logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Arlec Grid Connect Smart Home Control Kit - 5 Device Teardown

wolfieeewolf 2508 11
ADVERTISEMENT
Reply Cool? Ranking DIY | New topic
Notify about new articles
  • The Arlec Grid Connect Smart Home Control Kit has 4 separate devices bundled together. I will break them down one by one

    You can not use any of the sensors or buttons without the Hub as they are all running Bluetooth chips.

    Device Name: Arlec Grid Connect Smart Home Control Plug
    Device Type: Hub and Energy meter
    Device Chip: Unknown. This device is sonically welded shut.

    White Arlec Grid Connect smart home plug with logo.

    Flashing of Main Chip

    I have no idea what kind of chip is inside. The device is sonically welded shut. Considering how much I paid for the kit I am reluctant to take it apart.

    I believe it could possibly be a BK7231N/BK7231T chip as it has energy monitoring on board and the Arlec PC191HA runs on those as well. I have tried to use CloudCutter Lightleak to query the chip but have not been successful.

    The device also has some kind of Bluetooth chip on board as the bundled sensors require the hub to run them.

    Device Name: Arlec Grid Connect Contact Sensor
    Device Chip: BT5S

    White Arlec Grid Connect contact sensor with two parts. Top view of the Arlec Grid Connect contact sensor PCB with BT5S chip and connector labels.

    Flashing of Main Chip

    Appears this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

    Device Name: Arlec Grid Connect Motion Sensor
    Device Chip: BTU

    White cube-shaped motion sensor Arlec. Close-up of Arlec Grid Connect BTU circuit board. Inside view of the electronic components of the Arlec Grid Connect device.

    Flashing of Main Chip

    Appear this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

    Device Name: Arlec Grid Connect Smart Button Kit Version
    Device Chip: BT5S

    White Arlec Grid Connect attachment in a square shape. Electronic board with a BT5S module and SMD components. Printed circuit board with smart home electronic components

    Flashing of Main Chip

    Appears this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

    There are two versions of the smart button one comes with the kit the other can be purchased on its own. They both have different chips

    Device Name: Arlec Grid Connect Smart Home Button
    Device Chip: ers-10tBBvB-aa_v1.2

    Printed circuit board with a microchip and inscriptions on the surface. Internal view of an Arlec Grid Connect device with visible circuitry. View of the interior of a smart home device with a CR2032 battery.

    Flashing of Main Chip

    Appears this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

    See Here for the best teardown of this device.


    Configuration of all devices

    So far I have just been using a combination of Home Assistants Tuya Integration, Local Tuya and Tuya BLE

    I have most of the devices working except for the smart buttons. None of the integrations seems to get them to show up. I can use the Tuya app to make scenes for the buttons but the scenes only allow you to control Tuya devices linked to the app. The scenes do show up in home assistant but you can't really do much with them. I have put in a git hub request with Tuya BLE to see if they can get the buttons working. At this stage, it's still pending.

    When I get some time I will see if I can pull some data off these chips to see if they are hackable and post it here.

    Cool? Ranking DIY
    About Author
    wolfieeewolf
    Level 11  
    Offline 
    wolfieeewolf wrote 92 posts with rating 18, helped 6 times. Been with us since 2023 year.
  • ADVERTISEMENT
  • #2 20697702
    p.kaczmarek2
    Moderator Smart Home  
    Very interesting devices, they remind me of Aqara set that I have tested two years ago or so.

    Can you write few words about how you've got them to connect to HA without changing firmware? I haven't used Tuya BLE project yet. It looks promising.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • Helpful post
    #3 20700779
    wolfieeewolf
    Level 11  

    p.kaczmarek2 wrote:
    Can you write a few words about how you got them to connect to HA without changing the firmware?


    Connecting Devices to Home Assistant Without Changing Firmware

    Step 1: Link Devices to Tuya App:

    Begin by linking all your devices to the Tuya App on your mobile phone.

    Step 2: Obtain Access Credentials:

    Follow the Tuya Integration Guide to create an access ID and client secret.

    Step 3: Install Local Tuya:

    Install Local Tuya by following this guide.

    Step 4: Set Up Devices:

    Initially, use Local Tuya to set up the hub.
    For motion and contact sensors, utilize the Home Assistant Tuya Integration.

    Step 5: Smart Button Support:

    Smart buttons have limited support. Scenes can be created via the mobile app and accessed in Home Assistant, but they primarily work with devices from the Tuya app.
    Automation within Home Assistant may be required to expand its functionality.

    Step 6: TuyaBLE Integration:

    For better smart button support, submit a request on the TuyaBLE GitHub page.
    Note that the developer's progress may be influenced by external circumstances.
  • #4 20703284
    wolfieeewolf
    Level 11  
    Any ideas on what would be the best way to extract the firmware off these devices? They are Tuya modules so I was guessing just using the Tuya SDK or something like that. I did look at using BKwriter and easy flasher but they seem to only work with BK7231 modules.

    I also looked at getting a JTAGulator or a Black Magic Probe but they are ridiculously expensive.

    Not really sure what else to try. Any suggestions would be great.
  • ADVERTISEMENT
  • #5 20704555
    wolfieeewolf
    Level 11  
    So it looks like one of the smart buttons has an MCU on board

    Close-up of a circuit board with a TLSR8250 chip from Telink.

    It's a TLSR8250 from Telink.

    Appears there are some burning tools that could allow you to get data of the chip. Unfortunately, it looks like you need one of these Telink Kits.

    I did find an OTA solution here but Not really sure how to use it yet.
  • ADVERTISEMENT
  • #6 20704597
    p.kaczmarek2
    Moderator Smart Home  
    If their tools are operating on top of the UART, it still should be possible use cheap UART dongle. Maybe you can try first checking the RX and TX pins with UART to USB converter and see if there are any debug logs printed out. We could later use that debug logs to determine which SDK they used to create firmware for this.

    As for the software, please stick only to original flasher tools when trying to support new devices. Using a third party tool can be very risky, if no one tested it before, it may as well brick your device.
    Helpful post? Buy me a coffee.
  • #7 20715558
    wolfieeewolf
    Level 11  
    p.kaczmarek2 wrote:
    If their tools are operating on top of the UART, it still should be possible use cheap UART dongle. Maybe you can try first checking the RX and TX pins with UART to USB converter and see if there are any debug logs printed out. We could later use that debug logs to determine which SDK they used to create firmware for this.


    I have been trying to extract data from the modules using Realterm. I haven't been successful yet in getting any data to output.

    It got the better of me and I decided to try and open the Hub. Inside I found it uses a CR2S module. I haven't yet tried to pull data from it. It appears the is an MCU on board as well so might not be able to get too much information from the device. Will see how I go and I'll post the results.

    A circuit board with visible electronic components, including integrated circuits and resistors. Close-up of a circuit board showing electronic components, including an IC labeled ICW4008 and a 2A fuse. View of an electronic module with various components on a printed circuit board. CR2S module with electronic components on a circuit board.

    Added after 3 [hours] 34 [minutes]:

    I have been trying to get the data off the CR2S module but I'm not having much success.

    I have tried using Realterm, YAT and Putty but none of them seem to be able to get anything.

    I have tried 4 different USB to TTY/Serial adapters and basically every setting I can think of that should work and still nothing.

    I thought there was something wrong with the drivers but I have tested it with some other modules and they all get an output fine.

    I desoldered the module and tried connecting that way but still no show.

    Unfortunately in my desoldering of the uart wires the TX pad ripped off so I can't do any more testing.

    There was no magic smoke when I turned it back on so for now it looks like it still works. Need to do a bit of testing to see if I still have full function with the device. So far it appears to be working ok with the other devices.

    I'm sure there is a way to get these modules to output something but whatever that is it's beyond my skill level.
  • #8 20812524
    wolfieeewolf
    Level 11  
    Have been doing a little bit more investigation about these devices. I found a few things that might be interesting

    TLSR8250F512ET32


    datasheet for the TLSR8250
    Datasheet_...SR8250.pdf Download (1.46 MB)

    So far it appears that there is no way to dump the firmware without some kind of authorization key and a Telink Burning and Debugging Tool (BDT).
  • #9 20814187
    wolfieeewolf
    Level 11  
    Not sure if this is at all helpful but I did find a Github link to some people having the same issues with Telink chips. Link

    This could possibly be the SDK to get it flash. Still looks like it will need a lot of work to get it working with OBK.
  • #10 20814316
    p.kaczmarek2
    Moderator Smart Home  
    Nice find! Is there a flasher as well? Can you try to read the firmware dump?
    Helpful post? Buy me a coffee.
Reply Cool? Ranking DIY | New topic
Notify about new articles
Report a violation of the law

Topic summary

The discussion revolves around the Arlec Grid Connect Smart Home Control Kit, which includes a hub and several Bluetooth-enabled devices. Users are exploring methods to extract firmware from these devices, particularly focusing on the Arlec Smart Home Control Plug, which is suspected to contain a BK7231N/BK7231T chip. Various approaches to connect the devices to Home Assistant without altering firmware are shared, including using the Tuya app and Local Tuya integration. Users also discuss challenges in accessing the internal components, with one user identifying a TLSR8250 MCU in a smart button and another discovering a CR2S module in the hub. Tools like UART converters and Telink Burning and Debugging Tools (BDT) are suggested for firmware extraction, but users express concerns about the complexity and cost of these tools.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT