Start a new topic

protocol for Sonoff Dual to replace original firmware

With the following information it should be possible to replace the original firmware.


Details from my protocol analyzer (attached to ERX/ETX:


19230,8,N,1


Sampled from pushing the button on the internet

0xA0

0x04

0xxx

0xA1


where 0xxx seems to be:

0x00 both off

0x01 relay one on

0x02 relay two on

0x03 both relays on


2 people have this question

If you push attached buttons, the protocol seems to be the same in the other direction:


Sampled from pushing attached physical buttons:

0xA0

0x04

0xxx

0xA1


where 0xxx seems to be:

0x00 both off

0x01 relay one on

0x02 relay two on

0x03 both relays on


4 people like this

Hello All,

i couldnt flash customized firmware after my first flash to sonoff dual switch, can anyone please help me resolving this issue.



2 people like this

@nobee: I think those headers are not connected to ESP8266 - so it is not possible.


I soldered a thin wire to esp8266 pin4 and 5 directly to get 2 extra inputs/outputs. It requires some precise work but I think this is the only way to get some I/Os.


It would be great if ITEAD would revise this board and add this as default.


2 people like this

Following

0x00 both off

0x01 relay one on

0x02 relay two on

0x03 both relays on


it sems that on my sonoff dual (v2.0):

0x05 relay one on, relay two off

0x06 relay one off, relay two on


Hope this helps someone :)



1 person likes this

It is pin 15:



1 person likes this

Just made a working test sketch:

  

// the setup function runs once when you press reset or power the board
void setup() {
  // initialize digital pin LED_BUILTIN as an output.
  Serial.begin(19200);
}

// the loop function runs over and over again forever
void loop() {

  Serial.write(0xA0);
  Serial.write(0x04);
  Serial.write(0x01); 
  Serial.write(0xA1);
  Serial.flush();
  delay(1000);                       // wait for a second
  Serial.write(0xA0);
  Serial.write(0x04);
  Serial.write(0x03); 
  Serial.write(0xA1);
  Serial.flush();
  delay(1000);                       // wait for a second 
  Serial.write(0xA0);
  Serial.write(0x04);
  Serial.write(0x00); 
  Serial.write(0xA1);
  Serial.flush();
  delay(1000);                       // wait for a second
}

  



1 person likes this

And a simple MQTT sketch:

  

// derived from the Basic MQTT example https://github.com/knolleary/pubsubclient/blob/master/examples/mqtt_basic/mqtt_basic.ino

#include <ESP8266WiFi.h>
#include <PubSubClient.h>

// Update these with values suitable for your network.

const char* ssid = "xxx";
const char* password = "yyy";
const char* mqtt_server = "zzz";

boolean relay1 = false;
boolean relay2 = false;


WiFiClient espClient;
PubSubClient client(espClient);

void setup_wifi() {
  delay(10);
  // We start by connecting to a WiFi network
  //Serial.println();
  //Serial.print("Connecting to ");
  //Serial.println(ssid);

  WiFi.begin(ssid, password);

  while (WiFi.status() != WL_CONNECTED) {
    delay(500);
    //Serial.print(".");
  }

  randomSeed(micros());

  //Serial.println("");
  //Serial.println("WiFi connected");
  //Serial.println("IP address: ");
  //Serial.println(WiFi.localIP());
}

void callback(char* topic, byte* payload, unsigned int length) {
  boolean bset = false;
  payload[length] = '\0';
  String sPayload = String((char *)payload);
  String sTopic = String(topic);
  if (sTopic == "sonoff/1/relay1/set") {
    if (sPayload == "1") {
      if (relay1 == false) bset = true;
      relay1 = true;
    } else {
      if (relay1) bset = true;
      relay1 = false;
    }
  }
  if (sTopic == "sonoff/1/relay2/set") {
    if (sPayload == "1") {
      if (relay2 == false) bset = true;
      relay2 = true;
    } else {
      if (relay2) bset = true;
      relay2 = false;
    }
  }
  if (bset) setrelays();
}

void reconnect() {
  // Loop until we're reconnected
  while (!client.connected()) {
    //Serial.print("Attempting MQTT connection...");
    // Create a random client ID
    String clientId = "sonoff-";
    clientId += String(random(0xffff), HEX);
    // Attempt to connect
    if (client.connect(clientId.c_str())) {
      // Once connected, publish an announcement...
      client.publish("sonoff/1", "connected");
      setrelays();
      // ... and resubscribe
      client.subscribe("sonoff/1/#");
    } else {
      // Wait 5 seconds before retrying
      delay(5000);
    }
  }
}

void setup() {
  Serial.begin(19200);
  setup_wifi();
  client.setServer(mqtt_server, 1883);
  client.setCallback(callback);
  client.loop();
}

void loop() {

  if (!client.connected()) {
    reconnect();
  }
  client.loop();
}

void setrelays() {
  byte b = 0;
  if (relay1) b++;
  if (relay2) b += 2;
  Serial.write(0xA0);
  Serial.write(0x04);
  Serial.write(b);
  Serial.write(0xA1);
  Serial.flush();
  if (relay1) client.publish("sonoff/1/relay1", "1");
  else client.publish("sonoff/1/relay1", "0");
  
  if (relay2) client.publish("sonoff/1/relay2", "1");
  else client.publish("sonoff/1/relay2", "0");
}
 

  


1 person likes this

Is there no way to control ITEAD cloud from PC/Linux/Mac etc?

I don't want to alter my firmware because I have SonOff Pro and want to use RF aswell...

but I want to be able to switch on/off from the PC.


1 person likes this

Markus.

This is encouraging - I've spent the morning tinkering with the Sonoff Dual and want to upload some 8266 Arduino code.


I can see data on the TX/RX pins as per your investigations when buttons are pressed.  


Can I ask how you've uploaded the code above to the board?  Is it through the same header? If so, how did you get into some sort of programming mode  (i.e. GPIO0 low) - had hoped it would be button on front, but doesn't seem to be.


Thanks


Luke.

 

 Hi Markus,


I have used your description to program the Sonoff Dual - thank you very much for this.

I use a Webserver (browser) that sends requests to the Sonoff Dual and reports the action back to the browser. I also use Fhem homeautomation and managed it with help of an experienced programmer to integrate the Dual into Fhem. Switiching of my blinds/shutters from a webbrowser or through Fhem works very well.


The main drawback for me is that I don't have a real response form the Sonoff Dual to Fhem. When I'm not at home I have no chance to see the status of my shutters.

For Fhem, MQTT is also implemented and it works fine together, e.g. with ESPEasy on ESP8266.

My programming knowledge is really limited, and so far I was not able to implement MQTT into my Arduino sketch (see attachment). Could you take a look at my sketch and give me support how to integrate MQTT into it?

The MQTT broker in Fhem homeautomation is protected with user / password. How could this be intergrated into the sketch? E.g., in ESPEasy the Controller IP, Controller Port, Controller User, Controller Password are listed which I use in the MQTT broker.


It would be really great if I can get help from you or any advice how to go forward.

Gisbert

ino
Hi

I have developed generic mqtt software for both the original Sonoff and Sonoff TH series. If Marcel hasn't found anything, maybe this will help.

https://github.com/KmanOz/Sonoff-HomeAssistant

Regards and thanks for the reverse engineering of the the Dual. Saves me some work indeed.

 

Hi,

Just stumbled over your discussion. I have 2 standard sonoff's to try them out.
One connected and configured through the app.
I intend to control them through openHab, but without tinkering with the units. Instead I want to develop 'Binding' for openHab.
You have discovered the protocol for the duals, I assume the protocol should be more or less similar.
The IP Address is known to me but i have not yet found the communication port. Could you provide me with that info?

Regards,
Marcel

 

I did't try to probe any holes, but from what  I see on the PCB those extra pins are not connected anywhere. 

I did a quick photo of my setup, but the lighting was terrible so you cannot see much (red wire is soldered to the leftmost pin of the ESP8255EX chip - corresponds to pin4)

fhdlmo_c-FWxob9rRh7r41M1u5m3IH9NZw.jpg


Thank you so much Matej Klun. I assume that pin 4 is VDD3P3, which means it cant be acted as a analogue sensor. Let me know if I am wrong.


http://espressif.com/sites/default/files/documentation/0a-esp8266ex_datasheet_en.pdf

Maybe I was unclear in previous post. I was talking about GPIOs. So the pin is actualy pin24 but GPIO5 (before I made a mistake and wrote pin4). I hope I did not make to much confusion.

see page 5 of http://espressif.com/sites/default/files/documentation/0a-esp8266ex_datasheet_en.pdf for details.


Login or Signup to post a comment