logo elektroda
logo elektroda
X
logo elektroda
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

Reverse Engineering Tuya Beacon Mesh Protocol for Aliexpress Lights with ESP32 Proxy

holchansgomes 1695 1
ADVERTISEMENT
  • #1 21342561
    holchansgomes
    Level 3  
    Posts: 21
    Close-up of a circuit board with electronic components and LEDs.

    Bought some cheap lights from Aliexpress with an unknown controller. https://www.aliexpress.com/item/1005006850698500.html

    No WiFi so localtuya is not an option, just found out the device is not BLE neither so ha_tuya_ble won't work either. It's a Tuya Beacon Mesh protocol. A 1 way advertisement protocol where each device will work as a relay. More info about Tuya Beacon Mesh: https://solution.tuya.com/cms/solution/zm_dj_beacon_en and https://support.tuya.com/en/help/_detail/Kd9y7yburrjti also a guide on how to make a controller for it: https://developer.tuya.com/en/docs/iot/beacon-remote?id=Kcyvzvvk9yw58

    Since I don't know which chip it is I'm now focused on reverse engineering the Bluetooth advertisements packets, is this the right path? I know nothing about it. Using my android phone while controlling the devices I pulled the logs, filtered only the timeframe where the actions were happening and cleaned the entries. Here it is: https://github.com/holchan/wireshark_logs files btsnoop_wireshark_packets_00x.json where I changed the device brightness from 1% to 25% in 1% steps. This one https://github.com/holchan/wireshark_logs/blob/main/btsnoop_wireshark_packets_on&off.json is a compact version of it, 4 seconds timeframe of me turning the device Off then On. Devices MAC are: DC:23:50:XX:XX:XX

    Seems like here has more info about it: https://github.com/tuya/tuya-iotos-beacon-sdk-ak80x

    I'm feeling really lost, am I on the right path? Is it possible to use my esp32 as a Bluetooth proxy sending advertisements to these lights?

    Added after 11 [hours] 1 [minutes]:

    Screenshot of B1SD-WE2I hardware information, showing firmware details and access to development documents.

    I think i finally found what the f### this chip is, a PHY6230 SOP16.

    Added after 4 [minutes]:

    Schematic of SOP16 application with component labels.

    more info about here: http://en.phyplusinc.com/product_detail/9.html

    Added after 3 [minutes]:

    SDK https://github.com/pvvx/PHY62x2/blob/master/SDK/PHY62XX_SDK_3.1.1.zip
  • ADVERTISEMENT
ADVERTISEMENT