Search

Flash Tasmota firmware Over The Air on Tuya Wifi switches

Contents[Hide]

dropcap emylo

Nowadays, you get very cheap wifi switches based on ESP8266/85 and Tuya IOT services. As Tuya company offers very cheap smart home solution branding, you'll find a huge number of branded switches based on their service.

Only problem with these devices is that they are working with some China based servers. So every time you want to switch-on your light with such a switch, your command need to go to China and come back. In case your internet is down or their server is having trouble (which happens too often) … no light !

This is not exactly what you can call freedom. Hopefully some Open Source firmware like Tasmota are available to liberate your Tuya based IOTs. Once flashed with this firmware, your devices can be configured to connect to any local MQTT broker or Home automation server.

Tuya Convert project is allowing you to flash an alternative firmware over The Air thanks to VTRUST hack.

This article explains step by step procedure to flash a Tasmota firmware OTA on most ESP8266/85 Tuya based wifi switches. It typically needs a Raspberry Pi with a Wifi adapter and a Linux computer. Your Wifi adapter should be able to enter in AP mode (which is the case with most recent models).

It has been tested with a Ubuntu 18.04 LTS workstation, an old Raspberry Pi B+ and a D-Link DWA-131 Wifi USB key. TP-Link TL-WN727N has also been used succesfully.

1. Raspberry Pi with Raspbian

First thing is to download and flash latest Raspbian image on a SD card for your raspberry version.

Image can be downloaded from https://www.raspberrypi.org/downloads/raspbian/

Extract .img file from the zip file and flash it with your favorite tool (I've done it with etcher).

Connect your Raspberry Ethernet port to your LAN and boot it.

If you've not configured SSH service, you need to do a console login at least once to start SSH service.

Terminal
# sudo service ssh start

Now that SSH server is started, you can run all following commands on your Raspberry from any SSH client.

2. Software installation

It's now time to update and install all needed software on your Raspberry.

Some software will be installed from Raspbian repositories and some from pip3 repositories.

Terminal
# sudo apt update
# sudo apt upgrade
# sudo apt install dnsmasq hostapd screen python3-pip python3-setuptools python3-wheel mosquitto nodejs haveged git
# sudo pip3 install paho-mqtt pyaes tornado

OTA flash process needs a modern version of NodeJS, starting from v10.15 +.

So if your node version is too old, you may need to download latest NodeJS version from https://nodejs.org/dist/ according to your Raspberry processor generation.

Terminal
# node -v
v6.2.1
# cat /proc/cpuinfo
Processor : ARMv6-compatible processor rev 7 (v6l)
...

Here I'm using an old Raspberry Pi B+ with armv6 processor and default NodeJS version is 6.2.1.
Raspberry Pi 2, 3, … are hosting armv7 processors.

For my armv6 processor, I need to download version v10.15.1 available from https://nodejs.org/dist/

Terminal
# wget https://nodejs.org/dist/v10.15.1/node-v10.15.1-linux-armv6l.tar.gz

Next you need to install NodeJS binaries and to check node and npm versions.

Terminal
# tar -xzf node-v10.15.1-linux-armv6l.tar.gz
# cd node-v10.15.1-linux-armv6l/
# sudo cp -R * /usr/local/
# cd ..
# rm -R node-v10.15.1-linux-armv6l
# node -v
v10.15.1
# npm -v
6.4.1

Next you need to clone and install tuya-convert from GitHub :

Terminal
# git clone https://github.com/ct-Open-Source/tuya-convert
# cd tuya-convert
# pushd scripts/smartconfig
# npm i
npm WARN deprecated circular-json@0.3.3: CircularJSON is in maintenance only, flatted is its successor.npm notice created a lockfile as package-lock.json. You should commit this file.npm WARN tuya-helper@1.0.0 No repository field.
added 498 packages from 315 contributors and audited 1684 packages in 597.569sfound 0 vulnerabilities

3. Flash Tasmota Over The Air

Everything is now ready to flash Tasmota firmware to your Tuya device Over The Air.

You just need to run these commands and to follow the instructions.

Terminal
# popd
# sudo ./start_flash.sh
======================================================
TUYA-CONVERT
https://github.com/ct-Open-Source/tuya-convertTUYA-CONVERT was developed by Michael Steigerwald from the IT security company VTRUST (https://www.vtrust.de/) in collaboration with the techjournalists Merlin Schumacher, Pina Merkert, Andrijan Moecker and Jan Mahn at c't Magazine. (https://www.ct.de/)
======================================================
PLEASE READ THIS CAREFULLY!
======================================================
TUYA-CONVERT creates a fake update server environment for ESP8266/85 based tuya devices. It enables you to backup your devices firmware and upload an alternative one (e.g. ESPEasy, Tasmota, Espurna) without the need to open the device and solder a serial connection (OTA, Over-the-air).Please make sure that you understand the consequences of flashing an alternative firmware, since you might lose functionality!
Flashing an alternative firmware can cause unexpected device behavior and/or render the device unusable. Be aware that you do use this software at YOUR OWN RISK! Please acknowledge that VTRUST and c't Magazine (or Heise Medien GmbH & Co. KG) CAN NOT be held accountable for ANY DAMAGE or LOSS OF FUNCTIONALITY by typing yes + Enter
Type yes
======================================================
Starting AP in a screen
Stopping any apache web server
Starting web server in a screen
Starting Mosquitto in a screen
======================================================
IMPORTANT
1. Connect any other device (a smartphone or something) to the WIFI vtrust-flash
The wpa-password is flashmeifyoucan
This step is IMPORTANT otherwise the smartconfig will not work!
2. Put your IoT device in autoconfig/smartconfig/pairing mode (LED will blink fast).
This is usually done by pressing and holding the primary button of the device3.
Press ENTER to continue

It's now time to :

  1. connect your smartphone to the vtrust-flash wifi network
  2. Press the reset button for few seconds on your switch (till the LED blinks fast)
  3. Press ENTER

Terminal
======================================================
Starting pairing procedure in screen
RTNETLINK answers: File exists
Waiting for the upgraded device to appearIf this does not work have a look at the '*.log'-files in the 'scripts' subfolder!
............................................

After less than 30 seconds, the LED should stop to blink fast and flash process will carry on after few more seconds.

Terminal

IoT-device is online with ip 10.42.42.42
Fetching firmware backup
Create backup of entire FLASH from 10.42.42.42
Connected... Flashsize= 1048576
b'read 0x00000000 to 0x000003FF'
b'read 0x00000400 to 0x000007FF'
...
b'read 0x000FF800 to 0x000FFBFF'
b'read 0x000FFC00 to 0x000FFFFF'
~/tuya-convert
======================================================
Getting Info from IoT-device
VTRUST-FLASH 1.0(c) VTRUST GMBH https://www.vtrust.de/35c3/
READ FLASH: http://10.42.42.42/get?read=HEX-ADDRESS
ChipID: f42d81
MAC: DC:4F:22:F4:2D:81
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M DOUT @ 40MHz
FlashChipId: 144051
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 3
system_upgrade_userbin_check: user2 0x81000
======================================================
Please make sure to note the correct SPI flash mode!
Installing an alternative firmware with the wrong flash mode will leave the ESP unable to boot!
Next steps:
1. To go back to the orginal software
# curl http://10.42.42.42/undo
2. Be sure the conversion software runs in user2
# curl http://10.42.42.42/flash2
3. Flash a third party firmware to the device
BE SURE THE FIRMWARE FITS THE DEVICE AND USES THE CORRECT FLASH MODE!
MAXIMUM SIZE IS 512KB
put or link it to ./files/thirdparty.bin
A basic build of Sonoff-Tasmota v6.4.1 is already included in this repository.
# curl http://10.42.42.42/flash3
Alternatively let the device download and flash a file via HTTP:
# curl http://10.42.42.42/flashURL?url=http://10.42.42.1/files/thirdparty.bin
HAVE FUN!

You are now ready to flash Tasmota firmware on your Tuya switch to give it freedom !

We will use the basic build provided with Tuya convert.

Terminal
# curl http://10.42.42.42/flash3

Flash won't take too much time and you switch will reboot automatically at the end of the flash.

It should restart in access point mode with a sonoff-xxxx SSID.

4. Configure Network

From you computer or from your smartphone, connect to this Wifi network. You'll be prompted the wifi configuration page.

Configure your Home wifi network SSID, password and Hostname (make sure its unique on your LAN).

Once everything is setup, just Save.

sonoff tuya wifi

When you save the new configuration, your switch will reboot and connect to your home network as a DHCP client.

5. Detect your device

From your Linux workstation, you'll need to find your new Tasmota device IP.

I've writtent a small script to help to list all Tasmota devices on your network.

You just need to download it from my Github repository and to run it :

Terminal
# sudo apt install fping
# sudo wget -O /usr/local/bin/tasmota-discover https://raw.githubusercontent.com/NicolasBernaerts/openhab/master/tasmota/tasmota-discover
# sudo chmod +x /usr/local/bin/tasmota-discover
# tasmota-discover
Netmask : 192.168.x.200/24
--------------------------
192.168.x.122 - pzem004 - Sonoff Basic Module, ver 6.5.0(release-sensors), Uptime 15T23:54:36
192.168.x.129 - vmc-front - Sonoff Basic Module, ver 6.4.1(basic), Uptime 0T00:07:49
192.168.x.187 - sensor-back - Sonoff TH Module, ver 6.5.0(release-sensors), Uptime 2T00:34:13
192.168.x.160 - vmc-back - Sonoff TH Module, ver 6.5.0(release-sensors), Uptime 15T23:54:35

You'll get all Tasmota devices found on your network. Uptime will give you the last one connected to your network.

If you want to configure your switch as a MQTT client and integrate it into OpenHab, you can follow this guide.

6. Conclusion

With this procedure, I've liberated few Tuya devices :

  • 10x e-mylo SS-8839-02 and SS-8839-03 switches
  • 1x SmartHome switch
  • 3x Wireless Light Bulb sockets

Most of them have been flashed using an old Raspberry Pi B+ and a Dlink DWA-131 wifi adapter.

One e-mylo SS-8839-03 has refused to enter in OTA flash mode with this setup. But it has succesfully been flashed after using a TP-Link TL-WN727N wifi adapter.

In case you can't flash one Smart Switch, just try another wifi USB key …

 

Hope it helps

 

Signature Technoblog

This article is published "as is", without any warranty that it will work for your specific need.
If you think this article needs some complement, or simply if you think it saved you lots of time & trouble,
just let me know at This email address is being protected from spambots. You need JavaScript enabled to view it.. Cheers !

icon linux icon debian icon apache icon mysql icon php icon piwik icon googleplus