Flash Tasmota firmware Over The Air on Tuya Wifi switches


dropcap emylo

Nowadays, you get very cheap wifi switches based on ESP8266/85 and Tuya IOT services. As Tuya company offers very cheap smart home solution branding, you'll find a huge number of branded switches based on their service.

Only problem with these devices is that they are working with some China based servers. So every time you want to switch-on your light with such a switch, your command need to go to China and come back. In case your internet is down or their server is having trouble (which happens too often) … no light !

This is not exactly what you can call freedom. Hopefully some Open Source firmware like Tasmota are available to liberate your Tuya based IOTs. Once flashed with this firmware, your devices can be configured to connect to any local MQTT broker or Home automation server.

Tuya Convert project is allowing you to flash an alternative firmware over The Air thanks to VTRUST hack.

This article explains step by step procedure to flash a Tasmota firmware OTA on most ESP8266/85 Tuya based wifi switches. It typically needs a Raspberry Pi with a Wifi adapter and a Linux computer. Your Wifi adapter should be able to enter in AP mode (which is the case with most recent models).

It has been tested with a Ubuntu 18.04 LTS workstation, an old Raspberry Pi B+ and a D-Link DWA-131 Wifi USB key. TP-Link TL-WN727N has also been used succesfully.

1. Raspberry Pi with Raspbian

First thing is to download and flash latest Raspbian image on a SD card for your raspberry version.

Image can be downloaded from

Extract .img file from the zip file and flash it with your favorite tool (I've done it with etcher).

Connect your Raspberry Ethernet port to your LAN and boot it.

If you've not configured SSH service, you need to do a console login at least once to start SSH service.

# sudo service ssh start

Now that SSH server is started, you can run all following commands on your Raspberry from any SSH client.

2. Software installation

It's now time to update and install all needed software on your Raspberry.

Some software will be installed from Raspbian repositories and some from pip3 repositories.

# sudo apt update
# sudo apt upgrade
# sudo apt install dnsmasq hostapd screen python3-pip python3-setuptools python3-wheel mosquitto nodejs haveged git
# sudo pip3 install paho-mqtt pyaes tornado

OTA flash process needs a modern version of NodeJS, starting from v10.15 +.

So if your node version is too old, you may need to download latest NodeJS version from according to your Raspberry processor generation.

# node -v
# cat /proc/cpuinfo
Processor : ARMv6-compatible processor rev 7 (v6l)

Here I'm using an old Raspberry Pi B+ with armv6 processor and default NodeJS version is 6.2.1.
Raspberry Pi 2, 3, … are hosting armv7 processors.

For my armv6 processor, I need to download version v10.15.1 available from

# wget

Next you need to install NodeJS binaries and to check node and npm versions.

# tar -xzf node-v10.15.1-linux-armv6l.tar.gz
# cd node-v10.15.1-linux-armv6l/
# sudo cp -R * /usr/local/
# cd ..
# rm -R node-v10.15.1-linux-armv6l
# node -v
# npm -v

Next you need to clone and install tuya-convert from GitHub :

# git clone
# cd tuya-convert
# pushd scripts/smartconfig
# npm i
npm WARN deprecated circular-json@0.3.3: CircularJSON is in maintenance only, flatted is its successor.npm notice created a lockfile as package-lock.json. You should commit this file.npm WARN tuya-helper@1.0.0 No repository field.
added 498 packages from 315 contributors and audited 1684 packages in 597.569sfound 0 vulnerabilities

3. Flash Tasmota Over The Air

Everything is now ready to flash Tasmota firmware to your Tuya device Over The Air.

You just need to run these commands and to follow the instructions.

# popd
# sudo ./
TUYA-CONVERT was developed by Michael Steigerwald from the IT security company VTRUST ( in collaboration with the techjournalists Merlin Schumacher, Pina Merkert, Andrijan Moecker and Jan Mahn at c't Magazine. (
TUYA-CONVERT creates a fake update server environment for ESP8266/85 based tuya devices. It enables you to backup your devices firmware and upload an alternative one (e.g. ESPEasy, Tasmota, Espurna) without the need to open the device and solder a serial connection (OTA, Over-the-air).Please make sure that you understand the consequences of flashing an alternative firmware, since you might lose functionality!
Flashing an alternative firmware can cause unexpected device behavior and/or render the device unusable. Be aware that you do use this software at YOUR OWN RISK! Please acknowledge that VTRUST and c't Magazine (or Heise Medien GmbH & Co. KG) CAN NOT be held accountable for ANY DAMAGE or LOSS OF FUNCTIONALITY by typing yes + Enter
Type yes
Starting AP in a screen
Stopping any apache web server
Starting web server in a screen
Starting Mosquitto in a screen
1. Connect any other device (a smartphone or something) to the WIFI vtrust-flash
The wpa-password is flashmeifyoucan
This step is IMPORTANT otherwise the smartconfig will not work!
2. Put your IoT device in autoconfig/smartconfig/pairing mode (LED will blink fast).
This is usually done by pressing and holding the primary button of the device3.
Press ENTER to continue

It's now time to :

  1. connect your smartphone to the vtrust-flash wifi network
  2. Press the reset button for few seconds on your switch (till the LED blinks fast)
  3. Press ENTER

Starting pairing procedure in screen
RTNETLINK answers: File exists
Waiting for the upgraded device to appearIf this does not work have a look at the '*.log'-files in the 'scripts' subfolder!

After less than 30 seconds, the LED should stop to blink fast and flash process will carry on after few more seconds.


IoT-device is online with ip
Fetching firmware backup
Create backup of entire FLASH from
Connected... Flashsize= 1048576
b'read 0x00000000 to 0x000003FF'
b'read 0x00000400 to 0x000007FF'
b'read 0x000FF800 to 0x000FFBFF'
b'read 0x000FFC00 to 0x000FFFFF'
Getting Info from IoT-device
ChipID: f42d81
MAC: DC:4F:22:F4:2D:81
SdkVersion: 1.5.3(aec24ac9)
BootVersion: 4
BootMode: 1
FlashMode: 1M DOUT @ 40MHz
FlashChipId: 144051
FlashChipRealSize: 1048576
FlashChipSize: 1048576
FlashChipMode: 3
system_upgrade_userbin_check: user2 0x81000
Please make sure to note the correct SPI flash mode!
Installing an alternative firmware with the wrong flash mode will leave the ESP unable to boot!
Next steps:
1. To go back to the orginal software
# curl
2. Be sure the conversion software runs in user2
# curl
3. Flash a third party firmware to the device
put or link it to ./files/thirdparty.bin
A basic build of Sonoff-Tasmota v6.4.1 is already included in this repository.
# curl
Alternatively let the device download and flash a file via HTTP:
# curl

You are now ready to flash Tasmota firmware on your Tuya switch to give it freedom !

We will use the basic build provided with Tuya convert.

# curl

Flash won't take too much time and you switch will reboot automatically at the end of the flash.

It should restart in access point mode with a sonoff-xxxx SSID.

4. Configure Network

From you computer or from your smartphone, connect to this Wifi network. You'll be prompted the wifi configuration page.

Configure your Home wifi network SSID, password and Hostname (make sure its unique on your LAN).

Once everything is setup, just Save.

sonoff tuya wifi

When you save the new configuration, your switch will reboot and connect to your home network as a DHCP client.

5. Detect your device

From your Linux workstation, you'll need to find your new Tasmota device IP.

I've writtent a small script to help to list all Tasmota devices on your network.

You just need to download it from my Github repository and to run it :

# sudo apt install fping
# sudo wget -O /usr/local/bin/tasmota-discover
# sudo chmod +x /usr/local/bin/tasmota-discover
# tasmota-discover
Netmask : 192.168.x.200/24
192.168.x.122 - pzem004 - Sonoff Basic Module, ver 6.5.0(release-sensors), Uptime 15T23:54:36
192.168.x.129 - vmc-front - Sonoff Basic Module, ver 6.4.1(basic), Uptime 0T00:07:49
192.168.x.187 - sensor-back - Sonoff TH Module, ver 6.5.0(release-sensors), Uptime 2T00:34:13
192.168.x.160 - vmc-back - Sonoff TH Module, ver 6.5.0(release-sensors), Uptime 15T23:54:35

You'll get all Tasmota devices found on your network. Uptime will give you the last one connected to your network.

If you want to configure your switch as a MQTT client and integrate it into OpenHab, you can follow this guide.

6. Conclusion

With this procedure, I've liberated few Tuya devices :

  • 10x e-mylo SS-8839-02 and SS-8839-03 switches
  • 1x SmartHome switch
  • 3x Wireless Light Bulb sockets

Most of them have been flashed using an old Raspberry Pi B+ and a Dlink DWA-131 wifi adapter.

One e-mylo SS-8839-03 has refused to enter in OTA flash mode with this setup. But it has succesfully been flashed after using a TP-Link TL-WN727N wifi adapter.

In case you can't flash one Smart Switch, just try another wifi USB key …


Hope it helps


Signature Technoblog

This article is published "as is", without any warranty that it will work for your specific need.
If you think this article needs some complement, or simply if you think it saved you lots of time & trouble,
just let me know at This email address is being protected from spambots. You need JavaScript enabled to view it.. Cheers !

icon linux icon debian icon apache icon mysql icon php icon piwik icon googleplus