Can't integrate TY0A01 - Door Lock

[MUzair030]

I'm using latest version of zigbee2mqtt & followed this guide: https://www.zigbee2mqtt.io/how_tos/how_to_support_new_devices.html and tried many times before posting the req.

Here's the log:

Zigbee2MQTT:info  2020-09-28 16:38:43: MQTT publish: topic 'zigbee2mqtt/bridge/l                                                                             og', payload '{"message":"announce","meta":{"friendly_name":"0xec1bbdfffea147e0"                                                                             },"type":"device_announced"}'
Zigbee2MQTT:debug 2020-09-28 16:38:48: Device '0xec1bbdfffea147e0' announced its                                                                             elf
Zigbee2MQTT:info  2020-09-28 16:38:48: MQTT publish: topic 'zigbee2mqtt/bridge/l                                                                             og', payload '{"message":"announce","meta":{"friendly_name":"0xec1bbdfffea147e0"                                                                             },"type":"device_announced"}'
Zigbee2MQTT:debug 2020-09-28 16:38:53: Received Zigbee message from '0xec1bbdfffea147e0', type 'attributeReport', cluster 'genBasic', data '{"65506":28,"appVersion":88}' from endpoint 1 with groupID 0
Zigbee2MQTT:warn  2020-09-28 16:38:53: Received message from unsupported device with Zigbee model 'TY0A01'
Zigbee2MQTT:warn  2020-09-28 16:38:53: Please see: https://www.zigbee2mqtt.io/how_tos/how_to_support_new_devices.html.
Zigbee2MQTT:debug 2020-09-28 16:38:54: Received Zigbee message from '0xec1bbdfffea147e0', type 'attributeReport', cluster 'genBasic', data '{"65503":"��\u0004'\u0013��\u0004'\u0012\r�\u0004'\u0012"}' from endpoint 1 with groupID 0
Zigbee2MQTT:warn  2020-09-28 16:38:54: Received message from unsupported device with Zigbee model 'TY0A01'
Zigbee2MQTT:warn  2020-09-28 16:38:54: Please see: `https://www.zigbee2mqtt.io/how_tos/how_to_support_new_devices.html.`
Zigbee2MQTT:debug 2020-09-28 16:38:54: Received Zigbee message from '0xec1bbdfffea147e0', type 'read', cluster 'genTime', data '["localTime"]' from endpoint 1 with groupID 0
Zigbee2MQTT:warn  2020-09-28 16:38:54: Received message from unsupported device with Zigbee model 'TY0A01'
Zigbee2MQTT:warn  2020-09-28 16:38:54: Please see: https://www.zigbee2mqtt.io/how_tos/how_to_support_new_devices.html.

I with this and also with different available door locks:

        zigbeeModel: ['TY0A01'],
        model: 'TY0A01',
        vendor: 'Unknown',
        description: 'Chinese Smart Lock',
        supports: 'Lock',
        fromZigbee: [fz.xiaomi_lock_report, fz.ignore_time_read],
        toZigbee: [],
        meta: {configureKey: 1},
        configure: async (device, coordinatorEndpoint) => {
            const endpoint = device.getEndpoint(1);
            const binds = ['genBasic'];
            await bind(endpoint, coordinatorEndpoint, binds);
        },
    },

including:

        fromZigbee: [fz.lock],
        toZigbee: [tz.generic_lock],

but it didn't work! :( Here is my database.db

{"id":2,"type":"Router","ieeeAddr":"0x588e81fffed0dba1","nwkAddr":7853,"manufId":4098,"manufName":"_TZE200_9i9dt8is","powerSource":"Mains (single phase)","m>
{"id":3,"type":"EndDevice","ieeeAddr":"0x00606efffe9563e7","nwkAddr":18933,"manufId":4412,"manufName":"OWON","powerSource":"Battery","modelId":"RC204_4C","e>
{"id":4,"ieeeAddr":"0x00606efffe919e3e","nwkAddr":6867,"epList":[],"endpoints":{},"interviewCompleted":false,"meta":{},"lastSeen":1600770348810}
{"id":5,"ieeeAddr":"0x00606efffe919e3e","nwkAddr":38911,"epList":[],"endpoints":{},"interviewCompleted":false,"meta":{},"lastSeen":1600773616307}
{"id":6,"ieeeAddr":"0x00158d0003a472e7","nwkAddr":59155,"modelId":"lumi.ctrl_86plug.aq1","epList":[1],"endpoints":{"1":{"epId":1,"inClusterList":[],"outClus>
{"id":7,"ieeeAddr":"0xec1bbdfffea1486e","nwkAddr":9519,"epList":[1],"endpoints":{"1":{"epId":1,"inClusterList":[],"outClusterList":[],"clusters":{"genBasic">
{"id":8,"type":"EndDevice","ieeeAddr":"0xec1bbdfffea147e0","nwkAddr":43437,"manufId":0,"manufName":"_TYST12_eyfzd1gi","powerSource":"Battery","modelId":"TY0>
{"id":9,"ieeeAddr":"0x00606efffe919e3e","nwkAddr":784,"epList":[],"endpoints":{},"interviewCompleted":false,"meta":{},"lastSeen":1600928335242}
{"id":10,"type":"EndDevice","ieeeAddr":"0x00158d000396115b","nwkAddr":742,"manufId":4151,"manufName":"LUMI","powerSource":"Battery","modelId":"lumi.sensor_s>
{"id":11,"type":"Router","ieeeAddr":"0x04cf8cdf3c7e157b","nwkAddr":56768,"manufId":4447,"manufName":"LUMI","powerSource":"Mains (single phase)","modelId":"l>
{"id":12,"type":"Coordinator","ieeeAddr":"0x00124b000be891f4","nwkAddr":0,"manufId":0,"epList":[1,2,3,4,5,6,8,11,12,13,47,110,242],"endpoints":{"1":{"profId>
{"id":13,"type":"Router","ieeeAddr":"0x00158d00028bc171","nwkAddr":55719,"manufId":4478,"manufName":"Feibit Co.,LTD","powerSource":"Mains (single phase)","m>

@Koenkk , kindly help or add device support for "TY0A01"

[Koenkk]

TuYa uses non-standard commands, you will need to sniff the traffic with the original gateway and follow https://medium.com/@dzegarra/zigbee2mqtt-how-to-add-support-for-a-new-tuya-based-device-part-2-5492707e882d

[MUzair030]

Hello @Koenkk , I followed the tutorial but its not complete. I made a zigbee sniffer, connected the device with its hub and sniffed the data: i dont know what to do now, How to integrate it with zigbee2mqtt?? Every time i do a single operation on device (i,e. Unlock the door), I receive different Data.. can you plz help?

Waiting for any guidance/tutorial that can help me figure out.

[kvvoff]

@Koenkk @MUzair030 I also bought this door lock (tuya M500). And I was also unable to add its support to z2m. Any tests are welcome, ready to help

My z2m log: Zigbee2MQTT:info 2020-08-18 08:14:07: Successfully interviewed '0x14b457fffe3cb090', device has successfully been paired Zigbee2MQTT:warn 2020-08-18 08:14:07: Device '0x14b457fffe3cb090' with Zigbee model 'TY0A01' is NOT supported, please follow https://www.zigbee2mqtt.io/how_tos/how_to_support_new_devices.html Zigbee2MQTT:info 2020-08-18 08:14:07: MQTT publish: topic 'zigbee2mqtt/bridge/log', payload '{"type":"pairing","message":"interview_successful","meta":{"friendly_name":"0x14b457fffe3cb090","supported":false}}'

[Koenkk]

@MUzair030 I don't have knowledge about TuYa devices, all I know is that they use a custom protocol (which makes integration very hard and time consuming). There are some people which know a lot about integrating TuYa devices (e.g. in #4185). Personally I don't have time to dive deep into the TuYa protocols, so I'm sorry I cannot help further here.

[UzairMushtaq-Hoo]

okay Thank you @Koenkk 👍

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 7 days

[yoprogramo]

Someone had luck on supporting this lock?

[szaman-89]

Hello @Koenkk , I followed the tutorial but its not complete. I made a zigbee sniffer, connected the device with its hub and sniffed the data: i dont know what to do now, How to integrate it with zigbee2mqtt?? Every time i do a single operation on device (i,e. Unlock the door), I receive different Data.. can you plz help?

Waiting for any guidance/tutorial that can help me figure out.

I ended up in the same place. Have no idea how to identify payload structure. Did you moved forward with this?

[rospogrigio]

Hi @MUzair030 and @szaman-89 , I am trying too to sniff the traffic of this device but I cannot get any packet, perhaps you could provide some help? Thank you

[szaman-89]

Hi @MUzair030 and @szaman-89 , I am trying too to sniff the traffic of this device but I cannot get any packet, perhaps you could provide some help? Thank you

Did you pair it with tuya gateway? Did you changed channels to find traffic in wireshark?

[rospogrigio]

Did you pair it with tuya gateway?

what do you mean by "it"? the device or the sniffer? I tried several times to sniff the traffic (both with the Rpi and with Windows), and then re-pair the smart lock with the gateway,

Did you changed channels to find traffic in wireshark?

I tried channels 11 and 12, should I try to use different channels?

[szaman-89]

what do you mean by "it"? the device or the sniffer? I tried several times to sniff the traffic (both with the Rpi and with Windows), and then re-pair the smart lock with the gateway,

I mean pairing lock with tuya gateway.

I tried channels 11 and 12, should I try to use different channels?

Yes, try to start with highest channel and then check lower ones. Chinese gateways usually works on channels 20-25.

[rospogrigio]

I mean pairing lock with tuya gateway.

OK then I already did that.

Yes, try to start with highest channel and then check lower ones. Chinese gateways usually works on channels 20-25.

Ooooh, good to know, did not imagine that. Will try the other channels and see if anything comes out, thank you.

One question: if you use linux, do you see a device in /dev associated to the sniffer? Because I don't, and I don't know if it's a problem...

[szaman-89]

One question: if you use linux, do you see a device in /dev associated to the sniffer? Because I don't, and I don't know if it's a problem...

I don't know. I'm sniffing with wireshark on windows.

[rospogrigio]

OK , and what channels you are using, as a curiosity?

[szaman-89]

OK , and what channels you are using, as a curiosity?

Mine gateway works on channel 20.

[rospogrigio]

@szaman-89 thank you for your help, I tried a lot of channels and finally discovered my device is using channel 15 so I was able to capture both pairing and opening traffic. I'll try to have a look at it and see if I can figure out how it works. Thank you!

[szaman-89]

@szaman-89 thank you for your help, I tried a lot of channels and finally discovered my device is using channel 15 so I was able to capture both pairing and opening traffic. I'll try to have a look at it and see if I can figure out how it works. Thank you!

I'm counting on you :D I have no idea how to interprate payloads.

[rospogrigio]

OK I am at the same point as you guys. We have to figure out what that 16-bytes payload is. It looks encrypted in some way, or maybe just encoded. Will try to ask the manufacturer and see if I can get something... Or maybe it's a sort of handshake with the device, in which they exchange a temporary key. I'll try to investigate more but don't expect too much...

[rospogrigio]

OK I've done some sniffing and this is what I've collected. Please confirm that you see the same with your devices. I see that 5 commands are exchanged between the ZC (the gateway) and the ZED (the smart lock). In the following list, "-->" means from ZC to ZED, and "<--" from ZED to ZC.

1. --> , command id 0x00, sequence number N
2. <-- , command id 0x02, sequence number M
3. <-- , command id 0x02, sequence number M+1
4. <-- , command id 0x23, sequence number M+2
5. --> , command id 0x23, sequence number N+1

Now, each of these commands has a 16-bytes payload which looks somehow encrypted, and changes at each interaction. My impression is that it could be a sort of key-exchange mechanism, in which the lock sends a certain key and it expects the gateway to respond in the correct way in order to unlock successfully. Unfortunately, it is very hard (if not impossible) to determine how this acknowledge works without knowing the involved protocol. Maybe we could ask the manufacturer if he can disclose something but I highly doubt he will. I've ben asking to my manufacturer (which is Airbnk, wonder if yours is the same), but with no luck so far, even if the interaction is still proceeding. If you happen to have any info by your manufacturer or if you have some ideas on how to decrypt this please share them. Bye!

[Faustino-ai]

OK I've done some sniffing and this is what I've collected. Please confirm that you see the same with your devices. I see that 5 commands are exchanged between the ZC (the gateway) and the ZED (the smart lock). In the following list, "-->" means from ZC to ZED, and "<--" from ZED to ZC.

1. --> , command id 0x00, sequence number N
2. <-- , command id 0x02, sequence number M
3. <-- , command id 0x02, sequence number M+1
4. <-- , command id 0x23, sequence number M+2
5. --> , command id 0x23, sequence number N+1

Now, each of these commands has a 16-bytes payload which looks somehow encrypted, and changes at each interaction. My impression is that it could be a sort of key-exchange mechanism, in which the lock sends a certain key and it expects the gateway to respond in the correct way in order to unlock successfully. Unfortunately, it is very hard (if not impossible) to determine how this acknowledge works without knowing the involved protocol. Maybe we could ask the manufacturer if he can disclose something but I highly doubt he will. I've ben asking to my manufacturer (which is Airbnk, wonder if yours is the same), but with no luck so far, even if the interaction is still proceeding. If you happen to have any info by your manufacturer or if you have some ideas on how to decrypt this please share them. Bye!

I am also working on this. One slightly out of topic question though, can you find the 'tuya.dump.txt' which according to the guide: https://www.zigbee2mqtt.io/how_tos/how_to_support_new_tuya_devices.html should be in /data but I couldn't find mine. As for the protocol, you can try creating an account on tuya's site: https://developer.tuya.com/en/ I remember someone found something there but it was for the thermostat. Not sure if it works the same for smart lock since the security level is very different for locks.

[rospogrigio]

I am also working on this. One slightly out of topic question though, can you find the 'tuya.dump.txt' which according to the guide: https://www.zigbee2mqtt.io/how_tos/how_to_support_new_tuya_devices.html should be in /data but I couldn't find mine.

I think you should find it in /opt/zigbee2mqtt/data , but I can't find it either, even though I am not at that point yet.

As for the protocol, you can try creating an account on tuya's site: https://developer.tuya.com/en/ I remember someone found something there but it was for the thermostat. Not sure if it works the same for smart lock since the security level is very different for locks.

Yeah I already have an account but couldn't find anything useful, if you have a specifiv place to search to suggest tell me, thank you.

[Faustino-ai]

I am also working on this. One slightly out of topic question though, can you find the 'tuya.dump.txt' which according to the guide: https://www.zigbee2mqtt.io/how_tos/how_to_support_new_tuya_devices.html should be in /data but I couldn't find mine.

Nope couldn't find it either. I am suspecting the smart lock to work very differently from the other tuya devices (like thermostats and lights) that people worked on here. And I am relatively new in this area as well so I am extremely confused right now.

I think you should find it in /opt/zigbee2mqtt/data , but I can't find it either, even though I am not at that point yet.

As for the protocol, you can try creating an account on tuya's site: https://developer.tuya.com/en/ I remember someone found something there but it was for the thermostat. Not sure if it works the same for smart lock since the security level is very different for locks.

Yeah I already have an account but couldn't find anything useful, if you have a specifiv place to search to suggest tell me, thank you.

Probably nothing useful on that website. I am trying to reach out to the tuya customer service but I am not so sure what to ask them.

[rospogrigio]

I think you can just tell them you would like to operate the device for integration on a third party software, and that you need support and see where the conversation goes.

[Faustino-ai]

I think you can just tell them you would like to operate the device for integration on a third party software, and that you need support and see where the conversation goes.

I remember seeing on some posts that someone actually did that. But their reply was something along the way of its only possible to use with tuya gateway. Anything outside of that they can't disclose. So I guess someone has to come out with a more indirect question

[Faustino-ai]

https://developer.tuya.com/en/docs/iot/smart-product-solution/product-solution-lock/product-solution-lock-zigbee/zigbee-doorlock-function-developer?id=K9fe9esofkzlf I am not sure how useful this is but this is all I can find from the official site. As for outside of this site, there's little to no proper explanation on how it works (at least for a newbie like me).

[rospogrigio]

Yeah, I've read that document dozens of times, and keep looking at it since it's being updated quite regularly. I also asked to the Tuya tech staff because it is unclear what they mean by "The password that is configured by the user on the app" or "The secret key that is created by the Tuya cloud platform". I was answered that my device lacks DPs 48 or 49 and that I should ask the reseller (Airbnk) to have them available (I was expecting with some sort of fw update, but they said it is actually needed to replace the device 😮 ). I have also tried to operate it using Cloud API commands but apparently the only function available to the user is "doorbell_volume". They have also suggested me to try to launch this API command GET /v1.0/devices/{device_id}/door-lock/remote-unlocks, but it returned an empty structure so it means that the function is not available. I finally also asked almost the same questions to the Airbnk support team, and they replied that they would investigate, but now 2 weeks have passed since their last reply, even though I've been asking for a reply. Will keep you posted, my personal need would be to be able (in any way) to lock the door remotely (in case I forgot to do it, it would be also nice to be able to schedule it) since I am frankly shocked that this feature is missing (I don't know if yours is missing it too). Bye!

[Faustino-ai]

Yeah, I've read that document dozens of times, and keep looking at it since it's being updated quite regularly. I also asked to the Tuya tech staff because it is unclear what they mean by "The password that is configured by the user on the app" or "The secret key that is created by the Tuya cloud platform". I was answered that my device lacks DPs 48 or 49 and that I should ask the reseller (Airbnk) to have them available (I was expecting with some sort of fw update, but they said it is actually needed to replace the device 😮 ). I have also tried to operate it using Cloud API commands but apparently the only function available to the user is "doorbell_volume". They have also suggested me to try to launch this API command GET /v1.0/devices/{device_id}/door-lock/remote-unlocks, but it returned an empty structure so it means that the function is not available. I finally also asked almost the same questions to the Airbnk support team, and they replied that they would investigate, but now 2 weeks have passed since their last reply, even though I've been asking for a reply. Will keep you posted, my personal need would be to be able (in any way) to lock the door remotely (in case I forgot to do it, it would be also nice to be able to schedule it) since I am frankly shocked that this feature is missing (I don't know if yours is missing it too). Bye!

Oh wow you're already quite deep into it. Frankly speaking I don't know much but it seems like mine does have the auto lock feature but its the on board function (where it auto locks after 5 - 10 seconds. And yes only within this range) I can't seem to adjust the lock time from the app as well, at least not from my out of the box gateway. My lock is relatively simple, just lock and unlock. I couldn't even change the door password from the native app (not sure if it is the real native app since my door lock is somehow unbranded) but can set temporary password, which would work as of now if I can succesfully implement it using Home Assistant. I will also keep you posted if I found out anything. Somehow the tuya page links to some page that only shows Chinese and I do know Chinese. Unfortunately I am quite new to be able to make use of those information so I will try to study on those and see what I can come up with.

[Faustino-ai]

MCU Integration Protocol for Zigbee Lock_Tuya Smart_Docs Center.pdf @rospogrigio Have you gone through this? I got this by trying to develop a new smart lock from the same website.

[rospogrigio]

MCU Integration Protocol for Zigbee Lock_Tuya Smart_Docs Center.pdf @rospogrigio Have you gone through this? I got this by trying to develop a new smart lock from the same website.

Yeah I think I have gone through everything 😆 . I think that doc is quite useless because it describes the internal communication between the Zigbee module and the hardware, while we would need the protocol for communicating with the Zigbee module. My device also has the auto lock feature but I find it quite useless for my purposes, especially because I bought the smart lock mostly for emergency purposes (if I forgot the keys inside), but would really like to lock the door remotely or at scheduled times (before going to bed for example). As I wrote to the manufacturer, currently both the app and the device are quite basic, compared to the competitors. What is shocking (and I wrote this both to Tuya support and to Airbnk) is that the app allows remote unlocking, but this feature is not available in the cloud API or by setting a DP, but as far as I understood this is because the app is using a different communication channel (and maybe also protocol?). Good to know that you know a bit of Chinese, maybe here you can find something useful: https://developer.tuya.com/en/docs/iot/smart-product-solution/product-solution-lock/product-solution-lock-zigbee/zigbee-doorlock-dp?id=K9fembhbeab0p OK let me know if you find out something, I'll do the same 😉