Hacking the Silvercrest (Lidl/Tuya) Smart Home Gateway

I’ve got myself into trouble playing with a Zemismart hub, Zigbee / Tuya / Homekit device.
To a stage where it boots to console login but seems the /tuya has been erased. So cannot use root login nor extract password. my bad.

Would anyone have a backup or alternative firmware for this device ? I can upload custom firmware to restore Zigbee/Tuya bridge but I will be missing the HomeKit integration from what I can read.

The device use an RTL8196E.

Alternativly, I could restore as a bridge Zigbee/Tuya connect to HA and expose to Homekit but that not my preferred path.

Thanks !

Hello,
is there a way, once the lidl gateway has been modified, for it to join an existing zigbee network and to act as a range extender ?
I don’t think the serial gateway is the way forward, as i want my gateway to join my existing network that i have on a conbee phoscon 2.

Thanks in advance for your help

Ho, there is no way. After modification the device is a coordinator with lan port. Perhaps you can write another firmware into the zigbee module, but you cant do it with the firmware in this mod.

Hello @bool2,

i’m try to flow your guidance to hack this but on terminal i get this image

Can you or someone tell me what I’m doing wrong?

Maybe wrong baud rate.
You get some output, so you are connected.

1 Like

@WallyR 38400 is the baud rate I’m using

I used pycryptodome-3.16.0.tar.gz library instead of pycrypto

Try 19200 pr even 9600

1 Like

Turn off flow control

@fdebrus i’m turn it off
it’s not that

@WallyR not working with that rate :frowning:

Done:
Solution:
image

I guess we assumed you were on a windows machine. :slight_smile:
Linux have so many other terminals that comes with a standard installation that Putty rarely gets used on those OSes.

1 Like

Hi Numo
How did you progress that now you communicate with Gateway ? Sort out you password? and move further in the procedure?

Hello all,

Having a Silvercrest gateway with this hack, I wonder if I could put this gateway in “production” as my main coordinator but I am not sure of its stability.
After a few days of testing, the solution doesn’t seem very stable but maybe I didn’t apply the right configuration ?

  • On Zigbee2Mqtt, devices disappear from the network in a random way and I have to re-pair them manually. The EZSP support is still “experimental” so it may be normal.
  • On ZHA, some temperature sensors never updated after the first value (during pairing), pairing also seemed a bit random with a need to restart Home Assistant. Also, some of my routers did not reconnect after a Home Assistant restart.

All my devices in the same locations work fine with a Sonoff ZB-Bridge (Original Firmware), but I wish I could get out the cloud.

My questions are :

  • Is this gateway viable in production, as much as a Sonoff USB Dongle Plus-P (or E, or maybe it’s a EP32 problem?) or is this hack a “test for fun” not intended for production? Lan GW are as performant as USB Stick (On good wired network) ?
  • Are the indications of @robertklep on the first messages still valid (Zigbee and TX Power channel change) ? Is it always necessary to make them in command line or it can be specified in the configuration of Zigbee2Mqtt or ZHA ? My sensor problems that do not update may be related to this TX Power. Is it recommended to increase the TX power or to keep the default value?

Have a good day,
Thanks,

Hello,

I’ve tryed the ‘esc’ procedure on a DMD2CC without success… so I’ve disoldered the SPI and dumped it…
On the tuya’s area I got only FF bytes so I suspect that the tuya partition isn’t event created in the flash.
I’ll do try to change /etc/passwd since the offset bytes aren’t correct, i’ts clearly a more recent firmware:

---RealTek(RTL8196E)at 2022.03.29-15:59+0800 v3.4T-pre2 16bit (380MHz)

I’ll update this post with success or failure report…

[Update] it seems that this device never connected to tuya wont work… the “tuya” partition is full of “0xFF” in the flash… so not initialized at all or not at this flash place.
I’ve managed to unscramble the “jffs2-fs” partition and get access to nearly all script.
I’ve changed the passwd file into the “root-fs” partition, just need to unsolder again the flash, update it, and solder it back to test.
This is confirmed working: after changing the /etc/passwd from symlink to real file on the flashmem, I can access to the tty device.
However, I do confirm that the device act strangely… (it doesn’t start dropbear nor tuyadropbear) I do believe that this device is somehow not standard…

1 Like

Hi, I’m not really sure what the problem is in my case, but this happens :
I was using the lidl router for 3 or 4 weeks now and it was running well. Today it lost connection and after restarting it does not get any ip from dhcp. If I go rx/tx and log in as root, it boots up and receives an ip.
After that when I restart it without serial access no dhcp.
But why after 3 or 4 weeks of usage ?
Hope some1 has an idea what i can try.

I’ve been using this device on my production system for over a year now. My experience is that once pairing is successful, it is pretty stable and I do not worry about it on a regular basis. I do like the fact that it does can be placed independently of the HA system, does not need a USB host machine and so there is no danger of interference caused by USB3 connections. My network currently has 22 devices.

Having said that, there are a few things I am aware of:

  • I think the range is probably worse than other sticks. It isn’t a big issue for me because other devices extend the mesh for it not to be a problem for me
  • I do sometimes see some problems with pairing a battery based device if the device is not placed right by the router beforehand: Sometimes, the device says it is paired when not all of the clusters are properly set up. This could be a problem with the ZHA stack, which I am using - this post says the problem went away when they switched to zigbee2mqtt.

I have acquired a Sonoff Zigbee 3.0 USB Dongle Plus, which I am using for quirk development. I don’t seem to get as many issues with pairing when I use the Sonoff.

Are the indications of @robertklep on the first messages still valid (Zigbee and TX Power channel change) ?

I haven’t needed to make any changes to these settings on my network.

2 Likes

Thanks for your feedback, I will continue to test this gateway to try to get a stable network.
I’m also interested in this LAN aspect that allows to place the gateway in the center of the house, which is not the location of the Home Assistant server.

I am interested in feedback from users who have increased the TX Power, have you noticed a gain in network stability? Or does the gateway become unstable with highest TX power setting since it is not designed for that.

Hello
I try to root the lidl gateway but the esc key does not interrupt the boot (thanks for the alternative keys I will try it!)
After several unsuccessful attempts (electrical connection/deconnection) my gateway now refuses to start! Has anyone ever had this problem?
Thank you