Teardown and Flashing Guide for SYLVANIA SmartPlus A19CCECWF RGBCT Bulb

Thank you, but can you also please include a full JSON template from the Web App, so I can add this device to our list here: https://openbekeniot.github.io/webapp/devicesList.html

Here's the JSON:

rronnander wrote:

The only thing odd is the device configuration states it is a WB3S, however, the module is a WB8P. Maybe that's actually "normal"?

Near as I can tell from comparing these boards is that the 8P has improved characteristics for antenna gain 2 dBi vs 1.2 and higher operating temp 105 'C vs 85'C with a new layout with I/O pins on 1 side vs 3 sides.



Thus "normal" to use latest Revision. So they keep track of major revisions by changing the model # and firmware changes ought to be compatible but may have bugs fixed.

I've taken a closer look at the main chips used on the circuit board:

BP2306 - LED Driver:



BP5628C - Dimmer:



KP15051SPA - Power Distribution:



No idea how to try to test these out with the configuration / pinout. I'll take a look around the forums for some other examples.

LED driver is controlled by PWM

The low side switch for regulation and buffer of current is provided by FET


This chip supports PWM Current Sensing (CS)

Okay, I have the following PWM mappings:



RGB mode seems to be working well with brightness and colors. The RED seems a little miscalibrated in the color picker. There's a sweet spot of deep red and then everything quickly looks pink, other colors seem pretty calibrated.

Setting the proper color range (2700-6500K):


Playing around with the PWM mappings on 24/26 give me the temp color slider. This puts the bulb into what appears to be white color mode stock temp (2700K). Adjusting the slider just acts as a weird additional brightness control but the color temp stays at 2700K. Looking into this more, but progress!

Added after 2 [hours] 20 [minutes]:

Okay, I think I have it working as expected now.

I enabled the following extra flags:

Flag 8 - [LED] Alternate CW light mode (first PWM for warm/cold slider, second for brightness)
Flag 24 - [LED] Emulate Cool White with RGB in device with four PWMS - Red is 0, Green 1, Blue 2, and Warm is 4



It's "working" in all modes. Looks good at first glance, but I'll test it against a tuya firmware version later this weekend. When the dust settles I'll update my original post with all the current config/info.

Gotten a few of these, how did you get the cloudcutter to work? Can't seem to get these bulbs into slow-flashing AP mode. Just quick flashing color cycling.

Which version did you get? Maybe it's patched already.
Here are tutorials for UART flash method (check which BK7231 chip you got):
https://www.youtube.com/playlist?list=PLzbXEc2ebpH0CZDbczAXT94BuSGrd_GoM

p.kaczmarek2 wrote:

Which version did you get? Maybe it's patched already.

Same model: A19CCECWF
But different SKU 75812 (4-pack)

Sylvania Wifi App shows device firmware version 1.1.4. Can't add to SmartHome/Tuya to double check firmware version.
Tried many different methods of trying to get into Access Point(AP) mode, but no luck, just quick flashes - 3 quick on/off, 5 quick on/off, 8 quick on/off, 10 quick on/off and same variations with 1 sec on/2 sec off, 5 sec on, 5 sec off, etc.. No SYLVANIA-* or any new Wifi APs show up with wifi scan on another computer, just the existing wifi APs around me. Maybe this model/update just uses bluetooth to do the pairing for WIFI.

>>21251013
I believe the magic number is 6 cycles. This is technically 6.5/7 cycles if you count the first power on event as a cycle. When flashing I was easily able to get each bulb into AP mode by powering the bulb up for ~10 seconds, then cycling the power 6 times. I hope they didn't patch these bulbs, they're a great option. I've also since moved on to ESPHome for these particular bulbs. Let me know if you can still flash the latest bulbs.

From tuya-cloudcutter's INSTRUCTIONS.md:

Quote:

When instructed, put your Tuya device in AP Mode by toggling it off and on again 6 times, with around 1 second in between each toggle. If it's a light bulb, it will blink slowly. If it blinks quickly, power cycle it 3 more times.

>>21255509 Just joined. I can confirm that the 4 packs from Menards with this bulb still work, and still are exploitable.
I have just converted 2 of my 4 just now, using tuya-cloudcutter.
Worked perfectly, and exactly like the instructions there (and here) say.

PS: If you have a Menards local to you, they are Clearancing them out for $6 for the 4 pack.

Added after 8 [minutes]:

rronnander wrote:

>>21251013
I've also since moved on to ESPHome for these particular bulbs.

Where did you get the config for ESPHome to be able to set the LEDs themselves?

I was planning to use this similar model as a guide, but wasn't sure:
https://devices.esphome.io/devices/LEDVANCE-E27-RGBW

Thanks for any info/help!

>>21345974

Thanks for the Menards tip.. I grabbed a few boxes today at $6.

I also grabbed a box of the smart plugs for $7.. I have been able to use cloudcutter on those as well. So far I don't see energy monitoring but useful for on/off.

>>21255509 >>21251013

I bought 5 boxes of these from the Menards clearance deal. I had a set of 4 bulbs from back in 2022 already outside that I was using local Tuya with. I was able to flash the 4 I already had with cloudcutter without issue. I was then able to flash 4 out of 5 boxes I got from Menards. One of the boxes I could not get a single bulb to go into AP Mode/Slow blink. I have no clue what the difference is with that one box. From the outside of the box, there's no difference. Same order number/shipment sticker on them. Boxes look the same. Considering I flashed 20 bulbs of this variety just fine, I think it's pretty safe to say there are some floating around that can't easily be put into AP Mode. The normal 3 cycles or 6 cycles just doesn't get them there. I will be deconstructing one of them for science.

>>21255509 A little more info on getting these into slow blink AP mode. Rronnander's (#21251013) advice worked well for me:

Quote:

I believe the magic number is 6 cycles. This is technically 6.5/7 cycles if you count the first power on event as a cycle. When flashing I was easily able to get each bulb into AP mode by powering the bulb up for ~10 seconds, then cycling the power 6 times.

When I did it, I did the off & on each less than a second, and did the initial power-on for about 20 seconds. After turning the power off & on the 5th time, the bulbs very briefly flashed off for a fraction of a second after turning on. I turned the bulb off and back on immediately after the brief flash.

On the first few bulbs I wasn't as consistent and now those will not go into slow blink AP mode. My guess is this mode gets locked out if it sees too many power off/on cycles or some other pattern it doesn't like.

I am struggling to get these A19CCECWF Bulbs to get into Slow AP flash. I've tried so many different versions of the above.
Power on for 20 seconds, turn off and on 6 times with 1 second inbetween.
Power on for 10 seconds, turn off and on 6 times but 5 seconds inbetween.
And a few other variations in there as well.
Is there a fool proof plan to get these into slow AP? I have the top off one and think I might hook up UART and flash it, but the EN pin is in a terrible location.
Thanks in advance.

bleeblak8 wrote:

I am struggling to get these A19CCECWF Bulbs to get into Slow AP flash. I've tried so many different versions of the above.
Power on for 20 seconds, turn off and on 6 times with 1 second inbetween.
Power on for 10 seconds, turn off and on 6 times but 5 seconds inbetween.
And a few other variations in there as well.
Is there a fool proof plan to get these into slow AP? I have the top off one and think I might hook up UART and flash it, but the EN pin is in a terrible location.
Thanks in advance.

Same issue here. Unable to get these into slow AP. Following in case someone knows a reliable method

Model: A19CCECWF
SKU: 75812 (4 pack)

I was able to grab four boxes of these from Menards. I've only opened two boxes so far, and here are my findings.

Box #1
Firmware v1.1.4
Unable to place into AP mode to run tuya-cloudcutter against it. tuya-convert is also unable to exploit it.

Box #2
Firmware v1.0.9
Able to place this box into AP mode and successfully flash via firmware selection (1.0.9 - BK7231T / oem_bk7231s_light_sp_mix4to5_db). Attempting to exploit by brand did not work. Like was said above, the process to get these bulbs into slow mode does not match any documentation I was able to find.

To get these bulbs into slow flash/AP mode:
1) Turn bulb on, wait until it starts flashing
2) Turn bulb off for .5 seconds
3) Turn bulb on for .5 seconds (First power-on)
4) Turn bulb off for .5 seconds
5) Turn bulb on for .5 seconds (Second power on)
6) Turn bulb off for .5 seconds
7) Turn bulb on for .5 seconds (Third power on)
8) Turn bulb off for .5 seconds
9) Turn bulb on for .5 seconds (Fourth power on)
10) Turn bulb off for .5 seconds
11) Turn bulb on, wait for flicker in light (Fifth power on)
12) Light should start flashing in AP mode

If you power the light on and it doesn't do a quick fade to on, but instead immediately turns on at full brightness, the controller didn't reboot and you turned the light on and off too fast. Also note that after the exploit runs, and you see the message block appear that says to power cycle and place the device into AP mode *again*, you need to power the bulb off quickly, then power it back on after a few seconds. If you wait too long, the exploit will fail.

Will update with more information as I work through these.

EDIT: I've got ESPHome working on all 8 v1.0.9 bulbs I've received. Easy process via tuya-cloudcutter. The v1.1.4 bulbs... I can't get them into AP mode to run cloudcutter. Some people were asking for an ESPHome template for the bulbs, below is what I was able to get working, adding it here for reference.: