AwesomeREA.org

Case study

flipper-telink: replacement firmware for Tuya Zigbee remotes

A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. For Tuya TS0044/TS0046 scene remotes, the notes trace the stock ~500 ms single-click delay to a double-click window; the replacement firmware drops that window while presenting the stock model IDs to Zigbee2MQTT. The latest Zigbee build is marked unverified for pairing, actions and battery reporting.

Requirements and limitations

  • Hardware: a Flipper Zero on Unleashed firmware (the notes name API 87.8; apps built with the official SDK will not load), wired to the target’s SWS pin, ground and 3.3 V. The flasher app builds with ufbt and a project-local SDK; the firmware builds with the Telink Zigbee+BLE SDK in a Docker tc32 toolchain and, once installed, updates over BLE OTA.
  • Inputs are the user’s own devices and their flash dumps. dumps/ publishes sanitized stock images of four devices, with Zigbee network state and Tuya credentials blanked by tools/sanitize_dump.py; raw dumps stay private. Stock firmware rights stay with its vendors, and the repository states no terms for these images.
  • The TS0044/TS0046 notes derive GPIO roles from the factory JSON config and trace a single click through a 300 ms double-click window plus event-queue, debounce and wake overhead, citing code addresses in the dump. Disassembly uses an included TC32 disassembler built from a third-party opcode table; the TS0046 application image is reported byte-identical to the TS0044 one apart from factory data.
  • Replacement firmware v00.14 sends short presses on release and holds after 1 s, identifies as the stock TS0044/TS0046 to Zigbee2MQTT and keeps a BLE service mode for OTA. The progress table records hardware checks for earlier versions; v00.14 was flashed to a TS0046, but pairing, actions and battery reporting in Zigbee2MQTT are marked unverified. The separate ZG-226Z alarm firmware is documented as built but not yet run on hardware. This review ran nothing.
  • The repository has no top-level license. Firmware directories carry a permissive notice for build files taken from pvvx/BZdevice and the Telink SDK’s Apache-2.0 license, and the notes credit pvvx’s SWire work. The README calls the project highly vibe-coded; the author’s post credits a pi agent running GLM-5.3, while the reviewed files name no model and establish no REA connection.

About this entry

Type
Case study
Category
Independent reconstruction cases
Relationship
Independent reconstruction project
Targets
Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. custom_fw/ss6400zb/README.md GitHub · ngxson/flipper-telink · Revision d58aef2
  2. README.md GitHub · ngxson/flipper-telink · Revision d58aef2
  3. AGENTS.md GitHub · ngxson/flipper-telink · Revision d58aef2
  4. custom_fw/ss6400zb/src/buttons.c GitHub · ngxson/flipper-telink · Revision d58aef2
  5. custom_fw/ss6400zb/src/zb_dev.c GitHub · ngxson/flipper-telink · Revision d58aef2
  6. custom_fw/zg226z/DETAILS.md GitHub · ngxson/flipper-telink · Revision d58aef2
  7. tools/sanitize_dump.py GitHub · ngxson/flipper-telink · Revision d58aef2
  8. tools/tc32dis.py GitHub · ngxson/flipper-telink · Revision d58aef2
  9. custom_fw/zg226z/LICENSE.BZdevice GitHub · ngxson/flipper-telink · Revision d58aef2
  10. custom_fw/zg226z/SDK/LICENSE.txt GitHub · ngxson/flipper-telink · Revision d58aef2