ct-Open-Source / tuya-convert

A collection of scripts to flash Tuya IoT devices to alternative firmwares
MIT License
4.6k stars 496 forks source link

Merkury MI-BW942-999w bulb stuck in smartconfig #692

Closed Didgeridrew closed 4 years ago

Didgeridrew commented 4 years ago

This is my first time using tuya-convert and I've seen a few websites where other people say they have been able to get these bulbs to flash, but I've tried multiple bulbs and they all get stuck.

I'm using a RPi Zero W set up as a serial device as described in the wiki. I have tried a phone, a tablet, and an ESP32 as the donor device to connect to vtrust-flash. All of them seem to connect without any issues.

Terminal

...
Checking UDP port 67... Available.
Checking TCP port 80... Available.
Checking TCP port 443... Available.
Checking UDP port 6666... Available.
Checking UDP port 6667... Available.
Checking TCP port 1883... Available.
Checking TCP port 8886... Available.
======================================================
  Starting AP in a screen
  Starting web server in a screen
  Starting Mosquitto in a screen
  Starting PSK frontend in a screen
  Starting Tuya Discovery in a screen

======================================================

IMPORTANT
1. Connect any other device (a smartphone or something) to the WIFI vtrust-flash
   This step is IMPORTANT otherwise the smartconfig may not work!
2. Put your IoT device in autoconfig/smartconfig/pairing mode (LED will blink fast). This is usually done by pressing and holding the primary button of the device
   Make sure nothing else is plugged into your IoT device while attempting to flash.
3. Press ENTER to continue

======================================================
Starting smart config pairing procedure
Waiting for the device to install the intermediate firmware
.Put device in EZ config mode (blinking fast)
Sending SSID                  vtrust-flash
Sending wifiPassword          
Sending token                 00000000
Sending secret                0101
................
SmartConfig complete.
Resending SmartConfig Packets
................
SmartConfig complete.
Resending SmartConfig Packets
................
SmartConfig complete.
Resending SmartConfig Packets
................
SmartConfig complete.
Resending SmartConfig Packets
................
SmartConfig complete.
Resending SmartConfig Packets
................
SmartConfig complete.
Resending SmartConfig Packets
................
SmartConfig complete.
Resending SmartConfig Packets
................
SmartConfig complete.
Resending SmartConfig Packets
................
SmartConfig complete.
Resending SmartConfig Packets
..............
Device did not appear with the intermediate firmware
Check the *.log files in the scripts folder
Do you want to try flashing another device? [y/N]

smarthack-wifi.log

System info

===========

94acc3b

Linux raspberrypi 4.19.118+ #1311 Mon Apr 27 14:16:15 BST 2020 armv6l GNU/Linux

OpenSSL 1.1.1d  10 Sep 2019

Dnsmasq version 2.80  Copyright (c) 2000-2018 Simon Kelley

Compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP con$

This software comes with ABSOLUTELY NO WARRANTY.

Dnsmasq is free software, and you are welcome to redistribute it

under the terms of the GNU General Public License, version 2 or 3.

hostapd v2.8-devel

User space daemon for IEEE 802.11 AP management,

IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator

Copyright (c) 2002-2019, Jouni Malinen <j@w1.fi> and contributors

Python 3.7.3

===========

Configuring AP interface…

RTNETLINK answers: File exists
RTNETLINK answers: File exists
Starting DNSMASQ server...
Starting AP on wlan0...
Configuration file: /dev/stdin
wlan0: Could not connect to kernel driver
Using interface wlan0 with hwaddr b8:27:eb:13:06:2e and ssid "vtrust-flash"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED
wlan0: AP-STA-CONNECTED 3c:71:bf:fe:50:2c
wlan0: AP-DISABLED
wlan0: CTRL-EVENT-TERMINATING
nl80211: deinit ifname=wlan0 disabled_11b_rates=0
AP closed
Stopping DNSMASQ server...

smarthack-web.log

Listening on 10.42.42.1:80

^CReceived SIGINT, exiting... ```

smarthack-psk.log

``` ^CTraceback (most recent call last):

  File "./psk-frontend.py", line 113, in <module>

    main()

  File "./psk-frontend.py", line 106, in main

    r,_,_ =  select.select(readables, [], [])

KeyboardInterrupt

smarthack-mqtt.log

1594222799: mosquitto version 1.5.7 starting
1594222799: Using default config.
1594222799: Opening ipv4 listen socket on port 1883.
1594222799: Opening ipv6 listen socket on port 1883.
^C1594222991: mosquitto version 1.5.7 terminating

smarthack-udp.log

Listening for Tuya broadcast on UDP 6666
Listening for encrypted Tuya broadcast on UDP 6667

^C
kueblc commented 4 years ago

I see an ESP device in your wifi log

wlan0: AP-STA-CONNECTED 3c:71:bf:fe:50:2c

Is this your smart device or the donor?

Didgeridrew commented 4 years ago

Yes

...Edit...

Sorry, my brain only half read your question...

3c:71:bf:fe:50:2c is the donor device.

justinmartin commented 4 years ago

I'm having the same problem. I assume its related to #483

1594173748: mosquitto version 1.5.7 starting
1594173748: Using default config.
1594173748: Opening ipv4 listen socket on port 1883.
1594173748: Opening ipv6 listen socket on port 1883.
^C1594408596: mosquitto version 1.5.7 terminating
1594478361: mosquitto version 1.5.7 starting
1594478361: Using default config.
1594478361: Opening ipv4 listen socket on port 1883.
1594478361: Opening ipv6 listen socket on port 1883.
^C1594478542: mosquitto version 1.5.7 terminating
1594478552: mosquitto version 1.5.7 starting
1594478552: Using default config.
1594478552: Opening ipv4 listen socket on port 1883.
1594478552: Opening ipv6 listen socket on port 1883.
new client on port 443 from 10.42.42.16:57510
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:57512
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:57513
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:57514
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:57515
could not establish sslpsk socket: [SSL: WRONG_SSL_VERSION] wrong ssl version (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:57517
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
^CTraceback (most recent call last):
  File "./psk-frontend.py", line 113, in <module>
    main()
  File "./psk-frontend.py", line 106, in main
    r,_,_ =  select.select(readables, [], [])
KeyboardInterrupt
new client on port 443 from 10.42.42.16:60724
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60725
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60726
could not establish sslpsk socket: [SSL: WRONG_SSL_VERSION] wrong ssl version (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60727
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60728
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60729
could not establish sslpsk socket: [SSL: WRONG_SSL_VERSION] wrong ssl version (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60731
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60732
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60733
could not establish sslpsk socket: [SSL: WRONG_SSL_VERSION] wrong ssl version (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60739
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60740
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60741
could not establish sslpsk socket: [SSL: WRONG_SSL_VERSION] wrong ssl version (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60742
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60743
could not establish sslpsk socket: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1056)
don't panic this is probably just your phone!
new client on port 443 from 10.42.42.16:60744
could not establish sslpsk socket: [SSL: WRONG_SSL_VERSION] wrong ssl version (_ssl.c:1056)
don't panic this is probably just your phone!
^CTraceback (most recent call last):
  File "./psk-frontend.py", line 113, in <module>
    main()
  File "./psk-frontend.py", line 106, in main
    r,_,_ =  select.select(readables, [], [])
KeyboardInterrupt
Listening for Tuya broadcast on UDP 6666
Listening for encrypted Tuya broadcast on UDP 6667
^CListening for Tuya broadcast on UDP 6666
Listening for encrypted Tuya broadcast on UDP 6667
^CListening for Tuya broadcast on UDP 6666
Listening for encrypted Tuya broadcast on UDP 6667
System info
===========
94acc3b
Linux tuya-convert 5.3.18-3-pve #1 SMP PVE 5.3.18-3 (Tue, 17 Mar 2020 16:33:19 +0100) x86_64 GNU/Linux
OpenSSL 1.1.1d  10 Sep 2019
Dnsmasq version 2.80  Copyright (c) 2000-2018 Simon Kelley
Compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify dumpfile

This software comes with ABSOLUTELY NO WARRANTY.
Dnsmasq is free software, and you are welcome to redistribute it
under the terms of the GNU General Public License, version 2 or 3.
hostapd v2.8-devel
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2019, Jouni Malinen <j@w1.fi> and contributors
Python 3.7.3
===========
./setup_ap.sh: line 19: rfkill: command not found
Attempting to stop wpa_supplicant
Stopping NetworkManager...
Configuring AP interface...
RTNETLINK answers: File exists
Starting DNSMASQ server...
Starting AP on wlx1491822f84d4...
Configuration file: /dev/stdin
rfkill: Cannot open RFKILL control device
wlx1491822f84d4: Could not connect to kernel driver
Using interface wlx1491822f84d4 with hwaddr 14:91:82:2f:84:d4 and ssid "vtrust-flash"
wlx1491822f84d4: interface state UNINITIALIZED->ENABLED
wlx1491822f84d4: AP-ENABLED 
wlx1491822f84d4: AP-STA-CONNECTED c0:e8:62:a7:c7:4a
wlx1491822f84d4: AP-STA-DISCONNECTED c0:e8:62:a7:c7:4a
wlx1491822f84d4: AP-STA-CONNECTED c0:e8:62:a7:c7:4a
wlx1491822f84d4: AP-STA-DISCONNECTED c0:e8:62:a7:c7:4a
wlx1491822f84d4: interface state ENABLED->DISABLED
wlx1491822f84d4: AP-DISABLED 
wlx1491822f84d4: CTRL-EVENT-TERMINATING 
nl80211: deinit ifname=wlx1491822f84d4 disabled_11b_rates=0
AP closed
Stopping DNSMASQ server...
Restarting NetworkManager...
Job for NetworkManager.service failed because the control process exited with error code.
See "systemctl status NetworkManager.service" and "journalctl -xe" for details.
System info
===========
94acc3b
Linux tuya-convert 5.4.41-1-pve #1 SMP PVE 5.4.41-1 (Fri, 15 May 2020 15:06:08 +0200) x86_64 GNU/Linux
OpenSSL 1.1.1d  10 Sep 2019
Dnsmasq version 2.80  Copyright (c) 2000-2018 Simon Kelley
Compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify dumpfile

This software comes with ABSOLUTELY NO WARRANTY.
Dnsmasq is free software, and you are welcome to redistribute it
under the terms of the GNU General Public License, version 2 or 3.
hostapd v2.8-devel
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2019, Jouni Malinen <j@w1.fi> and contributors
Python 3.7.3
===========
./setup_ap.sh: line 19: rfkill: command not found
Attempting to stop wpa_supplicant
Stopping NetworkManager...
Configuring AP interface...
RTNETLINK answers: File exists
Starting DNSMASQ server...
Starting AP on wlx1491822f84d4...
Configuration file: /dev/stdin
rfkill: Cannot open RFKILL control device
wlx1491822f84d4: Could not connect to kernel driver
Using interface wlx1491822f84d4 with hwaddr 14:91:82:2f:84:d4 and ssid "vtrust-flash"
wlx1491822f84d4: interface state UNINITIALIZED->ENABLED
wlx1491822f84d4: AP-ENABLED 
wlx1491822f84d4: AP-STA-CONNECTED 68:57:2d:d2:93:21
wlx1491822f84d4: AP-STA-CONNECTED c0:e8:62:a7:c7:4a
wlx1491822f84d4: AP-STA-DISCONNECTED c0:e8:62:a7:c7:4a
wlx1491822f84d4: interface state ENABLED->DISABLED
wlx1491822f84d4: AP-STA-DISCONNECTED 68:57:2d:d2:93:21
wlx1491822f84d4: AP-DISABLED 
wlx1491822f84d4: CTRL-EVENT-TERMINATING 
nl80211: deinit ifname=wlx1491822f84d4 disabled_11b_rates=0
AP closed
Stopping DNSMASQ server...
Restarting NetworkManager...
Job for NetworkManager.service failed because the control process exited with error code.
See "systemctl status NetworkManager.service" and "journalctl -xe" for details.
System info
===========
94acc3b
Linux tuya-convert 5.4.41-1-pve #1 SMP PVE 5.4.41-1 (Fri, 15 May 2020 15:06:08 +0200) x86_64 GNU/Linux
OpenSSL 1.1.1d  10 Sep 2019
Dnsmasq version 2.80  Copyright (c) 2000-2018 Simon Kelley
Compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify dumpfile

This software comes with ABSOLUTELY NO WARRANTY.
Dnsmasq is free software, and you are welcome to redistribute it
under the terms of the GNU General Public License, version 2 or 3.
hostapd v2.8-devel
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2019, Jouni Malinen <j@w1.fi> and contributors
Python 3.7.3
===========
./setup_ap.sh: line 19: rfkill: command not found
Stopping NetworkManager...
Configuring AP interface...
RTNETLINK answers: File exists
RTNETLINK answers: File exists
Starting DNSMASQ server...
Starting AP on wlx1491822f84d4...
Configuration file: /dev/stdin
rfkill: Cannot open RFKILL control device
wlx1491822f84d4: Could not connect to kernel driver
Using interface wlx1491822f84d4 with hwaddr 14:91:82:2f:84:d4 and ssid "vtrust-flash"
wlx1491822f84d4: interface state UNINITIALIZED->ENABLED
wlx1491822f84d4: AP-ENABLED 
wlx1491822f84d4: AP-STA-CONNECTED 68:57:2d:d2:93:21
Listening on 10.42.42.1:80
[I 200707 21:02:39 web:2250] 302 GET /hotspot-detect.html (10.42.42.16) 0.46ms
[I 200707 21:02:39 web:2250] 200 GET / (10.42.42.16) 0.47ms
[I 200707 21:02:40 web:2250] 302 GET /hotspot-detect.html (10.42.42.16) 0.27ms
[I 200707 21:02:40 web:2250] 200 GET / (10.42.42.16) 0.30ms
[I 200707 21:02:40 web:2250] 302 GET /hotspot-detect.html (10.42.42.16) 0.39ms
[I 200707 21:02:40 web:2250] 200 GET / (10.42.42.16) 0.37ms
[I 200707 21:04:36 web:2250] 302 GET /hotspot-detect.html (10.42.42.16) 0.31ms
[I 200707 21:04:36 web:2250] 200 GET / (10.42.42.16) 0.34ms
[I 200707 21:04:47 web:2250] 302 GET /hotspot-detect.html (10.42.42.16) 0.29ms
[I 200707 21:04:47 web:2250] 200 GET / (10.42.42.16) 0.40ms
[I 200707 21:04:47 web:2250] 302 GET /hotspot-detect.html (10.42.42.16) 0.38ms
[I 200707 21:04:47 web:2250] 200 GET / (10.42.42.16) 0.37ms
^CReceived SIGINT, exiting...
Listening on 10.42.42.1:80
[I 200711 09:40:01 web:2250] 302 GET /hotspot-detect.html (10.42.42.16) 0.43ms
[I 200711 09:40:01 web:2250] 200 GET / (10.42.42.16) 0.62ms
[I 200711 09:40:03 web:2250] 302 GET /hotspot-detect.html (10.42.42.16) 0.30ms
[I 200711 09:40:03 web:2250] 200 GET / (10.42.42.16) 0.22ms
[I 200711 09:40:03 web:2250] 302 GET /hotspot-detect.html (10.42.42.16) 0.35ms
[I 200711 09:40:03 web:2250] 302 GET /hotspot-detect.html (10.42.42.16) 0.25ms
[I 200711 09:40:03 web:2250] 200 GET / (10.42.42.16) 0.32ms
[I 200711 09:40:03 web:2250] 200 GET / (10.42.42.16) 0.24ms
^CReceived SIGINT, exiting...
Listening on 10.42.42.1:80
jonaseymour commented 4 years ago

Yeah, I think I'm having a similar issue. My RP 3B is creating the network vtrust-flash but with no password required. wifi.log

Attempting to stop wpa_supplicant
Stopping NetworkManager...
Configuring AP interface...
RTNETLINK answers: File exists
Starting DNSMASQ server...
Starting AP on wlan0...
Configuration file: /dev/stdin
Failed to create interface mon.wlan0: -95 (Operation not supported)
wlan0: Could not connect to kernel driver
Using interface wlan0 with hwaddr b8:27:eb:ad:ab:62 and ssid "vtrust-flash"`
Didgeridrew commented 4 years ago

Decided to take the plunge and sacrifice one of the bulbs this morning, to see if maybe they changed the mc. The chip on the wifi module is marked "BEKEN BK7231 10N32", so (as I understand it) that's the issue.

mati22124 commented 4 years ago

If it had a different chip, wouldn't it say something along the lines of This bulb dosen't have a ESP82xx chip therefore its not flashable? Over here it says Device did not appear with the intermediate firmware. Could you send pictures of the inside?

mati22124 commented 4 years ago

image

Does the WiFi module look like this? Module high listed in red.

mati22124 commented 4 years ago

@justinmartin I basically Have the same psk logs as you. I wonder why. They aren't the same logs as issue #483.

Didgeridrew commented 4 years ago

My pcb is a totally different layout... and the mc had a shield over it that I had to pry off to get the info.

MerkurybulbPCB

mati22124 commented 4 years ago

Hi! @Didgeridrew. The esp is the white chip in the upper right corner. That is what will get re flashed. At least we can confirm that this is the esp chip. If you look closely there is a small antenna at the top. What you read on the board might be a processer of something like that. In my case, I could the Mac address of the bulb by connecting it to the app. It came with updated firmware :-( v1.03. But in my case the bulb connects go the crust-flash network. I wonder whats happening?

kueblc commented 4 years ago

Decided to take the plunge and sacrifice one of the bulbs this morning, to see if maybe they changed the mc. The chip on the wifi module is marked "BEKEN BK7231 10N32", so (as I understand it) that's the issue.

You are correct, this is unfortunately not an ESP, this is Alibaba's IoT SoC.

@justinmartin that does not look like #483, you would see PSK ID 02.....

@jonaseymour the vtrust-flash AP should not have a password, this is intentional. However the following line is strange, considering you said the AP is visible:

Failed to create interface mon.wlan0: -95 (Operation not supported)

If it had a different chip, wouldn't it say something along the lines of This bulb dosen't have a ESP82xx chip therefore its not flashable? Over here it says Device did not appear with the intermediate firmware. Could you send pictures of the inside?

@mati22124 not necessarily, we try to detect in a few situations where a device connects but is not running an ESP, but if the device does not connect there's no way we can tell.

Closing as the original issue has been found (@Didgeridrew's bulb is not using an ESP). Feel free to continue discussion however.

mati22124 commented 4 years ago

Is this an esp chip? If I opened this up to flash it manually will I be able to get tasmota on it? Edit: sorry that was a dumb question I just read the top...

kueblc commented 4 years ago

@mati22124 the picture you posted looks like a TYLC2, which is an ESP based Tuya module, so in your case you should be able to flash by serial and use Tasmota.

mati22124 commented 4 years ago

@kueblc Sadly that was a picture I pulled of the internet

jonaseymour commented 4 years ago

Decided to take the plunge and sacrifice one of the bulbs this morning, to see if maybe they changed the mc. The chip on the wifi module is marked "BEKEN BK7231 10N32", so (as I understand it) that's the issue.

You are correct, this is unfortunately not an ESP, this is Alibaba's IoT SoC.

@justinmartin that does not look like #483, you would see PSK ID 02.....

@jonaseymour the vtrust-flash AP should not have a password, this is intentional. However the following line is strange, considering you said the AP is visible:

Failed to create interface mon.wlan0: -95 (Operation not supported)

If it had a different chip, wouldn't it say something along the lines of This bulb dosen't have a ESP82xx chip therefore its not flashable? Over here it says Device did not appear with the intermediate firmware. Could you send pictures of the inside?

Apologies, this was actually an issue with a different bulb. I was having what seemed like the same issue, so posted here without thinking...