search

parasite85 / tuya_dmd2cc_gateway_hack

7 stars 4 forks source link

readme

Hacking Tuya Zigbee Ethernet Gateway

Hello, I want you to present the method of hacking Tuya Zigbee Gateway. This time we will be talking about ethernet model. I`m in possession of DMD2CC-V1.0 gateway. There is a lot of other devices with same PCB board. Including LIDL Gateway. Just open your model and check if board is similar.

Picture of gatewa

I have marked few things on picture.

You finally will get a Linux login. Unfortunately, password is not known and in many cases is unique to each device. Most probably, password assigment is done on connection to Tuya cloud (when you have added your device to tuya) In some cases you can break the boot procedure and you can try to manipulate flash memory. To do this, hit ESC at the begining of boot. In my case bootloader has been locked (checked bootloader code). I had to use SPI Flash reader device to hack this gateway for the first time.

ESC key is not giving you realtek prompt

Still, I`m suggeting you to check all other possible ways for getting prompt. If nothing is working for you, there is a huge chance that you have Zigbee gateway with locked bootloader.

Fortunately, there is a way to get Realtek boot prompt even if it is locked. Boot program is doing initial configuration and it is performing Linux kernel loading to memory, verification and running Image from memory. We will get prompt when something has fail. For me, easiet method was to "corrupt" FLASH :-). To do this you will need following stuff:

Connect one end of wire somewhere you have a ground. I just attatched it to ethernet port. There is a shield around ethernet port. This shield is grounded. Do not connect second end of cable. Hack

This method might wont work out of the box. All you need is practice. Regarding second end of cable: we will be trying to do a glich. You need to do it when bootloader starts. Once you will see some bootloader text from screen you will need to connect second end of wire to SPI Flash memory. Check your flash and connect it to SCLK interface.

When you do it properly you will get following text on terminal:

---RealTek(RTL8196E)at 2022.03.29-15:59+0800 v3.4T-pre2 [16bit](380MHz)
P0phymode=01, embedded phy
check_image_header  return_addr:05010000 bank_offset:00000000
no sys signature at 00010000!
[…]
no sys signature at 0003D000!
no sys signature at 0003E000!
no sys signature at 0003F000!
no sys signature at 00040000!
get uboot flag failed
P0phymode=01, embedded phy

---Ethernet init Okay!
<RealTek>

Hooray.

Next, we will need to get root password. Now depending on your device you may need to read tuya-label flash or decode file.

Method 1 AUZKEY is stored on Tuya-Label

This is simple situation. Your key is stored on part of flash memory called tuya-label. All you need to to is to read a flash memory section with key. Creating 5 MTD partitions on "flash_bank_1":

0x000000400000-0x000000420000 : "tuya-label"

Follow procedure described in: Hacking Lidl Gateway.

Method 2 We dont care about AUZKEY

In this method you will not need to have AUZKEY. You will write your own password. Follow Paul Banks Hack

Method 3 We care about AUZKEY

If method 2 fails, you can try method 3. Get AUZKEY from jffs2-fs section of memory. I did little research on tuyamd executable and I have succesfully extracted (or decoded) auzkey. To extract auzkey you need to:

Then, use following program to decode.

AUZKEY decode script

It will give you output:

Decrypted data:

b'{"bsn":"XXXX","master_mac":"XXXXXX","auzkey":"XXXXXXXXXXXXX","uuid":"XXXXXXXXXX","prodtest_exit":"true"}\x0f\x0f\x0f\x0f\x0f\x0f\x0f\x0f\x0f\x0f\x0f\x0f\x0f\x0f\x0f'

Also file License.out with decrypted data will be produced.

Last 8 digits of AUZKEY is your password

Once you get root, you can adopt device to your needs.