openbeken

Tuya-Cloudcutter

by
A Tuya IR and RF bridge that has been flashed with new firmware using tuya-cloudconverter

Last year, I wrote about a tool called ‘tuya-convert’ which exploits a vulnerability in ESP-based Tuya devices to install custom firmware such as Tasmota. But not all Tuya devices use ESP chips, and that’s where tuya-cloudcutter comes in.

I have one such device, an ‘S11’ RF and IR bridge (pictured above) that I picked up cheaply from AliExpress last year. Instead of one of Espressif’s ESP chips, it comes with a Beken BK7231N chip. Having disassembled its case, I also didn’t find any obvious pins for the UART bus. So I was relieved to come across tuya-cloudcutter, as it doesn’t require any soldering or disassembly. tuya-cloudcutter should work with any devices that use the BK7231T and BK7231N chips.

Like tuya-convert, tuya-cloudcutter exploits a vulnerability. This was responsibly disclosed to Tuya (the bug bounty was donated to charity), and newer devices are shipped without this vulnerability. However, there’s no firmware update for my S11 device to fix the issue, which is perhaps poor from a security perspective but suits my needs right now.

Running tuya-cloudcutter on a Raspberry Pi

You’ll need to run tuya-cloudcutter on a Linux device, and a Raspberry Pi is perfect for this. Indeed, there’s a detailed tutorial to follow. You’ll need Python, Docker, Git and NetworkManager installed and enabled, and there are a couple of configuration files to edit before you start. Everything is done using a command prompt, so you could do it over SSH using a Windows machine with Putty if you wanted to.

A note: I first tried this on my nine-year-old’s Raspberry Pi 400, and it didn’t work, whereas it did on my Raspberry Pi 4. I believe it was an issue with the specific Wi-Fi adaptor in the Raspberry Pi 400.

You may find that it’s easier to have the device already set up in the Tuya or Smart Life app, as you’ll be able to find the existing firmware version. You’ll need this when running the tuya-cloudcutter tool.

Detaching and flashing

tuya-cloudcutter offers two modes:

  1. Detach – this leaves the Tuya firmware intact on the device, but detaches it from the Tuya cloud. You can then use the LocalTuya or TuyaLocal custom Home Assistant integrations from HACS to control your device, but the official Tuya and Smart Life apps won’t work anymore.
  2. Flash – this also flashes new firmware onto the device.

In terms of firmware choices, by default you get:

  • OpenBeken – a Tasmota-like firmware where you can configure the device
  • ESPHome Kickstart – a minimal version of ESPHome, which can be updated later.

You can also add your own firmware, although be careful as you may brick your device if the firmware isn’t configured correctly.

If you choose to flash new firmware, then when the tool has run correctly, you’ll see a new Wi-Fi network appear for you to connect to. The Hotspot login page should open automatically, but if not, go to http://192.168.4.1/ to proceed. You can then configure the firmware to connect to your Wi-Fi network.

Switching firmware later

For my device, I tried OpenBeken first, but found that it wasn’t able to use the RF capabilities of the device. Instead, I built an ESPHome configuration, using the tuya_rf custom component, and flashed that, using OpenBeken’s OTA firmware updater. Because once you’ve used tuya-cloudcutter to install new firmware on a device, you don’t need to use it again – you can switch from OpenBeken to ESPHome and vice versa quite easily.

Also, if you read yesterday’s post about the Sonoff RF Bridge, no, this RF bridge didn’t work with my doorbell either.

ESP Firmware alternatives

by

Building on last week’s post about flashing smart plugs Tasmota, today I’m going to talk about other custom firmware that you can install on devices with an Espressif ESP chip. Tasmota is the most well-known, but whilst researching how to do the flashing, I’ve come across some others.

Tasmota

Obviously the first one I should mention is Tasmota. It seems to be the most well-used, with active development and lots of features. It’s designed to be used only on ESP32 and ESP8266 boards. Tasmota incidentally is an acronym which stands for Theo-Arends-Sonoff-MQTT-OTA and to this day Theo Arends remains the primary developer.

Recent Tasmota releases have included Matter support, albeit only on ESP32 chips which have more storage than ESP8266.

ESPurna and ESPEasy

I’ve grouped these together, as I found out about them from this blog post by HomeOps which compares them to Tasmota. ESPEasy is actually the oldest, having been around for almost 10 years, but Tasmota and ESPurna both started up around a year later. There’s an update to the blog post which also includes ESPHome, and compares them in a more quantitative way.

Notably, ESPurna only works on ESP8265 and ESP8266 chips, whereas Tasmota and ESPEasy also work on ESP32 chips, such as the one in the m5stack Atom Lite that I turned into a Bluetooth Proxy. Both ESPurna and ESPEasy use MQTT to communicate with other devices.

ESPHome

ESPHome is part of the Open Home Foundation, along with Home Assistant, and as such integrates well with Home Assistant. Unlike the other firmware tools here, ESPHome doesn’t use MQTT by default, although if you build your own firmware with ESPHome then you can add it as an optional extra. Instead, it communicates via Home Assistant’s API. This offers some advantages – it allows Home Assistant to install firmware updates for ESPHome devices. But if you were to switch from Home Assistant to another smart home platform, then you would either need to recompile the ESPHome firmware to add MQTT, or switch to one of the other firmware platforms listed here.

Another thing I’m less keen on about ESPHome is that you use a YAML configuration file to configure devices. I found Tasmota’s web-based interface much more user-friendly.

It’s worth noting that, as well as Espressif chips, ESPHome also works on RealTek RTL8710 and Beken BK7231 series chips too.

OpenMQTTGateway

OpenMQTTGateway is a more specialised firmware designed to make existing non-smart products work over MQTT. It’s best used with BLE (Bluetooth Low Energy), RD, Infrared and old fashioned Serial (RS232) devices. You can buy devices from Theengs which have the OpenMQTTGateway firmware already flashed.

As far as I can tell, OpenMQTTGateway just works on ESP32 chips.

OpenBeken

OpenBeken started out as a way of implementing a Tasmota-like experience on Beken BK7231 chips, but now supports a huge range of chips including ESP32 (but not some other Espressif chips like ESP8826) and RealTek RTL8710. It apparently works in a similar way to Tasmota, but I’ve yet to try it. I have one Tuya device with a BK7231 chip, but I haven’t yet been brave enough to try to flash it. Again, it uses MQTT to communicate with other devices.