Jasco Enbrighten Café WiFi Lights - Teardown and Analyzing WB3S-IPEX Module

Jasco Enbrighten Cafe WiFi light teardown and analyzing [WB3S-IPEX]

My goal is to get all functions of these lights working locally in home assistant.

Jasco Enbrighten Café WiFi lights are sold in 12 and 24 strand sets. This teardown is for the 12-strand set, but I presume the 24 strand set is similar. They are controlled by the Tuya cloud with a custom app written by Enbrighten, but of course can also be fully controlled by Tuya Smart which is what I will be using in the teardown.


The plug on the power cord has a 250V5A glass fuse. The plug connects to a large enclosure by 18" of 18AWG 2-wire cable. The enclosure is wrapped in thick rubber via an injection molding process - presumably for waterproofing. The rubber was thick and difficult to cut, but thankfully not adhered to the plastic enclosure. Once the rubber was removed we can see several screws that need to be removed to gain access.


The enclosure contains the power supply, a daughterboard containing a Tuya WB3S-IPEX wifi module with external antenna and an unlabeled MCU, and a 2 wire button that shorts to enter pairing mode (long-press) or manually cycle through colors (short-press). The motherboard is secured to the bottom of the enclosure with two screws and was then filled with 10mm of epoxy - presumably for waterproofing. Note in the last photo I had already removed the wiring going to the lights and installed header pins.


The hard epoxy obscured almost everything. It was very difficult to remove the motherboard from the enclosure. After much prying and cutting I was able to remove it, but in the process I damaged part of the high voltage power supply. Once removed from the enclosure, I was able to use a heat gun, knives, scrapers, and plastic trim tools to remove enough epoxy from the motherboard to see the necessary low voltage components. I discovered I was able to back feed 5V and ground on the low voltage wires heading to the lights to get everything to function - hooray! I plan to repair the power supply or just feed the lights with an external supply.


The other end of the enclosure connects to the lights via a main cable. The main cable is 5-wire 18AWG and very thick. Two wires (black and white) are mains passthrough to the female plug on the end of the strand. The other three are 5V (red), ground (green), and data (blue). Each bulb tees off the main cable with a smaller diameter 4-wire 20AWG cable containing 5V, ground, and two data lines for daisy chaining Din and Dout to each bulb.


Each bulb unscrews to reveal a translucent dispersion lens secured to the base by three screws. There is a rubber gasket between the lens and base. The LED PCB has a RBG LED and a white LED. We can also see 5V, Din, Dout, and ground terminations from the 4-wire cable. The backside of the PCB contains an IC labeled OT1024B and what looks like FAZ1-7491MT along with various resisters and components. I was unable to find documentation on the IC. If you can find something, please share!




Interestingly, there is also the same OT1024B IC on the backside of the motherboard which is where some of the Tuya+MCU daughterboard Data pin connects. Probing the IC shows it is a 4-channel RGBW driver using an unknown protocol with the voltages below. I don't have a proper Oscilliscope and wasn't confident that my Arduino scope (https://projecthub.arduino.cc/Ameduino/diy-arduino-oscilloscope-56d4c0) output was accurate. I suspect the OT1024B is a generic IC using a common protocol, but have yet to discover which one. If you know, please share!


The Tuya+MCU daughterboard has 7 pads that physically pierce the motherboard and are soldered to corresponding pads on the backside of the motherboard. I removed the assembly to clean up with some IPA and photograph. I then reattached it at a better angle in order to access all the Tuya pads. We can clearly see the part number for the Tuya Wifi chip is WB3S-IPEX which is detailed at https://developer.tuya.com/en/docs/iot/wb3sipex-module-datasheet?id=K9irq0laun21z
WB3S-IPEX ...atform.pdf Download (661.73 kB)

At this point, I soldered wires to TXD1, RXD1 and GND then used two ESP32s in UART passthrough mode with TuyaMCUAnalzer.


Upon power-up we see the MCU info: {"p":"2q0e3h56uzb0sxbv","v":"0.2.11","m":0}. We also see two useful dpIds showing current value of the lights:
Power ..pdf Download (89.53 kB)

dpId=104 Str V=111111111111
- Individual bulb on/off as ASCII 1 or 0:
dpId=106 Str V=9001f403e8
- Mode, effect, speed, brightness and optional channel value (appended and delimited as ASCII 0#, max three).
- I cycled through the various colors, presets and customizations and noticed the following patterns below. The PDF has a ton of examples from the analyzer.
Decode T..a.pdf Download (115.85 kB)

Mode
0: Fade
1: Blink
2: Twinkle
3: Rainbow
4: Red White Blue
5: Red White Green
6: Mardi Gras
7: Valentines
8: Autumn
9: St. Patricks
a: Spring
b: Customize (probably b-f are custom save banks)

Effect
0: Solid (ignore mode and next 4 characters which are speed)
1: Twinkle
3: Pulse
4: Wave Chase
5: Chase
6: Wave
7: Fade
Speed
03e8 - 100%
01f4 - 50%
000a - 1%
Brightness
03e8 - 100%
01f4 - 50%
000a - 1%

I thought it'd be helpful to show some app screenshots.
1. Colors section. Note one red orb and 62 colors per the box. Also note the My Lights button explained in 2. This changes dpId 106.

2. My lights screen where you can add up to three orbs and set color for the repeating pattern, or toggle power to each bulb. This changes dpId 104.

3. Mode which contains presets (effects, brightness and speed manipulations). This changes dpId 106.

4. Dimming with range of 1%-100%. This changes dpId 106.


At this point I could use some guidance on next steps. I have some questions:

1. Can anyone tell by what I captured if this is a standard RGBW protocol?
2. Do I have enough data to recreate everything? I have four strands of lights, so can flash one and tear down another if I need more data.
3. Does BK7231Flasher support the WB3S-IPEX Tuya chip? I know WB3S is supported, but not sure if the IPEX piece matters or not. I know I'll have to detach the WB3S chip from the daughterboard since the MCU will interfere.
Note I tried to connect the lights to an ESP32 running WLED, but was unable to get them to turn on or do anything. I suspect it's because I don't have a level shifter inline and have ordered some. I'd like to just reflash the Tuya chip and learn if folks are willing to help!

Very good writeup! I will just add that 0x03e8 is 1000 in hex, so ranges are 0-1000.

The TuyaMCU RGB packet in OBK is implemented with tuyaMcu_setupLED https://www.elektroda.com/rtvforum/find.php?q=tuyaMcu_setupLED but it may not be the same as yours:

Still, if you just want, we can implement format of your device as well. We just would need your help with testing...

WB3S-IPEX is literally the same as WB3S but has added external connector for the antenna. Just remember that in order to flash it in TuyaMCU setup you may need to sever UART lines. TuyaMCU guide:
https://www.elektroda.com/rtvforum/topic4038151.html

I don't think lights not working with ESP32 is the levels issue, maybe you need to disconnect them from MCU first. Or maybe they are not straigh up WS2812B but some other different flavour with different timings.

I think you can make 2MB flash backup of this device and we will try to gradually create an autoexec.bat (and support) for that...

Added after 4 [minutes]:

EDIT 1:
This is totally new to me but it should be very easy to create driver for that:

Quote:

dpId=104 Str V=111111111111
- Individual bulb on/off as ASCII 1 or 0:

I may already look into it soon.

This:

also seems new.

I am thinking that I can consider putting support of that into separate driver for more clarity. As long as we know the formats (which you already reverse-engineered), it should be relatively easy.

Added after 1 [minutes]:

EDIT 2:
My current plan would be to create a secondary driver to work along with TuyaMCU and just receive/send the string values of those two dpIDs. I would just add a "on dpID set" callback and process it.

Firmware from BK7231Flasher. Really appreciate the assistance!
readResult...-07-38.bin Download (2 MB)

just adding a few things from that firmware for the records

boot log (bootloader not from your binary). Obviously it's not able to talk to the TuyaMCU past a certain point



user_params



fw 1.1.71 looks to be cloudcutter exploitable

So I would suggest starting with the most basic TuyaMCU config (baud rate setting + wifi default state to 0x04) and maybe manually sending string packets for now. In the morning I can look into making some kind of wrapper/driver for those two string data points (binary on/off for LEDs and this main control string)

OK, I will try to flash the latest OpenBK and do some testing.

One observation worth noting after reading your reply is the delimiter is just #, not 0#. It seems that IF the eleventh character exists then it tells us how many colors will be appended to the string which correspond to the repeating pattern (and how many orbs will show up on the colors section of the app to set color). The range is 0-2, so 3 total which lines up to the max on the app. Curious what'll happen if I set it to 4 and add a fourth color! I'll update my PDF in the main post with this information.

Pure red (max bright) - All 12 bulbs are solid red.
dpId=106 Str V=b001f403e80#00ff0000

Customize ([red][empty][empty], dimming at 50%, effect solid) - All 12 bulbs are solid red.
dpId=106 Str V=b001f401f40#00ff0000

Customize ([red][green][empty], dimming at 50%, effect solid) - Bulbs alternate red and green and are solid.
dpId=106 Str V=b001f401f41#00ff0000#0000ff00

-Customize ([red][green][blue], dimming at 50%, effect solid) - Bulbs alternate red, green blue and are solid
dpId=106 Str V=b001f401f42#00ff0000#0000ff00#000000ff

Updates:
I successfully flashed to 1.17.736 and added a simple autoexec.bat with 9600 baud and wifi.

I am able to successfully send commands and the MCU/lights respond as expected! Hooray! Here are some examples:

Product:
Info:CMD:[WebApp Cmd 'uartSendHex 55AA0001000000' Result] OK
Info:TuyaMCU:Received: 55 AA 03 01 00 2B 7B 22 70 22 3A 22 32 71 30 65 33 68 35 36 75 7A 62 30 73 78 62 76 22 2C 22 76 22 3A 22 30 2E 32 2E 31 31 22 2C 22 6D 22 3A 30 7D A5
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 1 (QueryProductInformation) len 50
Info:TuyaMCU:ParseQueryProductInformation: received {"p":"2q0e3h56uzb0sxbv","v":"0.2.11","m":0}

QueryInitStatus:
Info:CMD:[WebApp Cmd 'uartSendHex 55 AA 00 08 00 00 07' Result] OK
Info:TuyaMCU:Received: 55 AA 03 07 00 05 14 01 00 01 01 25
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
Info:TuyaMCU:ParseState: id 20 type 1-bool len 1
Info:TuyaMCU:ParseState: byte 1
Info:TuyaMCU:Received: 55 AA 03 07 00 10 68 03 00 0C 31 31 31 31 31 31 31 31 31 31 31 31 DC
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 23
Info:TuyaMCU:ParseState: id 104 type 3-str len 12
Info:TuyaMCU:Received: 55 AA 03 07 00 18 6A 03 00 14 62 30 30 31 66 34 30 33 65 38 30 23 36 34 36 34 63 38 62 65 B8
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 31
Info:TuyaMCU:ParseState: id 106 type 3-str len 20
Info:TuyaMCU:Received: 55 AA 03 07 00 05 6B 04 00 01 0C 8A
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
Info:TuyaMCU:ParseState: id 107 type 4-enum len 1
Info:TuyaMCU:ParseState: byte 12
Info:TuyaMCU:Received: 55 AA 03 07 00 08 1A 02 00 04 00 00 00 00 31
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
Info:TuyaMCU:ParseState: id 26 type 2-val len 4
Info:TuyaMCU:ParseState: int32 0

White 2200K(max bright ***Note only the White LED is on, RGB LEDs are off):
Info:CMD:[WebApp Cmd 'uartSendHex 55 AA 00 06 00 18 6A0300146230303166343033653830234646303030303030 2A ' Result] OK
Info:TuyaMCU:Received: 55 AA 03 07 00 18 6A 03 00 14 62 30 30 31 66 34 30 33 65 38 30 23 46 46 30 30 30 30 30 30 2E
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 31
Info:TuyaMCU:ParseState: id 106 type 3-str len 20
Info:TuyaMCU:Received: 55 AA 03 00 00 01 01 04

EDIT 1:
Only 4 pins on the WB3S are in use - TXD1, RXD1, Ground, and Vcc.
The button cycles the lights with no Tuya chip present at all (just the daughter board with MCU). Thus, the button directly shorts a pin on the MCU. Interestingly, QueryInitStatus does not reflect the actual color change by the button.

Nice, I see you already figured uartSendHex. For the record, there is an easier way to do this:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands.md
We have a command: tuyaMcu_sendState
For example:

Also, dpID 20 is a bool - on and off state, right? I think you can already map it to gui in autoexec.bat.

Now, I need to look into making a simple driver for 104 and 106 dpIDs...

Added after 35 [minutes]:

Initial PR test:
https://github.com/openshwprojects/OpenBK7231T_App/pull/1373
Only gui and backend for dpID 104.
Tested on windows so far, only data sending implemented.
Command:

Result:

This should be able to send:


Would you be able to give it a try already? I will try to add more to that soon.

Tested only on Windows:

Thanks for the tips and updates! I probably won't have time to test until tomorrow. I really appreciate the effort!

No problem, there is no hurry.
Now, the question is - how do we create interface for that?

steelincable wrote:

Customize ([red][empty][empty], dimming at 50%, effect solid) - All 12 bulbs are solid red.
dpId=106 Str V=b001f401f40#00ff0000

Customize ([red][green][empty], dimming at 50%, effect solid) - Bulbs alternate red and green and are solid.
dpId=106 Str V=b001f401f41#00ff0000#0000ff00

-Customize ([red][green][blue], dimming at 50%, effect solid) - Bulbs alternate red, green blue and are solid
dpId=106 Str V=b001f401f42#00ff0000#0000ff00#000000ff

3 separate color pickers with dimmer sliders? And with checkboxes? Or dropdown menu to choose 1 or 2 or 3 leds?

>>21246179
1373_merge_42e243d51e32 flashed and tested with Firefox. Results in the screenshot below. Other than the GUI being out of sync with the bulbs upon load, everything worked from a basic functionality perspective.



Other test observations:
- I don't see the wifi send in logs, just mcu received - I assume this is expected behavior?
- Occasionally clicking on a bulb number wouldn't work, seems like the buttons are refreshing every second (I see them flash when I mouse over) and clicking on a bulb number during a refresh doesn't transmit the event. This issue happened less frequently in Firefox incognito.
- Would it be possible to show the computed string value in ASCII on the web page? Or is there somewhere I can see this?

Regarding your interface question, I like your color picker idea for each orb. Below is a screenshot of the app with the max 3 orbs selected. I think showing 3 orbs at all times with a way to disable only orbs 2 and 3 would be the most logical. When you click an orb the currently selected color is highlighted on the picker. The lights are limited to 62 colors, but I'm not sure if that's a soft or hard limit. In other words I'm not sure if we have to limit the color picker to 62 colors as well and map them individually (well, 56 colors and 6 shades of white). I'll have to do some more testing there when I get some time.


Also note that dimming (and speed) is a global value, you can't dim each of the 3 orbs independently. Hopefully that makes it a bit easier.

I'll test the boolean on/off and report back, but yeah looks like it should be an easy one.

EDIT 1:
Toggle created and works as expected:

I was playing with the physical button that shorts a pin on the Tuya MCU (not the Tuya WiFi module). A long-press puts the Tuya WiFi module into pairing mode and the bulbs blink until canceled by a short-press.

A long-press causes the MCU to send the message below to the WiFi chip via UART. Is there a way to listen for this message and reset the OpenBK config back to defaults? Thinking there may be a need to change WiFi SSIDs or wipe bad config down the road without using the GUI. Is there a better way to reset WiFi/OpenBK?

Received by WiFi module:
55 AA 03 05 00 01 00 08
HEADER VER=03 Unk LEN 00 CHK

Here's the complete conversation after long-press:
Reset Bu..n.pdf Download (87.75 kB)

Friendly bump. @p.kaczmarek2 please let me know if you need anything. Thank you so much! BTW, it's been 20 years since I've programmed in C, but I'm happy to help if you have some ideas or guidance on direction with this!