Thank you for this! I was just searching for exactly this for this exact fountain. Have you figured out the calibration feature?
Iām about to endeavor this project. Was the flashing straight forward enough?
What sort of calibration is missing?
Thanks for this! Works great with the water fountain. Now I just need a way to track when my cats actually drink from it.
Any idea how to integrate the camera feeder?
Hi All. I also got the Granary Camera Feeder, but unfortunately (?) it also seems to be the non-tuya version. Am I right that there is no way to integrate that v2 to HA?
I started taking a look at the inside of the Granary Camera Feeder (PLAF103). I started by running an nmap scan of the device which only has telnet (21) and tuya (6668) as open ports. No RTSP unfortunately, so we donāt have an easy camera interface.
Telnet shows a login prompt but I havenāt been able to crack the login combination, so I moved on to taking apart the device.
I was able to get hooked up to the feeder via UART with pads they helpfully labeled on the board. The Baud Rate of this UART is 115385.
The SOC is an ANYKA AK39XXEV330 and the flash chip is an XMC QH128AHIG (I think, I honestly had a hard time making out the letters).
Itās running UBoot but Iāve so far been unable to get into the UBoot menu; it boots into Linux immediately, Hereās the logs from the early boot up sequence:
U-Boot 2013.10.0-V3.1.27 (May 17 2022 - 19:58:44)
DRAM: 64 MiB
efuse_read:0x0000000a
8 MiB
sd detect gpio mode:41!
mmc_sd: 0
In: serial
Out: serial
Err: serial
Net: eth-0
Hit any key to stop autoboot: 1
0
KERNEL: size:0x00190000, offset:0x00040000
SF: 1638400 bytes @ 0x40000 Read: OK
## Booting kernel from Legacy Image at 80008000 ...
Image Name: Linux-4.4.192V2.1
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1595680 Bytes = 1.5 MiB
Load Address: 80008000
Entry Point: 80008040
Verifying Checksum ... OK
XIP Kernel Image ... OK
kernel loaded at 0x80008000, end = 0x8018d920
using: FDT
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 4.4.192V2.1 (wm@ubuntu) (gcc version 4.9.4 (Buildroot 2018.02.7_V1.0.03-g9ff3371) ) #6 Sat Apr 2 17:18:03 CST 2022
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=0005317f
CPU: VIVT data cache, VIVT instruction cache
Machine model: ak3918ev330 dev board
Memory policy: Data cache writeback
ANYKA CPU AK39XXEV330 (ID 0x20160101)
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttySAK0,115200n8 root=/dev/mtdblock5 rootfstype=squashfs init=/sbin/init mtdparts=spi0.0:200K@0x0(UBOOT),4K@0x32000(ENV),4K@0x33000(ENVBK),48K@0x34000(DTB),1600K@0x40000(KERNEL),5568K@0x1D0000(ROOTFS),768K@0x740000(CONFIG) mem=64M memsize=64M
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 27356K/65536K available (3138K kernel code, 119K rwdata, 956K rodata, 136K init, 188K bss, 38180K reserved, 0K cma-reserved)
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xffc00000 - 0xfff00000 (3072 kB)
vmalloc : 0xc4800000 - 0xff800000 ( 944 MB)
lowmem : 0xc0000000 - 0xc4000000 ( 64 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.text : 0xc0008000 - 0xc0407d44 (4096 kB)
.init : 0xc0408000 - 0xc042a000 ( 136 kB)
.data : 0xc042a000 - 0xc0447c18 ( 120 kB)
.bss : 0xc0447c18 - 0xc0476e58 ( 189 kB)
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:126
ak39ev330_clk: CPU(JCLK): 708(Mhz)
ak39ev330_clk: MEMDDR2(DPHY): 354(Mhz)
ak39ev330_clk: VCLK: 320(Mhz)
ak-timer: ak_timer_init
clocksource: ak_cs_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 159271703898 ns
sched_clock: 32 bits at 12MHz, resolution 83ns, wraps every 178956970966ns
Calibrating delay loop... 351.43 BogoMIPS (lpj=1757184)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x80008400 - 0x8000843c
devtmpfs: initialized
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 256 (order: -1, 3072 bytes)
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
On-chip L2 memory initialized
ak-pinctrl 20170000.gpio: ak_pinctrl_probe 1958
ak_ev330_pinctrl: ak_pinctrl_probe irq: 15
media: Linux media interface: v0.10
Linux video capture interface: v2.00
clocksource: Switched to clocksource ak_cs_timer
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. Ā© 2001-2006 Red Hat, Inc.
jitterentropy: Initialization failed with host not compliant with requirements: 2
io scheduler noop registered (default)
AKxx uart driver init, (c) 2013 ANYKA
ttySAK0 at MMIO 0x20130000 (irq = 10, base_baud = 10000000) is a AK
console [ttySAK0] enabled
ttySAK1 at MMIO 0x20138000 (irq = 11, base_baud = 10000000) is a AK
loop: module loaded
zram: Added device: zram0
Start to init Anyka SPI Flash...
init Anyka SPI Nand Flash driver
spi0 new hz is 40000000, div is 2(change).
ak spiflash probe enter.
akspi flash ID: 0x00207017
ak-spiflash spi0.0: xm25qh64a (8192 Kbytes)
7 cmdlinepart partitions found on MTD device spi0.0
Creating 7 MTD partitions on "spi0.0":
0x000000000000-0x000000032000 : "UBOOT"
0x000000032000-0x000000033000 : "ENV"
0x000000033000-0x000000034000 : "ENVBK"
0x000000034000-0x000000040000 : "DTB"
0x000000040000-0x0000001d0000 : "KERNEL"
0x0000001d0000-0x000000740000 : "ROOTFS"
0x000000740000-0x000000800000 : "CONFIG"
Init AK SPI Flash finish.
akspi master SPI0 initialize success, use for PIO mode.
i2c /dev entries driver
ak_wdt_init: watchdog register...
NET: Registered protocol family 17
sctp: Hash tables configured (established 512 bind 1024)
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
devtmpfs: mounted
Freeing unused kernel memory: 136K
random: init: uninitialized urandom read (4 bytes read, 8 bits of entropy available)
random: swapoff: uninitialized urandom read (4 bytes read, 14 bits of entropy available)
random: mount: uninitialized urandom read (4 bytes read, 16 bits of entropy available)
mdev is ok......
random: ifconfig: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
random: mount: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
random: read_sensor_id.: uninitialized urandom read (4 bytes read, 23 bits of entropy available)
random: mkdir: uninitialized urandom read (4 bytes read, 24 bits of entropy available)
random: insmod: uninitialized urandom read (4 bytes read, 24 bits of entropy available)
ak_rtc: loading out-of-tree module taints kernel.
AK RTC, (c) 2018 ANYKA
rtc register framework...
We're Using Internal RC OSC.
random: mdev: uninitialized urandom read (4 bytes read, 25 bits of entropy available)
ak-rtc rtc: rtc core: registered ak-rtc as rtc0
random: mdev: uninitialized urandom read (4 bytes read, 25 bits of entropy available)
ak-i2c 20150000.i2c0: interval_scale property is not exist
i2c-0: AK I2C adapter
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ak-hshcd 20200000.usb: Anyka usb host controller
ak-hshcd 20200000.usb: new USB bus registered, assigned bus number 1
ak-hshcd 20200000.usb: irq 18, io mem 0x20200000
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Anyka usb host controller
usb usb1: Manufacturer: Linux 4.4.192V2.1 ak-hshcd
usb usb1: SerialNumber: Anyka usb host controller
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ak-hshcd 20200000.usb: Usb otg-hs controller driver initialized
[3460]:[akpcm_init:751]: akpcm_init...
[3464]:[akpcm_probe:576]: SPEAKER @14(lv 1)
[3474]:[akpcm_class_setup:215]: akpcm: pcm_major 0xf9
[3483]:[akpcm_playback_runtime_init]: playback_runtime pcm(0xc3bf8240) rt 0xc0c2a800 dev 0
[3491]:[akpcm_probe:603]: adc_list:1
[3504]:[akpcm_capture_runtime_init]: capture_runtime pcm(0xc3bf8240) rt 0xc0c2ac00 dev 1
[3521]:[akpcm_loopback_runtime_init]: loopback_runtime pcm(0xc3bf8240) rt 0xc0c2b000
[3538]:[akpcm_probe:672]: successful!
AK MCI Driver Module_init
akmci 20100000.mmc0: akmci_probe : MCI
akmci 20100000.mmc0: host->gpio_cd=41
akmci 20100000.mmc0: gclk = 160000000 Hz. div_l=199, div_h=199
akmci 20100000.mmc0: ios->clock = 400000 Hz. host->bus_clock = 400000 Hz
akmci 20100000.mmc0: Mci0 Interface.using l2dma. detect mode:gpio detect.
akmci 20108000.mmc1: akmci_probe : SDIO
akmci 20108000.mmc1: gclk = 160000000 Hz. div_l=199, div_h=199
akmci 20108000.mmc1: ios->clock = 400000 Hz. host->bus_clock = 400000 Hz
akmci 20100000.mmc0: gclk = 160000000 Hz. div_l=255, div_h=255
akmci 20100000.mmc0: ios->clock = 312500 Hz. host->bus_clock = 312500 Hz
akmci 20108000.mmc1: Mci1 Interface.using l2dma.sdio irq detect mode:plugin alway.
ak_uio: register uio device successfully with irq: 2!
akmci 20108000.mmc1: gclk = 160000000 Hz. div_l=255, div_h=255
akmci 20108000.mmc1: ios->clock = 312500 Hz. host->bus_clock = 312500 Hz
number of ak video subdev: 1
ak_camera_probe 717
ak_camera_probe 725
input: gpiokeys as /devices/platform/gpiokeys/input/input0
card disconnected!
insmod: can't read '/lib/modules/ak_motor.ko': No such file or directory
insmod: can't read '/lib/modules/ak_saradc.ko': No such file or directory
exFAT: file-system version 2.2.0-3arter97
sensor is 2232h
sc2232h_probe Apr 2 2021 16:03:46
i2c i2c-0: sc2232h Probed success, subdev:c0c64814
sensor_sys_init
####connent happen @ 4294937795
usb 1-1: new high-speed USB device number 2 using ak-hshcd
usb 1-1: New USB device found, idVendor=8065, idProduct=6000
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: iComm USB
usb 1-1: Manufacturer: iComm
usb 1-1: SerialNumber: 1234
Bus 001 Device 002: ID 8065:6000
wifi bus ok
wifi is 6x5x
wlan.c initWlan
*** _import_default_cfg, /etc/ssv6x5x-wifi.cfg ***
ssv6xxx_hci_init() start
ssv6xxx_sdio_init
ssv6xxx_usb_init
=======================================
== TURISMO - USB ==
=======================================
SSV6XXX_USB 1-1:1.0: CHIP ID: SSV6006C0
Attach SSV6006 family HWIF HAL function
Chip type a0
Load SSV6006 HWIF HAL HWIF function
ssv6xxx_dev_probe(): SSV6X5X device "SSV6006C" found !
SSV6006C
Attach SSV6006 family HAL function
Load SSV6006 common code
Load SSV6006C/D HAL MAC function
Chip type a0
Load SSV6006 HAL common PHY function
Load SSV6006C/D HAL BB-RF function
SSV WLAN driver SSV6006C: Enable RX(ep4) acc
SSV6XXX HCI TX Task started.
CHIP TAG: 2017071400053011
MAC address from e-fuse
EFUSE configuration
Read efuse chip identity[79000000]
r_calbration_result- 0
sar_result- 0
crystal_frequency_offset- a1
tx_power_index_1- 58
tx_power_index_2- 6
MAC address - 6c:60:eb:ac:de:a6
rate_table_1- 10
rate_table_2- 0
flash_file /tmp/flash.bin not found
str_table =
ssv6006_if_chk_mac2: is not need to check MAC addres 2 for this model
ssv6006_adj_config: clear hci rx aggregation setting
ssv6006_adj_config: clear hci tx aggregation setting
ssv6006_adj_config: not support external PA for this chip
SSV6XXX RX Task started.
ssv6xxx_usb_rx_task: nr_recvbuff=5
wait 0 ms for usb rom code ready
SSV WLAN driver SSV6006C: Disable RX(ep4) acc
SSV WLAN driver SSV6006C: Enable RX(ep4) acc
Using firmware "ssv6x5x-sw.bin".
SSV WLAN driver SSV6006C: Jump to ROM
Firmware version 7620
chan change ch 6, type 1, off_chan 0
INIT SSV CONTROL GENERIC NETLINK MODULE
ieee80211 phy0: SSV6X5X of iComm-semi
usbcore: registered new interface driver SSV6XXX_USB
zram0: detected capacity change from 0 to 8388608
Setting up swapspace version 1, size = 8384512 bytes
UUID=11c00c88-a5fc-410c-9739-d78f65258f03
Adding 8188k swap on /dev/zram0. Priority:-1 extents:1 across:8188k SS
reset jksdk_tcp
exist record folder
can't find sdcard
ipc login: cat: can't open '/mnt/config/record/version.txt': No such file or directory
upgrade file isn't exist
oem_pid.txt is exist
tuya_config.txt is exist
ucheck_mac.txt is exist
no scan upgrade wifi ssid
UUID is exit now !!
don't scan product test ssid
start main procedure
open ttySAK1 .....
fcntl=0
standard input is not a terminal device
set done!
Unfortunately, Iām not thrown into a root shell; Iām met with the same login as telnet. This is good and bad - if I do manage to find the credentials (and theyāre the same for every device) then in theory anyone who can use telnet should be able to root their feeder.
Iām very new to hardware reversing, so if someone who has more experience with this has any suggestions Iām happy to try them out! I think the next step for me is to dump the flash chip, but I donāt have the tools Iād need to do it (yet).
Anyway, I hope this helps to advance the research into this device since having it connected to the cloud makes me uneasy. Iāll update if I find out anything new.
2 Likes
If the new feeders are using MQTT instead of Tuya I wonder if we could just reroute all traffic from the feeder to home asisstant at the router level?
Would be interesting to see if there is a video on how to flash the PLWF105, just to make sure you donāt brick the device on accident. @tmfinnell
Hi @devmattrick
I think when I took this apart I was able to get into the UBoot menu by using RealTerm (I think thatās what it was) to send a ākeystrokeā during boot. IIRC this dropped me into the UBoot menu.
"Hit any key to stop autoboot: 1 "
IIRC you have to spam it pretty dang fast. I donāt remember getting much past that tho
EDIT: This is only a guess but I always wondered if we could dump the partitions to get the IPC login info. Maybe the config partition?
This line was always interesting to me, too.
ipc login: cat: canāt open ā/mnt/config/record/version.txtā
It almost looks like itās trying to cat a file to do the login
1 Like
So, I got another PLAF203 for a new kitten: https://www.amazon.com/dp/B0B5ZJY9M
I think my original one that I gave up trying to break into and just used Tuya Local is also a PLAF203. I donāt know what the difference is between PLAF103
This PLAF203 is different internals than my first. The internal chip is a GOKE GK7205V200, not ANYKA. It also contains a rtl8733bu. Also. itās not Tuya based anymore but instead seems to be MQTT which means my old approach of Tuya Local will not be good enough.
On my newest PLAF203 I can get into the UBOOT menu. I can also get a shell by just attaching to the UART. I think I have the stock firmware, I pulled it out of /user/ota1. I also tried dumping the FW from uboot with tftp but had network issues. I think the GOKE chips and ANYKA chips can be flashed with openipc but I have not tried.
EDIT: You can make the motor spin by echo 0 > /sys/class/gpio/gpio14/value
EDIT2: If anyone hooks up to the serial of the PLAF203 that is Tuya, try logging in with admin and 888888 it might work. Also try vsaas as the username
@tmfinnell @devmattrick Iāve been poking at this feeder, Petlibro plaf203, for about a year now.
There should be a telnet port open on port 21. The username is root and the password is AK2040jk .
So far I have dumped the firmware, have a backup of the file system with all the binaries, and mapped out the boot sequence.
It looks like local tuya can support some of the actions like feeding but still lack the way to access the camera feed.
Since there is no RTSP, my goal is to flash a custom firmware to the device, make an API that supports all the functions of the feeder and expose an camera feed.
Looks like Golang supports armv5, which I believe is the correct architecture. I did see a config file for the camera under /etc/jffs2/venc.cfg.
It also seems like the feeder communicates with the motor and some other functions via the serial connections. You can send some HEX commands and it will trigger 1 feeding.
I plan on opening sourcing my research but still need to clean up somethings.
In the meantime, the telnet login should be good for yāall. You also can run commands by adding a bash script to the root of the SD card named tmp_test.sh. This is I originally gain access to the device. From there I learned the system uses busybox, which has netcat. Using netcat I was able to open a reverse tunnel to my laptop, and grab the password hash.
Anyone interested in developing an local API for this? Helping do some debugging to get the camera feed going?
Sadly there are no open ports on newer models and they moved away from Tuya. On the plus side, the newer models have easy serial access to root. On newer models itās all MQTT. You can actually make it connect to your own broker and get messages, at least briefly. Eventually I think some sort of heartbeat function causes the mqtt to stop working.
I got most of it sorted for the newer models, except I am also stuck on the camera.
I think this is pretty close to what is needed for the current models:
They use a GOKE SoC with a GC2503 āimage sensorā. That project above I think is the general idea of what needs to be done.
I have a full dump of the newer firmware that I am happy to share, but I donāt know if it will be useful for Tuya models.
So I have seen:
- Tuya driven models with ANYKA SoC
- MQTT driven models with GOKE SoC
I have started to reverse engineer the āapplicationā as well, I can share the IDA project file for that if anyone is interested. I have annotated some of the functionality
EDIT: I went ahead and put the firmware here:
GitHub - taylorfinnell/PLAF203-research. This binary is executed when linux boots up.
It:
- Connects to wifi
- Enable all the GPIO stuff
- Handles the camera feed
The PCB of the model that the application is from has PLAF203 v0.8 silkscreened.
I might open the Tuya model back upā¦but I donāt think my cat will like it if I put her food machine back on my work bench 
@drcrow Do you see any āipcā processes in ps on the tuya model?
https://openipc.org/cameras/vendors/anyka
2 Likes