search

basilfx / TRADFRI-Hacking

Hacking IKEA TRÅDFRI products, such as light bulbs, window blinds and other accessories.
646 stars 64 forks source link

Patch firmware to allow write to all node attributes #48

Closed bluemoehre closed 4 months ago

bluemoehre commented 2 years ago

Hi, I just started tinkering with the new Tradfri light bulbs. I bought a lot of the new generation models, extracted the ZigBee modules and integrated them in non-smart devices. Now I would like to change some simple basic attributes (e.g. Name, Power Source, …).

In general my deCONZ / RaspBee can access these, but they are flagged as read only:

deCONZ node attributes

How can I find the parts in the firmware that control the write flags? Is it possible to patch an OTAU update binary? Any help is appreciated. Thanks!

MattWestb commented 2 years ago

The firmware is having one "default" device name and manufacture. If not other data is flashed to the device the firmware is using it. In the "user data" other of the flash (not the main flash the OTA is flashed but one custom storage) IKEA is saving manufacture tokens and custom data for the device that is over riding the data in the firmware.

I have getting one user data for on Open/Close remote and flashing it one one On/Off dimmer switch and its being transferred to one Open/Close remote with the same OTA firmware installed on the device.

If some one is having one Knyplan remote i like getting the user data and main flash of it if some user is having one then its having the same hardware ad the On/Off and Open/Close remotes.

Doing other changes is very likely braking the device firmware but you can always testing editing it and flashing it with one SWD probe. The OTA file can being used for "extracting" the s37 file that can being flashed to the device if braking it but always do one dump of the main flash and the user data so you can going back to the star and having on working device.