search

tuya-cloudcutter / lightleak

Firmware version-agnostic PoC exploit for smart devices
47 stars 10 forks source link

Moes MS-105 1 Gang 1/2 Way Dimmer Switch Module: Couldn't receive packets from the device #10

Open ElGranPepo opened 1 year ago

ElGranPepo commented 1 year ago

Device details are here: https://github.com/tuya-cloudcutter/tuya-cloudcutter/issues/233

Got a chance to work on this device again today, im using the Lightleak BK7231N Variant JTAG (XOR) profile and it successfully performs the exploit. i get an error when i try to dump the firmware. tried 2 different switches (one that was added to Tuya, on that was new in box) and got the same error on both. used newest version of Lightleak 0.6.1

kuba2k2 commented 1 year ago

The JTAG profile is 100% not correct. It was only added for debugging purposes. You need to choose a different profile, try with Variant 1 (XOR).

ElGranPepo commented 1 year ago

Thanks! Was able to use and dump Image. will put in cloudcutter ticket. Any way we can move the (XOR) profile to the top and make it bold?

kuba2k2 commented 1 year ago

We can change their names to something more meaningful. I think we should just give them names like BK7321N Type 1, Variant 1 and optionally put the "XOR" in parentheses.

kuba2k2 commented 1 year ago

I've updated them and added another "IP" profile (rarely used): obraz

The JTAG one still shows up 2nd, so hopefully the X will scare people out :smile:

ElGranPepo commented 1 year ago

Thanks!