Smartap Shower Control: Getting started with reverse engineering a smart home device?

I notice the smartap-tech.com site is no longer active, although still registered, we could try requesting to take over the domain e.g. GoDaddy offer a brokerage service, not sure how likely that would be successful, the domain will be up for renewal next August if it doesn’t auto renew, if we owned the domain we could redirect the traffic although I’m not sure how that would work with the embedded certificate

https://www.godaddy.com/en-uk/domainsearch/find?domainToCheck=smartap-tech.com

As progress seems to have slowed, it might be a good moment to take stock. As I understand it, nobody has managed to extract the firmware apart from @mav1. Without access to the firmware, we don’t have an understanding of whether it’s even feasible to regain control of these devices.

There are probably a few of us here who could try to do something with the firmware once extracted, so I suppose we should try to focus efforts on getting hold of the firmware again. I am (like many others) loth to start doing things to my installed Smartap units that might break them further. Does anyone have a “spare” unit? If not then there’s one on eBay at the moment, but it’s £180.

I suppose the questions are:

  1. Is anybody willing to sacrifice/provide a unit for firmware extraction?
  2. Is anybody willing and able to assist with the process of firmware extraction?
  3. Is anybody willing and able to help with reverse-engineering the code once we have it?
  4. This process is likely to take a moderate amount of time and money. There are significant risks, but I think quite a few would appreciate benefits (i.e. regaining remote access to their SmarTaps). How many of you would be willing to contribute to some sort of crowd-funded vehicle to allow this work to proceed without placing the risks entirely onto whomever volunteers to help?
2 Likes

Hi fellow SmarTap users, I have finally installed one of my two units and I think I got the 3 outlets to work, however I hardly get any water pressure, almost none.

I have good water pressure on every other shower/faucet in the house, apart from the SmarTap connected showers.

I have read an account by a user (another community) who had the same problem, lucky for him, it was while the company was up and running and it seems that remotely they juggled some “algorithms” and the pressure was established.

As anyone else had this problem? If so, how can I solve it? Thank you so much in advance

Hey Gavin, thanks for getting involved :slight_smile:

Totally agree with your sentiment and as you can see from the past posts this was pretty much the path we went down with @mav1. For spare units, realistically I think the only option is procurement, as pretty much everyone here is looking to solve the issue that they have with their currently installed unit, mine included… Although @Akabdm did mention that they have 2 units, one of which is not installed, so might be worth seeing if they are willing to donate temporarily for the purpose of firmware extraction. Of course there is the risk that the device could be bricked…

On point 3, I am willing, for sure! but ‘able’ is debatable, I more than happy to contribute in time and input but I am a hobbyist dev at best, so maybe could help with the softer side, like building the integration into HA, or just helping to co-ordinate efforts, setup a discord, that kinda thing.

As for money, a bunch of us contributed to Mavs buy me a coffee link - and you know where we are with that now lol.

Also, @NickBu and @SunnySide have expressed an interest in helping with this project, and I am sure the OG @vaderag would be keen to see some progress/support. Apologies if I missed anyone off but this is becoming a long thread.

Cheers, G

100% to everything @gmoney said!
I’m no expert but happy to help where I can. This has become especially relevant to me as I finally got a smart washing machine so would love to get the washing machine to pause when someone hops in the shower…
I donated money to @mav1 as well, but he seems to have gone :frowning: Maybe one day he’ll reappear with some extracts or progress

If there is a non-destructive way of pulling things I’d be happy, but I need my shower to work for now!

I’m not an expert in any of this stuff, but I’m wondering if it might be a more realistic solution to replace the circuit board in the main unit with a custom one, maybe based on ESPHome? ultimately it’s a WiFi connection controlling some valves?

If someone knows on this then it could be an idea. The challenge is (at least with my limited knowledge) taking the inputs from the controllers

I use a few esp32 but none to my knowledge have any kind of variance in the input, only on/off - maybe it’s possible but I think that would be the tricky part

It is absolutely possible to replace the electronic controls and I have thought about doing this a few times, the 2 valves for hot and cold are servo motors that can be controlled by a pwm signal that can be generated by an esp32, you may require some other power electronics including a suitable power supply, a solid state relay or maybe a MOSFET transistor, there are also some downsides:

  1. Smartap measures the water flow to prevent overfilling which would be difficult to safeguard against

  2. I don’t think you will be able to integrate the current Smartap outlet buttons and dials so an alternative method would be needed, home assistant would work nicely for this however

  3. I haven’t really looked into this yet but there must be either individual electronic valves or some kind of diverter valve to control the water outlet to use, electronic valves should be easy to connect to the esp32 via a relay

  4. Electrical safety of course

I have good knowledge about this as used to be an electrician and am now a software developer, would be happy to help anyone that wants to attempt it with the design and software advice and I may well attempt this myself at some point because I really want my bath working properly again.

1 Like

Love your thinking here. I have a number of ESP devices lying around unused so would love it if we got to a point that this could work

I think to be realistic, I wouldn’t be able to engage until we had a working prototype that involved the buttons - having the shower out of action while I fiddle would be grounds for divorce!!
But, if we get to a test stage then I’d be very up for trying some things out - I don’t have your experience, but am definitely not out of my depth with basic electronics etc

Same issue here, I have a semi working setup so am not going to attempt it unless I can get hold of a spare unit to modify.

so it seems like the next step would be to get hold of a spare unit and somehow work out what the electrical inputs/outputs are, and then we can see if that can be replicated with off the shelf components.

If that’s right, then there’s a spare unit on ebay right now :wink: What would be involved in working out what inputs/outputs are being sent/received from the current circuitry?

Sorry I have just realised in my above message I should have written stepper motors not servo motors.

Ideally they would have some kind of electrical schematic printed on the side or just the voltage and current ratings of the coils, or a part number we can look it up with.

The electronic valves for the outlet direction should have something similar

Alternatively we can measure the voltage applied to the motor when activate.

Having a physical spare unit would make these significantly easier to do, I have looked inside my unit but it’s very difficult to see any of that without disassembling. I would be happy to split the costs if we wanted to buy it together?

I am also happy to take it apart, work out what would be needed and share that info along with instruction for anyone that can reasonably convince me they aren’t going to electrocute themselves, shouldn’t be to difficult to actually setup because the control unit is quite big compared to an esp32 and a few other parts

Hey all, thanks for the recent resurgence on this project, any progress would be amazing at this point.

I am in the same boat as @vaderag - meaning that my buttons are tiled in and are therefore an MVP aspect of getting this going for my situation. Unfortunately, experimentation on my unit has the potential to leave me in the dog house - if I was on my own I would take the risk, I WFH after all, who needs to shower?

Out of the two options:

  1. Firmware cracking
  2. Hardware hacking with an ESP32

I honestly think that number one is going to be the easiest and most reliable long term. To me it’s analogous to trying to steal a car by breaking in and driving off, or stealing a car by replacing half the engine and ECU and driving off.

No credit to Smartap here as I think they are a bunch of %^$£!*s, but the hardware and how it works with flow rates, temperature readers, valves, solenoids, etc. is immensely complicated. Even going by @Akabdm’s post:

I have read an account by a user (another community) who had the same problem, lucky for him, it was while the company was up and running and it seems that remotely they juggled some “algorithms” and the pressure was established.

That puts fear into my heart as if we had a hardware solution, we would need to account for these mysteries just to get shit going, we have no idea what firmware based hotfixes they may have put in place post production.

If we can get into the firmware and control the unit in a way that the app did (we know the framework/API is there) then we get around all the pitfalls listed above that have a much higher chance of failing, IMO.

But again, not trying to knock the wind out of anyone’s sails here, just playing devil’s advocate and trying to give an alternative viewpoint.

:v:t2:

I agree, my view up until this forum started to go a bit quiet was that reverse engineering the binary was the way to go and it may still will be, you get all the advantages of access to all the sensors and controllers etc however unless that progresses further then the only thing left is to replace the controls, it doesn’t need to be anywhere near as complex as they made it, for my own setup I would simply control the temp with different levels of pwm cutoff to each stepper motor, I would want it as full flow as possible anyway so that’s easier to do. In terms of control this can be done easily with home assistant and some kind of template entities.

I looked at buying a JTAG tool but they are over £100 an I’m not even sure that is the right tool for extracting the binary

Hey everyone, couple of things
Firstly, my valve has started leaking, plumber thinks he might have sorted it, but I’m thinking I might try get a backup, so if anyone sees one please let me know - if I get one then I’d be up for experimenting with some help

All that aside, another thought that crossed my mind… Presumably Masco bought the company for a reason - it may be the technology, so we should keep an eye on other of their brands if they launch a three valve smart system - maybe there’s a (very) small possibility that we could sync with some other system

My shower has lots its config, which means that the extra button will turn the bath on, but it wont stop it.

I thought i maybe able to connect and post the config using postman, but i cant even connect to the WIFI of the smartap. I get it onto yellow (hold button for 5 secs) but no evalve network appears. also ive tried setting up a SmarTap hotspot and also had no luck.

Any ideas why i cant connect to the unit at all? did they release a firmware before selling to disable wifi? or am i missing something?

I saw someone else was having the same issue. is anyone able to still connect to its wifi?

thanks

stuart.

Also went to try and get refund from Victoria plum and got this response.

I need to advise you of below:
On 29 September 2023, Victoria Plum Limited (“the Company”) entered Administration and Samuel James Woodward and Timothy Graham Vance, partners of Ernst & Young LLP, were appointed as Joint Administrators (“Joint Administrators”). The appointment was made at the request of the Company’s Directors by the Qualifying Floating Charge Holder under the provisions of Paragraph 14 of Schedule B1 to the Insolvency Act 1986.
Shortly following their appointment, the Joint Administrators completed a sale of the business and certain assets of the Company to AHK Designs LTD (“the Purchaser”).

If you placed an order which is yet to arrive, unfortunately the Company is not in a position to fulfil your order.
The Company is also unable to accept any returns or provide any refunds on any goods or orders – this includes any orders where you are yet to receive your goods.
The contact details for the administrator is Victoria Plum Limited – in Administration (“the Company”) | EY UK

just my luck

I also have the same issue. And I’ve never been able to resolve it.

I think I’ll have to rip out my shower shortly sadly , as like you use one of the outlets for the bath with a separate control .

Wondering if anyone knows a way to change the default temperature / flow rate while it’s in this non connected state?
My default flow is slightly too high for the water pressure we have so it means the temperature control is erratic until I drop flow a bit :pensive:

Hi All
Has anyone solved this problem yet, new to all this.
my bathroom was fully smart but not now.