logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Flashing OpenBeken on EZAIoT Wifi RF Thermostat for Local Control

groove6j 1458 52
ADVERTISEMENT
Reply | New topic
  • #31 21553300
    insmod
    Level 24  
    >>21553289
    It's not FW2, since firmware can't be switched without OTA.
    Something else must be happening.
    What is the log output when connecting power via type-c without VDD?
  • ADVERTISEMENT
  • #32 21553334
    groove6j
    Level 8  
    >>21553300
    When I add VCC then its normal log and OpenRTL is booting. (LCD all bit are lit)
    Code: text Expand Select all Copy to clipboard
    #[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER ROMSUB:2
[MODULE_BOOT-LEVEL_INFO]:OTA1 USE
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xc014750:9328:0x83000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(8300c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x83000:0xc002835]
[MODULE_BOOT-LEVEL_INFO]:KM0 BOOT_IMG2 BOOT REASON: 0 
Flash ID:20, 42, 16
read_mode:3
calibration_ok:[2:19:11] 
FLASH CALIB[NEW OK]
RRAM: c0080 176B 
[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER MSP:[1007fffc]
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xe0990e0:102672:0x10005000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(1000500c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x10005000:0xe02b145]
[MODULE_BOOT-LEVEL_INFO]:Start NonSecure @ 0xe02b144 ...
[MODULE_BOOT-LEVEL_INFO]:KM4 BOOT REASON: 0 
#interface 0 is initialized
interface 1 is initialized

#[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER ROMSUB:2
[MODULE_BOOT-LEVEL_INFO]:OTA1 USE
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xc014750:9328:0x83000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(8300c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x83000:0xc002835]
[MODULE_BOOT-LEVEL_INFO]:KM0 BOOT_IMG2 BOOT REASON: 0 
Flash ID:20, 42, 16
read_mode:3
calibration_ok:[2:19:11] 
FLASH CALIB[NEW OK]
RRAM: c0080 176B 
[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER MSP:[1007fffc]
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xe0990e0:102672:0x10005000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(1000500c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x10005000:0xe02b145]
[MODULE_BOOT-LEVEL_INFO]:Start NonSecure @ 0xe02b144 ...
[MODULE_BOOT-LEVEL_INFO]:KM4 BOOT REASON: 0 
#interface 0 is initialized
interface 1 is initialized

Initializing WIFI ...Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
EasyFlash V4.1.0 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .

WIFI initialized

Main_Init_Before_Delay doneheap 0x2c960
Main_Init_DeWarn:CFG:CFG_InitAndLoad: Correct config has been loaded with 7 changes count.
Error:CMD:no file early.bat err -2
Main_Init_Delay done
N_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID [room]
Info:MAIN:Using Pass [xxxx]
Info:HTTP:TCP server listening
Info:MQTT:MQTT_RegisterCallback called for bT rtl8720dFF162F63/ subT rtl8720dFF162F63/+/set
Info:MQTT:MQTT_RegisterCallback called for bT obks/ subT obks/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/rtl8720dFF162F63/ subT cmnd/rtl8720dFF162F63/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obks/ subT cmnd/obks/+
Info:MQTT:MQTT_RegisterCallback called for bT rtl8720dFF162F63/ subT rtl8720dFF162F63/+/get
Info:CMD:CMD_StartScript: started @startup at the beginning
Info:CMD:CMD_StartScript: started autoexec.bat at the beginning
Info:MAIN:Main_Init_After_Delay done
Info:MAIN:Started TuyaMCU.
Info:GEN:Channel 1 type changed to toggle
Info:GEN:Channel 111 type not set because string is not a known type
Info:GEN:Channel 40 type changed to toggle
Info:MAIN:Time 1, idle 0/s, free 163904, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
#[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER ROMSUB:2
[MODULE_BOOT-LEVEL_INFO]:OTA1 USE
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xc014750:9328:0x83000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(8300c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x83000:0xc002835]
[MODULE_BOOT-LEVEL_INFO]:KM0 BOOT_IMG2 BOOT REASON: 0 
Flash ID:20, 42, 16
read_mode:3
calibration_ok:[2:19:11] 
FLASH CALIB[NEW OK]
RRAM: c0080 176B 
[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER MSP:[1007fffc]
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xe0990e0:102672:0x10005000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(1000500c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x10005000:0xe02b145]
[MODULE_BOOT-LEVEL_INFO]:Start NonSecure @ 0xe02b144 ...
[MODULE_BOOT-LEVEL_INFO]:KM4 BOOT REASON: 0 
#interface 0 is initialized
interface 1 is initialized

Initializing WIFI ...Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
EasyFlash V4.1.0 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .

WIFI initialized

Main_Init_Before_Delay doneheap 0x2c960
Main_Init_DeWarn:CFG:CFG_InitAndLoad: Correct config has been loaded with 7 changes count.
Error:CMD:no file early.bat err -2
Main_Init_Delay done
N_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID [room]
Info:MAIN:Using Pass [xxx]
Info:HTTP:TCP server listening
Info:MQTT:MQTT_RegisterCallback called for bT rtl8720dFF162F63/ subT rtl8720dFF162F63/+/set
Info:MQTT:MQTT_RegisterCallback called for bT obks/ subT obks/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/rtl8720dFF162F63/ subT cmnd/rtl8720dFF162F63/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obks/ subT cmnd/obks/+
Info:MQTT:MQTT_RegisterCallback called for bT rtl8720dFF162F63/ subT rtl8720dFF162F63/+/get
Info:CMD:CMD_StartScript: started @startup at the beginning
Info:CMD:CMD_StartScript: started autoexec.bat at the beginning
Info:MAIN:Main_Init_After_Delay done
Info:MAIN:Started TuyaMCU.
Info:GEN:Channel 1 type changed to toggle
Info:GEN:Channel 111 type not set because string is not a known type
Info:GEN:Channel 40 type changed to toggle
Info:MAIN:Time 1, idle 0/s, free 163904, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
Info:MAIN:Time 2, idle 0/s, free 163904, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
Info:MAIN:Time 3, idle 0/s, free 163904, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
Info:MAIN:Time 4, idle 0/s, free 163904, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
Info:MAIN:Time 5, idle 0/s, free 163904, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
Info:MAIN:Registered for wifi changes
Info:MAIN:Connecting to SSID [room]
Info:MAIN:Time 6, idle 0/s, free 160640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 
Info:MAIN:Boot complete time reached (5 seconds)

RTL8721D[Driver]: set ssid [room] 
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTING - 1
Info:MAIN:Time 7, idle 0/s, free 160960, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 

RTL8721D[Driver]: rtw_set_wpa_ie[1182]: AuthKeyMgmt = 0x2 
Info:MAIN:Time 8, idle 0/s, free 160800, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 

RTL8721D[Driver]: rtw_restruct_sec_ie[4294]: no pmksa cached 

RTL8721D[Driver]: start auth to 6e:3b:6b:51:55:6c

RTL8721D[Driver]: auth alg = 2
Recv Auth with status_code=0

RTL8721D[Driver]: 
OnAuthClient:algthm = 0, seq = 2, status = 0, sae_msg_len = 0

RTL8721D[Driver]: auth success, start assoc

RTL8721D[Driver]: association success(res=15)
wlan1: 1 DL RSVD page success! DLBcnCount:01, poll:00000001

RTL8721D[Driver]: ClientSendEAPOL[1728]: no use cache pmksa 

RTL8721D[Driver]: set pairwise key to hw: alg:4(WEP40-1 WEP104-5 TKIP-2 AES-4)

RTL8721D[Driver]: set group key to hw: alg:4(WEP40-1 WEP104-5 TKIP-2 AES-4) keyid:2
Info:MAIN:Time 9, idle 0/s, free 155104, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/16 



    When I remove VCC, then it logs this (and stops at the end, there is no more output) (LCD is normal, shows temp, and responds to buttons)

    Code: text Expand Select all Copy to clipboard
    [MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER ROMSUB:2
[MODULE_BOOT-LEVEL_INFO]:OTA1 USE
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xc014750:9328:0x83000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(8300c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x83000:0xc002835]
[MODULE_BOOT-LEVEL_INFO]:KM0 BOOT_IMG2 BOOT REASON: 0 
Flash ID:20, 42, 16
read_mode:3
calibration_ok:[2:19:11] 
FLASH CALIB[NEW OK]
RRAM: c0080 176B 
[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER MSP:[1007fffc]
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xe0990e0:102672:0x10005000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(1000500c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x10005000:0xe02b145]
[MODULE_BOOT-LEVEL_INFO]:Start NonSecure @ 0xe02b144 ...
[MODULE_BOOT-LEVEL_INFO]:KM4 BOOT REASON: 0 
#interface 0 is initialized
interface 1 is initialized

Initializing WIFI ...Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
#[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER ROMSUB:2
[MODULE_BOOT-LEVEL_INFO]:OTA1 USE
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xc014750:9328:0x83000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(8300c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x83000:0xc002835]
[MODULE_BOOT-LEVEL_INFO]:KM0 BOOT_IMG2 BOOT REASON: 0 
Flash ID:20, 42, 16
read_mode:3
calibration_ok:[2:19:11] 
FLASH CALIB[NEW OK]
RRAM: c0080 176B 
[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER MSP:[1007fffc]
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xe0990e0:102672:0x10005000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(1000500c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x10005000:0xe02b145]
[MODULE_BOOT-LEVEL_INFO]:Start NonSecure @ 0xe02b144 ...
[MODULE_BOOT-LEVEL_INFO]:KM4 BOOT REASON: 0 
#interface 0 is initialized
interface 1 is initialized

Initializing WIFI ...Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
#[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER ROMSUB:2
[MODULE_BOOT-LEVEL_INFO]:OTA1 USE
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xc014750:9328:0x83000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(8300c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x83000:0xc002835]
[MODULE_BOOT-LEVEL_INFO]:KM0 BOOT_IMG2 BOOT REASON: 0 
Flash ID:20, 42, 16
read_mode:3
calibration_ok:[2:19:11] 
FLASH CALIB[NEW OK]
RRAM: c0080 176B 
[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER MSP:[1007fffc]
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xe0990e0:102672:0x10005000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(1000500c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x10005000:0xe02b145]
[MODULE_BOOT-LEVEL_INFO]:Start NonSecure @ 0xe02b144 ...
[MODULE_BOOT-LEVEL_INFO]:KM4 BOOT REASON: 0 
#interface 0 is initialized
interface 1 is initialized

Initializing WIFI ...Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
EasyFlash V4.1.0 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
#[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER ROMSUB:2
[MODULE_BOOT-LEVEL_INFO]:OTA1 USE
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xc014750:9328:0x83000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(8300c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x83000:0xc002835]
[MODULE_BOOT-LEVEL_INFO]:KM0 BOOT_IMG2 BOOT REASON: 0 
Flash ID:20, 42, 16
read_mode:3
calibration_ok:[2:19:11] 
FLASH CALIB[NEW OK]
RRAM: c0080 176B 
[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER MSP:[1007fffc]
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xe0990e0:102672:0x10005000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(1000500c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x10005000:0xe02b145]
[MODULE_BOOT-LEVEL_INFO]:Start NonSecure @ 0xe02b144 ...
[MODULE_BOOT-LEVEL_INFO]:KM4 BOOT REASON: 0 
#interface 0 is initialized
interface 1 is initialized

Initializing WIFI ...Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
EasyFlash V4.1.0 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
#[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER ROMSUB:2
[MODULE_BOOT-LEVEL_INFO]:OTA1 USE
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xc014750:9328:0x83000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(8300c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x83000:0xc002835]
[MODULE_BOOT-LEVEL_INFO]:KM0 BOOT_IMG2 BOOT REASON: 0 
Flash ID:20, 42, 16
read_mode:3
calibration_ok:[2:19:11] 
FLASH CALIB[NEW OK]
RRAM: c0080 176B 
[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER MSP:[1007fffc]
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xe0990e0:102672:0x10005000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(1000500c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x10005000:0xe02b145]
[MODULE_BOOT-LEVEL_INFO]:Start NonSecure @ 0xe02b144 ...
[MODULE_BOOT-LEVEL_INFO]:KM4 BOOT REASON: 0 
#interface 0 is initialized
interface 1 is initialized

Initializing WIFI ...Entering initLog()...
Commands registered!
initLog() done!
  • ADVERTISEMENT
  • #33 21553348
    insmod
    Level 24  
    This looks like there is not enough power.
    Try connecting both type-c and vdd.
  • #34 21553349
    groove6j
    Level 8  
    >>21553348
    Yeah, I'll try again in the morning. Gonna get some sleep. Big thanks for the assistance! :)

    It is interesting that when it's stuck at booting, the display works (and I think that RF part works as well). It made me think, that the old firmware is loading, but actually it stuck, just the MCU part is working for some weird reason.
  • #35 21553802
    groove6j
    Level 8  
    >>21553348
    I have to first apply type-c/battery power. MCU boots, RTL fails.
    After that if I apply VCC RTL boots fine and MCU is still working. If I remove VCC, the RTL stalls. But if I remove type-c - both MCU and RTL keep working.

    In short - if I apply VCC afterwards, both MCU and RTL work. Disconnect VCC - RTL stops working. Why could that be?

    Can't get any TuyaMCU communications too. Tried this config:

    Code: text Expand Select all Copy to clipboard
    
startDriver TuyaMCU
tuyaMcu_setBaudRate 115200
tuyaMcu_defWiFiState 4
setChannelType 1 Toggle
setChannelLabel 1 "l1"
linkTuyaMCUOutputToChannel 1 bool 1 
setChannelLabel 2 "l2"
setChannelType 2 Toggle
linkTuyaMCUOutputToChannel 2 bool 2 
setChannelLabel 3 "Temperature"
setChannelType 3 TextField
linkTuyaMCUOutputToChannel 24 val 3


    I also tried 9600, 921600 and 460800 baud. When the MCU boots and screen works, the RF part totally works, there is no MCU<->OpenRTL communication yet. I understand that there are 2 UARTs on the Realtek chip. One is labeled LOG, which I used to flash and read system logs. The other one seems just to go to pin headers through 100Ohm resistors from Realtek chip.

    I couldn't get anything over that other UART port.
  • ADVERTISEMENT
  • #36 21554154
    insmod
    Level 24  
    What about startdriver tmSensor?
    Since there are batteries, perhaps tuyamcu is using v0 protocol?
    Another possibility is that it uses alternate uart, you would need to enable that flag to see if it works.
    You can also try to sniff non-log rx/tx for mcu communication.
  • #37 21554283
    groove6j
    Level 8  
    >>21554154
    Will try. The mystery to me is that the UART lines which go to points below R33 and R34, they don't seem to connect anywhere further. And by the looks there isn't anything under the screen either. Where does the MCU communicate then?

    I couldn't get anything out of that UART too. I tried standard baud rates with minicom, nothing. There is voltage at those pins, but no output. Although I might connect oscilloscope later.
  • #38 21556497
    groove6j
    Level 8  
    What is with the v0 protocol? How is it different?
    Still I haven't managed to get any TuyabMCU communications. tmSensor, also didn't work, as well as alternate UART flag.
    I think that I'll flash the stock firmware and try sniffing then.
  • #39 21556643
    insmod
    Level 24  
    v0 protocol is for TuyaMCU devices on battery power. In OBK it is enabled by tmSensor driver.
  • Helpful post
    #40 21556809
    p.kaczmarek2
    Moderator Smart Home  
    tmSensor (battery powered devices) are the devices where MCU controls the power of the WiFi module. This is done via MOSFET. Is your WiFi module VDD connected directly to 3.3V? Is so, it's not a battery powered device.

    tmSensor relies on the MCU enabling power of the WiFi module. So, the sequence is the following:
    - first MCU enables power of WiFI module
    - then WiFi module sends hello packet via UART to the MCU
    - then MCU replies.. etc etc.
    If you are powering WIFi module externally, for example, from the USB to UART converter, then tmSensor will not work, because MCU expects tmSensor to send packet exactly after it enables power of the WiFi module.
    Helpful post? Buy me a coffee.
  • #41 21557037
    groove6j
    Level 8  
    >>21556809
    I will flash stock firmware. And see what happens. Hope that the file I downloaded with python tool is OK, because when writing I had to use the AmebaD Windows tool for it to write properly, command line python tool failed.
  • #42 21567115
    groove6j
    Level 8  
    Some more information I have gathered:
    The UART (which is unlabeled on the board) is definitely wired to TuyaMCU, but the MCU itself seems to live under the display of the device (most likely), which requires full desoldering of it. I have come to this conclusion, because I couldn't trace that UART port to the chip next to RTL8720 and nowhere else of the bottom of this device. It is wired somewhere under the board and perhaps within some middle layer of the board, so I couldn't see the connection.

    So yes, the chip next to RTL seems to be some kind of display driver most likely. Anyways what's left to do is flashing the stock firmware and do some sniffing of TuyaMCU traffic on that UART. It should be smooth sailing from that on, because all dpIDs are found and should configure easily. Also the powering issues I have should clear out if the right data packets are sent on RTL8720 boot to power the TuyaMCU.

    I have some other work to do, so I can't get to sniffing the communications right now. But I will definitely catch on to it.
  • #43 21571326
    kasperkasperfish
    Level 1  
    any update on this? I have the same device working for 2 years now via tuya cloud->homeassistant. Would be interested to flash custom firmware on it to completely bypass the tuya cloud. peace
  • ADVERTISEMENT
  • #44 21571628
    groove6j
    Level 8  
    >>21571326
    Yeah, that integration is total trash for this device. Works slow and incomplete.

    We need to sniff TuyaMCU traffic on the first UART (the one not labeled LOG) with stock firmware. I couldn't get any data there, but I had already flashed the device.

    You could try flashing the device and tell your findings. Just take the stock backup and use the Windows AmebaD tool, it seems to work better.
  • #45 21571688
    insmod
    Level 24  
    Preferably sniff before flashing. Perhaps it even uses a different protocol, though i doubt it.
  • #46 21571823
    groove6j
    Level 8  
    I successfully flashed back to stock. The device works again fully. Tried pairing to Tuya and got some interesting output on UART (when entering pairing mode).
    Code: text Expand Select all Copy to clipboard
    
Initializing WIFI ...
WIFI initialized
init_thread(58), Available heap 0x17f8b18:12:15 INFO  tuya_iot_com_api.c:148: rst_reason is 0
OFFSET = 97d
GAIN_DIV = 2ad6
18:12:15 INFO  tuya_module_demo.c:1227: thermostat_radiator:1.0.6
18:12:15 INFO  tuya_module_demo.c:1228: firmware compiled at Jun 17 2023 12:06:23
18:12:15 INFO  simple_flash.c:670: init succ
18:12:15 INFO  mf_test.c:139: have actived over 15 min, not enter mf_init
18:12:15 INFO  tuya_main.c:142: mf_init succ
18:12:15 INFO  tuya_main.c:143: firmware compiled at Jun 17 2023 12:06:23
18:12:15 INFO  tuya_module_demo.c:1056: product_info = {"p":"eaacu1av8nz9qdva","v":"2.0.11","c":1,"t":0}z
18:12:15 INFO  tuya_module_demo.c:1307: pid = eaacu1av8nz9qdva, ver = 2.0.11, wifi_set_mode = 1
18:12:15 INFO  tuya_iot_com_api.c:954: country_code =
18:12:15 INFO  tuya_iot_com_api.c:958: MAC[1c-90-ff-16-2f-63]
wifi_set_lps_smartps:2
[tuya_module_demo.c:1157] sleep_time_ms = 1000
[tuya_module_demo.c:1169] wifi is not set for powersave, don't do everything
[tuya_module_demo.c:1157] sleep_time_ms = 30000
18:12:15 INFO  tuya_iot.c:577: tuya_iot_init
18:12:15 ERROR tuya_endpoint.c:158: local_storage_get region fail:0xffffffff
18:12:15 INFO  tuya_endpoint.c:234: endpoint_mgr.region:
18:12:15 INFO  tuya_endpoint.c:235: endpoint_mgr.regist_key:
18:12:15 INFO  tuya_endpoint.c:200: Environment:pro
18:12:15 INFO  tuya_endpoint.c:210: Host region:AY
18:12:15 WARN  tuya_iot.c:108: activate config not found:-1
02:00:00 INFO  lpmgr.c:148: min_dtim = 0
product_id:total len = 16
65 61 61 63 75 31 61 76 38 6e 7a 39 71 64 76 61
uuid:total len = 16
66 38 64 63 65 63 32 38 38 38 36 64 61 63 39 64
auth_key:total len = 32
75 77 71 42 53 31 54 4d 41 53 37 57 73 42 6d 4a 42 6c 63 63 66 38 6e 63 54 61 4a 4a 66 45 69 5a
device id key ::total len = 16
74 9d f9 ea 60 3b 08 87 33 ec 29 f0 6e b1 c4 97
adv->data:total len = 28
02 01 06 03 02 01 a2 14 16 01 a2 00 65 61 61 63 75 31 61 76 38 6e 7a 39 71 64 76 61
scan_resp->data:total len = 30
03 09 54 59 19 ff d0 07 00 03 00 00 04 00 94 e9 6f 88 2b 9a 83 b8 b5 b7 82 2d 1b ba 4b 7b


    Gonna try sniffing TuyaMCU now.
  • Helpful post
    #47 21571847
    divadiow
    Level 34  
    Code: JSON
    Log in, to see the code
  • #48 21571866
    groove6j
    Level 8  
    >>21571847 I attached full dpid list in the first post.

    Tried multiple baud rates, can't get anything out of that UART, now even with stock firmware flashed. Any ideas?
    I also tried swapping TX and RX lines. Also changing the temp from Tuya app works, but no data.

    With oscilloscope there is no oscillation over that TX and RX lines. However over LOG TX I get oscillation when the log data enters on boot (very normal). After that, nothing on both UARTs.

    Although there is oscillation on SWDIO ( see the 5 pins within the battery label) when I change temperature remotely. But that's some other protocol. On boot there's a reasonable amount of oscillation. And that's probably how the data is exchanged on this device?

    SWDIO and SWCLK are connected through a resistor and a (diode or transistor) to two pins (bottom 5 and 6 from left side). I don't know which is pin1, because the top of the chip is scraped.
  • #49 21571868
    divadiow
    Level 34  
    groove6j wrote:
    I attached full dpid list in the first post

    Ha. My bad. Thought it odd I hadn't posted it already for some reason. Oh well

    Added after 7 [hours] 47 [minutes]:

    groove6j wrote:
    I don't know which is pin1, because the top of the chip is scraped.


    pin1 marker?
    Close-up of a blue PCB with an integrated circuit and a red arrow pointing to one pin.

    also was it ever stated what this is marked as? I recognise the faint logo
    Photo of a circuit board with a large square integrated circuit marked in red.

    Added after 7 [minutes]:

    ah. Maybe Cmsemicon like seen here https://www.elektroda.com/rtvforum/topic4041794.html#20999418
  • #50 21571975
    p.kaczmarek2
    Moderator Smart Home  
    groove6j wrote:

    Tried multiple baud rates, can't get anything out of that UART, now even with stock firmware flashed. Any ideas?

    Wrong pins? Or maybe try more reliable approach:
    Salae 24MHz logic analyzer for 10$ - analysis of an unknown LED display protocol
    Helpful post? Buy me a coffee.
  • #51 21572734
    groove6j
    Level 8  
    divadiow wrote:
    Maybe Cmsemicon

    That is BAT32G127GH 232101T. Maybe there is some other MCU chip behind LCD, but I am now unsure about that. Most likely no chip there.

    p.kaczmarek2 wrote:
    Wrong pins?

    Most likely that UART is not used at all in this variant of the board. TX and RX just stay at 3.3v and there is no voltage from the other side (which probably doesn't go anywhere). It just has these pads there, that's all. I recorded no oscillation at all. There are some other variants of that thermostat that maybe have different board setup where these pads are used.

    p.kaczmarek2 wrote:
    try more reliable approach

    That's right, I'll order one and try to figure out that protocol that goes over that SWDIO line. Which from the name of it should be SWD. Is that even possible with OpenRTL?
  • #53 21573297
    groove6j
    Level 8  
    >>21573287
    This makes sense, I could probably also read that flash, but with that binary blob there is not much that can be accomplished, yes.

    Well none of the both UARTs are connected to BAT32, but SWD is, so Tuya probably has some SWD driver that takes care of the communication.

    Anyway thanks for the help, this becomes much clearer.
Reply | New topic
Report a violation of the law

Topic summary

The discussion revolves around the EZAIoT Wi-Fi RF thermostat, specifically the T9W 2.0 R9BW 2.0 model, which is currently cloud-controlled and not compatible with LocalTuya due to a unique protocol version. Users aim to flash OpenBeken firmware to enable local control. The device consists of an RF receiver powered by mains and a room thermostat with an LCD screen, which can be powered by batteries or USB-C. Participants explore the internal components, suspecting the presence of a Realtek RTL8720DN chip, and discuss challenges related to flashing and UART communication. They share insights on extracting firmware, identifying chip types, and troubleshooting issues related to the device's operation and communication protocols.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT