Custom firmware for cheap smart bulbs is easy to patch

It’s the end of another decade, and while we don’t have real hoverboards, flying cars, or affordable dental care, we do have colored light bulbs that can be controlled via WiFi. [Don Houdshell] picked up a couple of cheap Mercury-branded items during a Black Friday sale and quickly set about cracking them.
In general, many of these lamps are made by different companies and are rebranded for everyone who places an order. Light bulbs tend to use the Doodle IoT ecosystem. With Tuya’s ESP8266 based conversion project, flashing a light bulb with custom firmware is very easy. Using a Linux computer with a WiFi card running in hotspot mode, he tricks the server into downloading firmware updates for Tuya products. From there, the light bulb is an open book, ready to be bid.
However, one of [Don's] attempts failed. It was not possible to flash the firmware and the light bulb did not work properly. [Don] decided to take it apart, take a picture so we could read it, and connect to the ESP8266 directly through its serial interface. From there, it’s easy to reprogram the bulb with Tasmota firmware to get it working again.
Security itself is a big reason to run native firmware on IoT devices. It never hurts to know what you’re connected to online!
It’s like Trident Microsystems “didn’t make graphics cards” despite the thousands (or millions) of company names, logos, URLs, FCC:ID numbers, etc. on the PCB.
Trident is engaged in the *development* of video cards and the production of video chips. They make “reference kits” as “samples” that manufacturers can use as a basis for doing their work, such as modifying video BIOSes and drivers.
But Trident will sell anyone as many “samples” as they want – piece by piece – along with reference drivers. Because Trident didn’t solder the parts together or provide things like boxes, manuals, or driver install discs, they claim they’re not the manufacturer, even though all information about Trident is printed on the board they make or include their “pattern”. .
As a sneaky “non-manufacturer”, this approach is really liked by PC owners as few companies just solder the kits together and stuff them in their own boxes, and those few *do* do things for standard BIOS and drivers, so when these companies go bankrupt or stop supporting, the reference drivers will not work. So it is possible to have two cards with the same Trident chip, one is a build kit and the other is the same except for the Trident PCB markings, and a non-Trident card will work best when using Vanilla Win98, in while real Trident cards can work with 98SE, 2000 and even XP.
To be sure, Tuya is just designing and hosting the smart platform. Then you design the hardware there and connect it to their back end.
Tuya provides the firmware and infrastructure to connect to the cloud. Hardware is made by different manufacturers.
I ended up flashing a lot of ESP8266 sockets on Tasmota and it’s a dream in terms of reliability. I tried the Tuya Convert route, but it never worked – I ended up just plugging in the device and soldering the programming wires, then manually cleaning them one by one.
I have gone through a lot of *z-wave, zigbee and other unreliable devices. Homemade devices using USB dongles, paid SmartThings, Hue, Ikea and others… nothing seems to work reliably.
I now have an MQTT broker running on an RPi and talking to an ESP8266 socket over wifi, it’s 100% reliable and almost bulletproof. I’m using OpenHAB for cloud/telephony integration and it’s also pretty reliable compared to commercial products. I personally find great value in relying on Wi-Fi rather than z-wave etc – just being able to ping a device makes a huge difference!
Worth noting: It seems possible (and very easy) to power both white LEDs and colored LEDs with this Tasmota firmware bulb (by moving the colored and white sliders outside of the “off”/fully darkened environment). Doing so will lead to overheating of the bulb, which itself leads to crashes & reboots about every five minutes. Doing so will lead to overheating of the bulb, which itself leads to crashes & reboots about every five minutes. This will cause the lamp to overheat, which in itself leads to failures and reboots approximately every five minutes. This can cause the lamp to overheat, which in itself causes malfunctions and restarts approximately every five minutes. I’m not sure how easy it is to solve this problem with Tasmota, but I managed to avoid this particular trap by controlling the light bulb through Home Assistant rather than directly through the embedded web server.
Wow! I think I actually stumbled across your blog while doing this. It’s nice to know that you’re comrade HaD’er.
Does anyone know if Amazon Techin/Teckin bulbs work for this? I’ve had some recently (but nothing to hack and test at the moment) and I prefer hardware over software. Tasmota will be a dream come true for them!
I’m a little late to this party but a good start is to look at the MAC address, if it has an Espressif MAC address then it’s an ESP826x series chip and it should work. I recently bought a few Feit bulbs from Costco that were supposed to be based on the ESP8266, but it turns out they were replaced with other chips that can’t be reflashed.
By using our website and services, you expressly consent to the placement of our performance, functionality and advertising cookies.learn more


Post time: Aug-17-2022