Accéder au contenu principal

HACK of RF WIFI GATEWAY USB STICK

For this new article we will hack a new device; the SMART RF & WIFI GATEWAY or SMART HOME MODEM (difficult to have the real name with this kind of generic product ...)

The shape of the stick and its theoretical abilities attracted me at first time in aliexpress, I was asking myself what kind of microcontroller handle the wifi and RF on this size.

A simple package with a short user manual and the USB Stick.

At the rear a link enable to download an app, but it is not the way I want to go.


If with a screw driver or a knife we open it, we can see a surprise !


It seems to have an ESP on it.

We can see also a buzzer, a button and 2 leds. At the right we see the 433mhz antenna with its decoder.

The part of the uC back that we can see looks like a lot with the back side of an ESP12

.We see also 4 small holes that remind us the kind of programming holes present on the SONOFF devices. Do they enable to flash the chip?

By checking with a multimeter and seeing the pinout we can verify that the first one is connected to GND (black), second one to RX (yellow), third one to TX (orange).
Regarding VCC power we will use a separate power supply through the USB plug.

Once this check done I connected an FTDI following this principle:

  • BOARD GND - FTDI GND
  • BOARD RX - FTDI TX
  • BOARD TX - FTDI RX
Image result for esp12e pinout

I tried to upload many times without success, after rechecking the flashing prerequisites of the ESP12 I saw that GPIO0 must be at connected to ground, and it is not the cas per default of this board.

Let's connect GPIO0 to GND and see what happens


And it is flashed!!

Let's go in deep into this flashing process:
  1. Connect the FTDI to the board and the ground to GPIO0
  2. Connect the FTDI to your computer
  3. Power the board with an external power source through USB
  4. Open your arduino IDE or platformio
  5. With platformio  type the following command:  platformio run --target erase
  6. With the arduino IDE :Erase flash "All flash content"  & DOUT mode
  7. And now you can flash it with OpenMQTTGateway
The board is an ESP8266, here is the configuration used with PIO in the platformio.ini file:

[env:rf-wifi-gateway]
platform = ${com.esp8266_platform}
board = nodemcuv2
lib_deps =
  ${com-esp.lib_deps}
  ${libraries.rc-switch}
  ${libraries.esp8266_mdns}
build_flags = 
  ${com-esp.build_flags}
  '-DZgatewayRF="RF"'
  '-DGateway_Name="OpenMQTTGateway_ESP8266_RF"'
  '-DRF_RECEIVER_PIN=5'
board_build.flash_mode = dout

The RF receiver use the GPIO5, after some test we can see that:
the buzzer is on GPIO15, 
the blue LED on GPIO14
the red LED on GPIO16.

But I didnt found  which pin the button is connected to ...

After some tests of sending RF signals the device doesn't seems to support it.

Indeed I can't see any dedicated circuit for sending.

Nevertheless this ESP8266 board with an integrated RF receiver is quite interesting and fully compatible with OpenMQTTGateway.

Commentaires

Posts les plus consultés de ce blog

433toMQTTto433 - Bidirectional ESP8266 NodeMCU gateway between RF 433Mhz signal and MQTT

The goal  is to act as a gateway between 433Mhz sensors and a MQTT broker or between the MQTT broker and 433Mhz actuators, It enables to:
receive MQTT data from a topic and send RF 433Mhz signal corresponding to the received MQTT data publish MQTT data to a different topic related to received 433Mhz signal 
It can be an interesting part in an home automation system so as to interface sensors and actuators (wall sockets) with software like openhab.

List of compatible sensors here

The interest of putting this gateway to an ESP8266 and not on a raspberry pi is to be able to manage security actions at gateway level (power on a siren, cut power to certain devices) following RF data received by sensors without being dependent to the PI for security related actions.

[EDIT] all infos are now centralized into the github repository take a look at it you will find up to date info about OpenMQTTGateway

You need:

Software:

MosquittoArduino IDE latest version (tested ok with 1.6.10)esp8266 board added to t…

Infrared IR, 433mhz and MQTT on ESP8266 bidirectional gateway OpenMQTTGateway

Following discussions on the home assistant forum people gave me the idea to add Infrared communication to the 433mhz gateway. 

The goal is to act as a gateway between 433Mhz sensors, infrared remote controls and a MQTT broker or between the MQTT broker and 433Mhz actuators, infrared devices, It enables to:
receive MQTT data from a topic and send RF 433Mhz signal corresponding to the received MQTT data publish MQTT data to a different topic related to received 433Mhz signal receive MQTT data from a topic and send infrared signal corresponding to the received MQTT data publish MQTT data to a different topic related to received infrared signal 
It can be an interesting part in an home automation system so as to interface sensors and actuators (wall sockets), your tv, home cinema, hifi ... with software like openhab or home assistant.

List of compatible RF sensors here

[EDIT] all infos are now centralized into the github repository take a look at it you will find up to date info about OpenMQT…

Adding infrared emitter to SONOFF RF BRIDGE

With the add of  SONOFF RF Bridge  to the OpenMQTTGateway compatibility list we were able to send and receive 433mhz by MQTT. 
The interesting thing with OpenMQTTGateway is the ability to have on one board several gateways (RF, IR, BLE and more to come ;-). 

The last versions of SONOFF RF BRIDGE as two IO free pins, why not using these pins to add a new gateway to this little cheap device and control more devices.



If we follow the interest of the different gateways you are more interested on RF and after comes IR infrared.

My choice came in this case to add an infrared emitter to the RF Bridge, with this gateway we are adding the capacity of controlling TV, DVD, hifi...

On the hardware side, I followed the same schematic for IR setup with ESP8266 with just a little add a protection resistor of 1K for the IR led.
The other resistor is connected between the transistor base and IO5 of the RF Bridge instead of D0.
The IR led is powered by the 3,3V of the Sonoff RF Bridge.

The schema:


Here is how i…