Hacking the Silvercrest (Lidl/Tuya) Smart Home Gateway

Just a tip - dumping is much faster over TFTP. For that:

  • set host ip to 192.168.1.1
  • connect the gw by UART and ethernet, gw addr would be 192.168.1.6
  • get into the bootloader prompt
  • enter flr 80000000 <hex flash offset> <hex length>
  • read the file on your host with atftp -g -r test 192.168.1.6

It works because FLR command automatically exposes the loaded data over TFTP. Offsets and sizes for your convenience:

dev:    size   erasesize  name         offset
mtd0: 00020000 00010000 "boot+cfg"     0
mtd1: 001e0000 00010000 "linux"        20000
mtd2: 00200000 00010000 "rootfs"       200000
mtd3: 00020000 00010000 "tuya-label"   400000
mtd4: 00be0000 00010000 "jffs2-fs"     420000