Hello,

After doing all the steps i try to add a new user, but get read only system, then try change the password, i get sucess, but then after reboot, cannot login with the new password or the one the i retrive from the script.

The gateway appear to work normally but cannot login via console or ssh..

Thanks

From /tmp (that being deleted after reboot and not saved in the flash). dd if=/dev/mtd0 of=/tmp/dmtd0.bin for mtd0 - mtd4

Install tftpd64.464 and confing your eth network.

tftp -l /tmp/dmtd0.bin -r dmtd0.bin -p 192.168.2.10 For dmtd0.bin - dmtd4.bin

The tftp is one busybox version and have lesser parameters and dont printing command errors so well but looks working OK.

I have 5 bin files that looks good but i have not verifying if they is 100% OK.

Some like trying verifying that is working ???

ZHA is working great but my docker under windows is making strange things so cant testing so much.

Great work done !!

Based on this thread, we managed to get custom firmware running on the EFR32 Zigbee chip in the Lidl Gateway. I have made a script to perform the upgrade, and a guide on how to use it. It also includes sx compiled for the Realtek SoC on the device. This is needed for uploading the firmware with xmodem.

Since a lot of useful information is already in this repo, I guess it makes sense to use it as a base for further development. Feel free to provide feedback if you have any!

After not being able to connect to port 8888 after a reboot, I tried to start serialgateway manually:

# /bin/sh /tuya/serialgateway
/tuya/serialgateway: line 1: syntax error: "(" unexpected

Could it be that there's an error in the provided prebuilt serialgateway.bin?

Hello, I have a problem assigning any channel other than 25 to TYGWZ-01 coordinator.

I've used this gateway with my old network at channel 25. Now I try to build a new network with it in the neighboring room, while all old devices vere deleted from the ZHA configuration for this coordinator, the configuration was deleted also, and the coordinator is moved to brand new raspberry pi.

Just installed fresh container image for HA and try to add the coordinator to ZHA. But no metter what I try it keeps assigning channel 25 to it!

How do I make it run channel 23 then?

My config:

zha:
  zigpy_config:
    network:
      channel: 23             # What channel the radio should try to use.
      channels: [21, 22, 23]  # Channel mask

I found your website and followed everything to the letter. I managed to get the password, login, put serialgateway in the /tuya/ dir and execute the script. I get a new tuya_start.original.sh, and anew tuya_start.sh. When I use cat to check the new files I think the output is correct:

But: After reboot I can't reach the unit through home assistant, and i am still able to SSH to port 2333. SO something is not completely working. Do you have a hint for me to take me to the next and last step?

Thanks!

Hi,

can someone post the content of the original tuya_start.sh? The if clause got ignored while restoring back to factory and thus it has been overwritten :(

From the article to Gaining access to the device Quote "3) We replaced the /etc/passwd symlink with a passwd file we created with a known root password." Question: the password file to be put in the unsquashfs filesystem structure, is it need to be format as shardow passwd file or just plain text format like in the old-time linux passwd file. where should it be located in the file system i.e. in root directory and change the symlink to /etc/passwd Quote "6) Finally we TFTP'd the newroot.bin file to the device and used the bootloader command FLW to write it to flash." Can you outline the process to in the Quote (step 6 in the article)
Currently I have a dump of the device from your dump_flash.py and unsquashfs it into my virtualbox debian vm I got the directory contains all the files from the SquashFS dumped. as I'm not very familiar with the process of flashing the device with tftp I need more detail on how to do that on my device. I got device but can not get the root password fron the process you mentioned in the article so the alternative is to reflash it with modified SquashFS flash image to gain initial access to the device. I hope this will also help other that fail to get root password of the device as I am.

Thanks very much.

Hi there

I follow the procedure to get the root passwd however the passwd I got doesn't work. Not sure if I missed something .

I did as follow:

1. connected board via TTL serial and run putty terminal
2. interrupted boot process and got prompt
3. read KEK and AUSKEY
4. run the script and received auskey and root pass
5. power cycled the board with the network attached to boot in normal mode
6. via putty tried to log in with the passwd from the script but unfortunately system says login incorrect

SO I got stuck here for now.

Can you help?

first of all, thank you for the article. Just a ticket to warn. I had the bad idea to make an ssh-copy-id ... I'm not going to be able to access ssh anymore :'(

From version 3.10 on, python module(s) that use the # variant when parsing arguments need to have a #define PY_SSIZE_T_CLEAN before including Python.h. This is not done in pycrypto library and unfortunately this library is archived.

This patch fixes a SystemError when creating the AES cipher instance in the decode script by switching to cryptography library, a more popular and active python library than pycrypto.

After a successful retrieval of the password for Gateway1 (I have 2 of these), I got a login prompt and tried to login with root/password obtained via the serial connection. Don't know what exactly happened next, but currently the gateway seems to loop. I'm still able to retrieve the keys after using .

The loop looks like

Booting...

Booting...

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize @ 0000000h 0c84018h 00000c8h 0000040h 0000018h 0000000h 0000018h 1000000h @ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName @ 0010000h 0000100h 0001000h 0001000h 0000100h 0000010h 000004eh GD25Q128 @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ DDR1:32MB

---RealTek(RTL8196E)at 2021.01.21-19:59+0800 v3.4T-pre2 16bit P0phymode=01, embedded phy check_image_header return_addr:05010000 bank_offset:00000000 no sys signature at 00010000! P0phymode=01, embedded phy

---Ethernet init Okay! tuya:start receive production test frame ... Jump to image start=0x80c00000... decompressing kernel: Uncompressing Linux... done, booting the kernel. done decompressing kernel. start address: 0x80003780 Linux version 3.10.90 ([email protected]) (gcc version 4.6.4 (Realtek RSDK-4.6.4 Bui ld 2080) ) #11 Thu Jan 21 20:03:54 CST 2021 CPU revision is: 0000cd01 Determined physical RAM map: memory: 02000000 @ 00000000 (usable) Zone ranges: Normal [mem 0x00000000-0x01ffffff] Movable zone start for each node Early memory node ranges node 0: [mem 0x00000000-0x01ffffff] icache: 16kB/16B, dcache: 8kB/16B, scache: 0kB/0B Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS0,38400 root=/dev/mtdblock2 PID hash table entries: 128 (order: -3, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 27700k/32768k available (2479k kernel code, 5068k reserved, 525k data, 1 92k init, 0k highmem) SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 NR_IRQS:128 console [ttyS0] enabled Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656) pid_max: default: 4096 minimum: 301 Mount-cache hash table entries: 512 reg e0=0 reg e1=0 reg e2=0 reg e3=0 reg e4=0 reg e5=0 reg e6=0 reg e7=0 reg f0=0 reg f1=0 reg f2=0 reg f3=0 reg f4=0 reg f5=0 reg f6=0 NET: Registered protocol family 16 bio: create slab at 0 NET: Registered protocol family 2 TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP: reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. msgmni has been set to 54 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x18002000 (irq = 9) is a 16550A serial8250: ttyS1 at MMIO 0x18002100 (irq = 13) is a 16550A Realtek GPIO Driver for Flash Reload Default tuya_gpio_init ok, scan expire time:50 SPI INIT ------------------------- Force into Single IO Mode ------------------------ |No chipID Sft chipSize blkSize secSize pageSize sdCk opCk chipName | | 0 c84018h 0h 1000000h 10000h 10000h 100h 84 0 GD25Q128|

SPI flash(GD25Q128) was found at CS0, size 0x1000000 boot+cfg offset=0x0 size=0x20000 erasesize=0x10000 linux offset=0x20000 size=0x1e0000 erasesize=0x10000 rootfs offset=0x200000 size=0x200000 erasesize=0x10000 tuya-label offset=0x400000 size=0x20000 erasesize=0x10000 jffs2-fs offset=0x420000 size=0xbe0000 erasesize=0x10000 5 rtkxxpart partitions found on MTD device flash_bank_1 Creating 5 MTD partitions on "flash_bank_1": 0x000000000000-0x000000020000 : "boot+cfg" 0x000000020000-0x000000200000 : "linux" 0x000000200000-0x000000400000 : "rootfs" 0x000000400000-0x000000420000 : "tuya-label" 0x000000420000-0x000001000000 : "jffs2-fs" PPP generic driver version 2.4.2 nf_conntrack version 0.5.0 (432 buckets, 1728 max) ip_tables: (C) 2000-2006 Netfilter Core Team TCP: cubic registered NET: Registered protocol family 17 l2tp_core: L2TP core driver, V2.0 8021q: 802.1Q VLAN Support v1.8 Realtek FastPath:v1.03

Probing RTL819X NIC-kenel stack size order[1]... eth0 added. vid=9 Member port 0x10f... eth1 added. vid=8 Member port 0x10...

Booting...

Thanks for your time and effort in this project! I've 2 MOES branded Zigbee bridges that are internally the same as you use.

Let's start that I was able to obtain the root password from bridge nummer 1 (in another post I will come back to that one). Following thw same procedure I'm able to get both KEK/AUSKEY, but when re-using the script to decrypt the root password, I run into a problem:

root# python3 lidl_auskey_decode.py Enter KEK hex string line>5A5AA5A5 401A4000 8F7B238C 001AD582 Encoded aus-key as hex string line 1>13F436F6 E44A50B4 5AF2F409 7AE9D394 Encoded aus-key as hex string line 2>8E335DD1 C67C31D9 63B3EBD5 2C7C790A Traceback (most recent call last): File "lidl_auskey_decode.py", line 64, in print("Auskey:", auskey.decode("ascii")) UnicodeDecodeError: 'ascii' codec can't decode byte 0xaa in position 2: ordinal not in range(128)

Any ideas ?

When I try to read an attribute (e.g. app_version from Aqara Weather sensor) I constantly get the following error in Home Assistant log:

Logger: homeassistant.components.websocket_api.http.connection
Source: components/zha/api.py:679
Integration: Home Assistant WebSocket API (documentation, issues)
First occurred: 9:19:53 AM (4 occurrences)
Last logged: 9:26:11 AM

[547770400288] Error handling message: Unknown error
[547681024800] Error handling message: Unknown error
Traceback (most recent call last):
  File "/usr/src/homeassistant/homeassistant/components/websocket_api/decorators.py", line 26, in _handle_async_response
    await func(hass, connection, msg)
  File "/usr/src/homeassistant/homeassistant/components/zha/api.py", line 679, in websocket_read_zigbee_cluster_attributes
    success, failure = await cluster.read_attributes(
  File "/usr/local/lib/python3.9/site-packages/zigpy/zcl/__init__.py", line 297, in read_attributes
    result = await self.read_attributes_raw(to_read, manufacturer=manufacturer)
  File "/usr/local/lib/python3.9/site-packages/zigpy/device.py", line 287, in request
    raise zigpy.exceptions.DeliveryError(
zigpy.exceptions.DeliveryError: [0x2513:1:0x0000]: Message send failure

Don't know if it is a problem in HA, in ZBGW or what... 😃

Hi Paul,

Amazing project! I already have a lidl silver crest gateway up and running which I wish to integrate with Home Assistant.

Would appreciate a step by step n00b proof guide. Thanks

Cheers,

Pictures of Tuya TYGWZ-01 / TuyaGo TYGWZ01 and links to official product page is missing project website:

https://paulbanks.org/projects/lidl-zigbee/

Suggest mention "Tuya TYGWZ-01 (also known as TuyaGo TYGWZ01)" as well as add links plus one or a few images:

Product dimensions：90x90x23mm (Package dimensions：1000x1000x50mm)

https://go.tuya.com/en/productDetail?code=83jt6kkktau3

https://zigbeealliance.org/zigbee_products/tuya-smart-gateway/

The obvious advantage of the original TYGWZ-01 (non-Lidl/Silvercrest) gateway is its availability outside of Europe.

Such wide availability should benefit all people and project whose goal it is to hack it for other purposes than its intended use.

It is also sold under different rebranded names such as Lonsonho, Moes, BENEXMART, Kstyhome, Moniclern, OWSOO, Zemismart, as well as in combination with Zigbee devices:

https://www.amazon.com/Zigbee-Switch-standard-Control-gateway/dp/B082B2FT6V

https://www.amazon.com/Gateway-Control-Temperature-humidity-gateway/dp/B083PRPYQ8/

https://www.amazon.com/OWSOO-Gateway-Wireless-Control-Compatible/dp/B08YNG15XQ

https://www.amazon.com/Moniclern-Powered-Gateway-Connection-Products/dp/B08HV1BNLG

https://www.amazon.com/Kstyhome-Powered-Gateway-Connection-Products/dp/B08XY37L49/

https://www.amazon.com/OWSOO-Powered-Gateway-Connection-Products/dp/B08768DMJJ/

https://www.amazon.com/OWSOO-Temperature-Humidity-Automation-Security/dp/B0868QJ1NV/

https://www.amazon.com/OWSOO-Temperature-Humidity-Automation-Security/dp/B0868NZHJZ/

As you all probably already know TYGWZ01 is also available in online stores in the European Union and the United Kingdom:

https://www.amazon.de/ZigBee-Gateway-zentraler-Controller-Hub-ZigBee-Ger%C3%A4te/dp/B083584M99/

https://www.amazon.co.uk/Zigbee-Gateway-Central-Controller-Devices/dp/B083584M99/

https://www.amazon.co.uk/TYGWZ-01-Gateway-Central-Controller-Devices/dp/B07N65MXD4/

https://www.amazon.de/BENEXMART-PIR-Sensor-Temperatur-Feuchtigkeitssensor-Combination/dp/B07SCXNG14/

https://www.amazon.co.uk/BENEXMART-PIR-Sensor-Temperatur-Feuchtigkeitssensor-Combination/dp/B07SCXNG14/

It can of course be ordered from Chinese stores like BangGood, Gearbest, or Aliexpress, but shipping from China is slow now.

https://www.gearbest.com/other-car-gadgets/pp_3008504694819915.html?wid=2000001

https://www.banggood.com/Zemismart-Tuya-ZB-Gateway-Hub-Smart-Home-Bridge-Smart-Life-APP-Wireless-Remote-Controller-Works-with-Alexa-Google-Home-p-1837198.html

https://www.aliexpress.com/item/1005002441359324.html

https://www.aliexpress.com/item/4000071525839.html

https://www.aliexpress.com/item/1005002340919938.html

https://www.aliexpress.com/item/1005002007026244.html

https://www.aliexpress.com/item/1005002341316609.html

https://www.aliexpress.com/item/4001263689776.html

https://www.aliexpress.com/item/4001263868157.html

https://www.aliexpress.com/item/1005002545821613.html

You just have to do a little research before placing an order to really get the Ethernet ("wired") version and not the WiFi version.