Hacking the Silvercrest (Lidl/Tuya) Smart Home Gateway

I’ve seen wireguard mentioned when I was setting up a new OpenWRT router. But I have been using ZeroTier for years and only recently needed to think about adding a managed network for unsupported platforms.

autossh looks like it could manage it, but the nice thing about the tmux for now at least is that I use it for other things wrt debug logging. There’s many ways to skin a cat. And I doubt I really will be adding software to the gateway :slight_smile:

I guess wireguard I could run myself? There is something to be said for that. ZT is just lazyness and the result of a fobia for linux network configs that I picked up in the beginning.

ZeroTier is fine too. The point is to have the gateway use a network device such that it doesn’t need to manage disconnects.

A disappointing thing about the hack Paul made is that his hack isn’t portable (it requires setting up a toolchain which is annoying). If he would just have made it available via Nix/Guix, there wouldn’t be such a problem.

The scripts he has writte also aren’t portable, because they require dependencies (which again could have been solved by using Nix/Guix). I just don’t understand why people write code they intend to share with others that doesn’t work everywhere.

Otherwise, it’s great Paul’s website exists.

I never really had a usecase to hack a device (not sure whether I actually had one in that I could just have bought such a gateway off the shelf). Is it even possible to buy devices that are just as capable as the hacked version of this one right now?

The latency for turning lights on/off without a stupid cloud in the way is amazing too.

There are different schools I guess. I have been vaguely aware of Nix but I’ve never seen it as a way to work ‘portable’, like as in ‘devops’ and reproducible everywhere… Yeah, maybe? I thought of it more as an OS with its own thing. But I only ever read some reviews of Nix. I see Guix is a newer thing. To be honest, I’ve been doing alot of docker and I see now those two are a bit of polar opposites. Docker is like hack until you have a sort-of OS filetree and stick it in an image. Nix on the other hand wants to restrict and declare everyting? But I mean, can I build a docker from scratch with Nix OS in it?

Oh and btw the hardware hacking is just economical and fun. I trust OpenWRT more than any other brand. Last month picked up an Archer C7 that was sold here years ago in .nl to cable internet customers under the market price with customized firmware just for it to work as a wifi extender. So they are plenty and to these people it is useless and already old.

What do you run HA on? I’ve benchmarked my cloud this month and realized I did not really need them at all, even two old thin clients can do about as much as what I pay them for.

No its not the case. At that point I had created the root image manually and it was not bootable. The roofs_tool.py creates an image that will reboot if the power cycled so it will not be a problem for you.

Hello,

I’m new to Home Assistant and have no experience with hacking.
At the moment I am able to reach the bootloader of the Lidl Silvercrest gateway and have the RealTek promt and also see the available commands after entering “?”.
But if i try to execute a command I always get back “Unknown Command !”
So I’m stuck.
Does somebody have an idea that can help me

It is working.
I rebooted once again and now it is OK.
I have already the decrypted AusKey and Root Password.

Sorry for the inconvenience.

Serial can be tricky. I’d like to help but I’m not sure what could be going on but maybe you could describe your software and hardware you use? Which serial bridge, which terminal program. Could it have something to do with serial parameters (like parity, bits flow?). Line/carriage returns?

I usually hook up screen like screen /dev/usbTTY <baudrate> (I should be looking at cu) and forget about the rest :slight_smile:

Edit: ok. Cool.

Thanks for the reply.
I already edited my original post because it is working now.
I probably did something wrong but I don’t know what …

I have another question.
I’m at the boot prompt of the server, can I change the password of the server and will this a permanent
change or will this be overwritten with a next boot?

I don’t have it hooked up to serial, its just running for me for a year now like I described but I canot access the SSH shell session anymore.

But iirc there was something with an image or a read-only partition? Idk, I really cannot remember because I’ve also been hacking at a WIFI camera recently with similar issues and I probably confuse these.

My suggestion is use sshpass and move on, but that is based on my experience.

OK thanks.

I have access to the lidl gateway but when I start with ## Setting up device for Home Assistant control I need a serial port to TCP/IP gateway program.
Which program is this for a Linux pc?
Or is there another way to transfer a file to the gateway?
I been busy for hours browsing google to find a solution but to no avail.
Can someone help me because at the moment I’m stuck.
Thanks in advance.

Hey, that’s great to see you managed to get it working for you.

Actually, the procedure is already a lot more automated now than it was when I started. In order to get much better, it needs more time investing in it to improve the process. We have to bear in mind that the people who got the scripts to this stage already invested a lot of their spare time on the project to get it working in the first place. Paul wrote a whole website full of information and details about the device. Myself, I built on that knowledge and spent a lot of time working out some of the problems I encountered, and writing the procedure up as it was at this stage, plus being active on this thread to help clarify questions that come up for other people. Right now, you are probably one of the best person to move things forward - you have just experienced the process and are most aware of where the hardest parts are. :smiley: Things have changed in various ways since my last writeup - for example, an updated writeup from you taking the things you learnt into account would help other people attempting the same.

Thank you for the expect script you posted - that will make life a little easier for people coming here in future.

Do I need to do something with socat too?

No, the serialgateway.bin does this job (forwarding traffic between the Zigbee chip on the gateway and the network)

Can I use this gateway also just via the network without using the serial port (after the hack itself has been done)?

That’s correct, you don’t need the serial port afterwards because you can do everything via ssh. I have left the wires connected to the serial port on mine just in case, but in the end I haven’t needed them at all.

1 Like

I guess you are referring to this page

It’s just a summary of what you need to do at point 1 and is described further down:

So you just need to execute something like

cat serialgateway.bin | ssh -p2333 [email protected] "cat >/tuya/serialgateway

Thanks for the answer.
My mistake, I didn’t lay the link between point 1 (Install …) and 1) the real program I need to download.
Point 2 and 3 I understood and those where no problem.

But I have still some questions about the execution of:
cat serialgateway.bin | ssh -p2333 [email protected] "cat >/tuya/serialgateway

Do I need to connect a ethernet cable between my pc and the lidl box with the change the box is contacting the cloud and changing the password as I have read on this forum
.
Do I have to change the ip adress of the lidl box with ifconfig to be in line with my network?

I think I’m missing something about the way this is working.

Some explanation will be appreciated.

I solved it.
This is what I did:

1. via serial console
   a. cp /tuya/ssh_monitor.sh /tuya/ssh_monitor.original.sh
   b. echo "#!/bin/sh" >/tuya/ssh_monitor.sh
   c. reboot
2. removed the WAN cable to be sure not internet connection
3. connected ethernet cable from LAN to box
4. changed ip adress of box to my LAN
5. cat homeassistant/lidl/serialgateway.bin | ssh -p22 -oHostKeyAlgorithms=+ssh-dss  [email protected] "cat >/tuya/serialgateway"
6. connect to box with ssh -p22 -oHostKeyAlgorithms=+ssh-dss  [email protected]
7. execute the other updates.

Still to:
change the ip address of the box to my LAN permanently.

This is a socalled “useless use of cat”. I know you didn’t write it, just wanting to share it.

1 Like

Which one did you use to get it working? I also dont get e prompt while pressing esc several times during boot.
I use an FTDI32 device

Should I be able to use a Tuya smart zigbee actuator in this way too? How to pair a Tuya Smart ZigBee Radiator actuator using a hacked Lidl Silvercrest gateway?

The date command returns a wrong date, presumably because NTP is not being run. As such I think the hack needs to be modified. There is an ntpclient on the device.

# date
Fri Jan  9 21:36:53 UTC 1970

Hi! I managed to solder pins on board and get everything set up. Only thing missing is that I can’t get openHAB to see the device. I followed these instructions: Hacking the Lidl Silvercrest ZigBee Gateway: A Step-by-Step Tutorial - Tutorials & Examples - openHAB Community. I used socat and I can see the tty device created and it links to /dev/pts/1 which has correct user/group. I tried with minicom to use that port as openhab user and saw traffic with wireshark so socat works. OpenHAB has these in the logs:
2022-02-23 18:09:44.677 [ERROR] [zigbee.dongle.ember.ZigBeeDongleEzsp] - EZSP Dongle: Unable to open serial port.

I don’t see any traffic with wireshark when openHAB tries so it probably can’t open the port? BTW openhab I’m using is v3.2.0 on AlmaLinux 8.5. Has anyone else seen this problem?