Hardware and Software Hack Smart Devices, Tuya and Broadlink LEDbulb, Sonoff, BSD33 Smart Plug

In this Instructable I show you how I flashed several smart devices with my own firmware, so I can control them by MQTT via my Openhab setup.

I will add new devices when I hacked them.

Of course there are other software based methods to flash custom firmware, like Tuya convert, but I like to understand how the device works and what is 'under the hood'.

Code is written and flashed using Arduino IDE.

I control my devices via Openhab and Google Home (via Openhab), if you want to know more or need the .items file etc, please let me know in the comments.

Safety first!

Be careful since we are working on mains voltage powered devices. Disconnect the devices from the power supply before working on them.

I you have any doubts if the device is safe after the modification, please discard it.

Supplies

For most hacks you need a FDTI programmer attached to a computer running Arduino IDE, some jumper wires, a soldering iron, some resistors and ESP8266 or ESP8285 modules.

Step 1: Tuya LED RGBW Smart Bulb

Intro

I bought this lamp from Aliexpress. It works fine with the Smart Life app, but I wanted to control it via MQTT from Openhab. I already made my own Sonoff B1 firmware, so I tried to flash this lamp with that firmware.

Flashing

You open the lamp by carefully removing the plastic cap, by hand by using force or via the twisting of a screw driver between the metal and the plastic. You can see the bare ESP8266 chip.

The needed connections are exposed via small pads on the PCB (3v3, GND, RX, TX and IO0 (GPIO0))

I first put some solder to the pads and solder to the wires and then soldered them together. I used a tiewrap and some hot glue to attach the wires to the lamp.

GPIO0 is needed to bring the ESP8266 in program mode. Connect it to ground when powering the ESP8266. You can power and flash the ESP8266 using a FTDI programmer.

Firmware

The firmware is based on my Sonoff B1 firmware, but is modified, because the Sonoff B1 uses MY9231 LED drivers which are driven by the ESP8285 chip and in this Tuya Smart lamp the 4 channels (RGBW) are driven by mosfets switched by PWM signals directly from the ESP8266.

The green channel is connected to GPIO12, red to GPIO14, blue to GPIO13 and the white channel is connected to GPIO4. In the code you see that as: #define GREENPIN 12 #define REDPIN 14 #define BLUEPIN 13 #define WHITEPIN 4.

The complete code is on my Github.

Step 2: Generic Warm White LED Bulbs - Part 1

Intro

I bought these LED bulbs from Aliexpress Blue/white box and black box. They are ment to be controlled via the Magic home smart home app and the Techlife pro app. I did not try these apps, since I wanted to control the LED bulbs via MQTT from Openhab. Since I already had the firmware for the RGBW bulbs, I used that with not four (RGBW) channels, but only one channel.

Flashing

You open the lamp by carefully removing the plastic cap. I found out the the cap was a little glued to the metal, so I needed force from a screw driver between the metal and the plastic.

I expected to see an ESP8266 or ESP8285 chip, however it was a Broadlink module. The module looked much like an ESP12 module, but I found out the the pinout was completely different. From removing the metal cover, I found out it was a RDA 5981AM chip.

My solution to replace this chip by an ESP is shown in the next step.

Step 3: Generic Warm White LED Bulbs - Part 2

The modules are connected to the base of the lamp via 3 pins, see the first picture:

• 3V3 (3.3V)
• GND (ground)
• PWM (pulse width modulation)

The PWM pin is used to set the brightness of the lamp via a PWM signal, which can vary from 0 (lamp is off) to 100 (lamp is completely on) and every value in between. See this website for some more information about PWM signals.

Since ESP8266 and ESP8285 modules run on 3.3V and can easily generate a PWM signal, I changed the Broadlink modules to ESP8266 or ESP8285 modules I had laying around.

The ESP-01S (ESP8266) modules are flashed via a separate programmer, see step 3 of this Instructable. I soldered female header pins to the lamp with a pull up resistor between 3V3 and EN (enable). This was my first experiment, later on I changed to the ESP8285 modules.

The ESP-M1, ESP-M3 and ESP-01F (ESP8285) modules are flashed by soldering wires to the needed connections (3V3, GND, RX, TX and GPIO0 (see step 1, the flashing of the Tuya smart lamp). I soldered a pull up resistor between 3V3 and EN (enable).

With the ESP-M3 module, I use GPIO4 to generate the PWM signal. At first I used GPIO2, but when the LEDbulb is of, the low GPIO2 results in the illuminatuon of the on-board LED, which gives a undesired blue glow in the LEDbulb.

Add some kapton tape to improve isolation between the module and the lamp base connections.

Edit: I found out that the ESP-01F module does not reliably started up, probably due to power instability at power up. I solved this by adding a 10 uF tantalum capacitor between GND and VCC. Noteworthy a ceramic 10 uF capacitor did not work.

Step 4: Generic Warm White LED Bulbs - Part 3

Firmware

The code is on my Github.

The firmware inludes a web interface to control the LEDbulb, and also has an option to update the firmware OTA via Webupdate

Step 5: Sonoff or BSD33 Smart Plug - Part 1

Intro

I bought this WiFi smart plug from Aliexpress. It works fine with the Smart Life app, but I wanted to control it via MQTT from Openhab. I already made my own Sonoff firmware for smart plugs and sockets, so I tried to flash this lamp with that firmware.

I also used this firmware to flash my Sonof S20 and Sonoff S26 smart plugs and Sonoff basic and Sonoff Basic R3 smart switches. How to open and hardware connect Sonoff devices for flashing is described for Tasmota at the wiki of tasmota, therefore this is not described here.

Opening the socket

The smart plug is glued together. To open it put a screwdriver in the cutout at the earth and apply some force by using the other side of the socket as a pivot point (hint from from netpokin this topic). This way you should be able to crowbar it out without damaging the socket.

In the pictures you see the inside of the plug. It consists of a main board with the relay a smaller pcb on which the ESP8266 chip and the memory is mounted. The boards are connected via accessible solder connections.

Step 6: Sonoff or BSD33 Smart Plug - Part 2

Flashing

I reverse engineered the solder connections. See the picture for the description of the connections. I found out that:

• GPIO2 is connected to the LED (in the button of the plug).
• GPIO13 is connected to the button itself.
• GPIO15 is connected to the mosfet which switches the main relay.

You can power and flash the ESP8266 using a FTDI programmer. Connect female dupont cables to the following connections: (VCC (3.3V), GND, RX, TX and GPIO0)

GPIO0 is needed to bring the ESP8266 in program mode. Connect it to ground when powering the ESP8266.

On my FTDI programmer I added a 470uF capacitor between ground and VCC. In another project I found out that this increased the stability.

The FTDI programmer has some other unused GND and VCC pins, you can use them to connect GPIO0 to GND.

Step 7: Sonoff or BSD33 Smart Plug - Part 3

Firmware

My firmware is on my Github.

Main parts of the firmware

• Connection to WiFi and MQTT server
• Manual switching when online and offline (at startup)
• If the relay is switched manually when the device is offline, it sends the state via MQTT when reconnected
• The relay state is stored in RTC memory (see this video about RTC memory of the ESP8266)
• Web interface for controlling the switch and accessing the Webupdate for OTA
• The firmware is suitable for this BSD33 smartplug, but also for Sonoff devices: Sonoff S20, Sonoff S26, Sonoff basic, Sonof Basic R3

Openhab integrations

I use this plug to control the power of my coffee machine. Via Openhab and Google Home I can control it via voice.

I implemted a timer which switches of my coffee machine after a preset time, see the picture of my Openhab sitemap. The preset time is injected in NodeRed, with different preset times on weekdays and weekend days.

See my Github for examples of the items, rules and sitemap files.