Another TY0201 by _TZ3000_bjawzodf with display #107

diggit · 2024-07-12T15:04:25Z

Hi,
I have this Zigbee sensor with display: TY0201 by _TZ3000_bjawzodf

Module: ZTU
Sensor: AHT20 o flex cable
Display driver: BL55072

supplied from DC/DC is boost (3.5 V)

Button GPIO: ZTU B4, when switched pulls B4 to GND through 1k resistor
I2C bus (display driver and sensor):

SDA: ZTU A1
SCL: ZTU A0

SWS is not available on any test point or trace so disassembly is necessary for flashing.

Original FW readout (read out 2 times and it matched) DOES NOT WORK, DO NOT USE!:
TY0201-by-TZ3000_bjawzodf_0x10013001_1M.zip

Photos - click to expand

(On top left, there is also signal bar graph - not connected at photo)

Position of plastic locks. Best way to start opening the case is from the bottom with thin metal shim. Once the first lock opens, continue with plastic prying bar all around.

I assume next steps would:

implement display driver
find segment mapping

I am a bit lazy to setup whole TLSR8 IDE and write pure C code, but I can definitely find out those GPIOs...

The text was updated successfully, but these errors were encountered:

pvvx · 2024-07-13T09:37:34Z

The ZTU module uses a TLSR8258 chip with built-in 1 Megabyte SPI-Flash memory.
BL55072 is used in TH05.

lcd_i2c_addr = 0x3E

 const uint8_t lcd_init_cmd[]	=	{
		// LCD controller initialize:
		0xea, // Set IC Operation(ICSET): Software Reset, Internal oscillator circuit
		0xd8, // Mode Set (MODE SET): Display enable, 1/3 Bias, power saving
		0xbc, // Display control (DISCTL): Power save mode 3, FRAME flip, Power save mode 1
		0x80, // load data pointer
		0xf0, // blink control off,  0xf2 - blink
		0xfc, // All pixel control (APCTL): Normal
		0x60,
		0x00,0x00,000,0x00,0x00,0x00,0x00,0x00,0x00
};

Full analogue in firmware lywsd03mmc HW: B1.9.

To determine the bitmap of the LCD screen, you need to use BLE firmware with settings similar to lywsd03mmc HW: B1.9. There is a special command for working with the screen buffer.
The checksum of the written OTA file in TY0201-by-TZ3000_bjawzodf_0x10013001.bin does not match the current options. Addres 0x1F7F0. This is most likely an outdated version of Telink OTA.

Signature, checksum, Uint32 at address 0x1F7F0 is equal to 0x90EA6C20. Telink utility tl_check_fw2.exe calculates 0x097B7ACB for this file (0...0x1F7F0).

diggit · 2024-07-13T19:37:26Z

1 - updated first post with full 1M dump, I am using TlsrComSwireWriter so it may not be 100% reliable
2 , 3 - thanks, good resources where to start
4 - what is the impact of this?

I'll try to build do some FW experiments later, but first I have to re-check pinout. Those i2c pins don't make sense.

pvvx · 2024-07-14T09:52:32Z

Module: ZTU

1 - updated first post with full 1M dump,

https://developer.tuya.com/en/docs/iot/ztu-module-datasheet?id=Ka45nl4ywgabp

ZTU is embedded with a low-power 32-bit CPU, 1024-KB flash , 64-KB RAM, and rich peripheral resources.

But you have a ZTU module with 512 kilobytes of Flash!
I saw this, but then the ZTU modules did not have an iron shielding case. Cheaper option.

4 - what is the impact of this?

The checksum only indicates that some other SDK was used to build the firmware. Most likely outdated.

Typically Tuya's Zigbee firmware comes with BootLoader. The main program downloaded via OTA is then located at address 0x8000. This affects the fw OTA build type.

ZigbeeTlc and ATC_MiThermometer firmware work with any Flash size. And adapted to the update option with or without Bootloader - during OTA the Bootloader will be removed. If the original firmware had a bootloader, then it will not be possible to restore the flashed thermometer with FW ZigbeeTLc by using the original Zigbee OTA file.

TelinkMiFlasher.html checks the checksum during OTA and will refuse to write such a file. FW during OTA also checks the checksum and will refuse to start this FW OTA.

pvvx · 2024-07-14T10:29:17Z

OTA bin for TelinkMiFlasher.html with adjusted checksum.
TY0201-by-TZ3000_bjawzodf_0x10013001_ota.zip

diggit · 2024-07-14T15:24:12Z

OTA bin for TelinkMiFlasher.html with adjusted checksum.
TY0201-by-TZ3000_bjawzodf_0x10013001_ota.zip

My device has Zigbee FW, so I guess TelinkMiFlasher.html is not usable here.

What does this OTA contain?

It also looks like this one will need some HW modifications too. i2c seems to be on pins which can't be switched to i2c mode if I read datasheet correctly. There is footprint for some similar chip like in ZTH01/ZTH02 have, but not populated. To connect sensor and LCD driver to the normal i2c pins, purple connections would have to be added.

pvvx · 2024-07-14T19:05:34Z

First you need to make BLE firmware.
You can't debug anything in Zigbee.

GPIO	Function
D4	SWM/I2S_SDO/PWM2_N
C1	I2C_SCK/PWM1_N/PWM0/PGA_N0
RST
C4	PWM2/UART_CTS/PWM0_N/sar_aio<8>
B7	SDM_N1/SPI_DO/UART_RX/lc_comp_ain7/sar_aio7
B1	WM4/UART_TX/ATSEL2/lc_comp_ain1/sar_aio1
VCC
GND
B5	SDM_N0/PWM5/lc_comp_ain5/sar_aio5
B4	SDM_P0/PWM4/lc_comp_ain4/sar_aio4
D2	SPI_CN/I2S_LR/PWM3
C3	PWM1/UART_RX/I2C_SCK/XC32K_I/PGA_N1
C2	PWM0/7816_TRX(UART_TX)/I2C_SDA/XC32K_O/PGA_P1
A1	DMIC_CLK/7816_CLK/I2S_CLK
A0	DMIC_DI/PWM0_N/UART_RX
B6	SDM_P1/SPI_DI/UART_RTS/lc_comp_ain<6>/sar_aio<6
PA7	SWS/UART_RTS
C0	I2C_SDA/PWM4_N/UART_RTS/PGA_P0
D7	SPI_CK/I2S_BCK/7816_TRX(UART_TX)
D3	PWM1_N/I2S_SDI/7816_TRX(UART_TX)

I2C_SDA - PC0, PC2
I2C_SCK - PC1, PC3

TheNitek · 2024-12-02T18:31:18Z

I have one of those bricked after a (failed) zigbee2mqtt OTA update. Should a recovery work via https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html using the binary from the first post?

pvvx · 2024-12-03T07:15:22Z

There is 1MB - it takes too long to flash it using such a programmer.
And the MAC address of the device will be the same as diggit.

Try TY0201-by-TZ3000_bjawzodf_0x10013001_ota.bin from the post above first.

selvalt7 · 2024-12-08T12:41:46Z

I can confirm that by bridging pads like in the picture below, results in working temperature functionality.

It also requires modifying firmware to use the correct pin for the button ( B4) and the correct sensor (AHT2X3X).
I didn't bother to add display functionality, so it stays blank.

It also looks like this one will need some HW modifications too. i2c seems to be on pins which can't be switched to i2c mode if I read datasheet correctly. There is footprint for some similar chip like in ZTH01/ZTH02 have, but not populated. To connect sensor and LCD driver to the normal i2c pins, purple connections would have to be added.

pvvx · 2024-12-08T13:26:11Z

Button GPIO: ZTU B4, when switched pulls B4 to GND through 1k resistor I2C bus (display driver and sensor):

SDA: ZTU A1

SCL: ZTU A0

TH03 and LKTMZL02 use soft I2C.
Need to change I2C_SCL_LCD, I2C_SDA_LCD, ....
And create a map of LCD segments.

pvvx · 2024-12-15T13:04:30Z

Flashing the file provided by @diggit into the ZTU module showed that the file does not work!

diggit · 2024-12-15T14:28:43Z

Interesting. I did several matching readouts using uart method and your script, I even fixed one timing issue and backed up and successfully restored other ZTU based sensor this way. (Did not try it with this one though.) Mabe you have different HW or there is some device specific part or dump maY be corrupted as you say.

mechanig · 2024-12-27T21:21:37Z

Hi, @pvvx can you check if the dump I attached is working? This is a dump from a brand new device, made via TlsrComSwireWriter. I have a broken device due to an upgrade from z2m. And I can't get it to work when I deploy this dump.

TY0201_TZ3000_bjawzodf.zip

pvvx · 2024-12-28T01:54:31Z

The firmware checksum does not match tl_check_fw2.exe.
The firmware can be tied to the Flash serial number. This has happened with Zigbee before.

pvvx · 2024-12-28T03:06:05Z

TY0201-by-TZ3000_bjawzodf_0x10013001_ota.zip and TY0201_TZ3000_bjawzodf.zip firmware behave the same.
They output some signal to PA1 and that's it.
Without a real device, nothing else can be verified.
And everyone who has such thermometers is too lazy to make alternative firmware.

ouinouin · 2025-01-07T17:07:09Z

@pvvx I have a bit of time and a lot of those devices to test, i bought some adapters to flash with TB 03F like shown here : https://github.com/doctor64/tuyaZigbee/blob/master/docs/flash.md .
i lack competencies for coding, but i m good at logic analyzers/ scopes , which firmware to flash and what are the steps to find the LCD mapping with this firmware ?

pvvx · 2025-01-08T01:20:00Z

It is necessary to create a new firmware with BLE. Taking into account the PCB layout (used GPIO).
FW BLE has a function to create a map of screen segments and other debugging functionality.
This is not possible on Zigbee.

pvvx mentioned this issue Dec 8, 2024

TY0201 (_TZ3000_bjawzodf) wrong custom firmware submitted Koenkk/zigbee-OTA#620

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Another TY0201 by _TZ3000_bjawzodf with display #107

Another TY0201 by _TZ3000_bjawzodf with display #107

diggit commented Jul 12, 2024 •

edited

Loading

pvvx commented Jul 13, 2024 •

edited

Loading

diggit commented Jul 13, 2024

pvvx commented Jul 14, 2024 •

edited

Loading

pvvx commented Jul 14, 2024

diggit commented Jul 14, 2024

pvvx commented Jul 14, 2024 •

edited

Loading

TheNitek commented Dec 2, 2024

pvvx commented Dec 3, 2024 •

edited

Loading

selvalt7 commented Dec 8, 2024 •

edited

Loading

pvvx commented Dec 8, 2024

pvvx commented Dec 15, 2024 •

edited

Loading

diggit commented Dec 15, 2024 •

edited

Loading

mechanig commented Dec 27, 2024

pvvx commented Dec 28, 2024

pvvx commented Dec 28, 2024 •

edited

Loading

ouinouin commented Jan 7, 2025

pvvx commented Jan 8, 2025

Another TY0201 by _TZ3000_bjawzodf with display #107

Another TY0201 by _TZ3000_bjawzodf with display #107

Comments

diggit commented Jul 12, 2024 • edited Loading

pvvx commented Jul 13, 2024 • edited Loading

diggit commented Jul 13, 2024

pvvx commented Jul 14, 2024 • edited Loading

pvvx commented Jul 14, 2024

diggit commented Jul 14, 2024

pvvx commented Jul 14, 2024 • edited Loading

TheNitek commented Dec 2, 2024

pvvx commented Dec 3, 2024 • edited Loading

selvalt7 commented Dec 8, 2024 • edited Loading

pvvx commented Dec 8, 2024

pvvx commented Dec 15, 2024 • edited Loading

diggit commented Dec 15, 2024 • edited Loading

mechanig commented Dec 27, 2024

pvvx commented Dec 28, 2024

pvvx commented Dec 28, 2024 • edited Loading

ouinouin commented Jan 7, 2025

pvvx commented Jan 8, 2025

diggit commented Jul 12, 2024 •

edited

Loading

pvvx commented Jul 13, 2024 •

edited

Loading

pvvx commented Jul 14, 2024 •

edited

Loading

pvvx commented Jul 14, 2024 •

edited

Loading

pvvx commented Dec 3, 2024 •

edited

Loading

selvalt7 commented Dec 8, 2024 •

edited

Loading

pvvx commented Dec 15, 2024 •

edited

Loading

diggit commented Dec 15, 2024 •

edited

Loading

pvvx commented Dec 28, 2024 •

edited

Loading