Day: 9 July 2025

Portisch firmware on a Sonoff RF Bridge

by
A AZDelivery D1 development board that I've used to flash Portisch firmware on a Sonoff RF Bridge

A couple of weeks ago, I wrote about flashing Tasmota firmware onto some old Tuya smart plugs, using a USB to UART converter and some Dupont jumper cables. I also flashed Tasmota onto a Sonoff RF Bridge, which I’d bought to listen to doorbell presses. This meant that the RF Bridge would work with Home Assistant without needing a HACS integration or addon, and wouldn’t need to rely on cloud services to run.

However, inside every Sonoff RF Bridge there are two wolves chips with firmware. There’s an ESP8266 chip, which handles the Wi-Fi side of things, and an OBS38S003 chip which handles RF communication. I have the latest R2 v2.2 model; older ones have a different RF chip.

The default iTead firmware on the RF chip has been locked down to only support a limited number of RF messages. That’s fine if your device is supported, but my doorbell isn’t. So even with Tasmota installed, pressing the button my doorbell didn’t do anything as the RF firmware was programmed to ignore it.

Portisch RF fimrware

The OBS38S003 RF chip can be flashed with ‘Portisch’ firmware, which allows all RF messages to be received and decoded. However, whereas the ESP9266 chip has UART pins that don’t require any soldering to access, the OBS38S003 doesn’t support a UART bus. There are therefore two ways to get around this:

  1. Modify the board using additional soldered cables and cutting some lines on the board
  2. Using another circuit board, flashing firmware onto that, and then using the flashing board to flash the chip.

I went with option 2 – I don’t have a soldering iron to hand, and didn’t want to make a mistake and damage the board beyond repair. Instead, I bought this AZDelivery D1 NodeMCU Wi-Fi Development Board (sponsored link). There are a number of ‘D1’ boards out there – Wemos make the most well-known – but this was £7 and available from Amazon. Ironically this board also contains an ESP8266 chip.

Flashing the development board

To flash the D1 board, I needed to install two things:

  1. The Arduino IDE
  2. Python

I installed both, and then followed the instructions that came with the AZDelivery D1 board to set it up as a board in the Ardunio IDE. Next, I loaded the OnbrightFlasher into the Ardunio IDE and flashed it onto the D1 board. Make sure that use a micro-USB cable that supports both data and charging – a charging-only cable will power the device, but you won’t be able to connect to the D1.

Next, it was time to connect the D1 board to the Sonoff RF board. From here, it’s best to follow this tutorial from the ‘Erasing the MCU (RF chip) on the PCB‘ heading, with the following notes:

  • I only got a garbage response from the ‘handshake’ command until I amended the baud rate to 115200 in the Arduino IDE.
  • When it comes to running the flashScript.py script, open a command prompt first, and then run the script.
  • For the OBS38S003 firmware, there are 4 different firmware versions that you can flash. I had the most luck with the one called ‘portisch_main_OB38S003_BUCKET_SNIFFING_INCLUDED.hex‘.
  • If you haven’t already flashed Tasmota, make sure that you flash the ‘tasmota-sensors’ version rather than plain vanilla Tasmota.
  • If you have ESPHome on your Sonoff RF Bridge (see here for the YAML configuration), rather than Tasmota, you may have more luck with rcswitch_main_OB38S003.hex (I haven’t tried this myself)

Once the firmware is flashed, you can disconnect everything, put your Sonoff RF Bridge back together.

Testing the Portisch firmware

In Tasmota, open the Console and type in ‘rfraw 1‘ and press enter to enable Portisch. Then type ‘rfraw 192‘, and the device should beep. You can then type ‘rfraw 177′ and the Sonoff RF Bridge will go into ‘bucket sniffing’ mode – this will display the various codes being broadcast on the 433 MHz band. There’s more guidance on the Tasmota device page and RF commands section.

So, is my doorbell smart now?

The bad news is that, despite all this work, I haven’t been able to use the RF Bridge to capture my doorbell’s signals to turn them into actions in Home Assistant. The codes being sent by my doorbell seem to rotate, presumably so that only the receivers in my house respond and not someone else’s. And, the 433 MHz channel is also very noisy – there are lots of codes being sent by other devices like a frustrating game of Numberwang.

Basically, if I want to have a smart doorbell, I’m going to need to just buy an actual smart doorbell, aren’t I? At least I have an ESP development board to play with now.