Hacking the Silvercrest (Lidl/Tuya) Smart Home Gateway

swedude · July 20, 2021, 11:54am

hello im trying to use the script above but zigbee are unreachable until I change back to the original file from the guide, can you spot what I am doing wrong?

//remove old file

rm ./tuya/tuya_start.sh


//make new file
cat >/tuya/tuya_start.sh <<EOF
#!/bin/sh
while true; do
pgrep -x serialgateway >/dev/null
if [[ $? -ne 0 ]] ; then
echo “Restarting SerialGateway: $(date)” >> /var/log/serialgateway.txt
/tuya/serialgateway &
fi
sleep 30
done &
EOF

//set permissions just in case
chmod 755 /tuya/tuya_start.sh

reboot

it looks like it should work and I just cant figure it out.

do I have to make /var/log/serialgateway.txt myself or will it be created?
or something else? any and all ideas are welcome
Thank You!!!

Mark5 · July 21, 2021, 7:22am

I had the exact same problem.
Just change that line :

cat >/tuya/tuya_start.sh <<EOF

to

cat >/tuya/tuya_start.sh <<‘EOF’

This will prevent bash from evaluating variables in the cat stuff.

swedude · July 21, 2021, 7:38am

Thank you that works!!!
but I don’t know if its a copy and paste error I had to change from ´` to ‘’
so if someone do copy and past try this:

cat >/tuya/tuya_start.sh <<'EOF'
#!/bin/sh
while true; do
pgrep -x serialgateway >/dev/null
if [[ $? -ne 0 ]] ; then
echo “Restarting SerialGateway: $(date)” >> /var/log/serialgateway.txt
/tuya/serialgateway &
fi
sleep 30
done &
EOF

Again big thank you!!

swedude · July 21, 2021, 6:11pm

So I got this idea to monitor the zigbee connection just to see that it is stable

sensor:
  - platform: command_line
    name: zigbee connected
    command:  '/bin/bash -c "( netstat -tn |  grep  -c  "192.168.1.133:8888")"'

and its kind of but not really working
it reads 1 when its connected, and when its not connected I get a error message in the log saying the command failed… and it stays 1

Command failed: /bin/bash -c "( netstat -tn | grep -c "192.168.1.133:8888")"

when I run it directly in the command line its working and I get 1 or 0

Any ideas why its not working? or any other ideas how to check that it is online?

challs · July 24, 2021, 1:54pm

I think I can see the problem: The exit code of grep will be non zero if the number of lines matched is zero.

Try adding || true to always return a success exit code:

command: '/bin/bash -c "( netstat -tn | grep -c "192.168.1.133:8888" || true)"'

swedude · July 24, 2021, 7:28pm

Thank you that helped a lot,

this is what I ended up with I added " ESTABLISHED" just to make sure it was connected and not just trying to connect
if u use this just make sure that you add or remove enough spaces " " between 8888 and ESTABLISHED so it can get a match, this should be 35 chars long in total

>>192.168.1.133:8888      ESTABLISHED<<

  - platform: command_line
    name: zigbee connected
    command: /bin/bash -c "( netstat -tn | grep -c '192.168.1.133:8888      ESTABLISHED' || true)"
    scan_interval: 20
    command_timeout: 10
    unit_of_measurement: ' '

Big thank you for the work you all put into this

challs · July 26, 2021, 8:49pm

Glad to hear it worked!

You could tell grep to match any number of spaces, which would make it slightly more robust:

 \+ESTABLISHED

The space is the the character to match
+ says one or more of those characters (‘+’ needs to be escaped if not using extended regular expressions)

In your case that would be:

    command: /bin/bash -c "( netstat -tn | grep -c '192.168.1.133:8888 \+ESTABLISHED' || true)"

Germil · August 1, 2021, 4:46am

Hello,
I try and try, but I fail.
I get the same error over and over again when entering the KEK code:
What am i doing wrong?

C:\Users\Milan>lidl_auskey_decode.py
Enter KEK hex string line>      39713448               4B4F666C        367C7943
       526C3A39
Traceback (most recent call last):
  File "C:\Python32\SCRIPTS\lidl_auskey_decode.py", line 54, in <module>
    kek = _decode_kek(_get_bytes(input("Enter KEK hex string line>")))
  File "C:\Python32\SCRIPTS\lidl_auskey_decode.py", line 52, in _get_bytes
    return unhexlify(a[0] if len(a)==1 else a[1])
TypeError: 'str' does not support the buffer interface

Thanks.

robertklep · August 1, 2021, 9:07am

Start by removing any superfluous whitespace from the hex string.

Germil · August 1, 2021, 9:31am

I have try one space, just one space on the start, just on the end of string, no spaces, but no luck.

robertklep · August 1, 2021, 5:01pm

The input should be “397134484B4F666C367C7943526C3A39”, no spaces (and no quotes). Seems to get accepted when I try and run the script.

Germil · August 1, 2021, 6:13pm

Thank you, on my pc it doesnt accept the string, so it must have been something wrong.
Can you please tell me whith which program do you work?
I have 3.2 python, and use that script.
Error i get:

(base) C:\Python32>lidl_auskey_decode.py
Enter KEK hex string line>397134484B4F666C367C7943526C3A39
Traceback (most recent call last):
  File "C:\Python32\lidl_auskey_decode.py", line 54, in <module>
    kek = _decode_kek(_get_bytes(input("Enter KEK hex string line>")))
  File "C:\Python32\lidl_auskey_decode.py", line 52, in _get_bytes
    return unhexlify(a[0] if len(a)==1 else a[1])
TypeError: 'str' does not support the buffer interface

robertklep · August 1, 2021, 7:22pm

I’m using Python 3.9 on macOS, same script.

PistolPete · October 5, 2021, 10:56am

Just wanted to thank @bool2 for the comprehensive and easy to follow guide on getting this working with ZHA. I was using a Sonoff Bridge, but I was experiencing a random number of my battery powered sensors going unavailable at random times. I just assumed that they were not very good but after reading that wifi zigbee bridges are not all that I got a Lidl bridge, followed your guide and was up and running in 10 mins. Took me a bit to migrate the 40 odd devices I had but since then I’ve never had a device not check in within 3 hours. No more running around the house at the weekend “re-adding” sensors!

hebom · October 19, 2021, 9:09pm

Sending /tmp/firmware.gbl, 1062 blocks: Give your local XMODEM receive command now.
Xmodem sectors/kbytes sent: 0/ 0kRetry 0: Cancelled

Transfer incomplete
Successfully flashed new EZSP firmware! The device will now reboot.

I can’t seem to get the firmware to update. I’m running the script from a RasPi (running Rasbian 10, Buster). I’ve unplugged the device and tried several time, all without luck. Any ideas?

EnsconcE · October 30, 2021, 12:07pm

I got a Moes Wired Smart Gateway wich is not the TYGWZ-01, but the NH-GWZ1 with board revision 1.0.1. The board seems to be the same, except that the board is blue and the shape is a bit different. The hack described in this topic also applies for that gateway

What i cannot seem to get to work is zibee2mqtt. Is it possible to use this zigbee controller in zigbee2mqtt?

challs · October 31, 2021, 11:16am

Hello. I normally use the Zha integration, but I did get zigbee2mqtt running with my controller briefly when I wanted to compare the quirk handling for one of my devices. So yes, I think you should be able to get it working with zigbee2mqtt.

EnsconcE · November 1, 2021, 8:07pm

So yeah i was seeing mine also in zigbee2mqtt, but for some reason it didn’t work. To get it to work, the firmware has to be 6.7.8. After that, zigbee2mqtt needs the following configuration

serial:
  port: tcp://[gatewayip]:8888
  adapter: ezsp

After this the devices will not show up as unknown, but as the devices as they are. Now i hope that it all works correctly

Edit:
For anybody who wants to know, i was coming from 6.5.0

Enoo · November 1, 2021, 9:46pm

Successfully hacked my bridge; Thanks to all on this thread.

This guide and found Pauls page very helpful.

pbackx · November 14, 2021, 2:41pm

@bool2 Also a heartfelt thank you from me. Everything worked perfectly on the first try! Awesome work.

BTW I used a Raspberry Pi to make the serial connection, using minicom. So if you have a Raspberry Pi around, there’s no need to go buy new hardware. Some useful links for those who want to go that way:

https://www.cyberciti.biz/tips/connect-soekris-single-board-computer-using-minicom.html