logo elektroda
logo elektroda
X
logo elektroda

Reverse Engineering Tuya Beacon Mesh Protocol for Aliexpress Lights with ESP32 Proxy

holchansgomes 759 1
ADVERTISEMENT
  • #1 21342561
    holchansgomes
    Level 3  
    Close-up of a circuit board with electronic components and LEDs.

    Bought some cheap lights from Aliexpress with an unknown controller. https://www.aliexpress.com/item/1005006850698500.html

    No WiFi so localtuya is not an option, just found out the device is not BLE neither so ha_tuya_ble won't work either. It's a Tuya Beacon Mesh protocol. A 1 way advertisement protocol where each device will work as a relay. More info about Tuya Beacon Mesh: https://solution.tuya.com/cms/solution/zm_dj_beacon_en and https://support.tuya.com/en/help/_detail/Kd9y7yburrjti also a guide on how to make a controller for it: https://developer.tuya.com/en/docs/iot/beacon-remote?id=Kcyvzvvk9yw58

    Since I don't know which chip it is I'm now focused on reverse engineering the Bluetooth advertisements packets, is this the right path? I know nothing about it. Using my android phone while controlling the devices I pulled the logs, filtered only the timeframe where the actions were happening and cleaned the entries. Here it is: https://github.com/holchan/wireshark_logs files btsnoop_wireshark_packets_00x.json where I changed the device brightness from 1% to 25% in 1% steps. This one https://github.com/holchan/wireshark_logs/blob/main/btsnoop_wireshark_packets_on&off.json is a compact version of it, 4 seconds timeframe of me turning the device Off then On. Devices MAC are: DC:23:50:XX:XX:XX

    Seems like here has more info about it: https://github.com/tuya/tuya-iotos-beacon-sdk-ak80x

    I'm feeling really lost, am I on the right path? Is it possible to use my esp32 as a Bluetooth proxy sending advertisements to these lights?

    Added after 11 [hours] 1 [minutes]:

    Screenshot of B1SD-WE2I hardware information, showing firmware details and access to development documents.

    I think i finally found what the f### this chip is, a PHY6230 SOP16.

    Added after 4 [minutes]:

    Schematic of SOP16 application with component labels.

    more info about here: http://en.phyplusinc.com/product_detail/9.html

    Added after 3 [minutes]:

    SDK https://github.com/pvvx/PHY62x2/blob/master/SDK/PHY62XX_SDK_3.1.1.zip
  • ADVERTISEMENT
ADVERTISEMENT