Flashing smart plugs with tuya-convert FAIL

-
I purchased a Medion Life+ Smart Plug from Aldi, for the purpose of doing some experimentation, and setting up a few automation ideas I had by connecting it to my Home Assistant instance.


After getting it home, and doing a bit of I realised that these plugs were actually manufactured by Tuya, and were simply rebranded with the Aldi Medion brand.

I found that there was a Tuya component for Home Assistant that worked with the Tuya cloud, however upon doing some more reading, a more appealing solution emerged.

I realised that many people were flashing Tuya based devices with custom firmware such as Tasmota or ESPHome, which allowed local control of the devices over a local network using Home Assistant. 

Usually flashing these devices means pulling them apart and using a USB-to-serial adaptor to flash the custom firmware. But, even more searching led me to tuya-convert which makes it possible to flash some Tuya-based devices over the air.

So, I dove in.

The instructions for tuya-convert recommended using a Raspberry Pi, but as my Raspberry Pi Zero W was tied up running Home Assistant, this wasn't really an option.

So, I instead went down the path of installing Ubuntu 19.04 on an old laptop, and trying to get tuya-convert running.

The Ubuntu install process is very slick these days, and I had it installed in a dual-boot setup with Windows 10 in no time. I then downloaded the tuya-convert git repository and installed the repository using the following commands

git clone https://github.com/ct-Open-Source/tuya-convert
cd tuya-convert
./install_prereq.sh

I then downloaded the Tasmota binary sonoff.bin (in this case 6.6.0) tried to start the tuya-convert flashing process using the following command

./start_flash.sh

But, this is where the trouble started. Over the next week or two I battled with Ubuntu and tuya-convert, firstly to attempt to get tuya-convert running correctly on Ubuntu, and then after that hurdle was overcome, getting the Medion smart plug to flash successfully.

What I finally realised was that the vulnerability tuya-convert was relying on had unfortunately been patched by Tuya in a subsequent firmware update, and the Medion plug must have had the updated firmware.

Word on the street was that some devices with old firmware were still able to be flashed successfully though, so I learnt that the Brilliant Smart Wifi Plugs were also a Tuya-based device, and purchased one of those.


Alas, my efforts failed again, suggesting that the Brilliant plugs also had the updated firmware which had been patched. 

But, like all clouds there is usually a silver lining; I recalled the Sonoff S20 I had purchased over 12 months ago, and realised that there were clear instructions for flashing Tasmota on the S20 using a USB-to-serial adaptor if I was willing to pull it apart. 

So, I ordered a CH340G USB to serial adapter from eBay, and prepared for the next instalment...



Comments

  1. Unknown29 December 2019 at 23:16

    Hmm purchased the medium plug a few months ago....and did the toya-convert on it today and worked pretty good. So maybe new version of the convert software.

    ReplyDelete
    Replies
    1. oscillatory31 December 2019 at 18:19

      Yes, this post was from before the current version of tuya-convert became available. At the moment tuya-convert should work with these and other devices, but presumably at some point the vulnerability in the tuya firmware that tuya-convert is currently exploiting will be patched, and it will stop working again.

      Delete
  2. AR4 June 2020 at 20:19

    I've done 3 of the Brilliant smart plugs using tuya-convert wirelessly in the last week. All 3 were bought from Officeworks. I believe the vulnerability patch is only applied if you hook it to the Brilliant app first. Also have done some of the Deta branded stuff from Bunnings succesfully. Cheers, Andrew

    ReplyDelete
    Replies
    1. oscillatory4 June 2020 at 22:57

      Hi Andrew, thanks for your comment. This post was from a time last year (2019) when tuya-convert had stopped working.

      Delete

Post a Comment

Popular posts from this blog

Smart Irrigation Controller with Tasmota and Home Assistant

-
Image
I've recently been working on a smart, wifi-enabled irrigation or watering controller for my garden, and have finally got it up and running. I'll start with a picture of the finished product, so you know where this is heading. I had a few ideas for how to achieve this, and over the last few months I've been examining different options, and recently took the plunge and purchased some hardware. I've been doing a number of projects with ESP8266 based hardware, Tasmota firmware, and Home Assistant and so it was inevitable any solution I put in place would feature those elements.
Read more

Controlling Samsung Air Conditioner from Home Assistant

-
Image
I've gradually been connecting as many devices as I can using Home Assistant. One of the things that has been on my list is our WiFi connected Samsung Air Conditioner. It is a Samsung model AR24FSSSBWKN sold in Australia in around 2015. We have made use of being able to control the air conditioner using the Samsung Smart Air Conditioner Android app , but it has always been problematic. It consistently requires a username and password to be entered when using it outside of the home, recently it has stopped working inside the home, and it also requests some (in my view) unnecessary permissions (such as telephone and contacts). So, the idea of being able to control it via Home Assistant is appealing. I'd considered trying to set something up with my Broadlink IR Pro  to control it via IR, but most of the possible solutions seemed a bit clumsy. I became aware of the climate_ip custom component for Home Assistant  created by SebuZet who is active on the Home As...
Read more

PIR Sensor with Wemos D1 Mini and Tasmota

-
Image
I ordered a couple of these AM312 PIR sensors from Banggood recently, to test using them in a multi-function sensor with Tasmota . There is some good information on configuring Tasmota with these sensors , and the manual can be found here . You can see an image of the sensor below, along with pin assignments. Thanks to the creator of this image; unfortunately I can't find the original source to offer credit, but am happy to do so if you reach out to me! These PIR modules simply behave as a switch. To experiment, I've simply connected the OUT pin to D2 (GPIO4) on a Wemos D1 Mini module, and have configured the LED on D4 (GPIO2) on the Wemos to turn on when the PIR sensor is triggered, as a visual indicator. You can see the setup on a small breadboard here. The configuration is Tasmota is here. Note that the LED is on D4 (GPIO2) but needs to be pulled high to turn the LED off, and pulled low to turn the LED on. Hence, the need to invert the signal using RelayX...
Read more