TuyaMCU analyser - UART packet decoder for Tuya devices - unknown packets

Question

Howdy, I am sitting on a new device: Carbon Monoxide (CO) detector. Details once there's something to present, for now I'm stuck on the communication between the MCU and the TuyaMCU. A dedicated BA45F6746 from Holtek is used as the MCU for detection, with display support. A CBU is being used as...

p.kaczmarek2 · Answer

According to the topic:
TuyaMCU protocol - communication between microcontroller and WiFi module .
The TuyaMCU header is 0x55AA, the next byte is the version, generally 0x00 or 0x03.

In your case it is:
55 07 03 01 00 00 60
This does not look like TuyaMCU.
In addition it is:
55 07 03 01 00 00 60
55 07 03 01 00 00 60 07 00 00 00
I don't see a length byte (or two bytes) here, as long as these are whole packets....

Let's check here:

55 A4 AA 13 00 18 00 0A 01 36 00 00 01 E4 00 00 00 01 01
while 13 is the length, 13 in hex is 16+3 = 19, doesn't add up anyway.... unless it's the whole packet that has 19? And not the payload?

It could be a different protocol, for example in the case of this device it was:
Reverse engineering of the unusual Tuya FS-05R UART-based dimmer protocol .
There was supposedly a TuyaMCU-compatible package there, but a different way of sending.

BL0942 also has communication starting with 0x55:
https://www.elektroda.com/rtvforum/topic3887748.html

So it could be a slightly different protocol, just because the start is 0x55 doesn't mean anything yet. Alternatively, maybe you intercepted with interference?

And do the checksums match?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

Samezrp1 · Answer

Maybe the attached files will help. Logs from Rx1, Tx1 and Tx2 when the test button is pressed, at which time TuyaMCU sends information to WiFi.

Samezrp1 · Answer

I see that PuTTY can add its line ends (0D 0A), so I've attached the logs from CoolTerma.

Plus additionally what the flasher reads from the config.


{
	"abi":"0",
	"id":"null",
	"swv":"1.0.2",
	"bv":"40.00",
	"pv":"2.2",
	"lpv":"3.4",
	"pk":"uade6fhqmx2hxxxx",
	"firmk":"null",
	"cadv":"1.0.3",
	"cdv":"1.0.0",
	"dev_swv":"1.0.2",
	"s_id":"null",
	"dtp":"0",
	"sync":"0",
	"attr_num":"0",
	"mst_tp_0":"0",
	"mst_ver_0":"null",
	"mst_tp_1":"0",
	"mst_ver_1":"null",
	"mst_tp_2":"0",
	"mst_ver_2":"null",
	"mst_tp_3":"0",
	"mst_ver_3":"null "
}

.

Samezrp1 · Answer

I've been away for a while, I've taken some timestamp logs and linked them so you can see the correlation between TuyaMCU and MCU, maybe this will get someone closer to a solution.
By the way, do you know how to strigger the carbon monoxide sensor without the monoxide itself? I'd like to trigger an alarm and see how the TuyaMCU is informed of the alarm.

p.kaczmarek2 · Answer

Only two bytes and the checksum at the end change, have you tried checking what is in those bytes? What do they look like as a 16 bit integer for example? .

Samezrp1 · Answer

Today I came across this topic: url . some of the finds in common, maybe it's worth combining them?

TuyaMCU analyser - UART packet decoder for Tuya devices - unknown packets

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Didn't find an answer? Ask Artificial Intelligence

Topic summary