EMAX-Tuya

EMAX smart power sockets that is based on Tuya and one can buy from e.g. Motonet 95-02136 and the importer homepage is emaxsmarthome

This have now been added to tuya-cloudcutter but the tuya-cloudcutter vulnerability this requires, was patched so one could probably not use this any more!

Result

It is possible to convert to ESPHome with the LibreTiny project, and by that enable the device to only exist on a private LAN without going to the internet. This has been working for years.

Reverse engineering

Opening up the device and a visual inspection of the chip shows this is a WB2S

Serial port 1

This port is used for programming the device and reading out the software with the help of ltchiptool and a basic RT232L USB dongle. The chip info and software version is Get chip info from ltchiptool. Note! It will probably need external power in order to flash new software to it.

Reading out the ROM file can also be done with ltchiptool (I used Windows 11 for this). The dumped-out software can be dissected with bk7231tools

$ bk7231tools dissect_dump -e -O dump_extract_dir original.bin 
RBL containers:
	0x10f9a: bootloader - [encoding_algorithm=NONE, size=0xdd20]
		extracted to dump_extract_dir
	0x129f0a: app - [encoding_algorithm=NONE, size=0xf0200]
		extracted to dump_extract_dir
Storage partition:
	0x1ee000: 32 KiB - 12 keys
	- 'gw_bi'
	- 'user_param_key'
	- 'gw_wsm'
	- 'is_stride'
	- 'gw_di'
	- 'tls_ca_cnt'
	- 'gw_ai'
	- '0000032ccw'
	- 'timer_arr'
	- 'em_sys_env'
	- 'astro_timer'
	- 'mf_test_close'
		extracted all keys to dump_extract_dir/original_storage.json
Storage area `user_param_key`:
	- found! Extracted to dump_extract_dir/original_user_param_key.json

Serial port 2

This port is used as a console port and logs what happens on the device.

Connecting RT232L USB dongle to the chips gives this output tuya.log.

Flashing the device

As there was no EMAX in the list of boards, I added original_storage.json to upk.libretiny.eu to generate a yaml file that one can add to Home Assistant and ESPHome.

Get a yaml file for ESPHome

Found BK7231T config!
Switch/plug config
 - relay 1: pin P24
 - button 1: pin P10
Status LED: pin P26, inverted True
Power monitoring chip BL0937: CF/ELE=P6, CF1/VI=P7, SEL=P8
 - shunt resistor: 1 mΩ

A file made based on inspiration from upk.libretiny.eu: emax.yaml

Download the binary to WB2S

Add a new device in ESPHome (Home Assistant), select the WB2S device, add the yaml file from this repo, and when compiling select to download the u2f file format. Use that file to flash the device over serial port 1. After this you can see the webserver with the values .

Note I got 422.2V where it should be around 240V so either I have some broken shunt resistor or it requires calibration.