Hacking the Silvercrest (Lidl/Tuya) Smart Home Gateway

Hardware
145

@JeromeT - What settings dod you add to the Zigbee2Mqtt configuration from Edge to allow it start and connect to your rebranded Tuya Gateway?

146

set adapter to “ezsp”

See here

147

I am new here, don’t have any knowledge about coding. However, it’s just work well.
Thank for your info.

ps. Anyone has instruction to config TX radio and Zigbee Channel. I already read some info. above but still blurred.

Thanks in advance

148

Hi challs,
I’m trying to get root access to my device but not quite success yet.
I follow the instruction on Hacking the Silvercrest (Lidl) Smart Home Gateway - Paul Banks DOT Org as followed

  • Execute: python dump_flash.py --serial-port /dev/ttyUSB0 --output-file rootfs.bin --start-addr 0x200000 --end-addr 0x400000 ==> This step took me around 40 Minutes
  • Execute: sudo unsquashfs rootfs.bin
  • Execute: mkpasswd -m descrypt MyPassword
  • Execute: unlink etc/passwd in the directory squashfs-root/etc
  • Create a new file named passwd using vi with the following content in directory squashfs-root/etc
    root:GfA8dj418kOCc:0:0:root:/:/bin/bash
  • Execute: sudo mksquashfs squashfs-root newroot.sqfs -comp xz
  • Execute: python rootfs_tool.py build newroot.sqfs newroot.bin
  • Enter command: ipconfig 172.16.10.101
    in bootloader screen
  • Enter command autoburn=0 in bootloader screen
  • Upload the file newroot.bin in binary format using tftp
  • Enter command FLW 200000 80500000 000E1000 in bootloader screen after file sucessfully uploaded
    After that I disconnect and reconnect the power to the device again
    I got struck in the bootloader screen and I can not logon with my root password that was entered in the passwd file.
    following is the log captured during boot and manually boot
Booting...
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@ 0000000h 0c84018h 00000c8h 0000040h 0000018h 0000000h 0000018h 1000000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@ 0010000h 0000100h 0001000h 0001000h 0000100h 0000010h 000004eh GD25Q128

@ 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
DDR1:32MB
 
---RealTek(RTL8196E)at 2019.01.23-17:03+0800 v3.4T-pre2 [16bit](400MHz)
P0phymode=01, embedded phy
check_image_header  return_addr:05010000 bank_offset:00000000
no sys signature at 00010000!
rootfs checksum error at 00200000!
no rootfs signature at 00210000!
no rootfs signature at 00250000!
no rootfs signature at 00201000!
......
.......
no rootfs signature at 003FF000!
no rootfs signature at 00400000!
P0phymode=01, embedded phy

---Ethernet init Okay!
tuya:start receive production test frame ...
P0phymode=01, embedded phy

---Ethernet init Okay!
<RealTek>
<RealTek>FLR 80500000 20000 001E0000
Flash read from 00020000 to 80500000 with 001E0000 bytes        ?
(Y)es , (N)o ? --> y
Flash Read Successed!
<RealTek>J 80c00000
---Jump to address=80C00000
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x80003780
Linux version 3.10.90 (huangxh@zp-VirtualBox) (gcc version 4.6.4 (Realtek RSDK-9
CPU revision is: 0000cd01
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Zone ranges:
  Normal   [mem 0x00000000-0x01ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x01ffffff]
icache: 16kB/16B, dcache: 8kB/16B, scache: 0kB/0B
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line:  console=ttyS0,38400 root=/dev/mtdblock2 
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 27700k/32768k available (2479k kernel code, 5068k reserved, 525k data, )
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128
console [ttyS0] enabled
Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
reg e0=0
reg e1=0
reg e2=0
reg e3=0
reg e4=0
reg e5=0
reg e6=0
reg e7=0
reg f0=0
reg f1=0
reg f2=0
reg f3=0
reg f4=0
reg f5=0
reg f6=0
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) 2001-2006 Red Hat, Inc.
msgmni has been set to 54
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x18002000 (irq = 9) is a 16550A
serial8250: ttyS1 at MMIO 0x18002100 (irq = 13) is a 16550A
Realtek GPIO Driver for Flash Reload Default
tuya_gpio_init ok, scan expire time:50
SPI INIT
 ------------------------- Force into Single IO Mode ------------------------ 
|No chipID  Sft chipSize blkSize secSize pageSize sdCk opCk      chipName    |
| 0 c84018h  0h 1000000h  10000h  10000h     100h   84    0          GD25Q128|
 ---------------------------------------------------------------------------- 
SPI flash(GD25Q128) was found at CS0, size 0x1000000
boot+cfg offset=0x0 size=0x20000 erasesize=0x10000
linux offset=0x20000 size=0x1e0000 erasesize=0x10000
rootfs offset=0x200000 size=0x200000 erasesize=0x10000
tuya-label offset=0x400000 size=0x20000 erasesize=0x10000
jffs2-fs offset=0x420000 size=0xbe0000 erasesize=0x10000
5 rtkxxpart partitions found on MTD device flash_bank_1
Creating 5 MTD partitions on "flash_bank_1":
0x000000000000-0x000000020000 : "boot+cfg"
0x000000020000-0x000000200000 : "linux"
0x000000200000-0x000000400000 : "rootfs"
0x000000400000-0x000000420000 : "tuya-label"
0x000000420000-0x000001000000 : "jffs2-fs"
PPP generic driver version 2.4.2
nf_conntrack version 0.5.0 (432 buckets, 1728 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
NET: Registered protocol family 17
l2tp_core: L2TP core driver, V2.0
8021q: 802.1Q VLAN Support v1.8
Realtek FastPath:v1.03

Probing RTL819X NIC-kenel stack size order[1]...
eth0 added. vid=9 Member port 0x10f...
eth1 added. vid=8 Member port 0x10...
[peth0] added, mapping to [eth1]...
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 192K (802f0000 - 80320000)
init started: BusyBox v1.13.4 (2019-01-23 17:02:04 CST)
udhcpc (v1.13.4) started
Sending discover...
Sending select for 172.16.1.167...
Lease of 172.16.1.167 obtained, lease time 43200
deleting routers
route: SIOCDELRT: No such process
adding dns 172.16.1.1

Please press Enter to activate this console. SELF_PWD=/
run /tuya/tuya_start.sh
udhcpc (v1.13.4) started
chpasswd: an error occurred updating password for root
start.conf is exist
Sending discover...
Sending select for 172.16.1.167...
Lease of 172.16.1.167 obtained, lease time 43200
current run dir:/tuya/tuya_user1
deleting routers
route: SIOCDELRT: No such process
adding dns 172.16.1.1
killall: tyZ3Gw: no process killed

tuya-linux login: root
Password: 
Tuya Linux versi
Please press Enter to activate this console. nlRecvFromAppSock sg_netlinkKeyPid1
nlRecvFromAppSock port link sg_netlinkPid:181

tuya-linux login: root
Password: 
Login incorrect
tuya-linux login: root
Password: 
Tuya Linux versi
Please press Enter to activate this console. 
tuya-linux login:

Please Help mw Identify what went wrong in my device. How fo I get to the device with root password.

Thanks very much
***** EDIT With Solutions *******

  1. First Issue is my passwd file using /bin/bash as default shell for root which is not avaliable in the image the correct one should be root:<Result from mkpasswd -m descrypt MyPassword>:0:0:root:/:/bin/sh
  2. Last Issue is my flash image that include checksum not properly write into flash after tftp. It’s was write with FLW 200000 80500000 000E1000 which result in 2 bytes checksum of the image not included. the correct command would be FLW 200000 80500000 000E1002
149

Your passwd file is using a shell of /bin/bash but there’s no /bin/bash on the device. Try /bin/sh instead! :slight_smile:

150

Thanks very much. I can access root now but power cycle still struck in bootloader
i did * Execute: python rootfs_tool.py build newroot.sqfs newroot.bin before tftp the newroot.bin but it seem no signature can be found in the image uploaded that may cause the bootloader not boot it.

Booting...

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@ 0000000h 0c84018h 00000c8h 0000040h 0000018h 0000000h 0000018h 1000000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@ 0010000h 0000100h 0001000h 0001000h 0000100h 0000010h 000004eh GD25Q128
@ 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
DDR1:32MB
 
---RealTek(RTL8196E)at 2019.01.23-17:03+0800 v3.4T-pre2 [16bit](400MHz)
P0phymode=01, embedded phy
check_image_header  return_addr:05010000 bank_offset:00000000
no sys signature at 00010000!
rootfs checksum error at 00200000!
no rootfs signature at 00210000!
no rootfs signature at 00250000!
no rootfs signature at 00201000!
.....
.....
.....
no rootfs signature at 003FE000!
no rootfs signature at 003FF000!
no rootfs signature at 00400000!
P0phymode=01, embedded phy

---Ethernet init Okay!
tuya:start receive production test frame ...
P0phymode=01, embedded phy

---Ethernet init Okay!
<RealTek>
<RealTek>
<RealTek>FLR 80500000 20000 001E0000
Flash read from 00020000 to 80500000 with 001E0000 bytes        ?
(Y)es , (N)o ? --> y
Flash Read Successed!
<RealTek>J 80c00000
---Jump to address=80C00000
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x80003780
Linux version 3.10.90 (huangxh@zp-VirtualBox) (gcc version 4.6.4 (Realtek RSDK-9
CPU revision is: 0000cd01
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Zone ranges:
  Normal   [mem 0x00000000-0x01ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x01ffffff]
icache: 16kB/16B, dcache: 8kB/16B, scache: 0kB/0B
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line:  console=ttyS0,38400 root=/dev/mtdblock2 
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 27700k/32768k available (2479k kernel code, 5068k reserved, 525k data, )
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128
console [ttyS0] enabled
Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
reg e0=0
reg e1=0
reg e2=0
reg e3=0
reg e4=0
reg e5=0
reg e6=0
reg e7=0
reg f0=0
reg f1=0
reg f2=0
reg f3=0
reg f4=0
reg f5=0
reg f6=0
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) 2001-2006 Red Hat, Inc.
msgmni has been set to 54
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x18002000 (irq = 9) is a 16550A
serial8250: ttyS1 at MMIO 0x18002100 (irq = 13) is a 16550A
Realtek GPIO Driver for Flash Reload Default
tuya_gpio_init ok, scan expire time:50
SPI INIT
 ------------------------- Force into Single IO Mode ------------------------ 
|No chipID  Sft chipSize blkSize secSize pageSize sdCk opCk      chipName    |
| 0 c84018h  0h 1000000h  10000h  10000h     100h   84    0          GD25Q128|
 ---------------------------------------------------------------------------- 
SPI flash(GD25Q128) was found at CS0, size 0x1000000
boot+cfg offset=0x0 size=0x20000 erasesize=0x10000
linux offset=0x20000 size=0x1e0000 erasesize=0x10000
rootfs offset=0x200000 size=0x200000 erasesize=0x10000
tuya-label offset=0x400000 size=0x20000 erasesize=0x10000
jffs2-fs offset=0x420000 size=0xbe0000 erasesize=0x10000
5 rtkxxpart partitions found on MTD device flash_bank_1
Creating 5 MTD partitions on "flash_bank_1":
0x000000000000-0x000000020000 : "boot+cfg"
0x000000020000-0x000000200000 : "linux"
0x000000200000-0x000000400000 : "rootfs"
0x000000400000-0x000000420000 : "tuya-label"
0x000000420000-0x000001000000 : "jffs2-fs"
PPP generic driver version 2.4.2
nf_conntrack version 0.5.0 (432 buckets, 1728 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
NET: Registered protocol family 17
l2tp_core: L2TP core driver, V2.0
8021q: 802.1Q VLAN Support v1.8
Realtek FastPath:v1.03

Probing RTL819X NIC-kenel stack size order[1]...
eth0 added. vid=9 Member port 0x10f...
eth1 added. vid=8 Member port 0x10...
[peth0] added, mapping to [eth1]...
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 192K (802f0000 - 80320000)
init started: BusyBox v1.13.4 (2019-01-23 17:02:04 CST)
udhcpc (v1.13.4) started
Sending discover...
Sending select for 172.16.1.167...
Lease of 172.16.1.167 obtained, lease time 43200
deleting routers
route: SIOCDELRT: No such process
adding dns 172.16.1.1

Please press Enter to activate this console. SELF_PWD=/
run /tuya/tuya_start.sh
udhcpc (v1.13.4) started
chpasswd: an error occurred updating password for root
start.conf is exist
Sending discover...
Sending select for 172.16.1.167...
Lease of 172.16.1.167 obtained, lease time 43200
current run dir:/tuya/tuya_user1
deleting routers
route: SIOCDELRT: No such process
adding dns 172.16.1.1
killall: tyZ3Gw: no process killed

tuya-linux login: nlRecvFromAppSock sg_netlinkKeyPid:180
nlRecvFromAppSock port link sg_netlinkPid:180

tuya-linux login: root
Password: 
Tuya Linux version 1.0
Jan  1 00:00:58 login[123]: root login on 'console'
# ls
bin   etc   init  mnt   root  sys   tuya  var
dev   home  lib   proc  sbin  tmp   usr
#
151

I try the same thing but my device still end up in bootloader after power cycle.
I found a message indicate checksum error in the bootloader output during boot

no sys signature at 00010000!
rootfs checksum error at 00200000!

I notice something from my working directory to build the newroot.bin

-rw-r--r--  1 root      root       921602 May  9 01:30 newroot.bin
-rw-r--r--  1 root      root       921600 May  8 23:11 newroot.sqfs
-rw-r--r--  1 root      root      2097152 May  8 19:16 rootfs.bin
-rw-r--r--  1 root      root         3224 May  9 01:30 rootfs_tool.py
drwxrwxr-x 14      1001      1001    4096 Jan 23  2019 squashfs-root

the newroot.bin which is the result of running command
python rootfs_tool.py build newroot.sqfs newroot.bin
the file size of the newrot.bin is 2 bytes larger is this normal?

152

Yes, that’s the added checksum so make sure you’re writing those extra 2 bytes to flash too! Your FLW command above is 2 bytes short i.e. 000E1000 shoud be 000E1002

You can validate the checksum with this :

python rootfs_tool.py check newroot.bin

It should also work on rootfs.bin.

153

Thank you very much, you are my life saver. I just write the flash with 2 bytes more and it works!.

1 Like
154

Hello,
I’m having an issue upgrading my device ncp firmware. I got the device from aliexpress and there all kind of issue to resolve. I’m now successfully got root access to the device and installed serialgateway. my device firmware is not quite as same as people in this thread yet it is similar in nature. I have to dump flash and rebuild rootfs then write back into the device’s flash inorder to get access to device’s root.
now I’m try to upgrade the ncp firmware but seem my ncp firmware is not EmberZNet version 6.5.0.0 but it is EmberZNet version: 6.2.3.0 build 204

bash-5.0# bellows -d socket://172.16.1.167:8888 info               
[08:6b:d7:ff:fe:d3:19:87]
[0x0000]
[<EmberNetworkStatus.JOINED_NETWORK: 2>]
[<EmberStatus.SUCCESS: 0>, <EmberNodeType.COORDINATOR: 1>, EmberNetworkParameters(extendedPanId=8b:c0:51:2d:a2:d1:dc:6e, panId=0x5b9b, radioTxPower=13, radioChannel=20, joinMethod=<EmberJoinMethod.USE_MAC_ASSOCIATION: 0>, nwkManagerId=0x0000, nwkUpdateId=0, channels=<Channels.ALL_CHANNELS: 134215680>)]
[<EmberStatus.SUCCESS: 0>, EmberCurrentSecurityState(bitmask=<EmberCurrentSecurityBitmask.TRUST_CENTER_USES_HASHED_LINK_KEY|64|32|HAVE_TRUST_CENTER_LINK_KEY|GLOBAL_LINK_KEY: 244>, trustCenterLongAddress=08:6b:d7:ff:fe:d3:19:87)]
Manufacturer: 
Board name: 
EmberZNet version: 6.2.3.0 build 204

I try your script to upgrade the firmware with no sucess

bash-5.0# ./firmware_upgrade.sh 172.16.1.167 22 V7 ncp_firmware.gbl
[email protected]'s password: 
[email protected]'s password: 
[email protected]'s password: 
Sending /tmp/firmware.gbl, 1434 blocks: Give your local XMODEM receive command now.
Xmodem sectors/kbytes sent:   0/ 0kRetry 0: Got a1 for sector ACK
Retry 0: NAK on sector
Retry 0: Got a1 for sector ACK
Retry 0: NAK on sector
Retry 0: Got a1 for sector ACK
Retry 0: Timeout on sector ACK
Retry 0: Timeout on sector ACK
Retry 0: Timeout on sector ACK
Retry 0: Timeout on sector ACK
Successfully flashed new EZSP firmware! The device will now reboot.

although the message shown sucess but bellows -d still show EmberZNet version: 6.2.3.0 build 204
Are there anything need to change on the upgrade process as it is not the same as from 6.5.5 to 6.7.8

*** Edit for Solution ***
@Ordspilleren I Alread upgrade it to 6.7.8 using upgrade_ncp.py. your script some how not work on my device not sure why but I did try it several times with no luck.
Thanks BTW.

Thanks anyway

155

Is it possible to re-flash the roots flash dump back to the device with the same process to flash new root fs on to the device. It seem my device having a really old version of the firmware and may r it’s software too. One ncp firmware still at 6.2.3 while people here got 6.5.5 as preloaded firmware. My ssh do not on port 2333 as you mentioned in the guide but instead at port 23 as standard ssh. What is the FLW command I may use to write the roots.bin back to the device. I will try to pair my device to the cloud to get updated version before freeing it from the cloud later
*** Edit for Solution on upgrade ncp firmware ***
I try your python scritpt upgrade_ncp.py and it works first try.
Thanks you. I will not upgrade my device image from tuya cloud so thanks anyway

156

Quick update from my Silvercrest experience:
Up until about a month ago I was running on a separate OS/Hassio combo (wanted to run stuff from a SSD on a PI3+ and at that time this was not properly supported).
The Silvercrest hack was executed as described and stuff started to work, but ONLY using Bellows. Not all devices were able to join properly however like the Xiaomi Lux device (I got it to join, but it did not work as expected).
So last month I switched to a Out-of-the-box HomeAssistant installation and voilĂĄ, no more issues!
My advise if you are not yet running a clean HomeAssistant setup and have the hardware to do that: go for a clean setup! Saved me a lot of frustration in the end :grinning:

157

Hello @bool2,

thank a lot for your work, much appreciated !
Here is my feedback after a couple of months running it.

I am experiencing some issues with the serialgateway process stopping working after many days (10, 14 days tipically) which required rebooting the gateway.

Today I had the same issue with ZHA not connecting to the gatweway (connection refused), so I SSH to it and verified that the /tuya/serialgateway process was not running.
After rebooting everything works fine for days.

Have anyone else had this issue? What do you suggest?

Thanks again!

158

If anyone interested I have solved updating tuya_start.sh in this way:

#!/bin/sh
while true; do
pgrep -x serialgateway >/dev/null
if [[ $? -ne 0 ]] ; then
echo “Restarting SerialGateway: $(date)” >> /var/log/serialgateway.txt
/tuya/serialgateway &
fi
sleep 30
done &

1 Like
159

Good idea! My serialgateway restarted yet again this morning. I put in a Homeassistant automation to tell me if one of my devices is unavailable and notify me if that happens.

160

Great News, i have the key, now i follow the instructions from web page

from the line “## Customise running software on the gateway” onwards, its all double dutch

1 Like
161

okay all Ive done it, and it only has taken 6mts.

162

Hi there!
In case anyone is interested in putting something usefull on the button press, it’s located on GPIO9.

I’ve just exported it using

echo 9 > /sys/class/gpio/export

After that I was able to track button press:

# while true; do cat gpio9/value; sleep 1; done
1
1
0
0
1
1
1
^C
#

163

i managed to get the root passwd, i can login with the root passwd
ifconfig reveals 192.168.1.42 as ip

but this command doesn’t work:
cat serialgateway.bin | ssh -p2333 [email protected] “cat >/tuya/serialgateway”
ssh: connect to host 192.168.1.42 port 2333: Connection refused

i can ping the gateway:
PING 192.168.1.42 (192.168.1.42) 56(84) bytes of data.
64 bytes from 192.168.1.42: icmp_seq=1 ttl=64 time=0.761 ms
64 bytes from 192.168.1.42: icmp_seq=2 ttl=64 time=0.654 ms

164

ssh doesn’t seem to be running?

nmap -sT -p- 192.168.1.42
Starting Nmap 7.70 ( https://nmap.org ) at 2021-06-17 13:45 CEST
Nmap scan report for 192.168.1.42
Host is up (0.029s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
6668/tcp open irc
12130/tcp open unknown
MAC Address: 18:69:D8:30:29:7F (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 35.86 seconds