logo elektroda
logo elektroda
X
logo elektroda

Globe 35804 RGB LED Bulb: Exploit with Tuya Cloudcutter, OpenBK7231T_UG & SM2135/SM2235 Chip

desolatax 1260 3
ADVERTISEMENT
  • #1 20441300
    desolatax
    Level 2  
    Globe 35804 RGB LED Bulb: Exploit with Tuya Cloudcutter, OpenBK7231T_UG & SM2135/SM2235 Chip
    Got this Globe 35804 RGBCW LED Bulb that I have purchased at Costco Canada and The Source Canada

    Here is a post of the FCC teardown that helped me: https://fccid.io/2AQUQGB35804/Internal-Photos/Internal-Photos-5007861.pdf
    I have not cracked mine open as I don't need to anymore!

    Found out that these are exploitable through Tuya Cloudcutter Ran Lightleak to pull the device profile, then loaded OpenBK7231T_UG_1.15.447.bin on to it

    Looks like you can learn alot from browsing this board for an hour or two! What an amazing resource!
    Found out this uses an SM2135 (Or maybe a SM2235? I tried that too and I'd get colors but not accurate control and it jumped all over the place when I tried to change it, not sure if this could benefit from 10bit that the SM2235 has? I'm totally new to this)

    Below are the settings
    Map pin 8 to SM2135CLK
    Map pin 26 to SM2135DAT
    Set startup command or just run the following via execute command
    SM2135_Map 2 1 0 4 3

    Turn on Flag 9 (Bulb would only flicker if I didn't have this on, Think it's needed but I don't know much about this)
    Configure Startup to be -1 and Configure Flag 12 if you want it to remember after reboot

    This bit helped me map out the clock/data pins and the RGBCW profile to map above to the SM2135 after reviewing some other posts on this forum.
                    "iicb": 0,
                    "iicc": 4,
                    "iicg": 1,
                    "iicr": 2,
                    "iicscl": 8,
                    "iicsda": 26,
                    "iicw": 3,


    Below is the full dump from tuya-cloudcutter+lightleak. I've also submitted the profile for Tuya-cloudcutter to have it added to the devices list. These bulbs were all running 2.9.16 from Tuya.

    
    {
            "manufacturer": "Globe Electric",
            "name": "35804 RGB E26 LED Bulb",
            "key": "keytg5kq8gvkv9dh",
            "ap_ssid": "Globe Suite",
            "github_issues": [],
            "image_urls": [],
            "profiles": [
                    "oem-bk7231s-light-ty-2.9.16-sdk-1.0.8-40.00"
            ],
            "schemas": {
                    "000002f04p": [
                            {
                                    "type": "obj",
                                    "mode": "rw",
                                    "property": {
                                            "type": "bool"
                                    },
                                    "id": 20
                            },
                            {
                                    "type": "obj",
                                    "mode": "rw",
                                    "property": {
                                            "range": [
                                                    "white",
                                                    "colour",
                                                    "scene",
                                                    "music"
                                            ],
                                            "type": "enum"
                                    },
                                    "id": 21
                            },
                            {
                                    "type": "obj",
                                    "mode": "rw",
                                    "property": {
                                            "min": 10,
                                            "max": 1000,
                                            "scale": 0,
                                            "step": 1,
                                            "type": "value"
                                    },
                                    "id": 22
                            },
                            {
                                    "type": "obj",
                                    "mode": "rw",
                                    "property": {
                                            "min": 0,
                                            "max": 1000,
                                            "scale": 0,
                                            "step": 1,
                                            "type": "value"
                                    },
                                    "id": 23
                            },
                            {
                                    "type": "obj",
                                    "mode": "rw",
                                    "property": {
                                            "type": "string",
                                            "maxlen": 255
                                    },
                                    "id": 24
                            },
                            {
                                    "type": "obj",
                                    "mode": "rw",
                                    "property": {
                                            "type": "string",
                                            "maxlen": 255
                                    },
                                    "id": 25
                            },
                            {
                                    "type": "obj",
                                    "mode": "rw",
                                    "property": {
                                            "min": 0,
                                            "max": 86400,
                                            "scale": 0,
                                            "step": 1,
                                            "type": "value"
                                    },
                                    "id": 26
                            },
                            {
                                    "type": "obj",
                                    "mode": "wr",
                                    "property": {
                                            "type": "string",
                                            "maxlen": 255
                                    },
                                    "id": 28
                            },
                            {
                                    "mode": "rw",
                                    "id": 30,
                                    "type": "raw"
                            },
                            {
                                    "mode": "rw",
                                    "id": 31,
                                    "type": "raw"
                            },
                            {
                                    "mode": "rw",
                                    "id": 32,
                                    "type": "raw"
                            },
                            {
                                    "mode": "rw",
                                    "id": 33,
                                    "type": "raw"
                            },
                            {
                                    "type": "obj",
                                    "mode": "rw",
                                    "property": {
                                            "type": "bool"
                                    },
                                    "id": 34
                            },
                            {
                                    "mode": "rw",
                                    "id": 210,
                                    "type": "raw"
                            }
                    ]
            },
            "device_configuration": {
                    "Jsonver": "1.1.9",
                    "brightmax": 95,
                    "brightmin": 10,
                    "cagt": 15,
                    "campere": 20,
                    "category": "0505",
                    "cmod": "rgbcw",
                    "colormax": 100,
                    "colormin": 10,
                    "crc": 90,
                    "cwmaxp": 100,
                    "cwtype": 0,
                    "defbright": 100,
                    "defcolor": "c",
                    "deftemp": 100,
                    "dmod": 2,
                    "gmkb": 60,
                    "gmkg": 60,
                    "gmkr": 80,
                    "gmwb": 75,
                    "gmwg": 70,
                    "gmwr": 100,
                    "iicb": 0,
                    "iicc": 4,
                    "iicg": 1,
                    "iicr": 2,
                    "iicscl": 8,
                    "iicsda": 26,
                    "iicw": 3,
                    "module": "WB3L",
                    "onoffmode": 0,
                    "pmemory": 1,
                    "prodagain": 0,
                    "remdmode": 0,
                    "rgbt": 10,
                    "rstbr": 50,
                    "rstcor": "c",
                    "rstnum": 3,
                    "rsttemp": 100,
                    "title20": 1,
                    "wampere": 55,
                    "wfcfg": "spcl_auto",
                    "wfct": 3,
                    "wt": 15
            }
    }
    
  • ADVERTISEMENT
  • #2 20441397
    p.kaczmarek2
    Moderator Smart Home
    Thanks, I will note two things:
    desolatax wrote:

    Found out this uses an SM2135 (Or maybe a SM2235? I tried that too and I'd get colors but not accurate control and it jumped all over the place when I tried to change it, not sure if this could benefit from 10bit that the SM2235 has? I'm totally new to this)

    Your bulb has SM2135 inside so it's not possible to run SM2235 driver on that. You'd have to replace the chip inside. You are bound to 8 bit colours.

    Also... the SM2135_Map (and all other map commands) used to remap channel order are now saving results in flash, so you could also just execute it once without using Startup command and it would work as well, but that's not a problem. You can do both ways and both will work.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 20442263
    desolatax
    Level 2  
    p.kaczmarek2 wrote:
    Thanks, I will note two things:
    desolatax wrote:

    Found out this uses an SM2135 (Or maybe a SM2235? I tried that too and I'd get colors but not accurate control and it jumped all over the place when I tried to change it, not sure if this could benefit from 10bit that the SM2235 has? I'm totally new to this)

    Your bulb has SM2135 inside so it's not possible to run SM2235 driver on that. You'd have to replace the chip inside. You are bound to 8 bit colors.

    Thanks! That makes sense, totally fine with 8 bit, just saw that I would get some response from the LEDs when I tried SM2235, but no actual consistent control of brightness/color so I thought I'd ask :)
    p.kaczmarek2 wrote:

    Also... the SM2135_Map (and all other map commands) used to remap channel order are now saving results in flash, so you could also just execute it once without using Startup command and it would work as well, but that's not a problem. You can do both ways and both will work.

    Makes sense!
  • Helpful post
    #4 20442268
    p.kaczmarek2
    Moderator Smart Home
    Hmm, from what I remember, the SM2235 protocol is very similar to SM2135, but takes few more bytes, so you were just most likely getting random interpretation of incorrect packets that were sent by the driver.

    Btw, we just published video about BL602 bulb, but also with I2C-like (modified version of I2C) driver, BP5758.
    https://www.youtube.com/watch?v=L6d42IMGhHw
    Helpful post? Buy me a coffee.
ADVERTISEMENT