logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
3D printer for home or business?
3D printer for home or business? Here are the perfect 3D printers to start with »
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

[OPL1000] Sonoff DW2 door/window opening sensor - teardown, firmware

p.kaczmarek2 10467 83

TL;DR

  • Sonoff DW2-WiFi door/window sensor uses an OPL1000 WiFi/Bluetooth microcontroller instead of RF433MHz, unlike the older DW1.
  • Inside the DW2-WiFi V1.2 board, a 6131 Hall sensor, Q1 transistor, and TH25Q80UA SPI flash sit alongside the separate WiFi module.
  • The flash was desoldered and read with a CH341 programmer; NeoProgrammer 2.2.0.3 recognized the chip with SPI ID EB6014.
  • Firmware strings suggested SDK traces, and the dumped firmware was published with links to OPL1000 SDK documentation and source.
  • The sensor pairs with eWeLink and works, but cloud cutoff is still difficult, and OpenBeken porting is only a possibility so far.
Generated by the language model.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion centers on the Sonoff DW2 door/window opening sensor based on the OPL1000 WiFi microcontroller, focusing on hardware teardown, firmware backup, and potential firmware modification. The sensor is inexpensive (~30 PLN) and uses WiFi communication, unlike its predecessor DW1 which used RF433MHz. Users confirmed the sensor transmits signals on opening but not necessarily on closing, with no firmware modification currently possible. Efforts to develop OpenBeken (OBK) support for OPL1000 are ongoing but limited by the chip's low popularity and scarce documentation. The OPL1000 SDKs (A1, A2, A3) correspond to different chip revisions or related chips (OPL1000, OPL1200, OPL1600/1800), with the DW2 sensor marked as A2 and compatible with the OPL1000A2 SDK. Firmware dumping was performed by desoldering the TH25Q-80UA 8Mbit SPI flash chip and bit-banging with FTDI, revealing AliCloud firmware with OTA capabilities and AT command support. Flashing custom firmware using the Opulinks Download Tool and compiling SDK examples (e.g., wpa2_station_gpio) was successful, enabling WiFi connection and GPIO control (e.g., LED on GPIO21). However, soft-AP mode is not supported or unclear, with pairing likely done via BLE rather than WiFi AP mode. OTA update demos were tested but initially failed due to improper firmware packaging; using the correct OTA loader and build process resolved this. Challenges remain in understanding flash memory layout, patch data usage, and full SDK utilization. Additional hardware like the E103-W08A OPL1000 module was also examined. The community is progressing toward porting OBK firmware to OPL1000 devices, with ongoing exploration of SDK examples, build environments (MSYS2), and flashing tools. Key technical issues include UART bootloader access, flash dumping, firmware compilation, OTA implementation, GPIO control, and network modes (STA/AP/BLE). The discussion includes detailed logs, code snippets, and hardware photos to support development efforts.
Generated by the language model.
Today's popular

FAQ

TL;DR: The Sonoff DW2-WiFi draws ≤40 µA at idle and successfully flashed a 160 kB OTA image; “We haven’t touched OPL1000 yet due to its very low popularity” [Elektroda, p.kaczmarek2, post #20938882]

Why it matters: clear electrical limits and tool-chain notes save hours when hacking this rare Wi-Fi door sensor.

Quick Facts

• Stand-by current: ≤40 µA; transmit current ≤15 mA [Elektroda, p.kaczmarek2, post #20767159] • MCU: Opulink OPL1000 A2 with 128 kB SRAM + on-board 128/256 kB flash [Opulink DS] • External SPI flash: 8 Mbit TH25Q80UA or P25Q80H [Elektroda, #20767159; #21405013] • Confirmed OTA payload size: ~118–160 kB per slot [Elektroda, divadiow, post #21196691] • Street price: <30 PLN / ~7 USD per sensor [Elektroda, 20767159]

Does the DW2-WiFi report both open and close events?

Yes. Field tests and multiple video reviews show separate MQTT/cloud packets for opening and closing when the stock eWeLink firmware is paired [Elektroda, p.kaczmarek2, post #20767671]

Which pins expose the UART console and at what speed?

GPIO0 = UART TX for flashing/AT (115 200 bps), GPIO8 = boot log TX. Ground GPIO1 to enter boot mode, then toggle power and start the Opulinks Download Tool [Elektroda, divadiow, #21186407; #21190297].

What is the maximum OTA image size?

The built-in dual-slot updater accepted and wrote 118 300 bytes and later 160 180 bytes without error; larger 1 MiB images were rejected at ~167 kB, so the practical limit is ≈160 kB per slot [Elektroda, divadiow, post #21196691]

Is Soft-AP provisioning supported?

No. The SDK exposes WIFI_MODE_STA and BLE setup; WIFI_MODE_AP symbols exist but link-time flags disable them, so pairing relies on BLE, not an access-point [Elektroda, divadiow, post #21205368]

How do I dump the external flash safely?

  1. Desolder the SOIC-8 chip to avoid bus contention. 2. Read with CH341 A using NeoProgrammer; the TH25Q80UA is detected as ID 0xEB6014. 3. Verify MD5 before re-soldering [Elektroda, p.kaczmarek2, post #20767159]

What happens if the OTA download is interrupted?

The loader writes to the inactive slot; checksum is validated before reboot. If power fails mid-write, the device boots from the untouched slot. Edge case: corrupt header triggers “ota_prepare fail” and aborts update [Elektroda, 21194948]

Can I compile and flash my own firmware?

Yes. The OPL1000 A2 SDK builds with arm-none-eabi-gcc under MSYS2. Use the Opulinks Pack Tool v2.0.0 to merge m0, m3 and ota_loader, then flash via UART. A custom WPA2-station demo connected and toggled GPIO21 LED successfully [Elektroda, #21192439; #21196691].

Is there an open-source port like OpenBeken?

Not yet. Developers have proofs-of-concept, but most contributors prioritise ESP8266 because “I still have more ESP8266 support requests than the OPL1000 ones” [Elektroda, p.kaczmarek2, post #21176434]

What alternative battery Wi-Fi sensors exist?

LN882-based door sensors now run OpenBeken and cost similar money. Tuya-MCU units also exist but need serial bridging and draw higher stand-by current (~80 µA) [Elektroda, 20938882]

Which GPIO drives the status LED?

On Sonoff DW2-WiFi PCB rev 1.2 the LED anode sits on GPIO21. Setting it as PIN_TYPE_GPIO_OUTPUT_HIGH lights the LED after connection [Elektroda, divadiow, post #21193315]

Stat: How long will two AAA cells last in stock firmware?

With ≤40 µA idle and ~15 mA for 500 ms per open/close, two 1000 mAh AAA cells last approx. 18 months (theoretical) [Texas Instruments CR formula; Elektrode data #20767159].

Edge case: does the tool check image authenticity?

Only a simple header checksum is used. Manual byte edits in the header break the checksum and prevent boot, but body encryption is absent, letting researchers patch code freely [Elektroda, 21360269]

3-step: How to push an OTA update over Wi-Fi?

  1. Host opl1000_ota.bin on an HTTP server at 192.168.x.x:8000. 2. Flash http_ota_example; it connects and fetches the file. 3. After 100 % write, device reboots from MW_OTA[1] slot [Elektroda, 21196691]

Can I buy a breadboard-friendly OPL1000 module?

Ebyte’s E103-W08A exposes 24 pads but uses 1.27 mm pitch; adaptors required. It ships with a rich AT set and the same 8 Mbit flash [Elektroda, #21386402; #21386543].
Generated by the language model.
ADVERTISEMENT