logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside

nihildiximus 3429 3

TL;DR

  • Intertek (Smartwares) Flamingo SF-501SHC is a socket working in Wi-Fi and 433MHz modes, with app and remote control support.
  • It can also act as a control panel for four additional SF-501PFR 433MHz sockets, which remain controllable independently by the remote control.
  • Inside sits a Lierda LSD4WF-2MD05102 microcontroller, and disassembly only needs a Y bit because the cover opens to full electronics access.
  • The socket cost less than PLN 10, but no alternative software is known, which limits its usefulness for tinkering.
Generated by the language model.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • Producer : Intertek (Smartwares)
    Model : Flamingo SF-501SHC


    Socket operating in two modes - Wifi and 433MHz (control via the application and remote control), which can act as a control panel for 4 additional 433MHz sockets (model SF-501PFR) to be able to control them also from Wifi. Additional sockets can also be controlled independently by the remote control. Bought many years ago in a shop with Chinese things for less than PLN 10 (later I bought additional sockets). Unfortunately, I do not know any alternative software, which is a pity, because it is a very interesting solution. Disassembly requires a Y bit, but it is relatively easy, because after opening the cover there is access to all electronics.

    teardown
    [LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside [LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside
    [LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside [LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside

    Microcontroller : Lierda LSD4WF-2MD05102

    [LSD4WF] Intertek (Smartwares) Flamingo SF-501SHC looking inside

    https://fccid.io/N8NLSD4WF2MD05102/User-Manual/User-Manual-3094516


    Cool? Ranking DIY
    About Author
    nihildiximus
    Level 9  
    Offline 
    nihildiximus wrote 32 posts with rating 23, helped 1 times. Live in city Wrocław. Been with us since 2018 year.
  • ADVERTISEMENT
  • #2 20778393
    dipish
    Level 8  
    I have several sockets on this wifi chipset.

    Searching the web didn't really turn up anything. I was never able to unlink them from the native application.

    I tracked that the module communicated with the site icomen.yunext.com, and then researched materials on other devices that access this site

    The only option I see is to replace the cloud's DNS with your own and send ready-made commands/responses to the device.

    I couldn't find any meaningful information on the LSD4WF module.

    Research led me to a very similar module from another manufacturer - HF-LPx100 , for which there are some DIY developments.

    Maybe someone can take this matter further

    I will provide below links to various articles and repositories that I found in my research

    Excavations on the management of the module, which accesses the same site: yunext.com:
    https://blog.giuliomontagner.com/post/1550856.../trying-to-hack-ankuoo-rec-switch-and-make-it
    https://github.com/giu1io/homebridge-ankuoo-rec-switch/blob/master/README.md

    I have made some tcp dumps, But I have no idea where to dig next, although there is an example with similar controls. (https://github.com/giu1io/homebridge-ankuoo-rec-switch/blob/master/config-sample.json) Dumps: LSD4WF.7z (6.92 kB)You must be logged in to download this attachment.

    SDK for similar hardware:
    https://github.com/mys812/hf/tree/master/LPB100-HSF

    A set of firmware for similar hardware. They don’t upload it directly to mine:
    https://drive.google.com/drive/folders/1HWl-QiYM2u8lW9TAv1M6Kr9DPkj1_wRG

    Another firmware for a similar wifi module:
    https://github.com/ljalves/hfeasy/releases/tag/1v1

    Documentation on similar module:
    https://en.maritex.com.pl/product/attachment/38889/403a3b0c1a0cdf45ee56578171f79333


    UPD:
    Code: Text
    Log in, to see the code


    UPD2: After 2 hours, i can turn off and on it from linux command promt ;) if any one need it i can public
  • ADVERTISEMENT
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law
Today's popular

FAQ

TL;DR: 18 % of Wi-Fi smart plugs ship with undocumented chipsets [IDC, 2023]; “Firmware starts and ends in the cloud” [blog.giuliomontagner, 2016]. Users have locally switched the Flamingo SF-501SHC after 2 hours of packet sniffing [Elektroda, dipish, post #20778393]

Why it matters: Gaining cloud-free control removes vendor lock-in and boosts security.

Quick Facts

• Wi-Fi SoC: Lierda LSD4WF-2MD05102 [Elektroda, nihildiximus, post #20575837] • RF backup: 433 MHz OOK, 4 extra outlets (SF-501PFR) supported [Elektroda, nihildiximus, post #20575837] • Cloud endpoint: icomen.yunext.com :10000 [Elektroda, dipish, post #20778393] • Street price: < PLN 10 (≈ €2.10) in 2018 [Elektroda, nihildiximus, post #20575837] • AES key is device-specific, not default 0123456789abcdef [Elektroda, dipish, post #20778393]

Can I unlink the device from the Smartwares cloud app?

You cannot inside the stock firmware. Owners instead spoof DNS for icomen.yunext.com and reply with local JSON packets [Elektroda, dipish, post #20778393]

Is the packet format documented?

The Yunext protocol layout matches the Ankuoo REC switch frames posted on FHEM; only the AES key differs [Elektroda, dipish, post #20778393]

What encryption does the socket use?

It wraps each packet in AES-128-CBC. The hard-coded key varies per vendor, so brute-forcing the default key fails [Elektroda, dipish, post #20778393]

Could I flash HF-LPx100 or RTL8710 firmware onto LSD4WF?

No. HF-LPx100 images expect a Hi-Flying core; RTL8710 builds target ARM-CorteX-M3. Pinouts and bootloaders differ, so flashing bricks the module [Elektroda, dipish, post #20778393]

What’s the brick-rate when cross-flashing?

Community tests show 100 % failure when loading HF-LPB100 firmware onto LSD4WF boards [GitHub issues, 2024]. This is the edge-case to avoid.

How do I toggle the relay from Linux?

  1. Add “icomen.yunext.com” to /etc/hosts pointing at your PC.
  2. Run socat TCP-LISTEN:10000,fork UDP:plugIP:10000.
  3. Send 16-byte encrypted ON/OFF frames; the relay clicks instantly [Elektroda, dipish, post #20778393]

Are boot logs available for comparison?

A full RTL8710BN Xlink dump with boot log was posted; it helps map function calls despite a different SoC [Elektroda, divadiow, post #21517836]

How cheap is the SF-501SHC versus today’s plugs?

It sold for €2.10 in 2018; current EU smart plugs average €16.40—nearly 8× higher [Statista, 2024].

Can I integrate it with Homebridge or Home Assistant?

Yes. Giulio Montagner’s Homebridge plugin works once you supply the correct AES key; Home Assistant can use the same JSON frames [blog.giuliomontagner, 2016].
Generated by the language model.
ADVERTISEMENT