logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside

nihildiximus 3612 3

TL;DR LABEL_AI_GENERATED

  • Intertek (Smartwares) Flamingo SF-501SHC is a socket working in Wi-Fi and 433MHz modes, with app and remote control support.
  • It can also act as a control panel for four additional SF-501PFR 433MHz sockets, which remain controllable independently by the remote control.
  • Inside sits a Lierda LSD4WF-2MD05102 microcontroller, and disassembly only needs a Y bit because the cover opens to full electronics access.
  • The socket cost less than PLN 10, but no alternative software is known, which limits its usefulness for tinkering.
AI summary based on the discussion. May contain errors.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
Listen:
  • Producer : Intertek (Smartwares)
    Model : Flamingo SF-501SHC


    Socket operating in two modes - Wifi and 433MHz (control via the application and remote control), which can act as a control panel for 4 additional 433MHz sockets (model SF-501PFR) to be able to control them also from Wifi. Additional sockets can also be controlled independently by the remote control. Bought many years ago in a shop with Chinese things for less than PLN 10 (later I bought additional sockets). Unfortunately, I do not know any alternative software, which is a pity, because it is a very interesting solution. Disassembly requires a Y bit, but it is relatively easy, because after opening the cover there is access to all electronics.

    teardown
    [LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside [LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside
    [LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside [LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside

    Microcontroller : Lierda LSD4WF-2MD05102

    [LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside

    https://fccid.io/N8NLSD4WF2MD05102/User-Manual/User-Manual-3094516


    Cool? Ranking DIY
    W pełni konfigurowalna automatyzacja domu - prezentacja Fox Wi-Fi Quad Input [sponsorowany]
    About Author
    nihildiximus
    Level 9  
    Offline 
    nihildiximus wrote 32 posts with rating 23, helped 1 times. Live in city Wrocław. Been with us since 2018 year.
  • ADVERTISEMENT

  • Known packet structure, but AES key still unknown

    #2 20778393
    dipish
    Level 8  
    Posts: 12
    Help: 1
    Rate: 5
    I have several sockets on this wifi chipset.

    Searching the web didn't really turn up anything. I was never able to unlink them from the native application.

    I tracked that the module communicated with the site icomen.yunext.com, and then researched materials on other devices that access this site

    The only option I see is to replace the cloud's DNS with your own and send ready-made commands/responses to the device.

    I couldn't find any meaningful information on the LSD4WF module.

    Research led me to a very similar module from another manufacturer - HF-LPx100 , for which there are some DIY developments.

    Maybe someone can take this matter further

    I will provide below links to various articles and repositories that I found in my research

    Excavations on the management of the module, which accesses the same site: yunext.com:
    https://blog.giuliomontagner.com/post/1550856.../trying-to-hack-ankuoo-rec-switch-and-make-it
    https://github.com/giu1io/homebridge-ankuoo-rec-switch/blob/master/README.md

    I have made some tcp dumps, But I have no idea where to dig next, although there is an example with similar controls. (https://github.com/giu1io/homebridge-ankuoo-rec-switch/blob/master/config-sample.json) Dumps: LSD4WF.7z (6.92 kB)You must be logged in to download this attachment.

    SDK for similar hardware:
    https://github.com/mys812/hf/tree/master/LPB100-HSF

    A set of firmware for similar hardware. They don’t upload it directly to mine:
    https://drive.google.com/drive/folders/1HWl-QiYM2u8lW9TAv1M6Kr9DPkj1_wRG

    Another firmware for a similar wifi module:
    https://github.com/ljalves/hfeasy/releases/tag/1v1

    Documentation on similar module:
    https://en.maritex.com.pl/product/attachment/38889/403a3b0c1a0cdf45ee56578171f79333


    UPD:
    Code: Text
    Log in, to see the code


    UPD2: After 2 hours, i can turn off and on it from linux command promt ;) if any one need it i can public
  • ADVERTISEMENT

  • RTL8710BN dump appears to use Xlink SDK

    #4 21517836
    divadiow
    Level 38  
    Posts: 5222
    Help: 449
    Rate: 918
    cool

    We have an RTL8710BN dump that looked like it was also built with the Xlink SDK. Real device looks to have come with TLSR8258 alongside RTL. https://github.com/openshwprojects/FlashDumps.../IoT/RTL8710BN/GE_Plug_XLinkSDK_RTL8710BN.bin

    boot log for the RTL Xlink device:

    Code: Text
    Log in, to see the code
Reply Cool? Ranking DIY | New topic
Notify about new articles
Listen:
Report a violation of the law
Today's popular

FAQ LABEL_AI_GENERATED

TL;DR: 15 focused answers and one expert note, "very interesting solution", explain the Intertek Smartwares Flamingo SF-501SHC for repairers and smart-home hackers who need teardown, 433 MHz bridge, yunext.com, AES-128, and Xlink SDK context. [#20575837] Why it matters: The SF-501SHC combines Wi-Fi control and 433 MHz socket bridging, so cloud loss can affect several dependent plugs.

Option Thread-specific role Practical status
LSD4WF-2MD05102 Original Wi-Fi module in SF-501SHC No confirmed alternative firmware in the thread
HF-LPx100 / LPB100 Similar module family researched for DIY work Has SDKs, documentation, and community examples
RTL8710BN Xlink SDK device Comparable Xlink-built device dump Boot log shows Realtek-style Xlink firmware clues

Key insight: The strongest path is not direct firmware replacement. The thread points to protocol research, DNS redirection, TCP dumps, and Xlink-related SDKs as the most actionable route.

Quick Facts

  • The Flamingo SF-501SHC is an Intertek Smartwares socket with Wi-Fi and 433 MHz operation, controlled by app and remote. [#20575837]
  • The main identified microcontroller or Wi-Fi module is Lierda LSD4WF-2MD05102, linked to an FCC user manual page. [#20575837]
  • The socket can act as a control panel for 4 additional 433 MHz SF-501PFR sockets. [#20575837]
  • The original unit cost was under PLN 10, and disassembly needs a Y bit for the screws. [#20575837]
  • A related RTL Xlink boot log reports 40,000,000 Hz XTAL and compile time Jun 5 2020 16:32:39. [#21517836]

What is the Lierda LSD4WF-2MD05102 Wi-Fi module used in the Intertek Smartwares Flamingo SF-501SHC socket?

The Lierda LSD4WF-2MD05102 is the identified Wi-Fi module inside the Flamingo SF-501SHC smart socket. The teardown names Intertek Smartwares as producer and Flamingo SF-501SHC as model. "Lierda LSD4WF-2MD05102" is a Wi-Fi module that provides network connectivity for the socket, identified by board marking and linked to an FCC user manual. The thread gives no pinout, flash size, or confirmed replacement firmware for it. [#20575837]

How do you open and disassemble the Flamingo SF-501SHC smart socket safely?

Open the Flamingo SF-501SHC by removing the case screws with a Y bit, then lifting the cover. After opening, the electronics are accessible without deeper mechanical stripping. 1. Unplug the socket from mains power. 2. Remove the security screws with a Y bit. 3. Lift the cover and inspect the exposed PCB. The thread describes disassembly as relatively easy after the cover opens. [#20575837]

How does the Flamingo SF-501SHC use both Wi-Fi and 433 MHz remote control modes?

The Flamingo SF-501SHC operates in 2 modes: Wi-Fi app control and 433 MHz remote control. Wi-Fi links the socket to the original application. The 433 MHz path allows control from the handheld remote. This dual-mode design also lets the main socket bridge commands to additional 433 MHz sockets. That makes one Wi-Fi socket useful as a gateway for simpler RF-only plugs. [#20575837]

What role does the Flamingo SF-501SHC play as a control panel for SF-501PFR 433 MHz sockets?

The SF-501SHC can act as a control panel for 4 additional SF-501PFR sockets. Those extra sockets use 433 MHz control and can also work independently from the remote. The gateway role means Wi-Fi commands can reach multiple RF sockets through the SF-501SHC. This expands app control without putting Wi-Fi hardware into every extra plug. [#20575837]

What alternative firmware options exist for the LSD4WF-2MD05102 module in the Flamingo SF-501SHC?

No confirmed alternative firmware exists for the LSD4WF-2MD05102 in this thread. The original poster explicitly did not know any alternative software. Later research found similar HF-LPx100, LPB100, and hfeasy materials, but those did not directly upload to the LSD4WF device. This is a key failure case: similar firmware exists, but direct flashing is not validated. [#20778393]

How can the Flamingo SF-501SHC be controlled locally without the original cloud application?

Local control appears possible by reproducing the cloud protocol and sending prepared commands or responses. One tester reported controlling the socket from a Linux command prompt after 2 hours. The same post says the native application could not be unlinked. The practical route is protocol emulation, not a confirmed firmware replacement. This depends on correct packet handling and encryption details. [#20778393]

Why does the Flamingo SF-501SHC communicate with icomen.yunext.com or yunext.com?

The socket communicates with icomen.yunext.com because its cloud control path uses the yunext.com platform. Traffic research showed the module contacting that site. The researcher then compared other devices using the same service. "yunext.com" is a cloud platform endpoint that smart sockets contact for remote control, shared across multiple manufacturers and protocol examples. [#20778393]

What is yunext.com in the context of Ankuoo, Smartwares, and other Wi-Fi smart sockets?

yunext.com is the shared platform target used by several Wi-Fi smart socket implementations discussed in the thread. The research links Ankuoo REC switch work, a Homebridge plugin, and Smartwares-style devices through the same cloud domain. Packet structure information also appears in outside discussions referenced by the post. The important point is cross-device protocol similarity, not brand identity. [#20778393]

How can DNS redirection be used to replace the original cloud service for LSD4WF-based sockets?

DNS redirection can point the socket away from the vendor cloud and toward a local server. The local server must then send valid prepared commands and responses. This approach replaces the cloud destination, not the socket firmware. It still requires matching the expected yunext.com protocol. If encryption keys differ, valid-looking packets can still fail. [#20778393]

What is the packet structure used by yunext.com smart socket devices, and how is AES-128 involved?

The yunext.com packet structure is described as known and broadly shared across manufacturers using that platform. The payload uses AES-128 encryption, but the LSD4WF key is not confirmed. "AES-128" is a symmetric encryption method that uses a 128-bit key to protect packet payloads, making command replay fail when the device-specific key differs. The known example key "0123456789abcdef" was reported as not matching this socket. [#20778393]

How can someone find the AES-128 encryption key used by an LSD4WF smart socket?

Find the AES-128 key by analyzing firmware, captured traffic, or runtime behavior from the actual LSD4WF device. The thread does not publish the key. It only states that the common key "0123456789abcdef" is not the same. A plugin author asked researchers to share the correct key if found. This missing key is the main blocker for generic username-and-password setup. [#20778393]

What tools are useful for capturing and analyzing TCP dumps from a Wi-Fi smart plug?

TCP dumps are useful because they show the socket’s cloud communication path and packet timing. The researcher made TCP dumps but did not know the next analysis step. "TCP dump" is a captured record of network packets that helps identify hosts, ports, payload patterns, and command exchanges between a device and service. The thread’s next clues were yunext.com examples and config samples. [#20778393]

HF-LPx100 vs LSD4WF-2MD05102: which module is easier to hack or support with DIY firmware?

HF-LPx100 appears easier to research than LSD4WF-2MD05102 in this thread. The researcher found DIY developments, an SDK for LPB100-HSF, firmware collections, hfeasy releases, and documentation for similar modules. The LSD4WF module lacked meaningful public information. However, the thread also warns that similar firmware did not upload directly to the LSD4WF socket. [#20778393]

What is the Xlink device SDK, and how might it relate to LPB100 or LSD4WF smart socket firmware?

The Xlink device SDK is a linked development package that includes an LPB100 example. A later post identified it as possibly relevant to this device class. "Xlink device SDK" is a device software development kit that provides example firmware projects, including an LPB100 demo, for cloud-connected embedded smart devices. The thread does not prove it builds LSD4WF firmware. [#21517731]

How are RTL8710BN Xlink SDK devices similar to LSD4WF or LPB100-based smart plugs?

RTL8710BN Xlink SDK devices are similar because they also appear to use Xlink-built smart-plug firmware patterns. One referenced dump is for a GE plug using Xlink SDK on RTL8710BN. Its boot log shows RTL8195A, XTAL 40,000,000, OTA1 use, and compile time Jun 5 2020 16:32:39. That gives comparison clues, not a drop-in firmware path. [#21517836]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT