Arlec Grid Connect Smart Home Control Kit - 5 Device Teardown

wolfieeewolf 627 6

Reply Cool? Ranking DIY | New topic

Notify about new articles

Helpful post? (+1)

#1 17 Aug 2023 15:32

The Arlec Grid Connect Smart Home Control Kit has 4 separate devices bundled together. I will break them down one by one

You can not use any of the sensors or buttons without the Hub as they are all running Bluetooth chips.

Device Name: Arlec Grid Connect Smart Home Control Plug
Device Type: Hub and Energy meter
Device Chip: Unknown. This device is sonically welded shut.

Flashing of Main Chip

I have no idea what kind of chip is inside. The device is sonically welded shut. Considering how much I paid for the kit I am reluctant to take it apart.

I believe it could possibly be a BK7231N/BK7231T chip as it has energy monitoring on board and the Arlec PC191HA runs on those as well. I have tried to use CloudCutter Lightleak to query the chip but have not been successful.

The device also has some kind of Bluetooth chip on board as the bundled sensors require the hub to run them.

Device Name: Arlec Grid Connect Contact Sensor
Device Chip: BT5S

Flashing of Main Chip

Appears this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

Device Name: Arlec Grid Connect Motion Sensor
Device Chip: BTU

Flashing of Main Chip

Appear this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

Device Name: Arlec Grid Connect Smart Button Kit Version
Device Chip: BT5S

Flashing of Main Chip

Appears this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

There are two versions of the smart button one comes with the kit the other can be purchased on its own. They both have different chips

Device Name: Arlec Grid Connect Smart Home Button
Device Chip: ers-10tBBvB-aa_v1.2

Flashing of Main Chip

Appears this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

See Here for the best teardown of this device.

Configuration of all devices

So far I have just been using a combination of Home Assistants Tuya Integration, Local Tuya and Tuya BLE

I have most of the devices working except for the smart buttons. None of the integrations seems to get them to show up. I can use the Tuya app to make scenes for the buttons but the scenes only allow you to control Tuya devices linked to the app. The scenes do show up in home assistant but you can't really do much with them. I have put in a git hub request with Tuya BLE to see if they can get the buttons working. At this stage, it's still pending.

When I get some time I will see if I can pull some data off these chips to see if they are hackable and post it here.

Cool? Ranking DIY
About Author
wolfieeewolf wolfieeewolf

Level 9
Offline

Joined: 10 Feb 2023

Posts: 43

Help: 5

Posts rating: 10

Points: 83
wolfieeewolf wrote 43 posts with rating 10, helped 5 times. Been with us since 2023 year.
#2 17 Aug 2023 21:41

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#2 17 Aug 2023 21:41

Very interesting devices, they remind me of Aqara set that I have tested two years ago or so.

Can you write few words about how you've got them to connect to HA without changing firmware? I haven't used Tuya BLE project yet. It looks promising.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600 and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects
Helpful post

#3 20 Aug 2023 13:01

wolfieeewolf wolfieeewolf

Level 9

Topic author Helpful post? (+2)

Helpful post #3 20 Aug 2023 13:01

p.kaczmarek2 wrote:
Can you write a few words about how you got them to connect to HA without changing the firmware?

Connecting Devices to Home Assistant Without Changing Firmware

Step 1: Link Devices to Tuya App:

Begin by linking all your devices to the Tuya App on your mobile phone.

Step 2: Obtain Access Credentials:

Follow the Tuya Integration Guide to create an access ID and client secret.

Step 3: Install Local Tuya:

Install Local Tuya by following this guide.

Step 4: Set Up Devices:

Initially, use Local Tuya to set up the hub.
For motion and contact sensors, utilize the Home Assistant Tuya Integration.

Step 5: Smart Button Support:

Smart buttons have limited support. Scenes can be created via the mobile app and accessed in Home Assistant, but they primarily work with devices from the Tuya app.
Automation within Home Assistant may be required to expand its functionality.

Step 6: TuyaBLE Integration:

For better smart button support, submit a request on the TuyaBLE GitHub page.
Note that the developer's progress may be influenced by external circumstances.
#4 22 Aug 2023 09:33

wolfieeewolf wolfieeewolf

Level 9

Topic author Helpful post? (0)

#4 22 Aug 2023 09:33

Any ideas on what would be the best way to extract the firmware off these devices? They are Tuya modules so I was guessing just using the Tuya SDK or something like that. I did look at using BKwriter and easy flasher but they seem to only work with BK7231 modules.

I also looked at getting a JTAGulator or a Black Magic Probe but they are ridiculously expensive.

Not really sure what else to try. Any suggestions would be great.
#5 23 Aug 2023 06:51

wolfieeewolf wolfieeewolf

Level 9

Topic author Helpful post? (0)

#5 23 Aug 2023 06:51

So it looks like one of the smart buttons has an MCU on board

It's a TLSR8250 from Telink.

Appears there are some burning tools that could allow you to get data of the chip. Unfortunately, it looks like you need one of these Telink Kits.

I did find an OTA solution here but Not really sure how to use it yet.
#6 23 Aug 2023 07:58

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#6 23 Aug 2023 07:58

If their tools are operating on top of the UART, it still should be possible use cheap UART dongle. Maybe you can try first checking the RX and TX pins with UART to USB converter and see if there are any debug logs printed out. We could later use that debug logs to determine which SDK they used to create firmware for this.

As for the software, please stick only to original flasher tools when trying to support new devices. Using a third party tool can be very risky, if no one tested it before, it may as well brick your device.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600 and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects
#7 31 Aug 2023 06:24

wolfieeewolf wolfieeewolf

Level 9

Topic author Helpful post? (0)

#7 31 Aug 2023 06:24

p.kaczmarek2 wrote:
If their tools are operating on top of the UART, it still should be possible use cheap UART dongle. Maybe you can try first checking the RX and TX pins with UART to USB converter and see if there are any debug logs printed out. We could later use that debug logs to determine which SDK they used to create firmware for this.

I have been trying to extract data from the modules using Realterm. I haven't been successful yet in getting any data to output.

It got the better of me and I decided to try and open the Hub. Inside I found it uses a CR2S module. I haven't yet tried to pull data from it. It appears the is an MCU on board as well so might not be able to get too much information from the device. Will see how I go and I'll post the results.

Added after 3 [hours] 34 [minutes]:

I have been trying to get the data off the CR2S module but I'm not having much success.

I have tried using Realterm, YAT and Putty but none of them seem to be able to get anything.

I have tried 4 different USB to TTY/Serial adapters and basically every setting I can think of that should work and still nothing.

I thought there was something wrong with the drivers but I have tested it with some other modules and they all get an output fine.

I desoldered the module and tried connecting that way but still no show.

Unfortunately in my desoldering of the uart wires the TX pad ripped off so I can't do any more testing.

There was no magic smoke when I turned it back on so for now it looks like it still works. Need to do a bit of testing to see if I still have full function with the device. So far it appears to be working ok with the other devices.

I'm sure there is a way to get these modules to output something but whatever that is it's beyond my skill level.
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Log in with Google

Reply Cool? Ranking DIY | New topic

Notify about new articles