break-throughs with the ICE protocol, but pulling apart the Zengge app XAPK reveals 4 OTA firmware blobs for Yichip bluetooth devices assets/5A_0052_2A_00.hex assets/ota/53_0033_20_00.hex assets/ota/53_0035_08_01.hex assets/ota/56_00AD_41_00.hex... [Read more]

FAQ

TL;DR: At £1 for 4 bulbs, "there's potential" to find hackable smart lighting in a Re-Use bin. This FAQ helps buyers and tinkerers separate real smart bulbs from lookalikes, identify YC1166, WB3L/BK7231T, and PIR-only designs, and spot pairing or previous-owner lock-in issues before spending time on a teardown. [#21897048]

Why it matters: Cheap second-hand bulbs can hide reusable Tuya or Bluetooth hardware, but the same bin can also contain non-smart PIR lamps and already-paired devices.

Bulb	What it turned out to be	Main silicon or clue	Practical result
IKEA Tradfri LED2003G1	Not yet covered in the shown teardown	Workbench teardown pending	Unknown from this thread
Ener-J SHA5262 9W	Tuya smart RGB CCT bulb	WB3L, BK7231T, PWM pins mapped	Good candidate for template-based reuse
Unmarked E27 with dome	Basic PIR LED bulb	MX8198H + 1A21-Z PIR sensor	Not a smart bulb
Unbranded RGBWW BLE+2.4G	Zengge smart bulb	YiChip YC1166 + SM2135EH	Pairs inconsistently and stops responding after power cycles

Key insight: The best low-cost finds are the bulbs with identifiable radio modules or debug output. A visible PIR dome usually signals a motion bulb, not a hackable Wi‑Fi smart lamp.

Quick Facts

The haul cost £1 for 4 bulbs, or £0.25 each, from a Re-Use centre bulb drawer. [#21897048]
The unbranded RGBWW bulb uses a YiChip YC1166 radio SoC and an SM2135EH 5-channel constant-current LED driver on a module marked BY4-M5 V1.1. [#21897048]
The YC1166 debug console appeared on IO31 at 921600 baud and reported firmware 53_0035_09_01 with build time 20211116. [#21897048]
The Ener-J SHA5262 maps PWM channels to P8 red, P24 green, P26 blue, P7 cool, and P6 warm at 1000 Hz. [#21897152]
The PIR bulb identifies a 1A21-Z analog pyroelectric sensor with 135° horizontal and 123° vertical field of view, plus 2–15 V operation and 12 µA typical current. [#21897152]

How do you identify worthwhile smart bulbs in a Re-Use shop bulb bin before buying them?

Check for brand labels, smart-light wording, radio clues, and unusual domes before buying. In this haul, plain visual sorting separated four interesting candidates from ordinary fluorescent or incandescent bulbs, but one "interesting" dome lamp still proved to be only a PIR bulb. Prioritize bulbs marked IKEA, Tuya-style brands, RGBWW, BLE, Wi‑Fi, or with model numbers you can later trace on the PCB. [#21897048]

What hardware is inside the unbranded RGBWW BLE+2.4G bulb built around the YiChip YC1166 and SM2135EH?

It contains a Zengge module marked BY4-M5 V1.1 with a YiChip YC1166 MCU and an SM2135EH LED driver on the LED board. Other board markings include ZJ-PWH-RGBWW-L2 V1.1, CH-323L-009A, and ZJ-LB-BWPWH-RGBWW-L1. That combination points to a Bluetooth plus proprietary 2.4 GHz RGBWW smart bulb rather than a Tuya Wi‑Fi design. [#21897048]

How do you put the Zengge YC1166 Bluetooth bulb into pairing mode, and why is the process so hit-and-miss?

Use rapid power toggling, but expect unreliable entry into pairing mode. The thread describes this exact sequence:

Turn the bulb on and off rapidly.
Repeat the on-off cycle several times.
Scan immediately with a compatible app.

The bulb only seemed to enter pairing mode after repeated on-off-on-off-on-off action, and even then discovery was "pretty hit-and-miss." That failure pattern suggests unstable pairing logic or strict app compatibility. [#21897048]

Why does the unbranded Zengge YC1166 bulb stop responding after a couple of power cycles?

The thread shows the bulb becomes unstable after a few power cycles, but it does not prove a single root cause. It would pair only inconsistently, then "stop responding after a couple of on/offs," even when the correct Zengge-branded app detected it. The strongest evidence is operational, not diagnostic: flaky pairing, strict app dependence, and repeated loss of response after mains toggling. [#21897048]

Which apps actually work with the YC1166-based Zengge bulb, and how does the Zengge app compare with other Zengge-made apps?

Only the app named Zengge worked in this test, and even that result was unstable. The author states that, among Zengge-made apps tried, only the "Zengge" app picked the bulb up, while other related apps did not. Even with that app, the bulb stopped responding after a couple of power cycles, so compatibility was narrow and reliability remained poor. [#21897048]

What is the YiChip YC1166, and what are its Bluetooth, CPU, memory, and flash capabilities?

"YiChip YC1166 is a Bluetooth microcontroller that drives connected lighting, combining a dual-core design with integrated 2.4 GHz radio support." In this bulb, it is described with Bluetooth 5.0 BR/EDR/BLE, proprietary 2.4 GHz support, an ARM Cortex‑M0 up to 48 MHz, 16 KB Data RAM, 16 KB cache/code RAM, and 4 Mbit / 512 KB internal flash. The quoted RF figures include about -95 dBm BLE sensitivity and up to +9 dBm TX power. [#21897048]

What is the SM2135EH LED driver, and what role does it play in RGBWW smart bulbs?

"SM2135EH is a 5-channel intelligent dimming LED constant-current driver that controls low-power LED channels, including RGB and white outputs." In this bulb, it sits on the LED disc and handles the RGBWW emitters, while the YC1166 handles radio, logic, and effects. The rear DAT/CLK pads lead to the SM2135H family driver, not to the YC1166 programming interface. [#21897048]

How is the YC1166 programmed through the ICE or IO31 pin, and what does the 921600 baud debug log reveal about the firmware?

The thread indicates the YC1166 uses a proprietary single-wire method on ICE/IO31, not the nearby DAT/CLK pads. IO31 also exposed a live UART-style debug log at 921600 baud. That log reported PPlus_SUCCESS, firmware version 53_0035_09_01, build time 20211116, ZJ_BLE_ADAPTER_VER 2.0.1_build0, LIGHT_VERSION 0.0.3_build0, and LED-driver initialization lines tied to SM2135EH. [#21897048]

In what way could an OBK BT ESP gateway or btproxy be used to detect or interact with a YC1166 Bluetooth bulb?

The thread suggests OBK BT ESP gateway or btproxy as a possible discovery path, but no actual test result is given yet. One participant asked whether an OBK BT ESP gateway could see the YC1166 bulb, and the reply said that btproxy should be explored because its setup and limits were still unclear. So the practical takeaway is simple: detection is plausible, but unverified in this discussion. [#21897922]

What did the teardown of the unmarked E27 bulb with a PIR dome reveal, and which PIR parts were identified inside it?

It revealed a basic PIR LED bulb, not a networked smart bulb. The teardown identified board markings PIRCVDY-8P-V5, PIRCVDB-8P-V2, and 2PH110122A, plus an MX8198H control IC and a 1A21-Z analog pyroelectric PIR sensor. That parts list matches a motion-activated lamp architecture rather than Bluetooth, Zigbee, or Wi‑Fi smart lighting. [#21897152]

What is the 1A21-Z pyroelectric PIR sensor, and what do its field-of-view and electrical specs mean in practice?

"1A21-Z is an analog pyroelectric PIR sensor that detects motion by sensing infrared changes, using a TO-5 metal-can package and very low current draw." The thread lists 135° horizontal and 123° vertical field of view, 2–15 V operating voltage, 12 µA typical current, and 28 µVpp typical noise. In practice, those numbers fit a wide-angle, low-power motion lamp front end. [#21897152]

How do you extract UART logs, Tuya KV data, and pin mappings from an Ener-J SHA5262 bulb with a WB3L/BK7231T module?

Use the module UART, then read the Tuya storage and configuration fields from the dump. In this bulb, TX2 exposed a boot log showing BK7231S_1.0.5, Tuya SDK details, product key keytg5kq8gvkv9dh, and schema 00000149dc. The same dump also revealed the Tuya KV block, SSID data, module name WB3L, and PWM pin mapping for all five LED channels. [#21897152]

What OpenBeken template and PWM pin configuration fit the Ener-J SHA5262 9W RGB CCT bulb?

The matching template is an Ener-J SHA5262 profile for BK7231T on a WB3L board with five PWM outputs. The thread’s OBK template maps P8 = PWM1 red, P24 = PWM2 green, P26 = PWM3 blue, P7 = PWM4 cool, and P6 = PWM5 warm, and sets the command powersave 1. The stored Tuya parameters also show 1000 Hz PWM frequency. [#21897152]

How do WB3L, BK7231T, and BK7231S_2M relate to each other in Tuya smart bulbs, and why do those identifiers sometimes differ in dumps?

In this bulb, WB3L is the module name, BK7231T is the chip family identified by the teardown, and BK7231S_2M appears as an internal platform string in Tuya data. The thread explicitly notes this mismatch: "Device seems to be using WB3L module, which is using BK7231T," while the dump still reports BK7231S_2M under em_sys_env. So one dump can contain module, silicon, and platform identifiers that do not match perfectly. [#21897152]

What other smart devices might turn up in Re-Use centres like this besides smart bulbs, and how do you safely evaluate them before purchase?

This thread only confirms bulbs, not other smart devices. The safe evaluation method shown here is practical: inspect labels and model numbers first, check for obvious clues like a PIR dome, then verify whether the device exposes a known module, debug UART, or prior pairing data after purchase. One Ener-J bulb still held the previous owner’s Wi‑Fi details, so second-hand smart gear can arrive already paired or provisioned. [#21897922]

Generated by the language model.