Hacking the Silvercrest (Lidl/Tuya) Smart Home Gateway

I’m using Python 3.9 on macOS, same script.

1 Like

Just wanted to thank @bool2 for the comprehensive and easy to follow guide on getting this working with ZHA. I was using a Sonoff Bridge, but I was experiencing a random number of my battery powered sensors going unavailable at random times. I just assumed that they were not very good but after reading that wifi zigbee bridges are not all that I got a Lidl bridge, followed your guide and was up and running in 10 mins. Took me a bit to migrate the 40 odd devices I had but since then I’ve never had a device not check in within 3 hours. No more running around the house at the weekend “re-adding” sensors!

1 Like

Sending /tmp/firmware.gbl, 1062 blocks: Give your local XMODEM receive command now.
Xmodem sectors/kbytes sent: 0/ 0kRetry 0: Cancelled

Transfer incomplete
Successfully flashed new EZSP firmware! The device will now reboot.

I can’t seem to get the firmware to update. I’m running the script from a RasPi (running Rasbian 10, Buster). I’ve unplugged the device and tried several time, all without luck. Any ideas?

I got a Moes Wired Smart Gateway wich is not the TYGWZ-01, but the NH-GWZ1 with board revision 1.0.1. The board seems to be the same, except that the board is blue and the shape is a bit different. The hack described in this topic also applies for that gateway :blush:

What i cannot seem to get to work is zibee2mqtt. Is it possible to use this zigbee controller in zigbee2mqtt?

3 Likes

Hello. I normally use the Zha integration, but I did get zigbee2mqtt running with my controller briefly when I wanted to compare the quirk handling for one of my devices. So yes, I think you should be able to get it working with zigbee2mqtt.

So yeah i was seeing mine also in zigbee2mqtt, but for some reason it didn’t work. To get it to work, the firmware has to be 6.7.8. After that, zigbee2mqtt needs the following configuration

serial:
  port: tcp://[gatewayip]:8888
  adapter: ezsp

After this the devices will not show up as unknown, but as the devices as they are. Now i hope that it all works correctly

Edit:
For anybody who wants to know, i was coming from 6.5.0

1 Like

Successfully hacked my bridge; Thanks to all on this thread.

This guide and found Pauls page very helpful.

@bool2 Also a heartfelt thank you from me. Everything worked perfectly on the first try! Awesome work.

BTW I used a Raspberry Pi to make the serial connection, using minicom. So if you have a Raspberry Pi around, there’s no need to go buy new hardware. Some useful links for those who want to go that way:

https://www.cyberciti.biz/tips/connect-soekris-single-board-computer-using-minicom.html

2 Likes

First of all thanks for the tutorial.

I am kind of an beginner in the programming world so i got some questions.
How does the TFTP thing work?
I have been searching online but cant find anything that works.

Thanks

Hello, you can find more details about the TFTP process in the writeup here

Hi!
You did great work, thank you! But I cannot pair my GW with HA. I did everything from here Home Assistant Integration - Hacking the (Silvercrest) Lidl Smart Home Gateway - Paul Banks DOT Org step by step. But HA gives me “Failed to connect” when I try to pair it. I tried all the commands few times as it is in tutorial (via serial and SSH both using Putty). All went fine without errors except the final step (pairing with HA). Please help. Can I debug it somehow?

HI, I am trying to hack the following Tuya Zigbee gateway I bought on Amazon

Here is a screenshot of the board.

image

I noticed there is no reference to J1 on it, but I connected the TXD, RXD and GND cables to a couple of different USB UART dongles and used Putty to make a connection. All I got was gibberish using the 38400 8N1 settings with no flow control.

I saw someone mention using RPi to make the connection so I tried this method and also got gibberish. Taking a look at the board I noticed the TXD/RXD pins are next to the wifi chip, not the zigbee chip, but I cannot see equivalent pins for the Zigbee chip, is my board not compatible with this method?

I want to unlock this gateway so I can use it with an Aqara mini switch.

Any help appreciated.

Thanks!

1 Like

Hi guys. I am new to Zigbee and need help from you. I have a Lidl Tuya gateway and some Lidl devices that are working great. Also I have one xiaomi mi light detection sensor ytc4043gl. I need to connect the xiaomi senor on Lidl gateway, along with the other Lidl devices. I need a scene with light sensor.
Is there any way to do that only with Lidl gateway (with custom firmware, I think) and no other hardware devices ? How ?
I manage to wired-up the serial ttl 3.3V and have found the key and pass for login in ssh.
@ robertklep I read here: " The result is that I managed to pair the [Xiaomi Mijia motion sensor ]" Can you help me with the light sensor ? Can I make it work ?
tks in advance.

Has anyone successfully using LIDL Remote Control with this hack? When I pair this remote there is only power entity and there is also no info in zha_events when I’m pressing buttons.

Furthermore I have doubts about the range of paired devices. I’ve paired Lidl bulb (a distance of approx. 9 meters from the gateway, behind the door and the wall RSSI: -78) and mentioned remote (a distance of approx. 6 meters from the gateway RSSI: -79). As @robertklep and @AdriaanB suggested I’ve changed TX to 18 and channel to 11.

This hack won’t work on your device. WRG1 is using a RTL8711AM ARM SOC ( RTL8711AM - REALTEK) ( WRG1 Module Datasheet-Documentation-Tuya Developer) running RTOS, while the LIDL gateway is using RTL8196E MIPS SOC ( RTL8196E - REALTEK) running Linux.
Tasmota for Tuya WRG1 Module (RTL8711AM) · Discussion #9262 · arendst/Tasmota (github.com)

Thanks. I wish i’d known this before trying to hack it, a waste of time and money.

I just bought a Lidl Smart Home gateway blindly, because I was sure the HA community had something for it. It did not disappoint, I haven’t tried hooking it up to serial yet but I’ve taken the time to add Paul’s magic solution to the WebArchive, just in case. Thank you all!

Remote control devices are not expected to expose sensors, rather they have events attached to them. Inside automation page, when you select your remote control entity, you should see possible list of events to trigger on.

There are no events and automations for this entity - only battery level. As I wrote before I’ve also tried to listening to zha_event in developer tools but without any effect.

Got it, just to double confirm, this is what i get in automation window. But when i first paired these into z2mqtt, there was no event name. I had to restart z2mqtt to get the trigger names correctly.