logo elektroda
logo elektroda
X
logo elektroda

C01W/C02W/C03W/C04W WiFi&BT LED Controller with TuyaMCU UART protocol

williamgibsonwg 5208 58
ADVERTISEMENT
  • #31 21238379
    theosoft
    Level 10  
    >>21238371
    Yes. Give it a try. May be the step to push the button twice is most important.
    But my first mistake was, that the device was discovered by the tuya app and i didn't realized it is bluetooth :-)
  • ADVERTISEMENT
  • #32 21238473
    jrhenk
    Level 10  
    >>21238379 >>21238379
    Just tried it with the device where it never worked but unfortunately this wasn't it. I was also wrong about the version, it's a tuya 1.3.1, always ends with "[!] The profile you selected did not result in a successful exploit"... too bad, guess it will remain on that pile for now :)
    I do however noticed that my tuyacloudcutter raspberry pi kills my openwrt access points, interesting random find. Did not connect the dots the last time I tinkered with cloudcutter
  • #33 21238512
    divadiow
    Level 34  
    jrhenk wrote:
    it's a tuya 1.3.1

    Just curious, is your device firmware 1.3.1 or 1.3.10?
  • #34 21239695
    jrhenk
    Level 10  
    >>21238512 lol that's actually a very good question, gonna check and report back :)
  • #36 21253730
    theosoft
    Level 10  
    Some notes:
    My devices.
    C05W 2.1.6. Cloudcutted
    HW5 MiBoxer 2.1.6: Flashed with interrupted RX (cutted with knife)

    Both now on Version: 1.17.740
    I played arround with scenes:
    1. I don't know if there are fixed scenes.
    2. Sending messages to DP25 sets scene parameters. The setting is confirmed from Tuya by sending the config back
    3. The format is, against the tuya specification, String. So when the message should be 0x01 0x02 ... you have to send the ASCII char 0x31 0x32
    4. Device has to be set to scene mode before sending message

    As an example for autoexec.bat:
    setButtonLabel 0 "Set Mode White"
    setButtonColor 0 "#00FFFF"
    setButtonEnabled 0 1
    setButtonCommand 0 "tuyaMcu_sendCmd 0x06 1504000100"
    
    setButtonLabel 1 "Set Mode Color"
    setButtonColor 1 "#FF0000"
    setButtonEnabled 1 1
    setButtonCommand 1 "tuyaMcu_sendCmd 0x06 1504000101"
    
    setButtonLabel 2 "Set Mode Scene"
    setButtonColor 2 "#00FF00"
    setButtonEnabled 2 1
    setButtonCommand 2 "tuyaMcu_sendCmd 0x06 1504000102"
    
    setButtonLabel 3 "Set Mode Music"
    setButtonColor 3 "#0000FF"
    setButtonEnabled 3 1
    setButtonCommand 3 "tuyaMcu_sendCmd 0x06 1504000103"
    
    
    alias soft tuyaMcu_sendCmd 0x06  19030036303434363436303230303738303345383033453830303030303030303436343630323030373830334538303030413030303030303030
    setButtonLabel 5 "Soft"
    setButtonColor 5 "#F0F0FF"
    setButtonEnabled 5 1
    setButtonCommand 5 soft 


    As you can see, the header is still HEX, but the Tuya message is ASCII coded.
    19: DP25
    03: String type
    0036: Lenght (54 char)
    303434363436303230303738303345383033453830303030303030303436343630323030373830334538303030413030303030303030

    decoded: 04 46 46 02 0078 03E8 03E8 0000 0000 46 46 02 0078 03E8 000A 0000 0000

    I wrote a tool for encode/decode scene messages...

    DP25 Editor V1.03 software interface with scene definitions.
  • ADVERTISEMENT
  • #38 21254597
    theosoft
    Level 10  
    >>21254523
    Do i have to ask @p.kaczmarek2 before distributing EXE files :-)

    Added after 51 [seconds]:

    p.kaczmarek2
  • ADVERTISEMENT
  • #40 21254903
    p.kaczmarek2
    Moderator Smart Home
    You can even post it as separate topic in Smart Home Tutorials with a brief description what it is and how it works. You can include source code as well, but not necessary.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #41 21255298
    theosoft
    Level 10  
    >>21254903

    Done. Should be in the temporary forum and published after acceptens...

    Added after 8 [minutes]:

    Is there a way to have a button in homeassistant to send profiles to tuya RGB?
    The OpenBeken flashed device is able to define a webbutton. See autoexec,bat sample above.
    But these buttons are not in homeassistant :-)
  • #42 21255321
    DeDaMrAz
    Level 19  
    theosoft wrote:
    Is there a way to have a button in homeassistant to send profiles to tuya RGB?
    The OpenBeken flashed device is able to define a webbutton. See autoexec,bat sample above.
    But these buttons are not in homeassistant


    Assign a channel to the button, set that chanel to toggle (I think) and do rediscovery and go from there.
  • #43 21255856
    theosoft
    Level 10  
    >>21255321
    Till now no sucess to see a scene button in homeassistant
  • #44 21255918
    DeDaMrAz
    Level 19  
    @theosoft

    This is a general idea that you can expand on.

    
    startDriver tuyaMcu
    
    alias TEST tuyaMcu_sendCmd 0x06 1504000100
    
    setChannelLabel 6 TEST
    publishChannel 6
    
    addChangeHandler Channel6 == 1 TEST


    To set the CH6 to Toggle go to webapp/config.

    Screenshot of the configuration of pin settings and channel types in a TuyaMCU device.

    There are other ways to do this, it is just one example of course, and idea to play around with.

    Screenshot from the simulator of TEST toggle.

    Screenshot showing CMD console on the left with MQTT information, and a device configuration panel in a web app on the right.

    Remember after these changes delete the device from HA and do rediscovery.

    Let us know if that worked for you.
  • #45 21256532
    theosoft
    Level 10  
    >>21255918
    Thanks for advice, I am closer to goul. I have to work on the logics.

    My solution at the moment:

    alias Soft backlog tuyaMcu_sendCmd 0x06 1504000102; tuyaMcu_sendCmd 0x06 19030036303434363436303230303738303345383033453830303030303030303436343630323030373830334538303030413030303030303030; addRepeatingEvent 1 1 setChannel 4 0

    // Doesn't work. Must be set with WebApp ??
    setChannelType 4 Toogle
    //
    setChannelLabel 4 Soft
    addChangeHandler Channel4 == 1 Soft
    publishChannel 4

    Added after 12 [minutes]:

    Some info:

    My HW5 modul is "strange". Set timing is different as tuya spec. Set Intervall to 100 results in 1sec blinking (Mode 1). Setting to 1 results in 10sec. An out of spec value 105 (0x69) results in 1/10 sec...
    An the modul seems to accept timings only from scene definition 0 ....

    Strange :-(

    Remote controll is allso not working, but i haven't tryed with original tuya firmware. The modul reacts, but is falling back to colormode....

    regards
  • #46 21256554
    DeDaMrAz
    Level 19  
    theosoft wrote:
    tuyaMcu_sendCmd 0x06 1504000102; tuyaMcu_sendCmd 0x06...


    Are you sure you should send 0x06 command twice?? What I have seen previously (as I don't know your device) is that there is usually a power on or set mode command (I guess 0x06) followed by the different command for scene depending on the dpID.
  • #47 21257076
    theosoft
    Level 10  
    >>21256554
    I tried to compine both commands, but doesn't work.
    BUT.
    I think there is a limit for message len.
    When i try to send this message from autoexec.bat :
    tuyaMcu_sendCmd 0x06 19030036303035413030303130303738303345383033453830303030303030303030303030313030303030303030303030303030303030303030
    On the RS242 interface the last 4 30 "0" are missing ...
    And maybe this is the reason for failures ...

    sending direct on CLI it is OK.

    regards
  • #48 21257143
    DeDaMrAz
    Level 19  
    @theosoft

    Take a look at this thread - https://www.elektroda.pl/rtvforum/topic4014389.html

    It may help you in some way.

    We will try to help you out more but we are limited with time so please be patient.

    And as far as I remember there we change the limit some time ago so what you are sending is not close to that limit.
  • #49 21257161
    p.kaczmarek2
    Moderator Smart Home
    The limit is 128 bytes packet and you reach 58 bytes it seems:
    Screenshot of Visual Studio editor with a source code file open.
    Code editor window in Visual Studio with a C language code snippet.
    I've tried to replicate your problem with a self test, but is passes correctly both when run from command interface, and also when run from LittleFS....
    https://github.com/openshwprojects/OpenBK7231...mmit/f5d8d602c4526363e31af5309fab2704306de597
    @DeDaMrAz can you check on any device whether this command really sends what we expect on UART?
    Expected result is:
    
    55 AA 00 06 00 3A 19030036303035413030303130303738303345383033453830303030303030303030303030313030303030303030303030303030303030303030 18
    

    spaces added only for clarity, treat it as hex string (remove spaces)
    Helpful post? Buy me a coffee.
  • #50 21257187
    theosoft
    Level 10  
    >>21257161

    I found a buffer with the size of 128 in the autoexec.bat part. Made a quick search :-)

    file: src/cmnds/cmd_main.c Line 940.

    commandResult_t CMD_ExecuteCommand(const char* s, int cmdFlags) {
    const char* p;
    const char* args;

    char copy[128];

    Is the line in the autoexec.bat to long to be executed correctly?

    Edit: I checked the string inside of autoexec.bat and it is exectly at pos 128 where the string is cutted. So i think the buffer to copy the command as string is to small.
    With the long messages for scenedefinitions i reached that limit. Is it possible to increase the buffer char copy[128] up to 1024? Or dynamic?

    regards
  • #51 21257212
    DeDaMrAz
    Level 19  
    This is the result I got from this command on a CBU module

    tuyaMcu_sendCmd 0x06 19030036303035413030303130303738303345383033453830303030303030303030303030313030303030303030303030303030303030303030


    Screenshot showing the TuyaMCU Explorer/Analyzer for OpenBeken with raw packet data in hexadecimal format.

    55 AA 00 06 00 3A 19030036303035413030303130303738303345383033453830303030303030303030303030313030303030303030303030303030303030303030 18


    @theosoft

    That is not the case, each character in your command is a single byte, for example 30 is a hex converted to byte it is 1 byte or 8 bits (00110000) so in theory for you to oversaturate that buffer you will have to send 256+ hex characters. Or at least this is what I think as I didn't look into the code for any other checks and conditions.

    You can also see that in the output where converted to 005A0001007803E803E80000000000000100000000000000000000 you are only sending 54 bytes.

    EDIT: it is maybe because it is unclear that tuyaMCu_sendCmd is using HEX and that is causing confusion.
  • #52 21257239
    theosoft
    Level 10  
    >>21257212
    Here my log from TX side. Wifi Modul send message to Tuya MCU
    55h AAh 00h 06h 00h 35h 19h 03h 00h 36h 30h 30h 36h 34h 30h 30h 30h 31h 30h 30h 30h 30h 30h 33h 45h 38h 30h 33h 45h 38h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 31h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h F0h C8h
    55h AAh 00h 06h 00h 3Ah 19h 03h 00h 36h 30h 30h 36h 34h 30h 30h 30h 31h 30h 30h 30h 30h 30h 33h 45h 38h 30h 33h 45h 38h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 31h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h 30h FDh


    It is cutted some how. I checked meanwhile allso the message send by homeassistant. The result is the same. Message is cutted. In text commandlines the byte demand is twice as much as in hex. You need 2 char for one byte description. May be to debug the situation in line 940, there should be a debug output for the copy buffer.

    regards
  • #53 21257462
    p.kaczmarek2
    Moderator Smart Home
    Are you using latest OBK?

    theosoft wrote:

    I found a buffer with the size of 128 in the autoexec.bat part. Made a quick search :-)

    file: src/cmnds/cmd_main.c Line 940.
    Code: C / C++
    Log in, to see the code

    This buffer is only used to store command name, not arguments. Check the whole code. Futhermore, as I said, self-test with UART passes correctly, so I would rather suspect that Beken UART queue is at fault.

    theosoft wrote:

    With the long messages for scenedefinitions i reached that limit. Is it possible to increase the buffer char copy[128] up to 1024? Or dynamic?

    This won't change anything due to the reason said above.

    I will repeat what I said in my previous post.
    I've tried sending this message from autoexec.bat and from alias in self-test:
    Code: C / C++
    Log in, to see the code

    All those tests are passing correctly. So either problem is somewhere else or is platform-specific, but buffer sizes are the same on all platforms?

    Maybe you have wrong trail and you meant that http button has limited buffer?
    Helpful post? Buy me a coffee.
  • #54 21257562
    theosoft
    Level 10  
    >>21257462
    But my cmdline in autoexec.bat looks like this and the alias is used in channal cmd.
    alias Alarm backlog tuyaMcu_sendCmd 0x06 1504000102; delay_ms 500; tuyaMcu_sendCmd 0x06 19030036303036343030303130303030303345383033453830303030303030303030303030313030303030303030303030303030303030303030; addRepeatingEvent 1 1 setChannel 5 0

    And the tuyaMcu_sendCmd is sending a message, but not complete. Anyway....
    BTW. Alias in Alias is possible?

    regards
  • #55 21257816
    p.kaczmarek2
    Moderator Smart Home
    We don't have support for delay in backlog yet. Currently, it will not delay. And you can't send two TuyaMCU command without delay if you don't enable TuyaMCU queue. You should rather see this topic:
    https://www.elektroda.com/rtvforum/topic4014389.html
    Also search for "startScript" there:
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/autoexecExamples.md
    Helpful post? Buy me a coffee.
  • #56 21360665
    T3elektroda
    Level 2  
    I have a C02W over here Version 2.1.6. I'd like to cloudcut. Is there a profile available?
  • #57 21361236
    divadiow
    Level 34  
    >>21360665

    try any profile with matching version
  • #58 21526233
    Ogurezzz
    Level 5  
    Hi!
    Got something wrong with my C01W
    Linux Mint 22.1
    Mono JIT compiler version 6.8.0.105:
    Spoiler:
    ~$ mono --version
    Mono JIT compiler version 6.8.0.105 (Debian 6.8.0.105+dfsg-3.6ubuntu2 Sun Mar 31 02:55:28 UTC 2024)
    Copyright (C) 2002-2014 Novell, Inc, Xamarin Inc and Contributors. www.mono-project.com
    TLS: __thread
    SIGSEGV: altstack
    Notifications: epoll
    Architecture: amd64
    Disabled: none
    Misc: softdebug
    Interpreter: yes
    LLVM: supported, not enabled.
    Suspend: hybrid
    GC: sgen (concurrent by default)

    Fresh BK7231Flasher.exe (v19)
    Log:
    
    Backup name is set to C01W.
    
    Starting read!
    Read parms: start 0x00 (sector 0), len 0x200000 (0 sectors)
    Now is: 21 апреля 2025 г. 16:01:12.
    Flasher mode: BK7231N
    Going to open port: /dev/ttyUSB1.
    Serial port open!
    Getting bus... (now, please do reboot by CEN or by power off/on)
    Getting bus success!
    Going to set baud rate setting (921600)!
    Will try to read device flash MID (for unprotect N):
    Flash MID loaded: 1560EB
    Will now search for Flash def in out database...
    Flash def found! For: 1560EB
    Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
    Entering SetProtectState(True)...
    sr: 0
    sr: 0
    final sr: 0
    msk: 407c
    cw: 0, sb: 2, lb: 5
    bfd: 0
    SetProtectState(True) success!
    Going to read encryption key...
    Encryption key read done!
    Encryption key: 510fb093 a3cbeadc 5993a17e c7adeb03
    Going to start reading at offset 0x00...
    Reading 0x00... failed with serial.BytesToRead 4095 (expected 4111)
    The beginning of buffer in UART contains 040EFF01E0FCF4061009000000200069 data.
    Failed! There was no result to save.
    


    xbuild of flasher from source was failed:
    Spoiler:
    >>>> xbuild tool is deprecated and will be removed in future updates, use msbuild instead <<<<

    XBuild Engine Version 14.0
    Mono, Version 6.8.0.105
    Copyright (C) 2005-2013 Various Mono authors

    Build started 21.04.2025 15:54:41.
    __________________________________________________
    /home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln: warning : Don't know how to handle GlobalSection ExtensibilityGlobals, Ignoring.
    Project "/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln" (default target(s)):
    Target ValidateSolutionConfiguration:
    Building solution configuration "Debug|Any CPU".
    Target Build:
    Project "/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/BK7231Flasher.csproj" (default target(s)):
    Target PrepareForBuild:
    Configuration: Debug Platform: AnyCPU
    Created directory "bin/Debug/"
    Created directory "obj/Debug/"
    Target ResolveAssemblyReferences:
    /usr/lib/mono/xbuild/14.0/bin/Microsoft.Common.targets: warning : Reference 'System.Deployment' not resolved
    For searchpath {CandidateAssemblyFiles}
    Warning: {CandidateAssemblyFiles} not supported currently
    For searchpath {HintPathFromItem}
    HintPath attribute not found
    For searchpath {TargetFrameworkDirectory}
    For searchpath {PkgConfig}
    Considered System.Deployment, but could not find in any pkg-config files.
    For searchpath {GAC}
    Considered System.Deployment, but could not find in the GAC.
    For searchpath {RawFileName}
    Considered 'System.Deployment' as a file, but the file does not exist
    For searchpath bin/Debug/
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Deployment' as a file, but the file does not exist
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Deployment.exe' as a file, but the file does not exist
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Deployment.dll' as a file, but the file does not exist
    /usr/lib/mono/xbuild/14.0/bin/Microsoft.Common.targets: warning : Reference 'System.Net' not resolved
    For searchpath {CandidateAssemblyFiles}
    Warning: {CandidateAssemblyFiles} not supported currently
    For searchpath {HintPathFromItem}
    HintPath attribute not found
    For searchpath {TargetFrameworkDirectory}
    For searchpath {PkgConfig}
    Considered System.Net, but could not find in any pkg-config files.
    For searchpath {GAC}
    Considered System.Net, but could not find in the GAC.
    For searchpath {RawFileName}
    Considered 'System.Net' as a file, but the file does not exist
    For searchpath bin/Debug/
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Net' as a file, but the file does not exist
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Net.exe' as a file, but the file does not exist
    Considered '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/System.Net.dll' as a file, but the file does not exist
    Target CopyFilesMarkedCopyLocal:
    Copying file from '/home/ogurezzz/Projects/BK7231GUIFlashTool/packages/Newtonsoft.Json.13.0.3/lib/net35/Newtonsoft.Json.dll' to '/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/bin/Debug/Newtonsoft.Json.dll'
    Done building project "/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/BK7231Flasher.csproj".-- FAILED
    Task "MSBuild" execution -- FAILED
    Done building target "Build" in project "/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln".-- FAILED
    Done building project "/home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln".-- FAILED

    Build FAILED.

    Warnings:

    /home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln: warning : Don't know how to handle GlobalSection ExtensibilityGlobals, Ignoring.

    /home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher.sln (default targets) ->
    (Build target) ->
    /home/ogurezzz/Projects/BK7231GUIFlashTool/BK7231Flasher/BK7231Flasher.csproj (default targets) ->
    /usr/lib/mono/xbuild/14.0/bin/Microsoft.Common.targets (ResolveAssemblyReferences target) ->

    /usr/lib/mono/xbuild/14.0/bin/Microsoft.Common.targets: warning : Reference 'System.Deployment' not resolved
    /usr/lib/mono/xbuild/14.0/bin/Microsoft.Common.targets: warning : Reference 'System.Net' not resolved

    3 Warning(s)
    0 Error(s)

    Time Elapsed 00:00:00.1623790


    UPD:
    Flashing works fine. But download doesn't work nor Linux, neither Win10.
  • #59 21562219
    george_unknown
    Level 1  
    Hello from 2025
    Here's my experience dealing with the model C01W.

    I bought it on aliexpress.
    cloudcutter didn't work (actually I only tried the related tool to backup original fw over-the-air). It said device still responded to pings after exploit was applied
    so the vulnerability was fixed apparently. So it's time to prepare an iron. Device's case can be opened perfectly without damage.
    Device board looks exactly like in the post #1 here.
    I soldered ftdi to mcu CMS32L051 pins 5, 6, ground. I connected pin 3 (mcu reset) to ground so mcu didn't disturb uart communication with CBU.
    Using separate usb cable I put 5v from PC to V+ just to power CBU. Separate cable was need to reset power and get into fw update mode.

    First I tried to dump original firmware. BK7231Flasher didn't work on linux.
    ltchiptool and bk7231tools both worked perfectly and got identical dumps.
    Next I flashed OpenBeken 1.18.101 and put "Startup commands text" from above and it works fine.
    The only hair in the soup was when device is powered up it turned on led strip by itself.
    And leds are turned on by mcu solely even before the first heartbeat from CBU.
    There are settings called "Do not disturb mode" DP 34 and initial mode DP 33. But I couldn't make them work as expected or I didn't understand it right.
    Instead I just added "tuyaMcu_sendState 20 1 0" cmd to the startup config to always turn it off right after power-up.

    Observations:
    1) According to inner temperature sensor CBU is rather hot. It starts with around 45 degree and ends up 65 degree being in own case without load.
    2) I bound GUI widget dimmer to the device using mqtt. So every mousemove over widget triggered mqtt message and series of messages (~20 messages)
    in several hundred ms makes firmware reboot reliably. I limited the frequency of messages and the problem was gone but it's not a good thing to selfreboot.

    // Here is my final config
    startDriver TuyaMCU
    setChannelType 1 toggle
    setChannelType 2 dimmer
    tuyaMcu_setDimmerRange 1 1000
    linkTuyaMCUOutputToChannel 20 bool 1
    linkTuyaMCUOutputToChannel 22 val 2
    // turn off led after power up
    tuyaMcu_sendState 20 1 0

Topic summary

The discussion revolves around the teardown and programming of the C01W/C02W/C03W/C04W WiFi and Bluetooth LED controllers utilizing the BK7231N chip and TuyaMCU UART protocol. Users share insights on flashing firmware using cloudcutter, capturing UART data for TuyaMCU commands, and configuring PWM outputs for RGBCW control. Various troubleshooting steps are discussed, including the importance of proper UART connections, the use of TuyaMCU drivers, and the challenges faced with device recognition in Tuya apps. Participants also explore the nuances of command structures, dpIDs for controlling device functions, and the impact of firmware versions on performance. The conversation highlights the community's collaborative efforts to decode protocols and improve device functionality.
Summary generated by the language model.
ADVERTISEMENT