Tuya smart plug OTA tasmota install

[Terry Sanders]

I've managed to get my smart plug to install tasmota via the plugs normal firmware upgrade.

Unfortunately it turns into a brick when I do this and I then have to start dismantling and soldering so I can fix it.

A memory dump reveals that the tasmota firmware did actually get stored in the flash but not at  0x00000, instead it got stored at 0x81000 which is why I think it isn't working. Am I correct in thinking this is why it isn't working? If so is there anything I can do to make it work?

[Philip Knowles]

If you flash using ESPFlasher using FTDI it should work. You may get it to flash OTA using SonOTA but that stopped working for Sonoff items a while back.

Regards

Phil K

--
You received this message because you are subscribed to the Google Groups "SonoffUsers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sonoffusers...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Terry Sanders]

I've no problem disassembling the unit and flashing it, what I'm trying to do is work out how to flash it over the air so anybody can do it.

So far I've intercepted the comms between the unit and a remote website. When the unit asks if there is a new firmware, which it does within a minute of powering on, I send back the following bit of JSON:

{
   "result" : {
      "url" : "http:///mywebserver/tuya-sonoff.bin",
      "size" : "965075",
      "version" : "1.1.0",
      "md5" : "238c50cbf5745737d23de20e2471b680",
      "type" : "0"
   },
   "e" : false,
   "success" : true
}

The tuya-sonoff.bin format is detailed here. 

The unit then downloads and installs the tuya-sonoff firmware but, it installs it at flash address 0x81000 instead of 0x00000 and the unit fails to boot.

I'm assuming that this failure to boot is because of the location it installs the firmware but I don't know for sure.

The original SonOTA had three stages to installing firmware and I suspect that this will be very similar.

I don't know enough about the internals of either the ESP8266 or the firmware to proceed any further without a lot of painstaking trial and error.

[Terry Sanders]

I've solved the problem and can now flash my tuya devices over the air instead of having to dismantle them.

The process is detailed here

[Glenn Chapman]

Wow - real game changer.

I've got one of those plugs and it was hell to dismantle!  In the end it has ended up sat back in its box as I couldn't be bothered to find out how to flash.

I shall now have a go once again - I shall report back to you.

Well done Terry!

[Philip Knowles]

Great. I wonder if a modified procedure would work for other devices - Sonoff and KingArt?

Regards

Phil K

[Terry Sanders]

I believe Sonoff and KingArt use eWeLink and sign the firmware so I don't think its possible at the moment.

[George Ioakimedes]

Thanks for sharing and confirming that it works. Michael Steigerwald gave a good talk at 35C3 where he detailed how to do what you have done. He is supposed to publish how he did it in detail but that hasn't been posted yet. I had started another thread about 1 month ago where I showed several of these plugs were in fact using the same hardware and that trying to flash them was not realistic so the only real way would be to use OTA. As soon as I have some free timeI'll try your method out and report back.

[Ron L]

Terry, great work.  I had a spare Tuya Smart Outlet and I am really interested in getting Tasmota installed on, so I went to your link referenced above where you use a Raspberry Pi for redirecting and flashing.

I probably should have asked a few more questions prior to diving in, so I am the one at fault for making my 1st brick.  No worry, I will hang on to it as not sure these devices are ever really dead.

Here are the questions I should have asked prior to bricking my device :)

Regarding your Raspberry Pi procedure setup:

1>  Are you using both the hardwired ethernet and the wifi adapter of the Raspberry Pi in your process?  That is, the hard wired ethernet always keeps your Pi connected to your home network (and internet) while the WLAN adapter will provide the private Wifi for the comm between Tuya Device and the Pi ??

2>  Is there any need for user to go in and edit the scripts  (ie. tuyota.pl)?  My initial thought was no, but I did later look at the script and see where you did put in a place to enter ones home SSID and Password to the script.

3>  Regarding the command line for running the script:  sudo ./tuyota.pl -ip 192.168.31.45 -s MyHomeNet -p MySecret The IP you show 192.168.32.45 ? Is this supposed to be changed to the IP address of the Tuya Device you are updating firmware on?? Likewise, assume MyHomeNet is to be changed to ones own wifi SSID and MySecret to the wifi password; however, my wifi password contains spaces (ie This is my Password) Not sure your script is set up to deal with spaces as I got a "Unknown Option" error. Regarding #3 and the spaces in the wifi password, I just ended up running the script without the -s and -p options figuring I could add them manually later like your guide implies. Also (prior to bricking), I kept getting errors when running the script leading me to believe the device was never really getting discovered, but like your guide says, I unplugged and plugged back in the device (rebooted) and then immediately run the script and that is when it appeared to flash the sonoff.bin file. Again, great work.

[Terry Sanders]

1. yes I'm using the hard wired connection to connect to my home network. The WiFi is exclusively used to connect to the device.

2. No editing is necessary, you can specify various parameters via the command line. If you run `./tuyota -h`it should show you the command line options.

3. In the example command line the ip address is that of the device so change it to yours and MyHomeNet/MtSecret should be changed to SSID and password of what you want the device to connect to when everything is done. If your password (or ssid) contains spaces or other  non alphanumeric characters) then use quotes. For example -p "This is my password".

If you can run the script again with just the -ip <your ip> option and paste the results here I'll have a look.

[Ron L]

I did rerun script per your request (screen capture below) but my devices is pretty much DOA.  Only get a solid dim led on side button when plugging it in.  Cannot get any response from holding down button for long periods or multiple button presses.  Will not even change relay states.  Not sure how to revive it.

That said, I do have one more non bricked one I can try it on.  One more question:  Do you have to put the Tuya Devices in any certain state prior to running script?  That is, do you have to get it flashing once ever 2 seconds prior to running script?

Here is screen shot from bricked device:

[Terry Sanders]

Looking at that, it didn't detect your working device. Was it switched on? It does look like your other device is DOA.

It order for the script to work the device must be fully provisioned using the SmartLife app (or equivalent) but when you run the script you shouldn't have any apps or programs (HA, Node-Red etc) communicating with it or they may interfere.

[Ron L]

Well, I am 0 for 2 it looks like.  Bricked both of them - really ready to get them out of my fleet of smart devices anyway.  The 2nd device along with your answers to my questions did go much smoother.  

In fact, I thought the 2nd one was going to make it but then got an error (see below screen shot).  Both devices seems bricked.  If there is a way to revive without opening them up, let me know.

I still like what you are trying to accomplish.  Maybe my failures will help refine the process.

[Terry Sanders]

It might not be dead. just sick (so might your other one be). Power on both device and use your phones WiFi to search for access points. If you see one called "FinalStage" then your device can still be recovered. If your phone does see the FinalStage access point then run the following command on your computer (as root):

iwlist wlan0 scan | grep ESSID

and see if FinalStage appears there. If it doesn't then there is a problem with your computer scanning for access points. There may be some process attached to the wlan0 such as wpa_supplicant.

If is does see it then run the script again but this time just run as this:

./tuyota -b 2

Good luck

[Johnathan Wee]

Sorry, this is a little off topic. But is the Tuya smart switch significant superior to a sonoff s20( which is more straight forward to flash)? It seems like a lot of trouble just to be able to disassemble and solder, and then flash the Tuya

I am in the midst of making such a decision. UK type plugs

Cheers

--

[Ing. Umberto Ballestrazzi]

I don't know if tuya is superior because my tuya is dead and I can't understand how the pins are connected to flash it by wire. The tuya design is different and probably is better (S20 and S26 are bigger). If you buy S20 you don't need a solder because of the holes in the pins. S26 (a newer design, less squared) requires a solder to program it.

Actually my tuya is in a box wating for a resurrection while I'm using 1 S20 and 3 S26 soldered and flashed in half an hour (I'm not a good solderer and I don't have good instruments).

[Michael Ingraham]

I can't comment on better/worse. What we're seeing in the marketplace is that many smart device manufacturers are using Tuya Wi-Fi modules in their devices. There are a wide variety of device options in the "Tuya market segment" that you cannot currently get from the Sonoff line of products.

As for flashing Tuya devices, a method of flashing these has been developed that does not require physical access to the circuit board to solder leads on the serial interface. The firmware update occurs OTA (TuyOTA, MockTuyaCloud). You can flash it with ESPeasy, ESPurna, TASMOTA. At that point, you have the easy OTA method provided by those firmware projects.

Michael Ingraham
Spartanburg, SC

[George Ioakimedes]

As Michael mentioned the there are many "Tuya" products available now. What is nice about these plugs is that they are small enough that they do not block the 2nd outlet that we have here in the US

[Johnathan Wee]

HI Terry,

It's great no disassembling of the Tuya switch needed now. Would you be able to do a walk through for what worked for you flashing OTA?

Or is it somewhat still hit and miss? 

Regards 

Jon

On Thu, 17 Jan 2019, 8:07 AM Terry Sanders <paran...@gmail.com wrote:

--

[Terry Sanders]

Hi Jon,

Here is an annotated walk through that I did with a fresh install of Raspbian. It has been a little hit and miss whether it works or not.

There is now another OTA method called tuya-convert  that I personally think is superior and more robust then mine. So if I had to recommend a method I would recommend theirs

Regards

Terry

[Johnathan Wee]

Something like this?

https://www.youtube.com/watch?v=O5GYh470m5k

[pcb1962]

On Monday, 28 January 2019 01:44:49 UTC, Johnathan Wee wrote:

Something like this?

https://www.youtube.com/watch?v=O5GYh470m5k

I did a couple yesterday using tuya-convert, it worked great.

One was a hyleton from China, and one a Koogeek from Amazon.

For anyone in the UK the Koogeek can be had from Amazon for ten pounds each if you buy 4 - https://www.amazon.co.uk/gp/product/B07H9P3F7S

These use the BlitzWolf module type in Tasmota and give power reading too.

[Michael Ingraham]

Even though you used Tuya-Convert, it might be helpful to add your devices to the list of successfully flashed devices on the TuyOTA wiki.

Regards.

Mike

Michael Ingraham
Spartanburg, SC

--

[Glenn Chapman]

I've flashed a couple.  When I browse to the new IP address the Tasmota loads and in Sonoff Basic Module I can control vis MQTT, change the On and Off and via Node Red in MQTT I can control and receive state updates, but the Tuya switch doesn't physically turn on and off.  Am I using the incorrect module or is there something else a miss?  I flashed the Teckin SP23

Glenn

[pcb1962]

On Tuesday, 29 January 2019 15:08:56 UTC, Glenn Chapman wrote:

I've flashed a couple.  When I browse to the new IP address the Tasmota loads and in Sonoff Basic Module I can control vis MQTT, change the On and Off and via Node Red in MQTT I can control and receive state updates, but the Tuya switch doesn't physically turn on and off.  Am I using the incorrect module or is there something else a miss?  I flashed the Teckin SP23

 First try changing the module type to Blitzwolf. If that doesn't work then change it to Generic and configure Relay1 on each GPIO until you find one that works. On the hyleton I mentioned above it works on GPIO15.

[Michael Ingraham]

Glenn,

Yes, it's likely that the configuration for a Sonoff Basic is not appropriate for your device. As @pcb1962 suggests, you could try the configuration of another module available in the TASMOTA template. If that doesn't work, then you'll need to configure your device as a Generic Module and configure the GPIOs for your device. Travis (@digiblur) has a procedure in his latest YouTube livestream to determine the proper GPIO configuration. Here's how I would summarize that:

• Set every GPIO (excluding, at first,  "dedicated" like Tx/Rx) to relays. Save configuration. Use web GUI toggles to find which GPIO control relays and LEDs. If unable to find relays and LEDs, set the "dedicated" GPIO and retry. Set the "active" GPIO to associate them with the RelayX or LEDX. Operation may dictate regular or inverted (RelayXi/LEDXi).
• Set every remaining GPIO (excluding, at first,  "dedicated" like Tx/Rx) to Switches. Save configuration. Display Status 8 (sensors) in the Console to see the current state of the GPIO. Then, while pressing the button(s), display Status 8 again. Whichever GPIO changes state is the GPIO tied to the button. If none change state, then configure the "dedicated" GPIO and retry. Change the GPIO to a Button (may need to determine whether the internal pull-up is used or not - ButtonXn for no pull-up). If you want to use short-press/long-press functionality (described in a couple other of Travis' videos), configure the button as a Switch instead.
• Set remaining GPIO to None

Mike

Michael Ingraham
Spartanburg, SC

--

[Michael Ingraham]

Actually, I hadn't looked at the Tuya-Convert wiki. That's the better place since it seems that procedure has led to more successful outcomes... and should be the ultimate repository. I see there's a Hyleton HLT-313. Is that the same module you flashed? But I don't see a Koogeek so it would be good if you added that to the list.

To unsubscribe from this group and stop receiving emails from it, send an email to sonoffusers+unsubscribe@googlegroups.com.

[pcb1962]

On Tuesday, 29 January 2019 16:00:52 UTC, Michael Ingraham wrote:

Actually, I hadn't looked at the Tuya-Convert wiki. That's the better place since it seems that procedure has led to more successful outcomes... and should be the ultimate repository. I see there's a Hyleton HLT-313. Is that the same module you flashed? But I don't see a Koogeek so it would be good if you added that to the list.

I did try to add there but couldn't find an edit button on the wiki page

[Phil]

hi,fwiw the 4x koogeeks in my cart following your link were not discounted.  is there an obvious link or offer i missed??  cheers

[pcb1962]

On Tuesday, 29 January 2019 16:10:38 UTC, Phil wrote:

hi,fwiw the 4x koogeeks in my cart following your link were not discounted.  is there an obvious link or offer i missed??  cheers

Just under the price is a line that starts with "Promotion Message ..... " 

Click the down arrow at the end of the line and you should see a dropdown with "Koogeek smart plug - buy 1 reduce 5 percent buy 2 to reduce 10 percent buy 3 to reduce 15 percent buy 4 to reduce 20 percent-Koogeek Promotion-6NTVJIYL"

Mine says "Already Redeemed" so it looks like you can only get the discount once.

[Phil]

Many Thanks..  4x bought @ the discount price.. ;)

[Michael Ingraham]

I just noticed that. In the interim, I submitted a "non-issue" issue with the information for the plug I flashed in hopes they'll use that information to update the wiki. I hope they make that page editable.

Michael Ingraham
Spartanburg, SC

--

You received this message because you are subscribed to the Google Groups "SonoffUsers" group.

To unsubscribe from this group and stop receiving emails from it, send an email to sonoffusers...@googlegroups.com.

[Johnathan Wee]

@pcb1962

I too flashed a Teckin SP23. Does configuring it under module as BlitzwolfSHP (45) work?

[Phil]

4 x koogeek (Uk Blitzwolf clones) Flashed OTA using the Tuya-Convert method.

Also 1 x aliexpress 4x UK socket strip with 4x usb ports Teapao brand (white box)

I have configured the koogeek devices as blitwolf modules and am getting some very different voltage readings from devices in the same socket strip (range 221v-252v)

I assume the sonoff POW configuration instructions apply??  

I now have a lil homework to do to determine how to configure the 4x strip ;)  

[Johnathan Wee]

Hi Phil,

Does the Koogeek also provide energy monitoring?

cheers

--

[Phil]

Yes but 'out of the box' the devices all plugged into the same outlet via a 7 socket extension lead read a range of 221-251v so they will need calibration and probably wont be very accurate even then.,   also while a small form factor and 2 x should sit side by side nicely in a 13a 2 gang faceplate they are still a tad 2 wide to sit side by side in a standard extension strip.

not a deal breaker   

[Phil]

Has anyone attempted to flash an itead/sonoff with this OTA proceedure with any success,  I have a few sonoff led bulbs and plates that i have been putting off flashing due to the fine detail soldering needed to connect to chip legs (I have bricked one led plate already).  

[Ron L]

Regarding the TuyOTA flash method, I have a brand new plug that I am ready to try this on.  Does it matter if the plug is fresh out of the box or should I go through the initial process of linking it to my home network via the Tuya App first before I flash with TuyOTA?

[Michael Ingraham]

Ron,

With the release of Tuya-Convert, that is the recommended flashing process over TuyOTA. The Tuya-Convert process is a bit more "robust" does not require first pairing with the SmartLife app.

Regards.

Mike

Michael Ingraham
Spartanburg, SC

--

[Ron L]

Tuya-Convert worked like a champ on a brand new smart plug I purchased on Amazon.  Aneken (brand) 15amp (mfg. rating) smart plug.

Configured as Generic with GPIO15 as Relay1, GPIO13 as Button1 and GPIO2 as LED1i

[Michael Ingraham]

Ron,

The Tuya-Convert Wiki has a page to add new supported devices. If your plug isn't on the page, could you add it along with your GPIO configuration? Thanks.

Michael Ingraham
Spartanburg, SC

[Ron L]

Done.  Never edited a Wiki before, but seem pretty painless.

What a great support group.