Comments (13)
It is already supported by the UPK2ESPHome plugin for LTChipTool. It is included with the binaries in the release section, or can be installed via pip with pip install upk2esphome
from ltchiptool.
I did try this however it unfortunately did not dump the device ID at all. Device ID looks similar to bf8b7201xxxxxxb69b9ucc
.
from ltchiptool.
Look at the source data.
from ltchiptool.
This particular device doesn't have an activated device id in storage (which means it wasn't joined to Smart Life at the time it was dumped).
uuid and authkey are present, which is how it communicated with Tuya's API to generate a device ID.
gw_di.id would have held the device id had it been activated.
from ltchiptool.
I see, had no idea that it generated a device ID by talking to the Tuya API. Was not able to find much information on that. Thanks for the information.
Yeah, this was a dump of a downlight before it was setup so it did not contain passwords etc.
Changing the UUID and authkey would therefore generate a different device ID correct?
I will analyse a dump from a configured device.
from ltchiptool.
The UUID and authkey are Tuya secrets per device, they must match, or communication will fail. The schema that is returned with the device id is attached to the uuid and authkey. The device id is generated each activation. The device has no local schema until it has been activated.
from ltchiptool.
Okay I do see the ID after analysing a dump from a configured device.
How would one go about generating a matching UUID and authkey then?
I assume there would be a process when initially developing the device.
from ltchiptool.
That is a secret defined by Tuya and attached to their license, it is not something that can just be generated. Every device has a unique UUID/authkey combo. UUID and authkey are only used in communication encryption until a device id is assigned, then it switches to seckey which is attached to the device id.
from ltchiptool.
I signed up to the Tuya cloud and generated a couple of free UUID and authkey pairs.
What would be the best way to update the originals with these?
from ltchiptool.
There is no easy existing way to do this. All the tools around just read storage data. You'd need to adapt them for editing, re-encrypted, writing, and crc checks. No 3rd party firmwares use Tuya's native storage for writing.
CloudCutter somewhat does this by exploit and using Tuya's SDK functions to overwrite that data, but it has limitations (cloudcutter is using smaller data fields and is limited in the size of data the exploit can carry as a payload).
from ltchiptool.
I have managed to decrypt and re-encrypt the Tuya storage partition. Doing a byte to byte comparision before and after shows no differences and it works upon flashing.
However upon modification before re-encryption it seems to crash on bootup. Looking through the bootup log shows the following:
[01-01 18:12:18 TUYA Err][lr:0xa803d] kvs_read fails gw_bi -1
[01-01 18:12:18 TUYA Err][lr:0xac82b] base read fail:-6914
[01-01 18:12:18 TUYA Err][lr:0xad16f] ERR_EXIT is Jumped!
[01-01 18:12:18 TUYA Err][lr:0x65ad5] tuya_iot_wf_soc_dev_init err:ffffe4fe
[01-01 18:12:18 TUYA Err][lr:0x65adf] smart fram init error
[01-01 18:12:18 TUYA Err][lr:0x57fb7] ret:-6914
Interestingly kvs_read fails gw_bi -1
shows up several times even when booting a working flash backup.
base read fail:-6914
always shows when modified even if I edit just a single byte before re-encryption. I even recalculate the checksum and update that too.
After a lot of playing around I believe there is something else in that partition that needs updating.
Here's the Tuya partition and decrypted Tuya partition. Read from offset 0x1EE000
.
tuya.bin.txt
decrypted_tuya.bin.txt
And heres the Python scripts I've been playing with.
split_tuya_storage.py.txt
update_uuid_authkey.py.txt
Should be able to chuck both in a folder with the above flash.bin
and run the split_tuya_storage.py
. Then afterwards run update_uuid_authkey.py
. That will decrypt, update, encrypt and output several files for comparison.
The update script is largely based on bk7231tools/analysis/storage.py.
from ltchiptool.
In your decrypted_tuya.bin.txt, it appears your gw_bi and user_param_key are colliding.
from ltchiptool.
Yeah, I think that's just how it looks when decrypted. Because that is unmodified, and when re-encrypting and flashing it works fine. Its just as soon as you modify it, the firmware spits out that error.
I tried editing another dump and it was the same issue.
Must be some other checksum in the file/partition?
from ltchiptool.
Related Issues (20)
- Avast detects virus in ltchiptool-v4.6.0.exe HOT 24
- Undefined method `Serial.set_buffer_size` method for non windows environment
- Problems flashing a new rtl8710bx board HOT 10
- Error running ltchiptool gui under macOS 13.6.1 HOT 12
- Unable to convert some datapoints. HOT 4
- Segmentation fault in Fedora 39 HOT 3
- Help with a Midea SmartKit Dongle HOT 10
- malware detected ?? HOT 2
- Chip Type - Unrecognized (0x48405F31) HOT 6
- Firmware Dump Analysis HOT 2
- Unrecognized chip 0x540A8B75 HOT 36
- v4.11.0 throws errors ... HOT 5
- RuntimeError: Error: 28841002: No permissions. Your subscription to cloud development plan has expired. HOT 7
- v4.0.0a2 'NoneType' object has no attribute 'get-uf2_ctx' (Windows 10) HOT 2
- Flashing Tuya WR2 HOT 18
- Failed to read flash WR3L module
- Error when creating uf2 file from OpenBK firmware HOT 14
- Microsoft Defender detects trojan in newest Release HOT 4
- Problems using ltchiptool 4.6.0 to write kickstart-bk7231t-2023-08-29.uf2 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ltchiptool.