New hackable ESP gadgets in local budget store "action" !!!

Moderators: grovkillen, Stuntteam, TD-er

Post Reply
Message
Author
FanOfHue
Normal user
Posts: 43
Joined: 06 Oct 2018, 10:08

New hackable ESP gadgets in local budget store "action" !!!

#1 Post by FanOfHue » 17 Aug 2019, 12:25

Yesterday i found some nice new products available in the Dutch Action store.
A full range of Wifi sensors and lights most of them under 9.95 euro each.

I bought some sensors to see what's inside and some of them have the Tuya ESP8266 module. So hack friendly i guessed

So my first "SmartNodeRules" PIR sensor prototype is now running!
It sends a messagebus event to all nodes on a PIR trigger and dumps some syslog messages as well.

Next victim will be the doorsensor.

The hand remote is not ESP8266 based, so that will not be an option.
(sadly)

Dick60
Normal user
Posts: 34
Joined: 11 Feb 2018, 17:35

Re: New hackable ESP gadgets in local budget store "action" !!!

#2 Post by Dick60 » 17 Aug 2019, 21:30

Nice, can you share a photo of the pir mentioned by you so I can buy one myself.

Domosapiens
Normal user
Posts: 282
Joined: 06 Nov 2016, 13:45

Re: New hackable ESP gadgets in local budget store "action" !!!

#3 Post by Domosapiens » 17 Aug 2019, 23:03

30+ ESP units for production and test. Ranging from control of heating equipment, flow sensing, floor temp sensing, energy calculation, floor thermostat, water usage, to an interactive "fun box" for my grandson. Mainly Wemos D1.

Dick60
Normal user
Posts: 34
Joined: 11 Feb 2018, 17:35

Re: New hackable ESP gadgets in local budget store "action" !!!

#4 Post by Dick60 » 18 Aug 2019, 11:33

Nice, keep posting your results. A few times a month I visit this store but never noticed theses items. I will buy a module for testing.

FanOfHue
Normal user
Posts: 43
Joined: 06 Oct 2018, 10:08

Re: New hackable ESP gadgets in local budget store "action" !!!

#5 Post by FanOfHue » 20 Aug 2019, 15:02

The doorsensor has also been migrated to a SmartNode with custom firmware.

User avatar
ManS-H
Normal user
Posts: 232
Joined: 27 Dec 2015, 11:26
Location: the Netherlands

Re: New hackable ESP gadgets in local budget store "action" !!!

#6 Post by ManS-H » 20 Aug 2019, 17:13

FanOfHue wrote:
20 Aug 2019, 15:02
The doorsensor has also been migrated to a SmartNode with custom firmware.
Can you told use how to flash the firmware? Open the device, soldering wires etc, with a few pictures should be nice. :D

FanOfHue
Normal user
Posts: 43
Joined: 06 Oct 2018, 10:08

Re: New hackable ESP gadgets in local budget store "action" !!!

#7 Post by FanOfHue » 20 Aug 2019, 20:18

I seems that you can use a project named Tuya-Convert to replace the firmware OTA way, but then you would need an RPI-3. I don't have one, so i took the hardware hack road:
Doorsensor.png
Doorsensor.png (456.95 KiB) Viewed 4228 times
Not really difficult to do. A siimple header gives access to RX/TX and GPIO-0 and that's all you need. I used Arduino IDE to upload the firmware in the same way as with other ESP8266 modules. Tuya modules are also very well documented. Just google for TYWE3S.

When initial upload is done, you can remove the header because future updates will be done with standard ESP8266 OTA.

Maarten112
Normal user
Posts: 6
Joined: 01 Apr 2016, 11:48

Re: New hackable ESP gadgets in local budget store "action" !!!

#8 Post by Maarten112 » 26 Aug 2019, 16:45

FanOfHue wrote:
20 Aug 2019, 15:02
The doorsensor has also been migrated to a SmartNode with custom firmware.
Did you measure the powerconsumption when running the doorsensor on tasmota/is the esp8266 put to sleep/deepsleep using interrupts? I'm very curious about batterylife of those sensors when running on tasmota!

RayEbb
Normal user
Posts: 1
Joined: 20 Aug 2019, 18:43

Re: New hackable ESP gadgets in local budget store "action" !!!

#9 Post by RayEbb » 28 Aug 2019, 18:52

FanOfHue wrote:
17 Aug 2019, 12:25
Yesterday i found some nice new products available in the Dutch Action store.
A full range of Wifi sensors and lights most of them under 9.95 euro each.

I bought some sensors to see what's inside and some of them have the Tuya ESP8266 module. So hack friendly i guessed

So my first "SmartNodeRules" PIR sensor prototype is now running!
It sends a messagebus event to all nodes on a PIR trigger and dumps some syslog messages as well.

Next victim will be the doorsensor.

The hand remote is not ESP8266 based, so that will not be an option.
(sadly)
Thx. for this tip!! Today i only bought the RGB LED strip, just to try. It works great!!

zizitop75
Normal user
Posts: 1
Joined: 29 Aug 2019, 14:41

Re: New hackable ESP gadgets in local budget store "action" !!!

#10 Post by zizitop75 » 29 Aug 2019, 14:44

Hi could you please explain how you flashed the led ruban contrôler. Thank you

patricx
Normal user
Posts: 1
Joined: 30 Aug 2019, 13:15

Re: New hackable ESP gadgets in local budget store "action" !!!

#11 Post by patricx » 30 Aug 2019, 13:32

i have flash the lsc doorsensor but how do i config it as a working sensor ?

bulthaup
Normal user
Posts: 11
Joined: 29 Jul 2019, 15:10

Re: New hackable ESP gadgets in local budget store "action" !!!

#12 Post by bulthaup » 30 Aug 2019, 15:50

How can you put the LSC door sensor in flash mode?

Tecumseh
Normal user
Posts: 29
Joined: 30 Sep 2016, 09:42

Re: New hackable ESP gadgets in local budget store "action" !!!

#13 Post by Tecumseh » 02 Sep 2019, 23:26

I found some more info and a tear-down of these devices on a the German forum mikrocontroller.net. It seams that the OTA update with Tuya-convert has been disabled by Tuya with a new firmware and these devices would have the new update. Also some of these devices don't have the esp8266 or esp8285 chip onboard that would enable us to change the firmware to espeasy. Although some items do have a chip with almost the same pinout as the esp-12f so a switch could be made.

What I have not found yet is how we would configure these devices after flashing them with espeasy. What pins are connected where and how do we configure deepsleep to get a sustainable battery life.

pgielen
Normal user
Posts: 8
Joined: 25 May 2019, 10:13

Re: New hackable ESP gadgets in local budget store "action" !!!

#14 Post by pgielen » 03 Sep 2019, 00:57

FanOfHue wrote:
20 Aug 2019, 20:18
IA siimple header gives access to RX/TX and GPIO-0 and that's all you need.
And of course 3v3 and GND. Can you put the chip in flash mode by connecting GPIO-0 to GND?

FanOfHue
Normal user
Posts: 43
Joined: 06 Oct 2018, 10:08

Re: New hackable ESP gadgets in local budget store "action" !!!

#15 Post by FanOfHue » 03 Sep 2019, 08:23

Chip/Module used:

Switch Plug ESP8285-TYWE2S
Door Sensor ESP8266-TYWE3S
PIR Sensor ESP8266-TYWE3S
Hand Remote RTL8710BN-WR3
Sirene RTL8710BN-WR3
Led Strip ESP8266-TYWE3L

At least the ESP editions can be flashed with ESP Easy or similar stuff. I'm not aware of any custom firmware for the RTL modules.

FanOfHue
Normal user
Posts: 43
Joined: 06 Oct 2018, 10:08

Re: New hackable ESP gadgets in local budget store "action" !!!

#16 Post by FanOfHue » 03 Sep 2019, 08:27

Tecumseh wrote:
02 Sep 2019, 23:26
I found some more info and a tear-down of these devices on a the German forum mikrocontroller.net. It seams that the OTA update with Tuya-convert has been disabled by Tuya with a new firmware and these devices would have the new update. Also some of these devices don't have the esp8266 or esp8285 chip onboard that would enable us to change the firmware to espeasy. Although some items do have a chip with almost the same pinout as the esp-12f so a switch could be made.

What I have not found yet is how we would configure these devices after flashing them with espeasy. What pins are connected where and how do we configure deepsleep to get a sustainable battery life.
Switch Plug is like this:
gpio 4 is LED (0 = on)
gpio 12 is relay (1 = on)
gpio 14 is switch (0 = pressed)

The battery operated devices do not need deepsleep config. The second MCU used on these devices controls the power to the ESP. Without trigger, the ESP is just powered off. When triggered, ESP will be powered on.

bulthaup
Normal user
Posts: 11
Joined: 29 Jul 2019, 15:10

Re: New hackable ESP gadgets in local budget store "action" !!!

#17 Post by bulthaup » 06 Sep 2019, 23:08

FanOfHue wrote:
03 Sep 2019, 08:27
Tecumseh wrote:
02 Sep 2019, 23:26
I found some more info and a tear-down of these devices on a the German forum mikrocontroller.net. It seams that the OTA update with Tuya-convert has been disabled by Tuya with a new firmware and these devices would have the new update. Also some of these devices don't have the esp8266 or esp8285 chip onboard that would enable us to change the firmware to espeasy. Although some items do have a chip with almost the same pinout as the esp-12f so a switch could be made.

What I have not found yet is how we would configure these devices after flashing them with espeasy. What pins are connected where and how do we configure deepsleep to get a sustainable battery life.
Switch Plug is like this:
gpio 4 is LED (0 = on)
gpio 12 is relay (1 = on)
gpio 14 is switch (0 = pressed)

The battery operated devices do not need deepsleep config. The second MCU used on these devices controls the power to the ESP. Without trigger, the ESP is just powered off. When triggered, ESP will be powered on.

Have you tried configuring the Door sensor already? Any idea about the GPIO settings?

FanOfHue
Normal user
Posts: 43
Joined: 06 Oct 2018, 10:08

Re: New hackable ESP gadgets in local budget store "action" !!!

#18 Post by FanOfHue » 07 Sep 2019, 13:45

AFAIK, the door sensor has no GPIO attached to any hardware. Only RX/TX is connected to the other MCU.
I'm working on a serial plugin for ESPCoreRules to read the status from the other MCU and instruct it to power off again.

I have seen an existing plugin for ESP Easy to controll Tuya MCU that might be enhanced to support the Door Sensor.

FanOfHue
Normal user
Posts: 43
Joined: 06 Oct 2018, 10:08

Re: New hackable ESP gadgets in local budget store "action" !!!

#19 Post by FanOfHue » 07 Sep 2019, 16:21

Latest commit of ESPCoreRules has a work-in-progress quick and dirty plugin for the doorsensor:
ESPCoreRules/_P201_TUYA.ino

You might be able to see how it works from this plugin:
https://github.com/SmartNodeRules/ESPCo ... 1_TUYA.ino

The plugin currently sends messages received from the second MCU to a syslog server. I could see from the syslog server that all is working.
The PIR sensor works in a similar way.

User avatar
enesbcs
Normal user
Posts: 404
Joined: 18 Jun 2017, 11:02
Location: Békéscsaba, Hungary
Contact:

Re: New hackable ESP gadgets in local budget store "action" !!!

#20 Post by enesbcs » 07 Sep 2019, 16:55

FanOfHue wrote:
07 Sep 2019, 13:45
AFAIK, the door sensor has no GPIO attached to any hardware. Only RX/TX is connected to the other MCU.
I'm working on a serial plugin for ESPCoreRules to read the status from the other MCU and instruct it to power off again.

I have seen an existing plugin for ESP Easy to controll Tuya MCU that might be enhanced to support the Door Sensor.
Is it similar to these gocomma/Neo door sensor?
Image

RobinS
Normal user
Posts: 3
Joined: 07 Sep 2019, 17:10

Re: New hackable ESP gadgets in local budget store "action" !!!

#21 Post by RobinS » 07 Sep 2019, 17:52

Have you tried configuring the Door sensor already? Any idea about the GPIO settings?
Hello,
I also stumbled across the LSC stuff in the action store and decided to give it a try.
In the last couple of days, I have been reverse engineering the door sensor.

My conclusions sofar:
I have removed the WiFi module so I could draw up some course schematic, and the Wifi module only uses its serial connections (RXD0, TXD0).
The reed contact (door sensor) is directly connected to the MCU, which powers on the Wifi module when its activated.
The Wifi module needs to initiate the communication, after some data exchange the MCU will sent the contact state to the Wifi module and the cloud.
I also logged the communication and unfortunately it uses a dialect of the Tuya protocol (see https://images.tuyacn.com/smart/aircon ... a-MCU.pdf ).
The MCU on the door sensor board uses some slightly different command codes than the standard.
The devices functions commands, listed as 0x06 and 0x07 in the Tuya document seem to be merged and have replace command 0x05.
I also checked the Tasmota Tuya protocol support in the Tuya dimmer module, and this does seem to support the switch functionality, but unfortunately it can not support the LSC Door sensor, as it uses the wrong command to communicate it :cry: It however should allow enough communication to allow the MCU to send the contact status to tasmota.

The original firmware is however quite fast in sending data to the cloud, as the total WiFi module power on time is approx 5.6 seconds.
In this time frame the module connects to the Wifi network, and sends the data to the cloud. It then takes several seconds more before a open/close notification is received on the app / phone.

The door sensor uses approx 5.8 - 6 µA when its in idle (no communication).
When the MCU wakes up, the current increases to 580-600 µA (Wifi module was removed from the board)
With the Wifi module I noticed current of 88 mA+ on my PSU (did not accurately measure this yet).

I expect that running Tasmota on the door sensor will reduce battery life as I think that Tasmota will require much more time than the 5.6 seconds to send the data.
Note: as the mikrocontroller.net forum post is more technically orientated, I will post my detailed findings there. (unless its desired here as well).

Best Regards,

Robin

FanOfHue
Normal user
Posts: 43
Joined: 06 Oct 2018, 10:08

Re: New hackable ESP gadgets in local budget store "action" !!!

#22 Post by FanOfHue » 07 Sep 2019, 18:37

I also reverse engineered the serial protocol to find out that it's not really following protocol as documented.

Taken from my plugin comments:

* tuyaSend <cmd>,<len>,<value> Send a serial message to the 'tuya' MCU as used on LSC Smart Connect PIR and Doorsensors
*
* Still debugging. Official documentation does not seem to match with commands used for PIR/Doorsensor
* tuyasend 1,0,0 Get device info from MCU
* tuyasend 2,1,0 fast blink LED
* tuyasend 2,1,1 start AP/config mode, power stays on, slow blink LED
* tuyasend 2,1,2 LED blink off
* tuyasend 2,1,3 ??
* tuyasend 2,1,4 Get device status from MCU

The main trick is to send command 2 with option 4. The MCU will send the status and will power off shortly after.
The whole procedure takes like 5 seconds on ESPCoreRules. ESP Easy could be similar but have not build a plugin for it.

RobinS
Normal user
Posts: 3
Joined: 07 Sep 2019, 17:10

Re: New hackable ESP gadgets in local budget store "action" !!!

#23 Post by RobinS » 08 Sep 2019, 12:42

@FanOfHue,
Good to see you progress as well.
Here is a my more detailed view on it.
I found that they do reuse mayor parts of the Tuya protocol, but have shifted some commands.
It follows the query sequence, but uses different command ID's, however with the same contents as the originally intended command ID.
It starts with the Product ID query => same as Tuya protocol. However the product ID info is missing the mode part.
Then it only uses command 0x02 (Query the working mode of the Wi-Fi module), where I would expect also command 0x03 (Report the network connection status of the device.) as a reply to report the status of the wifi connection. However the contents of the 0x02 messages with payload does follow the contents of command 0x03.
When the Wifi module reports status 5 (status code 0x04) (The device connects to the router and cloud) then the MCU starts reporting its status (and contact).
This however is not done with commands 0x06 and 0x07 as in the normal Tuya protocol, but all with command id 0x05 which is originally assigned to (Reset the Wi-Fi module and select a network configuration mode.) But the contents of the message follows again that of the offical Tuya commands 0x06 and 0x07.
So as you experienced sending the 0x02 command with 0x04 status will trigger the status as the MCU recieves a connection up event.
I have attached my sniffing results in the 7z, as I could not attach an excel file directly.

I think that for the other LSC devices command 0x05 (with the Tuya structure of commands 0x06 and 0x07) can be used to access the devices functions (reporting and quering).
Sending the connection up the MCU will then trigger the status reporting.

The response times you mentioned of ESPCoreRules and ESP easy sound really good.
I will look into them in more detail, as I not familiar with them.
Attachments
LSC doorsensor original fw com seq analyze.7z
(86.25 KiB) Downloaded 20 times

Robvs
Normal user
Posts: 1
Joined: 09 Sep 2019, 17:21

Re: New hackable ESP gadgets in local budget store "action" !!!

#24 Post by Robvs » 09 Sep 2019, 17:26

Ho Robin,
Closely watching your progrees. It would be really need when the doorsensor works with tasmota.

So which status is the ESP set in by the MCU when being idle? Its not a complete power down since its serial communication need to be kept alive to wake up again right?

RobinS
Normal user
Posts: 3
Joined: 07 Sep 2019, 17:10

Re: New hackable ESP gadgets in local budget store "action" !!!

#25 Post by RobinS » 09 Sep 2019, 19:04

Robvs wrote:
09 Sep 2019, 17:26
Ho Robin,
Closely watching your progrees. It would be really need when the doorsensor works with tasmota.

So which status is the ESP set in by the MCU when being idle? Its not a complete power down since its serial communication need to be kept alive to wake up again right?
Hi Robvs,

Thanks, but after some investigations I have decided to skip both Tasmota and ESPEasy for now.
Although I have now been able to modify and build the Tasmota firmware, the Tuya dimmer implementation is too fit for its purpose and will require quite some re-work.
Besides this I could not find any documentation on the Tasmota inner workings, so this will take quite some time as well. I came to the same conclusion with ESPEasy.

As I want my LSC smart devices operation asap, on my MQTT infrastructure I have decided to first develop an driver in a new clean project.
This will allow me to quickly to get up to speed with my driver development and test it in practice, although less universal as I would like.
When I have this operational, I am planning to port this into Tasmota, hopefully with some guidance from an experienced Tasmota developer.

I will still post my progress here and am planning to open source this project when finished.

Regarding the ESP state:
The default ESP state is dead... (its always powered off by the MCU)
When the MCU is triggered (powerup, contact change, or button pressed in the battery compartment) [for the doorsensor], the MCU will power on the ESP.
The MCU will however not send its status to the ESP, until it gets the report from the ESP that it has a fully functional network connection.
I estimate that the MCU will power off immediately when it receives the sort of acknowledge from the ESP.
I also estimate that the MCU will keep the ESP powered during the time there is idle communication.
However in my tests without ESP I have noticed that the MCU will power cycle the ESP when it does not receive a valid frame every x seconds. (did not time it).
And noticed that it will do this for a max 16 ... 20 second period, which I estimate that this could be the maximum time the MCU will allow the ESP to communicate.

If so then it will be impossible to configure Tasmota within this time frame.
I now kept the ESP powered with an external power source to keep it running, regardless of the MCU state.

Best Regards,

Robin

bulthaup
Normal user
Posts: 11
Joined: 29 Jul 2019, 15:10

Re: New hackable ESP gadgets in local budget store "action" !!!

#26 Post by bulthaup » 09 Sep 2019, 19:08

Hi, please keep this thread alive. Hacking these Action things is always fun :)

Ggaljoen
Normal user
Posts: 2
Joined: 30 Sep 2018, 17:36

Re: New hackable ESP gadgets in local budget store "action" !!!

#27 Post by Ggaljoen » 10 Sep 2019, 19:53

Promotion prices from tomorrow for BE & NL, maybe in other countries too...

tim
Normal user
Posts: 30
Joined: 05 Dec 2015, 11:24

Re: New hackable ESP gadgets in local budget store "action" !!!

#28 Post by tim » 15 Sep 2019, 15:23

Ggaljoen wrote:
10 Sep 2019, 19:53
Promotion prices from tomorrow for BE & NL, maybe in other countries too...
Thanks for the tip! Just went to the store and got me some smart plugs and a doorsensor.

I see more people discussing it here, what is the status for ESP Easy? Can i try the doorsensor with the latest ESP Easy build already?

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests