Great work Guys. This was quick and painless (unlike trying to connect my tuya ir controller to home assistant). This just worked without hardly doing anything. I have the “link+ pro Smoke alarms with base station” fs31 base station model SBS50 and 3 Smoke alarms XS01-M. Thanks.
Hello, would it be possible to create a virtual button to activate the smoke detector sirens? I have the gateway and the xs01m *6 detectors. I know this will never happen, but I would like the sirens of all the detectors to be able to activate in the event of a break-in in the house via a home assistant command. Would this be possible? I took this connected model hoping that it would be possible, but I can’t find out how to do it. Thank you all.
Any UK residents deployed these? I’m having a hard time figuring out the model numbers compared to the US based official website.
For example amazon have an MR11 which is the voice alarm combination model and the base station. However MR11 are apparently not compatible with MR31 but to me these look the same just a triple pack.
Thanks
Anyone working on an alternative Firmware for the SBS50 Base station? I had a surplus one and connected a Serial Port TTL adapter to it.
Output looks like this and loops:
ets Jul 29 2019 12:21:46
rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:2
load:0x3fff0018,len:4
load:0x3fff001c,len:948
load:0x40078000,len:11768
load:0x40080400,len:6332
entry 0x400806ac
I (858) psram: This chip is ESP32-D0WD
I (858) spiram: Found 64MBit SPI RAM device
I (858) spiram: SPI RAM mode: flash 40m sram 40m
I (861) spiram: PSRAM initialized, cache is in normal (1-core) mode.
I (868) cpu_start: Pro cpu up.
I (872) cpu_start: Application information:
I (877) cpu_start: Project name: esp-idf
I (881) cpu_start: App version: 202007.00
I (887) cpu_start: Compile time: Oct 16 2024 10:26:23
I (893) cpu_start: ELF file SHA256: 229b335dd86b150a...
I (899) cpu_start: ESP-IDF: v3.3.2-235-ga3ce2f400
I (905) cpu_start: Single core mode
I (909) cpu_start: Feed hardware watchdog
I (1811) spiram: SPI SRAM memory test OK
I (1829) heap_init: Initializing. RAM available for dynamic allocation:
I (1829) heap_init: At 3FFAFF10 len 000000F0 (0 KiB): DRAM
I (1831) heap_init: At 3FFB6388 len 00001C78 (7 KiB): DRAM
I (1837) heap_init: At 3FFB9A20 len 00004108 (16 KiB): DRAM
I (1843) heap_init: At 3FFBDB5C len 00000004 (0 KiB): DRAM
I (1849) heap_init: At 3FFCA190 len 00015E70 (87 KiB): DRAM
I (1856) heap_init: At 3FFE0440 len 0001FBC0 (126 KiB): D/IRAM
I (1862) heap_init: At 40078000 len 00008000 (32 KiB): IRAM
I (1868) heap_init: At 4009D908 len 000026F8 (9 KiB): IRAM
I (1875) cpu_start: Pro cpu start user code
I (1879) spiram: Adding pool of 3962K of external SPI memory to heap allocator
I (223) cpu_start: Starting scheduler on PRO CPU.
I (224) spiram: Reserving pool of 32K of internal memory for DMA/internal allocations
I (834) uart: ALREADY NULL
I (864) PKCS11: Initializing NVS partition: "storage"
E (884) PKCS11: failed nvs get file size 4354 0
I (964) gpio: GPIO[5]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (964) gpio: GPIO[12]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (974) gpio: GPIO[13]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (984) gpio: GPIO[19]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (994) gpio: GPIO[23]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (1734) gpio: GPIO[34]| InputEn: 1| OutputEn: 0| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:3
I (1754) gpio: GPIO[32]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (1754) gpio: GPIO[33]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (1764) gpio: GPIO[14]| InputEn: 1| OutputEn: 0| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:1
I (2024) gpio: GPIO[19]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (2024) gpio: GPIO[18]| InputEn: 1| OutputEn: 0| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (2974) wifi:wifi driver task: 3ffdfd54, prio:23, stack:3584, core=0
I (2974) system_api: Base MAC address is not set, read default base MAC address from BLK0 of EFUSE
I (2974) system_api: Base MAC address is not set, read default base MAC address from BLK0 of EFUSE
I (3124) wifi:wifi firmware version: 1afdae0
I (3124) wifi:config NVS flash: enabled
I (3124) wifi:config nano formating: disabled
I (3124) wifi:Init dynamic tx buffer num: 32
I (3134) wifi:Init data frame dynamic rx buffer num: 32
I (3134) wifi:Init management frame dynamic rx buffer num: 32
I (3144) wifi:Init management short buffer num: 32
I (3144) wifi:Init static tx buffer num: 16
I (3154) wifi:Init static rx buffer size: 1600
I (3154) wifi:Init static rx buffer num: 10
I (3154) wifi:Init dynamic rx buffer num: 32
Chip is an ESP32-WROVER-E
I connected VCC ↔ 3.3 V, RX ↔ TX, TX ↔ RX and GND ↔ GND, Baud-Rate 115200
After updating the Firmware from 1.5.7 to 1.6.0, the console output looks like this
ets Jul 29 2019 12:21:46
rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:2
load:0x3fff0018,len:4
load:0x3fff001c,len:948
load:0x40078000,len:11768
load:0x40080400,len:6332
entry 0x400806ac
I (868) psram: This chip is ESP32-D0WD
I (869) spiram: Found 64MBit SPI RAM device
I (869) spiram: SPI RAM mode: flash 40m sram 40m
I (871) spiram: PSRAM initialized, cache is in normal (1-core) mode.
I (878) cpu_start: Pro cpu up.
I (882) cpu_start: Application information:
I (887) cpu_start: Project name: esp-idf
I (892) cpu_start: App version: 202007.00
I (897) cpu_start: Compile time: Dec 31 2024 18:26:49
I (903) cpu_start: ELF file SHA256: 8af1206959803125...
I (909) cpu_start: ESP-IDF: v3.3.2-235-ga3ce2f400
I (915) cpu_start: Single core mode
I (919) cpu_start: Feed hardware watchdog
I (1821) spiram: SPI SRAM memory test OK
I (1839) heap_init: Initializing. RAM available for dynamic allocation:
I (1839) heap_init: At 3FFAFF10 len 000000F0 (0 KiB): DRAM
I (1841) heap_init: At 3FFB6388 len 00001C78 (7 KiB): DRAM
I (1847) heap_init: At 3FFB9A20 len 00004108 (16 KiB): DRAM
I (1853) heap_init: At 3FFBDB5C len 00000004 (0 KiB): DRAM
I (1859) heap_init: At 3FFCA1A8 len 00015E58 (87 KiB): DRAM
I (1866) heap_init: At 3FFE0440 len 0001FBC0 (126 KiB): D/IRAM
I (1872) heap_init: At 40078000 len 00008000 (32 KiB): IRAM
I (1878) heap_init: At 4009DEE4 len 0000211C (8 KiB): IRAM
I (1885) cpu_start: Pro cpu start user code
I (1889) spiram: Adding pool of 3962K of external SPI memory to heap allocator
I (233) cpu_start: Starting scheduler on PRO CPU.
I (234) spiram: Reserving pool of 32K of internal memory for DMA/internal allocations
I (254) xmc_sr: non-xmc (C84017). SR lock skipped.
I (804) uart: ALREADY NULL
I (834) PKCS11: Initializing NVS partition: "storage"
E (854) PKCS11: failed nvs get file size 4354 0
I (944) gpio: GPIO[5]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (944) gpio: GPIO[12]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (954) gpio: GPIO[13]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
I (964) gpio: GPIO[19]| InputEn: 0| OutputEn: 1| OpenDrain: 0| Pullup: 0| Pulldown: 0| Intr:0
Console output works only, if the USB-C Power is not connected. The Boot-Loop probably only occurs due to the insufficient Power Supply (the 3.3V from the USB TTL Adapter is not enough).
Best regards,
Patrick
I tried it a while back. During the pairing process, it sends the config. If we could inject that one you would not even need a custom firmware … just make it connect to your own MQTT server.
custom data (was printed as ascii in version 202007.00)
I (1197680) Custom Data: 7b 22 6d 73 67 54 79 70 65 22 3a 22 63 66 67 22
is
{"msgType":"cfg"}
{
"msgType":"cfg",
"houseId":"*******A888311FFBB169315501******",
"wifiSsid":"Alice im WLANd",
"wifiPassword":"3575056568641*******",
"validTime":30,
"mqttServer":"eu-central-1.x-sense-iot.com",
"rfBand":868
}
{
"msgType":"regSucc",
"requestId":"16366170**",
"stationSN":"F28013**"
}
I also tried dumping the firmware. Could only read chunks of 1000 byte at a time because it rebooted every second. Even unsoldered the ESP but that did not really help.
Sniffing bluetooth during the paring process also did not work. Seems that this part is encrypted. But I have no clue what I’m doing … so maybe someone else wants to check that.
Another thing I tried was to reverse engineer the 868 MhZ protocol and was able to test a smoke detector. But that seemed like a hack.
Thanks for the hint. I tried to hijack the Hostname in my own DNS-Server (pointed the Hostname eu-central-1.x-sense-iot.com to my local MQTT Server), but I did not receive any MQTT Infos on my local MQTT Server.
After capturing a few Packets on the Firewall and running it through Wireshark, it looks like they indeed use TLS and MQTT on Port 8883.
I might take a look at implementing TLS on my MQTT Broker to see if this gets the SBS50 to talk to my MQTT Broker, but that’s a Topic for another Day.