Cheap UK WiFi Bulbs with Tasmota - teardown help (TYWE3S)

Hi Jamie, can you tell us how you reversed the OTA mechanism? I’ve found a lot more devices using the TYWE3S, including motion sensors, door sensors and so on. Would be great to figure this out completely so that we can enable all of these devices for local usage without ever having to solder.

he says it bricked the device…

I’m aware. I’d like to identify the cause and solve it, maybe. Depending on the firmware running on the ESP8266, this might have been caused by the updated firmware taking up too much memory. It might be necessary to upload a lightweight firmware just meant for OTA, in order to have enough memory to fit the larger more functional firmware.

True, most custom firmwares do have a lightweight version just for that reason.
@jamie15 might provide us with an explanation of how he tricked the bulb into applying a non-factory FW ?

i finially got around to having a play. i flashed beantrees code with micro python all seems well, ive looked through ya code but im having trouble even turning the light off, set topic should be home/rgb1/set and payload ON or OFF? is this correct

for anyone searching in the future, because i have been on this for a couple weeks now, goto DiyHue on github, goto the Diylights and download the fastled sketch, change a few things are per this thread i think it was just data and clk pins. upload and configure to network. works perfect with http request whichs means i can use node red it. im sure HO could also

I thought I’d join in and have a play with the same light as the OP. However my light came with so much glue on the base it would not budge, and inevitably in trying the top alloy ring turned a little, and twisted the YYWE3S module right off of the power board. Also found the top white dome was super damn tight and would not come off (had to cut it eventually). Not a good start.
I’m wondering if there is an easier lamp to work with for HA hacking…

@mr.sneezy i know that feeling…
unfortunately, there’s just no way of knowing in advance which version of the hardware you’re going to get.
Will it open easy? Will the pads be exposed? Will the ESP be exposed? Will it be an 8265 or en 8266?

With extreme luck, you might get the seller to show you a pic of the actual item, with the dome removed.
On that same day, pigs will fly & hell will freeze over.

1 Like

Yeah sorry, I was venting my disappointment a bit there.
It looks to me like I can get the Sonoff B1 lamps for anly $6 more than what I paid for a the one above. Are they going to be an easier hack ?

in short : yes.

Both the Sonoff B1 and B1 R2 have the serial pads exposed when you remove the bulb’s dome.
see here : GitHub - arendst/Tasmota: Alternative firmware for ESP8266 and ESP32 based devices with easy configuration using webUI, OTA updates, automation using timers or rules, expandability and entirely local control over MQTT, HTTP, Serial or KNX. Full documentation at

Hello everyone,

Michael Steigerwald figured out how to hack Tuya devices over the air and presented his hack at 35C3. We sat down together and developed an easy to use procedure that only requires a Linux computer (e.g. Raspberry Pi) with a Wi-Fi adapter. As I suspected there would be international interest in this topic, we translated the news report and the step by step guide into English: https://www.heise.de/newsticker/meldung/No-Name-Smart-Home-Security-flaw-allows-easy-firmware-upload-4285085.html

Please contribute to the Wiki of the GitHub repository or send us an email ([email protected]) if you happen to come across a Tuya device. Cheers!

3 Likes

or…you know…go here :

1 Like

That repo now says “TUYA-CONVERT is a better and more robust OTA method of changing the firmware. I recomend you use that instead.”

Those are some pretty darn clear instructions.

All the bulbs I have modified (three different ones so far) have just used individual GPIO pins driving the different colours via PWM. The SLM211A just lets a single GPIO pin drive all the white LEDs.

patrol420 Sorry for the delay. My comments for the configuration set up didn’t keep up with the code. The latest version uses json

  - platform: mqtt_json
    name: "TYWE3S"
    state_topic: "home/rgb1/status"
    command_topic: "home/rgb1/set"
    brightness: true
    rgb: true
    white_value: true
    brightness_scale: 100

Example payload {"state": "OFF"}

For anyone curious I have this same style of light (in a GU10 package) working with esphomelib, config below if anyone is interested.

  name: rgbw_gu10_01
  platform: ESP8266
  board: esp01_1m

wifi:
  ssid: ''
  password: ''

# Enable logging
logger:

ota:
  password: ''

mqtt:
  broker: 192.168.1.60
  
web_server:
  port: 80
  
my9231:
 data_pin: GPIO13  # GPIO13 for AiLight
 clock_pin: GPIO15  # GPIO15 for AiLight
 num_channels: 6
 num_chips: 2

output:
  - platform: my9231
    id: output_blue
    channel: 1
  - platform: my9231
    id: output_red
    channel: 3
  - platform: my9231
    id: output_green
    channel: 2
  - platform: my9231
    id: output_white
    channel: 0

light:
  - platform: rgbw
    name: RGBW_GU10_01
    default_transition_length: 0s
    red: output_red
    green: output_green
    blue: output_blue
    white: output_white

These also work with Tasmota and just need to have the module changed to AILight.

3 Likes

In response to uregster

I have this same bulb from Tuya. I flashed the ESP with Tasmota 6.4.1
Then…

  1. Defined as Module Type “Generic”
  2. Define GPIO14 ® as PWM1
  3. Define GPIO012 (G) as PWM2
  4. Define, GPIO13 (B) as PWM3
  5. Define GPIO04 (W) as PWM4
  6. SetOption15 1
  7. SetOption30 0
  8. SetOption19 1 (for HASS discovery)

It will then operate as a light with fully adjustable colour and white light.

The SLM211a just drives the white LED channel, the three transistors clumped together at the top drive the RGB channels.

1 Like

@bircoe Which GU10 bulbs did you use, are they reliable?

Do you have a link to them?

These ones, not the cheapest but none of the GU10’s available in Aus seem to be cheap.

They are reliable and look pretty good, I’ll upload a video or pics later. No need to link them to Tuya, just do tuya-convert out of the box.

1 Like