I've found a working ethernet lan-only zigbee home automation (ZHA) coordinator on AliExpress

erkexzcx · February 28, 2022, 9:46am

Wanted to share the link to a working ZigBee coodinator (the device that is required to connect zigbee devices to HA) I’ve found on AliExpress that works in lan-only and does not need to be connected to your server via USB (it works over ethernet).

http://aliexpress.com/item/4000465421911.html (Moes Tuya ZigBee Smart Gateway Hub Smart Home Bridge Smart Life APP Wireless Remote Controller Works with Alexa Google Home, Wired Hub model)

It can be hacked by following this tutorial (steps are 100% identical. the board has visible differences, but pins location and instructions are completely identical): Tuya Ethernet Zigbee Gateway TYGWZ-01 Zigbee compatibility

It works

KKlitgaard · March 4, 2022, 8:29pm

The ZigStar LAN Gateway works pretty well as coordinator as well.
https://zig-star.com/projects/zigbee-gw-lan/

erkexzcx · March 10, 2022, 9:13pm

I’ve bought another one for a friend. This time I’ve taken some photos.

hijamie32 · August 14, 2022, 12:38pm

Hi,

Due to my current setup struggling I am looking at options and just seen your thread.

Is it still stable and up and running, any issues with different devices / brands?

Many thanks

avibarilan · December 4, 2022, 8:33pm

Hi
any chance to get a link to purchase the yellow ping and the usb adapter device?
or maybe just tell what are they called so that i can search around for them?

orange-assistant · December 5, 2022, 12:36pm

pin header

usb uart

julian33 · December 30, 2022, 10:20pm

Current version does not allow to recover the root password any more via escaping boot loader process.

Anybody has any idea on alternatives ?

ant-thomas · December 31, 2022, 6:28pm

I’m seeing the same with a similar gateway.
Can’t escape the boot process so cannot attempt to crack the root password.

Looks to be running quite a recent firmware - built 2022.09.02

github.com/banksy-git/lidl-gateway-freedom

Support for Tuya ZW05B0

opened 01:40PM - 30 Dec 22 UTC

ant-thomas

I've picked up a cheap ethernet gateway off Aliexpress. Seems to be the same …hardware as the Lidl Firmware is a lot newer - I've added headers and got to the boot messages so far. Pressing ESC doesn't seem to get to the bootload prompt. Any suggestions for next steps? ![image](https://user-images.githubusercontent.com/1029851/210075979-9b2899b7-9fd2-4e94-9bab-f389eaa13fb1.png) ![image](https://user-images.githubusercontent.com/1029851/210076074-30eada1a-3491-452c-9808-99fd63a8d89d.png) ![image](https://user-images.githubusercontent.com/1029851/210076297-ff4ed7fb-56dd-4e7d-a153-a31f20e72f90.png) ``` Booting... @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize @ 0000000h 0c84018h 00000c8h 0000040h 0000018h 0000000h 0000018h 1000000h @ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName @ 0010000h 0000100h 0001000h 0001000h 0000100h 0000010h 000004eh GD25Q128 @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ DDR1:32MB ---RealTek(RTL8196E)at 2022.09.02-15:49+0800 v3.4T-pre2 [16bit](380MHz) P0phymode=01, embedded phy check_image_header return_addr:05010000 bank_offset:00000000 no sys signature at 00010000! get uboot flag failed Jump to image start=0x80c00000... decompressing kernel: Uncompressing Linux... done, booting the kernel. done decompressing kernel. start address: 0x80003780 Linux version 3.10.90 (huangxh@embed) (gcc version 4.6.4 (Realtek RSDK-4.6.4 Build 2080) ) #5 Fri Sep 2 15:52:57 CST 2022 CPU revision is: 0000cd01 Determined physical RAM map: memory: 02000000 @ 00000000 (usable) Zone ranges: Normal [mem 0x00000000-0x01ffffff] Movable zone start for each node Early memory node ranges node 0: [mem 0x00000000-0x01ffffff] icache: 16kB/16B, dcache: 8kB/16B, scache: 0kB/0B Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS0,38400 root=/dev/mtdblock2 PID hash table entries: 128 (order: -3, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 27344k/32768k available (2763k kernel code, 5424k reserved, 562k data, 192k init, 0k highmem) SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 NR_IRQS:128 console [ttyS0] enabled Calibrating delay loop... 378.47 BogoMIPS (lpj=1892352) pid_max: default: 4096 minimum: 301 Mount-cache hash table entries: 512 reg e0=0 reg e1=0 reg e2=0 reg e3=0 reg e4=0 reg e5=0 reg e6=0 reg e7=0 reg f0=0 reg f1=0 reg f2=0 reg f3=0 reg f4=0 reg f5=0 reg f6=0 NET: Registered protocol family 16 bio: create slab <bio-0> at 0 NET: Registered protocol family 2 TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP: reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. msgmni has been set to 53 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x18002000 (irq = 9) is a 16550A serial8250: ttyS1 at MMIO 0x18002100 (irq = 13) is a 16550A Realtek GPIO Driver for Flash Reload Default tuya_gpio_init ok, scan expire time:50 SPI INIT ------------------------- Force into Single IO Mode ------------------------ |No chipID Sft chipSize blkSize secSize pageSize sdCk opCk chipName | | 0 c84018h 0h 1000000h 10000h 10000h 100h 84 0 GD25Q128| ---------------------------------------------------------------------------- SPI flash(GD25Q128) was found at CS0, size 0x1000000 boot+cfg offset=0x0 size=0x20000 erasesize=0x10000 linux offset=0x20000 size=0x1e0000 erasesize=0x10000 rootfs offset=0x200000 size=0x200000 erasesize=0x10000 tuya-label offset=0x400000 size=0x20000 erasesize=0x10000 jffs2-fs offset=0x420000 size=0xbe0000 erasesize=0x10000 5 rtkxxpart partitions found on MTD device flash_bank_1 Creating 5 MTD partitions on "flash_bank_1": 0x000000000000-0x000000020000 : "boot+cfg" 0x000000020000-0x000000200000 : "linux" 0x000000200000-0x000000400000 : "rootfs" 0x000000400000-0x000000420000 : "tuya-label" 0x000000420000-0x000001000000 : "jffs2-fs" PPP generic driver version 2.4.2 nf_conntrack version 0.5.0 (427 buckets, 1708 max) ip_tables: (C) 2000-2006 Netfilter Core Team TCP: cubic registered NET: Registered protocol family 10 sit: IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 l2tp_core: L2TP core driver, V2.0 8021q: 802.1Q VLAN Support v1.8 Realtek FastPath:v1.03 Probing RTL819X NIC-kenel stack size order[1]... eth0 added. vid=9 Member port 0x10f... eth1 added. vid=8 Member port 0x10... [peth0] added, mapping to [eth1]... VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 192K (80340000 - 80370000) init started: BusyBox v1.13.4 (2022-09-02 15:48:01 CST) Set power startcmd read b8000038: 2794A104 0000000F 00000042 00000018 '▒▒ B cmd write Write memory 0xb8000038 dat 0x1794a104: 0x1794a104 Set power end killall: dropbear: no process killed Please press Enter to activate this console. udhcpc (v1.13.4) started Tuya Gateway Application Normal Srart /tuya/tuya_start.sh UserAppRunDir: set defult run_dir:/tuya TY_ENV_APP_RUN_DIR=/tuya Sending discover... get user cfg file error, load defult cfg file load platform configure file:/tuya/def.cfg start.conf is exist udhcpc (v1.13.4) started current run dir:/tuya/tuya_user1 tuya_start_children.sh:UserAppRunDir:/tuya JsonFile Path:/tuya/def.cfg [engineer_mode: ] grep: /var/resolv.conf: No such file or directory Sending discover... killall: app_detect.sh: no process killed killall: tyZ3Gw: no process killed killall: log_detect.sh: no process killed killall: process_monitor.sh: no process killed killall: tyZ3Gw: no process killed killall: dropbear: no process killed Sending discover... cat: can't open '/tuya/eng_mode': No such file or directory no eng file Sending discover... nlRecvFromAppSock sg_netlinkKeyPid:242 nlRecvFromAppSock port link sg_netlinkPid:242 nameserver 8.8.8.8 nameserver 114.114.114.114 Sending discover... Sending discover... Sending discover... ```

julian33 · January 1, 2023, 10:45am

EDIT: After multiple retries…it worked…please disregard message

bought a second hand lidl gateway from wallapop. All fine except I am struggling to upgrade firmware

it seems I am missing something

Xmodem sectors/kbytes sent: 0/ 0kRetry 0: Timeout on sector ACK
Retry 0: Timeout on sector ACK
Retry 0: Timeout on sector ACK

TheoSl93 · April 12, 2023, 11:21am

Hi There!

I have a question about Zigbee hubs, I hope this is the right place to ask:

This coordinator is a substitute for the USB dongle that most of the people use, right?

I was thinking about buying an ethernet coordinator (like this one, but already flashed with tasmota) that I can place on a reachable place in the house, instead of the dongle. But, is it going to work the same? Can I send ‘posts’ and ‘gets’ to trigger actions?

And regarding the documentation, do I need to use the zigbee2mqtt integration and look for compatible devices? Or anything Zigbee compatible will work flawlessly in HASS? I would like, for example, to trigger the alarm of this smoke detector from HASS.

Thanks in advance!!

Arduous · April 30, 2023, 7:21am

Yes, this is an Ethernet based coordinator to replace an USB based one.

The ones you currently get if you order on AliExpress cannot be hacked anymore by interrupting the boot process. People successfully installed Tasmota by desoldering, modifying and resoldering the flash. Hacking the Silvercrest (Lidl/Tuya) Smart Home Gateway - #447 by ur5dco

I tried to get the ssh password from the manufacturer but they do not understand, or fake that they do not understand my question.

If anyone has a a new hack not involving removing the flash, or another reasonably cheap and sourceable Ethernet coordinator, I would be very happy to know about it.

TheoSl93 · May 12, 2023, 6:11am

Hi Arduous, thanks for your response!

I found a model which is already flashed but I haven’t tried yet. Does it seems legit? I think that, if it works, it can be a good one to use.

Arduous · May 12, 2023, 8:05am

Great! Thank you, I will order it. No later than this morning, I got confirmed that the development team do not want to give me the root password.

TheoSl93 · May 12, 2023, 8:57am

You’re more than welcome!

Would you mind keeping me updated about it? I would like to know if it works without shady workarounds with HASS and the standard integrations.

I hope it works

Rofo · May 12, 2023, 11:25am

Do these only work with Zigbee to MQTT or will they also function with ZHA ?

TheoSl93 · May 23, 2023, 7:46pm

Hi Rofo,

I have no idea, that’s what I was also wondering in order to implement it myself and look for the compatible zigbee devices. I think @ardous can enlight us when he recive the hub.

Arduous · May 30, 2023, 3:50pm

Hello,

I received the device. I stupidly “upgraded” the firmware with a wrong one, and do not have a copy of the original one. I am waiting for the seller to send it. In the while, I successfully flashed a firmware with the instructions found at GitHub - vahempio/Tasmota-for-eWeLink: Tasmota firmware for eWeLink gateway (ethernet + ZigBee) . Caveat is that I am not able to activate the Ethernet interface, but ZHA configured with the information found at How to use the Sonoff Zigbee Bridge with Home Assistant - Tasmota | digiblurDIY allowed me to have a working ZigBee bridge through Wi-Fi.

So while I am not totally able to confirm yet, I am pretty confident that it this device may be what we are looking for.

TheoSl93 · May 31, 2023, 1:30pm

Great!

I have to say I don’t understand what you did here… You flashed the firmware with a wrong version, but yet you got it working? Isn’t this already flashed with tasmota? Why did you flashed it again? Or are you talking about the other device you mentioned? The one you couldn’t flash because root access.

And thanks again for doing this research and posting it here!

Arduous · May 31, 2023, 1:45pm

I am talking about the ESP32 based device that I ordered recently. The Tasmota firmware that comes with it isn’t the latest one (1 or 2 versions behind). I wanted to flash it with a newer Tasmota firmware, but I flashed a firmware that does not support properly this board. Currently, the best I could do to recover from my mistake is to the flash the above mentioned firmware. Wi-Fi to ZigBee (ZHA) bridge does work, but as I cannot get the Ethernet interface to work, I cannot get the Ethernet to ZigBee setup that is our ultimate quest. I received the original firmware from the seller. Hopefully I will find some time tomorrow to flash it and report.

TheoSl93 · May 31, 2023, 4:52pm

Oh, I understand, now we are on the same page.

Good that the seller is helping as well. As soon as I’m back from holidays I’ll order the hub as well (just the one I linked a couple of weeks ago, right?) and update the firmware too. How did you did it? With tasmotizer and an usb adaptor (the one with the 4 pins, I can’t remember the name).

In that case I’ll buy it as well

Thanks for all the help!