and with 2 coordinators?
1 for zha and the other for zigbee2mqtt?
Is that possible?
If you have 2 zigbee coordinators then yes.
Note that there will be 2 different zigbee mesh networks, so powered devices on one network would not be able to relay for endpoint devices on the other network. But yeah devices from either networks would all go into HA.
Are the Xiaomi Aqara devices (contact sensor, temperature, and smartplug) compatible with the hacked version of this device? I have seen people claim that these do not implement Zigbee correctly and that they are incompatible with some coordinators.
I’m not aware that a particular coordinator causes compatibility issues with individual devices, so you should find that they will work if they are supported by the zha integration (as opposed to zigbee2mqtt, which supports devices in a different way to zha).
I don’t have any of those devices myself to be able to tell you how well they work, so I can’t share any experience with you on that.
The hacked devices have the EZSP chip, and the fact that they have been hacked doesn’t really make any difference compared to any other EZSP device. However, I have observed that the EZSP implementation seems to have some problems with pairing, especially if the device is battery powered and closer to another router than the coordinator while doing the pairing. Once things are paired, I haven’t noticed any further problems caused by coordinator.
Exactly! I glad to hear that I’m not alone with the same issues with pairing battery devices.
Hi,
I just bought a TYGWZ1 from Amazon. I opened it and it’s Rev 1.0.2. I can connect to it via Serial and I can also stop it in the bootloader. But when I enter the commands I just get FFFFFFFF
Here’s the complete Output:
Booting...
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@ 0000000h 0c84018h 00000c8h 0000040h 0000018h 0000000h 0000018h 1000000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@ 0010000h 0000100h 0001000h 0001000h 0000100h 0000010h 000004eh GD25Q128
@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
DDR1:32MB
---RealTek(RTL8196E)at 2019.01.23-17:03+0800 v3.4T-pre2 [16bit](400MHz)
P0phymode=01, embedded phy
check_image_header return_addr:05010000 bank_offset:00000000
no sys signature at 00010000!
---Escape booting by user
P0phymode=01, embedded phy
---Ethernet init Okay!
<RealTek>LR 80000000 401802 16
Unknown command !
<RealTek> FLR 80000000 401802 16
Unknown command !
<RealTek>FLR 80000000 401802 16
Flash read from 00401802 to 80000000 with 00000016 bytes ?
(Y)es , (N)o ? --> y
Flash Read Successed!
<RealTek>dw 80000000 4
80000000: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
<RealTek>FLR 80000000 402002 32
Flash read from 00402002 to 80000000 with 00000032 bytes ?
(Y)es , (N)o ? --> y
Flash Read Successed!
<RealTek>dw 80000000 8
80000000: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
80000010: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
<RealTek>
What am I doing wrong?
Greets
Daniel
2 Likes
I’ve found somewhere else the password tuya123. With this I was able to execute the scripts to connect it to HA.
1 Like
Hi, it has been a while (and had to check with a friend) but we are guessing, since we both used putty, the combo was CTRL + ]
Some more info:
And I wonder, and how do I connect via serial port? I have soldered an adapter to the pins, I have bought usb to serial… but what does the console refer to? on windows, linux?, some video out there. Thank you
Bellow based devices are not compatible with my Xiaomi Temperature/Moisture sensor.
I have 4x round ones, first edition.
When I had the CC2531 stick they worked, but my USB stick (bellow based) and now the Lidl Silvercrest hacked gateway (bellow based too) are not discovering them.
It’s not just one of them, all 4 devices cannot be discovered.
Batteries are good.
It is referring to the place where you can input commands which are sent over the Serial Terminal connection. Here’s an article that has a lot of detail about how this works and example software you can use: Serial Terminal Basics - SparkFun Learn
Somehow the 16th time he gave me the password, nothing changed in the setup, i just repeated the steps a couple of times and it spewed out the password.
But that said, forgive me for being thick in this, I know so many here dream this stuff, so what is next Paul did explain it really well i take that and he did a wonderful job but to me it is cryptic, sorry:
how do you do this:
step 1 Copy the MIPS(LX) compiled serial gateway to the device. Download here:
I can now log in to the gateway using putty ssh and it works but then?
can any one please explain this to me in layman terms:
From your host PC:
cat serialgateway.bin | ssh -p2333 [email protected] "cat >/tuya/serialgateway"
- Modify the boot script to disable the Tuya Applications and instead start the serial gatway.
On the device, execute the following:
if [ ! -f /tuya/tuya_start.original.sh ]; then cp /tuya/tuya_start.sh /tuya/tuya_start.original.sh; fi
cat >/tuya/tuya_start.sh <<EOF
#!/bin/sh
/tuya/serialgateway &
EOF
chmod 755 /tuya/serialgateway
This will backup the original tuya_start.sh script and replace it with a simpler one that simply starts serialgateway.
- (Optional) Disable the Tuya customised SSH server and revert to the “standard” dropbear SSH server on port 22.
NOTE: After this step, the SSH server will be available only on port 22 and not 2333.
On the device, execute the following:
if [ ! -f /tuya/ssh_monitor.original.sh ]; then cp /tuya/ssh_monitor.sh /tuya/ssh_monitor.original.sh; fi
echo "#!/bin/sh" >/tuya/ssh_monitor.sh
from my own PC is that within putty???
Modify bootscript is that the code provided???
and again is that done in the ssh session in putty or?
the oprtional thing why do that and what is dropbear? so why should i do that if anything could go wrong with it one little typo and maybe i brick the thing.
and what are the best steps to be taken to get ZHA working.
Can someone please explain the steps in terms I do get, I am sorry I do understand that well this is for people that are very provisional in all this, and Paul did an outstanding job for most.
I opened a SSH so what now?
I am root
howto get MIPS(LX) compiled serial gateway onto the machine and where to put it in there
this code from the PC is that in SSH/Putty — ```
cat serialgateway.bin | ssh -p2333 [email protected] “cat >/tuya/serialgateway”
please?
O I have no Linux machine so how to use the cat command
1 Like
one step further:
I did wget instead of cat, I see the new scripts in my tuya folder
did all the for me hocus pocus things…
the ssh port is now 22
tried to get the thing working in HA but here i get failed to connect
What is wrong I do not know how to test a socket ip:8888
SO how to know if things work
how to get it working in the first place
got it, was a crippled gateway script by windows, corrected that works now.
Only the date is still 1970 is there an easy way to fix the ntp time
now that I have it running do i need to update the frimware or is the old good enough, and if doing so “updating” will I lose everything and do i need to reinstall the gateway scripts again
1 Like
Just a note for people trying this. There seems to be an issue with 2022.7 which makes it no longer possible to make the socket connection (the final step you do when integrating the patched gateway with Home Assistant)
Took me an hour to figure this out, so I hope I can save some people some time.
Paul 
Thanks for your work, I started for EtherNet RJ-45 Gateway TUYA TYZS4 by MOES NH-GW01Z
22-08-22 have KEK and AUSKEY and have password decrypted and able to login root by putty
22-08-23
connect GateWay to local net, see IP 192.168.0.100
ubuntu 22.04
putty ssh
ssh -v -oHostKeyAlgorithms=+ssh-rsa [email protected]
firmware_upgrade.sh edited - add -oHostKeyAlgorithms=+ssh-rsa
sudo bash firmware_upgrade.sh 192.168.0.100 22 V7 NCP_UHW_MG1B232_678_PA0-PA1-PB11_PA5-PA4.gbl
OK
HA ZHA manual config
socket://192.168.0.100:8888
OK
few devices added
OK
???
have 2 TYZS4 MOES
first SN ends 63F second 75C
63F root password decoded
75C gave FFFFFFFF both kek and auskey
as May 2021
will try step by step, slowly please
what need to be done
1
get root password of GateWay Linux
2
log into the GateWay through SSH
3
to be able to roll back - copy 2 files - make copy new name up to you
/tuya/tuya_start.sh → /tuya/tuya_start.original.sh
/tuya/ssh_monitor.sh → /tuya/ssh_monitor.original.sh
change files
5
tuya_start.sh
#!/bin/sh
while true; do
pgrep -x serialgateway >/dev/null
if [[ $? -ne 0 ]] ; then
echo “Restarting SerialGateway: $(date)” >> /var/log/serialgateway.txt
/tuya/serialgateway >> /var/log/serialgateway.txt &
fi
sleep 30
done
6
ssh_monitor.sh
#!/bin/sh
7
copy file
https://paulbanks.org/download/files/lidl-zigbee/serialgateway.bin
to GateWay /tuya folder
continue if done
I was able to get it up and running without too much trouble. I did run into a few small issues.
-
I had an MD5 discrepency after copying over the serialgateway.bin file. I had initially used Windows to do it. Then I used Linux to copy it over again and there were no issues.
-
When running the python script to reveal the root password I got an error ‘No module named Crypto.Cipher’. This was resolved by installing pycrypto ‘sudo pip install pycrypto’
-
I had also forgot to reverse the TX/RX between the gateway and the USB/TTY converter.
Thanks for putting this together @bool2, a fun little project.
1 Like
Hi
I thought I’d have a go at this…
… and while I can connect to it ok it using a TTL serial (3.3v) USB connector and accessing it via Putty on my PC, i can see things loading up, and i can see my key presses appear in the terminal window, however I can’t seem to stop it loading/booting up and it always goes into ‘Sending discovery…’ mode ?
The guidance suggests i have to hit the ESC key very early on to opt out of the boot, but i can’t seem to get that to stop it…
Here’s my set up below, does anyone have ideas how to do this with Putty ?
With Putty, if you want to send an escape char (like ^[ with telnet), just press CTRL and $. Also, it may depends of your keyboard layout, as explain of the following link Putty escape chars.
Report whether this works.
1 Like
Thanks @lepton, sorry i should have mentioned in my post that i had tried that too (CTRL +$) - via the same link, (I also tried the esc key too) but nothing so far seems to stop the boot process and it progresses to “sending discovery…”…
I can confirm that I can connect to it, as eventually it will prompt me for username/password, which i can make attempts at (but obviously fail, as i don’t know it yet 
)
It feels like I’m missing something (perhaps obvious to you or others) ?