├── .github ├── ISSUE_TEMPLATE │ ├── bug_report.md │ └── documentation_issue.md ├── config.yml └── workflows │ └── pre-commit.yml ├── .gitignore ├── .pre-commit-config.yaml ├── 0-Hardware ├── README.md ├── datasheet │ ├── GD25Q127C_datasheet.pdf │ ├── H16107DF-FPE.pdf │ ├── RTL8196E-CG-datasheet.PDF │ └── Tuya TYZS4 datasheet.pdf └── media │ └── image1.png ├── 1-Firmwares ├── 10-EZSP-Reference │ └── README.md ├── 11-Simplicity-Studio │ └── README.md ├── 12-Backup-Flash-Restore │ ├── README.md │ └── media │ │ └── image1.png ├── 13-Bootloader-UART-Xmodem │ ├── README.md │ ├── bootloader_fw │ │ ├── TYZS4_bootloader-uart-xmodem.hex │ │ └── TYZS4_bootloader-uart-xmodem.s37 │ └── media │ │ ├── image1.png │ │ ├── image2.png │ │ ├── image3.png │ │ ├── image4.png │ │ ├── image5.png │ │ ├── image6.png │ │ ├── image7.png │ │ ├── image8.png │ │ └── image9.png ├── 14-NCP-UART-HW │ ├── README.md │ ├── firmware │ │ ├── flash_ezsp13.sh │ │ ├── flash_ezsp7.sh │ │ ├── flash_ezsp8.sh │ │ ├── ncp-uart-hw-7.4.5.gbl │ │ ├── ncp-uart-hw-7.5.0-btlhw.gbl │ │ ├── ncp-uart-hw-7.5.0.gbl │ │ └── sx │ └── media │ │ ├── image1.png │ │ ├── image10.png │ │ ├── image11.png │ │ ├── image12.png │ │ ├── image13.png │ │ ├── image14.png │ │ ├── image15.png │ │ ├── image2.png │ │ ├── image3.png │ │ ├── image4.png │ │ ├── image5.png │ │ ├── image6.png │ │ ├── image7.png │ │ ├── image8.png │ │ └── image9.png ├── 15-RCP-UART-HW │ ├── README.md │ ├── firmware │ │ └── rcp-uart-802154.gbl │ └── media │ │ ├── image1.png │ │ ├── image10.png │ │ ├── image11.png │ │ ├── image12.png │ │ ├── image13.png │ │ ├── image14.png │ │ ├── image2.png │ │ ├── image3.png │ │ ├── image4.png │ │ ├── image5.png │ │ ├── image6.png │ │ ├── image7.png │ │ ├── image8.png │ │ └── image9.png └── README.md ├── 2-Softwares ├── 20-Backup-Restore │ ├── README.md │ ├── media │ │ └── image1.jpeg │ └── scripts │ │ ├── backup_mtd_via_ssh.sh │ │ └── restore_mtd_via_ssh.sh ├── 21-Linux_Kernel │ └── README.md ├── 22-Update the Root Filesystem │ ├── README.md │ ├── media │ │ └── image1.jpeg │ ├── newroot.bin │ └── userdata.tar ├── 23-Create the Root Filesystem │ ├── README.md │ └── source_rootfs.tar.gz ├── 24-RCP-Daemons │ ├── 241-cpcd │ │ └── README.md │ ├── 242-zigbeed │ │ ├── README.md │ │ ├── media │ │ │ ├── image1.png │ │ │ ├── image2.png │ │ │ ├── image3.png │ │ │ └── image4.png │ │ └── source │ │ │ ├── zigbeed_ARM32.zip │ │ │ ├── zigbeed_ARM64.zip │ │ │ └── zigbeed_x86_64.zip │ └── README.md └── README.md ├── LICENSE └── README.md /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: 🐛 Bug Report 3 | about: Report a reproducible issue with the gateway or firmware 4 | title: "[BUG] " 5 | labels: bug 6 | assignees: '' 7 | 8 | --- 9 | 10 | ## Describe the bug 11 | 12 | A clear and concise description of what the bug is. 13 | 14 | ## To Reproduce 15 | 16 | Steps to reproduce the behavior: 17 | 1. Go to '...' 18 | 2. Flash '...' 19 | 3. Run '...' 20 | 4. See error 21 | 22 | ## Expected behavior 23 | 24 | What should have happened instead? 25 | 26 | ## Screenshots / Logs 27 | 28 | If applicable, add logs or screenshots to help explain your problem. 29 | 30 | ## Environment 31 | 32 | - Gateway Model: 33 | - Firmware version: 34 | - Zigbee stack (EZSP version, RCP, etc.): 35 | - Host software (Z2M, ZHA, ...): 36 | - OS / Toolchain / Simplicity Studio version: 37 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/documentation_issue.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: 📝 Documentation Issue 3 | about: Report incorrect, outdated or unclear information in the documentation 4 | title: "[DOC] " 5 | labels: documentation 6 | assignees: '' 7 | 8 | --- 9 | 10 | ## Describe the issue 11 | 12 | Which part of the documentation is incorrect, outdated or unclear? 13 | 14 | ## Location 15 | 16 | - File/section: (e.g. `1-Firmwares/14-NCP-UART-HW/README.md`) 17 | - Line number or heading (if possible): 18 | 19 | ## Suggested improvement 20 | 21 | (Optional) What would make this clearer or more accurate? 22 | 23 | ## Additional context 24 | 25 | Screenshots, references, or any extra notes that help illustrate the problem. 26 | -------------------------------------------------------------------------------- /.github/config.yml: -------------------------------------------------------------------------------- 1 | blank_issues_enabled: false 2 | contact_links: 3 | - name: 💬 Ask a question or get help 4 | url: https://github.com/jnilo1/silvercrest-gateway-hacking/discussions 5 | about: Please use GitHub Discussions for usage questions or support requests. 6 | -------------------------------------------------------------------------------- /.github/workflows/pre-commit.yml: -------------------------------------------------------------------------------- 1 | name: pre-commit 2 | on: 3 | pull_request: 4 | push: 5 | jobs: 6 | pre-commit: 7 | runs-on: ubuntu-latest 8 | env: 9 | RAW_LOG: pre-commit.log 10 | CS_XML: pre-commit.xml 11 | steps: 12 | - run: sudo apt-get update && sudo apt-get install cppcheck uncrustify 13 | if: false 14 | - uses: actions/checkout@v4 15 | - run: python -m pip install pre-commit 16 | - uses: actions/cache/restore@v4 17 | with: 18 | path: ~/.cache/pre-commit/ 19 | key: pre-commit-4|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }} 20 | - name: Run pre-commit hooks 21 | run: echo "Pre-commit temporarily disabled" 22 | - name: Convert Raw Log to Checkstyle format (launch action) 23 | uses: mdeweerd/logToCheckStyle@v2025.1.1 24 | if: ${{ failure() }} 25 | with: 26 | in: ${{ env.RAW_LOG }} 27 | - uses: actions/cache/save@v4 28 | if: ${{ ! cancelled() }} 29 | with: 30 | path: ~/.cache/pre-commit/ 31 | key: pre-commit-4|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }} 32 | - name: Provide log as artifact 33 | uses: actions/upload-artifact@v4 34 | if: ${{ ! cancelled() }} 35 | with: 36 | name: precommit-logs 37 | path: | 38 | ${{ env.RAW_LOG }} 39 | ${{ env.CS_XML }} 40 | retention-days: 2 41 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.docx 2 | *.bat 3 | node_modules/ 4 | -------------------------------------------------------------------------------- /.pre-commit-config.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | files: ^(.*\.(py|json|md|sh|yaml|yml|cfg|txt))$ 3 | exclude: ^(\.[^/]*cache/.*|demo/.*|debug/.*|.github/ISSUE_TEMPLATE)$ 4 | repos: 5 | - repo: https://github.com/executablebooks/mdformat 6 | # Do this before other tools "fixing" the line endings 7 | rev: 0.7.22 8 | hooks: 9 | - id: mdformat 10 | name: Format Markdown 11 | entry: mdformat # Executable to run, with fixed options 12 | language: python 13 | types: [markdown] 14 | exclude: ^(\.github/ISSUE_TEMPLATE.*)$ 15 | args: [--wrap, "75", --number] 16 | additional_dependencies: 17 | - mdformat-toc 18 | - mdformat-beautysh 19 | - mdformat-config 20 | - mdformat-gfm 21 | - setuptools 22 | - repo: https://github.com/pre-commit/pre-commit-hooks 23 | rev: v5.0.0 24 | hooks: 25 | - id: no-commit-to-branch 26 | args: [--branch, main] 27 | - id: check-yaml 28 | # Exclude because of bug in checker 29 | exclude: ^(docker-compose\.yml|.*/release-drafter\.yml)$ 30 | - id: debug-statements 31 | - id: end-of-file-fixer 32 | - id: trailing-whitespace 33 | - id: check-json 34 | - id: mixed-line-ending 35 | - id: check-builtin-literals 36 | - id: check-ast 37 | - id: check-merge-conflict 38 | - id: check-executables-have-shebangs 39 | - id: check-shebang-scripts-are-executable 40 | - id: check-docstring-first 41 | - id: fix-byte-order-marker 42 | - id: check-case-conflict 43 | - id: pretty-format-json 44 | exclude: ^(\.vscode|\.devcontainer) 45 | args: 46 | # order of keys in manifest.json is "special" 47 | - --no-sort-keys 48 | - repo: https://github.com/pre-commit/mirrors-prettier 49 | rev: v4.0.0-alpha.8 50 | hooks: 51 | - id: prettier 52 | exclude: ^(.*\.md)$ 53 | - repo: https://github.com/adrienverge/yamllint.git 54 | rev: v1.37.0 55 | hooks: 56 | - id: yamllint 57 | args: 58 | - --no-warnings 59 | - -d 60 | - "{extends: relaxed, rules: {line-length: {max: 90}}}" 61 | - repo: https://github.com/asottile/pyupgrade 62 | rev: v3.19.1 63 | hooks: 64 | - id: pyupgrade 65 | - repo: https://github.com/psf/black 66 | rev: 25.1.0 67 | hooks: 68 | - id: black 69 | args: 70 | - --safe 71 | - --quiet 72 | - -l 79 73 | - repo: https://github.com/Lucas-C/pre-commit-hooks-bandit 74 | rev: v1.0.6 75 | hooks: 76 | - id: python-bandit-vulnerability-check 77 | args: [--skip, "B105,B110,B311,B404,B603", --recursive, apps] 78 | - repo: https://github.com/fsouza/autoflake8 79 | rev: v0.4.1 80 | hooks: 81 | - id: autoflake8 82 | args: 83 | - -i 84 | - -r 85 | - --expand-star-imports 86 | - . 87 | - repo: https://github.com/PyCQA/flake8 88 | rev: 7.2.0 89 | hooks: 90 | - id: flake8 91 | additional_dependencies: 92 | - pyproject-flake8>=0.0.1a2 93 | - flake8-bugbear>=22.1.11 94 | - flake8-comprehensions>=3.8.0 95 | - flake8_2020>=1.6.1 96 | - mccabe 97 | - pycodestyle>=2.10.0 98 | - pyflakes>=2.4.0 99 | - repo: https://github.com/PyCQA/isort 100 | rev: 6.0.1 101 | hooks: 102 | - id: isort 103 | - repo: https://github.com/codespell-project/codespell 104 | rev: v2.4.1 105 | hooks: 106 | - id: codespell 107 | args: [-Ldout] 108 | - repo: https://github.com/pylint-dev/pylint 109 | rev: v3.3.6 110 | hooks: 111 | - id: pylint 112 | # exclude: ^$ 113 | args: 114 | - --reports=no 115 | - repo: https://github.com/pre-commit/mirrors-mypy 116 | rev: v1.15.0 117 | hooks: 118 | - id: mypy 119 | args: 120 | - --ignore-missing-imports 121 | - --install-types 122 | - --non-interactive 123 | - --check-untyped-defs 124 | - --show-error-codes 125 | - --show-error-context 126 | #additional_dependencies: 127 | # - types-requests 128 | # - urllib3 129 | - repo: https://github.com/lovesegfault/beautysh.git 130 | rev: v6.2.1 131 | hooks: 132 | - id: beautysh 133 | exclude: (run.sh)$ 134 | additional_dependencies: 135 | - setuptools 136 | - repo: https://github.com/shellcheck-py/shellcheck-py 137 | rev: v0.10.0.1 138 | hooks: 139 | - id: shellcheck 140 | files: ^[^\.].*\.sh$ 141 | args: [--shell, bash] 142 | -------------------------------------------------------------------------------- /0-Hardware/README.md: -------------------------------------------------------------------------------- 1 | # Lidl / Silvercrest Zigbee Gateway — Hardware Overview 2 | 3 | This section provides a detailed breakdown of the Lidl Silvercrest Zigbee 4 | gateway's hardware. It includes component identification, debug interface 5 | pinout, and serial specifications to help you understand and repurpose the 6 | device. 7 | 8 | ______________________________________________________________________ 9 | 10 | ## 🧱 Physical Construction 11 | 12 | - Screwless case held by 8 plastic clips evenly distributed along the edges 13 | - Clips require careful prying to open the lid 14 | - Single PCB housing all components 15 | 16 | ______________________________________________________________________ 17 | 18 | ## 📸 Main PCB Overview 19 | 20 |

21 | Lidl gateway board 22 |

23 | 24 | ______________________________________________________________________ 25 | 26 | ## 🔩 Main Components 27 | 28 | ### 1. Main Processor (U2) — _Red Box_ 29 | 30 | - **SoC**: 31 | [Realtek RTL8196E](https://www.alldatasheet.com/datasheet-pdf/pdf/1315416/REALTEK/RTL8196E-CG.html) 32 | - 32-bit Lexra RLX4181 core (MIPS32-compatible, big-endian) 33 | - Lacks unaligned memory access; uses MIPS16e compressed instructions 34 | - Runs at 400 MHz 35 | - Embedded Ethernet switch with 3 logical interfaces: `eth0`, `eth1`, and 36 | `peth0` (virtual) 37 | - Serial: two 16550A-compatible UARTs at MMIO addresses `0x18002000` and 38 | `0x18002100` 39 | - SPI controller used to access external NOR flash 40 | 41 | ### 2. Flash Memory (U3) — _Green Box_ 42 | 43 | - 16MB SPI NOR Flash 44 | ([GD25Q127](https://www.alldatasheet.com/datasheet-pdf/pdf/1151509/GIGADEVICE/GD25Q127C.html)) 45 | - 64KB erase blocks 46 | - Stores bootloader, Linux kernel, SquashFS rootfs, and JFFS2 persistent 47 | data 48 | 49 | ### 3. RAM (U5) — _Purple Box_ 50 | 51 | - 32MB SDRAM 52 | ([ESMT M13S2561616A](https://www.alldatasheet.com/datasheet-pdf/pdf/302727/ESMT/M13S2561616A.html)) 53 | or equivalent 54 | 55 | ### 4. Zigbee Module (CN1) — _Yellow Box_ 56 | 57 | - [Tuya TYZS4](https://developer.tuya.com/en/docs/iot/zigbeetyzs4module?id=K989rhycrz23f) 58 | - Based on Silicon Labs 59 | [EFR32MG1B232F256GM48](https://www.silabs.com/wireless/zigbee/efr32mg1-series-1-socs/device.efr32mg1b232f256gm48) 60 | - ARM Cortex-M4 core with integrated Zigbee stack 61 | - Connected to RTL8196E via UART1 62 | - Hosts the Zigbee firmware (typically NCP/UART) 63 | 64 | ### 5. Debug/Programming Interface (J1) — _Cyan Box_ 65 | 66 | - Combined serial + SWD debug port 67 | - Not populated by default (2.54mm header needed) 68 | - Pinout: 69 | ``` 70 | Pin 1: 3.3V VCC (bottom) 71 | Pin 2: Ground 72 | Pin 3: U2 Serial TX 73 | Pin 4: U2 Serial RX 74 | Pin 5: Zigbee module SWDIO 75 | Pin 6: Zigbee module SWCLK 76 | ``` 77 | 78 | ______________________________________________________________________ 79 | 80 | ## 🔌 Serial Port Specifications 81 | 82 | - Logic level: TTL 3.3V 83 | - Baud rate: 38400 bps 84 | - Configuration: 8 data bits, no parity, 1 stop bit (8N1) 85 | 86 | ______________________________________________________________________ 87 | 88 | ## 🧩 Additional Components 89 | 90 | - Ethernet magnetics 91 | - Status LEDs: 92 | - Ethernet activity 93 | - Zigbee communication 94 | - Clearly labeled test points on PCB (Side B) 95 | - Supporting discrete components (caps, resistors, etc.) 96 | 97 | ______________________________________________________________________ 98 | 99 | ## 🧠 Design Summary 100 | 101 | - Clean, well-structured single-board design 102 | - Minimalist layout with clearly separated domains (SoC / Zigbee) 103 | - Accessible debug interface and test points for hardware hacking 104 | - Suitable for firmware customization and hardware-based reverse 105 | engineering 106 | -------------------------------------------------------------------------------- /0-Hardware/datasheet/GD25Q127C_datasheet.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/0-Hardware/datasheet/GD25Q127C_datasheet.pdf -------------------------------------------------------------------------------- /0-Hardware/datasheet/H16107DF-FPE.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/0-Hardware/datasheet/H16107DF-FPE.pdf -------------------------------------------------------------------------------- /0-Hardware/datasheet/RTL8196E-CG-datasheet.PDF: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/0-Hardware/datasheet/RTL8196E-CG-datasheet.PDF -------------------------------------------------------------------------------- /0-Hardware/datasheet/Tuya TYZS4 datasheet.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/0-Hardware/datasheet/Tuya TYZS4 datasheet.pdf -------------------------------------------------------------------------------- /0-Hardware/media/image1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/0-Hardware/media/image1.png -------------------------------------------------------------------------------- /1-Firmwares/10-EZSP-Reference/README.md: -------------------------------------------------------------------------------- 1 | # EmberZNet and EZSP Reference 2 | 3 | This page clarifies the differences between various firmware modes (NCP, 4 | RCP), the role of EmberZNet, and the meaning of EZSP versions — common 5 | sources of confusion when flashing or configuring Zigbee firmware. 6 | 7 | ______________________________________________________________________ 8 | 9 | ## 🧠 What is EmberZNet? 10 | 11 | **EmberZNet** is Silicon Labs’ official Zigbee stack. It provides: 12 | 13 | - [IEEE 802.15.4](https://en.wikipedia.org/wiki/IEEE_802.15.4) 14 | [MAC](https://en.wikipedia.org/wiki/IEEE_802.15.4#The_MAC_layer) and 15 | [PHY](https://en.wikipedia.org/wiki/IEEE_802.15.4#The_physical_layer) 16 | - Zigbee Network layer (routing, addressing) 17 | - Zigbee Application layer (clusters, ZCL) 18 | - Security and commissioning logic 19 | 20 | It can run in multiple modes: 21 | 22 | ### ✅ SoC Mode 23 | 24 | - Full Zigbee stack **and** application run on the EFR32 chip. 25 | - No external host required. 26 | 27 | ### ✅ NCP Mode (Network Co-Processor) 28 | 29 | - The Zigbee stack runs on the EFR32. 30 | - An external Linux host communicates via **EZSP** protocol over UART. 31 | 32 | ### ✅ RCP Mode (Radio Co-Processor) 33 | 34 | - Only PHY and MAC run on the EFR32. 35 | - The Zigbee or Thread stack runs on the Linux host. 36 | - Requires CPC daemon (`cpcd`) on host. 37 | 38 | ______________________________________________________________________ 39 | 40 | ## 🔌 What is EZSP? 41 | 42 | EZSP = **Ember Zigbee Serial Protocol** 43 | 44 | It is a **binary protocol** developed by Silicon Labs to control a Zigbee 45 | NCP over a serial link. 46 | 47 | The Linux host communicates with the NCP using EZSP commands for: 48 | 49 | - Forming/joining a Zigbee network 50 | - Sending/receiving messages 51 | - Managing clusters, endpoints 52 | - Security, stack control 53 | 54 | ______________________________________________________________________ 55 | 56 | ## 🧾 EZSP Versions 57 | 58 | | EmberZNet Version | EZSP Version | Notes | 59 | | ----------------- | ------------ | ---------------------------------------------- | 60 | | 6.5.x.x | V7 | Found in original Lidl firmware | 61 | | 6.7.x.x | V8 | Used in Paul Banks’ project | 62 | | 7.4.x.x | V13 | Compatible with `ember` adapter in Z2M and ZHA | 63 | 64 | ______________________________________________________________________ 65 | 66 | ## 🧩 Compatibility with Zigbee2MQTT and ZHA 67 | 68 | ### Zigbee2MQTT 69 | 70 | | EZSP Version | Z2M Adapter | 71 | | ------------ | --------------------- | 72 | | V7/V8 | `ezsp` (deprecated) | 73 | | V13+ | `ember` (recommended) | 74 | 75 | ```yaml 76 | # Zigbee2MQTT example 77 | serial: 78 | port: tcp://192.168.1.x:8888 79 | adapter: ember 80 | ``` 81 | 82 | ### Home Assistant (ZHA) 83 | 84 | ZHA supports all EZSP versions but recommends EZSP V13+ for recent stacks. 85 | 86 | ______________________________________________________________________ 87 | 88 | ## 📦 Available Firmware Versions 89 | 90 | - 🔸 **EZSP V8**:\ 91 | Used to update [Paul Banks](https://paulbanks.org/projects/lidl-zigbee/) 92 | hack with a firmware provided by Gary Robas: 93 | [Download .gbl](https://github.com/grobasoz/zigbee-firmware/raw/master/EFR32%20Series%201/EFR32MG1B-256k/NCP/NCP_UHW_MG1B232_678_PA0-PA1-PB11_PA5-PA4.gbl) 94 | 95 | - 🔸 **EZSP V13**:\ 96 | Built from Simplicity Studio Gecko SDK 4.4.x, they provide the most 97 | recent EMberZNet 7.4.x versions available at the time of this writing. 98 | See [NCP-UART-HW section](../14-NCP-UART-HW/firmware) 99 | 100 | ______________________________________________________________________ 101 | 102 | ## 🛑 Important Notes 103 | 104 | - EZSP is **not compatible** with RCP firmwares (use CPC instead). 105 | - Z2M is phasing out support for `ezsp` adapter; prefer `ember`. 106 | - The firmware must match the **hardware pinout** (PA0/PA1/etc.). 107 | 108 | ______________________________________________________________________ 109 | 110 | ## 📚 References 111 | 112 | - [Silicon Labs EZSP Protocol Guide](https://www.silabs.com/documents/public/user-guides/ug100-ezsp-reference-guide.pdf) 113 | - [EmberZNet SDK documentation](https://docs.silabs.com/zigbee/latest/) 114 | - [Zigbee2MQTT EZSP support](https://www.zigbee2mqtt.io/guide/adapters/emberznet.html) 115 | -------------------------------------------------------------------------------- /1-Firmwares/11-Simplicity-Studio/README.md: -------------------------------------------------------------------------------- 1 | # Installing Simplicity Studio V5 2 | 3 | ## Overview 4 | 5 | Simplicity Studio V5 (SSV5) is the official development environment 6 | provided by **Silicon Labs** for developing, compiling, and flashing 7 | firmware onto **EFR32** chips. This guide outlines the installation steps 8 | for both **Windows** and **Linux** systems. 9 | 10 | ______________________________________________________________________ 11 | 12 | ## 1. Creating a Silicon Labs Account 13 | 14 | Before downloading Simplicity Studio, you must create a **free Silicon Labs 15 | account**: 16 | 17 | 1. Go to [Silicon Labs Developer Portal](https://www.silabs.com/developers) 18 | 2. Click **Sign Up** and complete the registration process. 19 | 3. Once registered, log in to your account to access the download page. 20 | 21 | ______________________________________________________________________ 22 | 23 | ## 2. Installation on Windows 24 | 25 | ### **2.1 Download Simplicity Studio V5** 26 | 27 | - Visit the official Silicon Labs website:\ 28 | [https://www.silabs.com/developers/simplicity-studio](https://www.silabs.com/developers/simplicity-studio) 29 | - Log in to your account and download the **Windows Installer**. 30 | 31 | ### **2.2 Install Simplicity Studio** 32 | 33 | 1. Run the downloaded installer (`SimplicityStudio.exe`). 34 | 2. Follow the on-screen instructions and accept the license agreements. 35 | 3. Select the **installation directory** (default is recommended). 36 | 4. Allow the installation to complete, then launch **Simplicity Studio 37 | V5**. 38 | 39 | ### **2.3 Install Required Components** 40 | 41 | 1. **Access Package Manager**: From the Simplicity Studio home page, 42 | navigate to the top menu and select **Install** > **Manage Installed 43 | Packages**. 44 | 45 | 2. **Open SDKs Tab**: In the Package Manager window, click on the **SDKs** 46 | tab to view the list of installed Software Development Kits. 47 | 48 | 3. **Modify Gecko SDK Version**: 49 | 50 | - Locate the Gecko SDK in the list. 51 | - Click the three-dot menu (ellipsis) next to the current Gecko SDK 52 | version. 53 | - From the dropdown menu, select **Change Version**. 54 | 55 | 4. **Select New Version**: In the subsequent dialog, choose the desired 56 | Gecko SDK version from the available options. 57 | 58 | 5. **Finalize Changes**: Click **Finish** to apply the changes and install 59 | the selected SDK version. 60 | 61 | For more detailed information, refer to the official Silicon Labs 62 | documentation on upgrading a project to a new GSDK version. 63 | 64 | ### **2.4 Verifying the Installation** 65 | 66 | 1. Optionally, connect an **ARM** or **Segger J-Link** debugger to the 67 | gateway JTAG interface (See 68 | [Backup & restore section](./12-Backup-Flash-Restore) for details). 69 | 2. Open the **Tools** menu and select `Commander`. 70 | 3. Run the following command to check the device: 71 | ```sh 72 | commander device info 73 | ``` 74 | <<<<<<< HEAD 75 | 76 | If the device is detected, Simplicity Studio is correctly installed. 77 | ======= 78 | If the device is detected, Simplicity Studio is correctly installed. 79 | >>>>>>> main 80 | 81 | ______________________________________________________________________ 82 | 83 | ## 3. Installation on Linux 84 | 85 | ### **3.1 Download and Install Dependencies** 86 | 87 | Before installing SSV5, ensure you have the required system dependencies: 88 | 89 | ```sh 90 | sudo apt update && sudo apt install -y libncurses5 libtinfo5 libx11-6 libxext6 libxrender1 libxtst6 libxi6 91 | ``` 92 | 93 | These are required for the GUI to function correctly. 94 | 95 | ### **3.2 Download Simplicity Studio V5** 96 | 97 | <<<<<<< HEAD 98 | - Visit the Silicon Labs website:\ 99 | ======= 100 | - Visit the Silicon Labs website: 101 | >>>>>>> main 102 | [https://www.silabs.com/developers/simplicity-studio](https://www.silabs.com/developers/simplicity-studio) 103 | - Log in to your account and download the **Linux installer** 104 | (`SimplicityStudioV5.tgz`). 105 | 106 | ### **3.3 Extract and Install** 107 | 108 | 1. Open a terminal and navigate to the download location: 109 | ```sh 110 | cd ~/Downloads 111 | ``` 112 | 2. Extract the archive: 113 | ```sh 114 | tar -xvzf SimplicityStudioV5.tgz 115 | ``` 116 | 3. Move into the extracted directory: 117 | ```sh 118 | cd SimplicityStudioV5 119 | ``` 120 | 4. Run the installer: 121 | ```sh 122 | ./studio.sh 123 | ``` 124 | 125 | ### **3.4 Install Required Components** 126 | 127 | Follow the same steps as in the Windows installation to install: the 128 | **Gecko SDK Suite**. 129 | 130 | ### **3.5 Verifying the Installation** 131 | 132 | 1. Optionally, connect an **ARM** or **Segger J-Link** debugger to the 133 | gateway JTAG interface (See Backup & restore section for details). 134 | 2. Open a terminal and run: 135 | ```sh 136 | commander device info 137 | ``` 138 | <<<<<<< HEAD 139 | 140 | If the device is detected, your installation is complete. 141 | ======= 142 | If the device is detected, your installation is complete. 143 | >>>>>>> main 144 | 145 | ______________________________________________________________________ 146 | 147 | ## 4. Additional Notes 148 | 149 | - **Administrator Privileges**: On some Linux systems, you may need to run 150 | Simplicity Studio as root. 151 | ```sh 152 | sudo ./studio.sh 153 | ``` 154 | - **udev Rules for Debugger Access**: If your debugger is not recognized, 155 | create a udev rule: 156 | ```sh 157 | echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="1366", MODE="0666"' | sudo tee /etc/udev/rules.d/99-segger.rules 158 | sudo udevadm control --reload-rules 159 | ``` 160 | - **Java Dependencies**: If Simplicity Studio fails to start, ensure you 161 | have Java installed: 162 | ```sh 163 | sudo apt install default-jre 164 | ``` 165 | 166 | ______________________________________________________________________ 167 | 168 | This guide ensures a smooth installation process for **Simplicity Studio 169 | V5** on both **Windows** and **Linux**. You are now ready to compile and 170 | flash firmware onto the Lidl Silvercrest gateway. 171 | -------------------------------------------------------------------------------- /1-Firmwares/12-Backup-Flash-Restore/README.md: -------------------------------------------------------------------------------- 1 | # Backup, Flash and Restore Procedure 2 | 3 | ## Overview 4 | 5 | Before modifying the firmware of your **Lidl Silvercrest Zigbee gateway**, 6 | it is **strongly recommended** to back up the original firmware. This 7 | ensures you can recover in case of a failed update or configuration error. 8 | 9 | This guide describes two main methods to back up, flash and restore the 10 | **EFR32MG1B firmware**: 11 | 12 | 1. **Method 1 – Hardware-based (RECOMMENDED)**:\ 13 | Using a hardware debugger via the SWD interface with Simplicity 14 | Commander. 15 | 16 | 2. **Method 2 – Software-based**:\ 17 | Using tools like ad-hoc script over SSH or software tools (like 18 | `universal-silabs-flasher`) requiring no extra hardware. 19 | 20 | > ⚠️ **Important:** Method 1 is the **most reliable and complete** 21 | > solution, offering full access to the flash memory and robust 22 | > verification. 23 | 24 | ______________________________________________________________________ 25 | 26 | ### Firmware File Types: `.bin`, `.s37`, and `.gbl` 27 | 28 | When working with EFR32MG1B firmware, you may encounter different file 29 | formats, each serving specific purposes: 30 | 31 | - **`.bin` (Raw Binary)**: A direct dump of the flash memory. This format 32 | is typically produced by the `commander readmem` command or 33 | `universal-silabs-flasher`. It contains the exact contents of the flash, 34 | byte-for-byte, without metadata. It is the **preferred format for full 35 | backup and restore operations** using hardware debuggers or low-level 36 | tools. 37 | 38 | - **`.s37` (Motorola S-Record)**: An ASCII-based, human-readable 39 | representation of binary data, often used during development or with 40 | bootloaders. While supported by many Silicon Labs tools, this format is 41 | less common in user-generated backups. 42 | 43 | - **`.gbl` (Gecko Bootloader Image)**: A structured, compressed firmware 44 | package used for **bootloader-based OTA (Over-The-Air)** or UART-based 45 | updates. It includes integrity checks and metadata, making it suitable 46 | for secure, partial updates, but **cannot be used for full flash 47 | restoration**. `commander flash` accepts `.gbl` files, but only if the 48 | bootloader is intact and supports it. 49 | 50 | > ⚠️ **Important**: When performing a full firmware backup or raw 51 | > restoration, always use the `.bin` format. Flashing `.gbl` files over raw 52 | > flash interfaces (like SWD) will not reconstruct the original flash 53 | > layout and may result in a non-functional system unless the Gecko 54 | > Bootloader is in place and operational. 55 | 56 | ______________________________________________________________________ 57 | 58 | ## Method 1: Hardware Backup, Flash & Restore via SWD (Recommended) 59 | 60 | ### Requirements 61 | 62 | - Lidl Silvercrest gateway with accessible SWD pins 63 | - A J-Link or compatible SWD debugger. I personally use a cheap (less than 64 | 5 USD incl shipping) OB-ARM Emulator Debugger Programmer: 65 |

OB-ARM debugger

66 | 67 | A useful investment! You can also build your own debugger with a Raspberry 68 | Pico and [`OpenOCD`](https://openocd.org/). Search the web! 69 | 70 | - [Simplicity Studio V5](https://www.silabs.com/developers/simplicity-studio) 71 | with `commander` tool 72 | - Dupont jumper wires (x4) 73 | 74 | ### Pinout and Wiring 75 | 76 | Connect the debugger to the gateway as follows: 77 | 78 | | Gateway Pin | Function | J-Link Pin | 79 | | ----------- | ----------- | ---------- | 80 | | 1 | VREF (3.3V) | VTref | 81 | | 2 | GND | GND | 82 | | 5 | SWDIO | SWDIO | 83 | | 6 | SWCLK | SWCLK | 84 | 85 | ______________________________________________________________________ 86 | 87 | ### Backup Procedure 88 | 89 | 1. **Launch Commander**:\ 90 | On Windows (default path): 91 | 92 | ```bash 93 | cd "C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\commander" 94 | ``` 95 | 96 | 2. **Check Device Connection**: 97 | 98 | ```bash 99 | commander device info --device EFR32MG 100 | ``` 101 | 102 | Output: 103 | 104 | ``` 105 | C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\commander>commander device info --device EFR32MG 106 | Reconfiguring debug connection with detected device part number: EFR32MG1B232F256GM48 107 | Part Number : EFR32MG1B232F256GM48 108 | Die Revision : A3 109 | Production Ver : 166 110 | Flash Size : 256 kB 111 | SRAM Size : 32 kB 112 | Unique ID : xxxxxxxxxxxxxxxx 113 | User Data Page : Unlocked 114 | Mass Erase : Unlocked 115 | Bootloader : Enabled 116 | Pin Reset : Soft Reset 117 | DONE 118 | ``` 119 | 120 | 3. **Read Full Flash (256KB)**: 121 | 122 | ```bash 123 | commander readmem --device EFR32MG1B232F256GM48 --range 0x0:0x40000 --outfile original_firmware.bin 124 | ``` 125 | 126 | Output: 127 | 128 | ``` 129 | C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\commander>commander readmem --device EFR32MG1B232F256GM48 --range 0x0:0x40000 --outfile original_firmware.bin 130 | Reading 262144 bytes from 0x00000000... 131 | Writing to original_firmware.bin... 132 | DONE 133 | ``` 134 | 135 | This creates a full backup of the firmware, including the bootloader. 136 | 137 | 4. **(Optional) Verify Backup**: 138 | 139 | ```bash 140 | commander verify --device EFR32MG1B232F256GM48 original_firmware.bin 141 | ``` 142 | 143 | Output: 144 | 145 | ``` 146 | C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\commander>commander verify --device EFR32MG1B232F256GM48 original_firmware.bin 147 | Parsing file original_firmware.bin... 148 | Verifying 262144 bytes at address 0x00000000...OK! 149 | DONE 150 | ``` 151 | 152 | ______________________________________________________________________ 153 | 154 | ### Restore Procedure 155 | 156 | 1. **Connect and verify debugger** as above. 157 | 158 | 2. **Flash firmware**: 159 | 160 | ```bash 161 | commander flash --device EFR32MG1B232F256GM48 firmware.bin 162 | ``` 163 | 164 | Output: 165 | 166 | ``` 167 | C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\commander>commander flash --device EFR32MG1B232F256GM48 firmware.bin 168 | Parsing file firmware.bin... 169 | Writing 262144 bytes starting at address 0x00000000 170 | Comparing range 0x00000000 - 0x0001FFFF (128 KB) 171 | Comparing range 0x00020000 - 0x0003FFFF (128 KB) 172 | Comparing range 0x00000000 - 0x00003FFF (16 KB) 173 | Comparing range 0x00038000 - 0x0003FFFF (32 KB) 174 | Erasing range 0x00004000 - 0x00023FFF (64 sectors, 128 KB) 175 | Erasing range 0x00024000 - 0x00037FFF (40 sectors, 80 KB) 176 | Programming range 0x00004000 - 0x00004FFF (4 KB) 177 | Programming range 0x00005000 - 0x00005FFF (4 KB) 178 | Programming range 0x00006000 - 0x00006FFF (4 KB) 179 | # ... more output 180 | Programming range 0x00035000 - 0x00035FFF (4 KB) 181 | Programming range 0x00036000 - 0x00036FFF (4 KB) 182 | Programming range 0x00037000 - 0x00037FFF (4 KB) 183 | Flashing completed successfully! 184 | DONE 185 | ``` 186 | 187 | Alternatively, use Simplicity Studio GUI: 188 | 189 | - Launch Simplicity Studio 190 | - Open Tools → Commander 191 | - Use the **Flash** tab to select your `.bin` file and program it 192 | 193 | ______________________________________________________________________ 194 | 195 | ### Flashing a `.gbl` File (Bootloader Mode Only) 196 | 197 | If your device is running a functional Gecko Bootloader, you can flash 198 | `.gbl` (Gecko Bootloader Image) files using Commander or the Simplicity 199 | Studio GUI. This method is useful for incremental updates or OTA-style 200 | deployment but **cannot perform full firmware restoration**. 201 | 202 | #### Using Commander: 203 | 204 | ```bash 205 | commander gbl flash --device EFR32MG1B232F256GM48 firmware.gbl 206 | ``` 207 | 208 | #### Caveats: 209 | 210 | - The Gecko Bootloader **must be present and working**. If the bootloader 211 | is erased or corrupted, this method will fail silently. 212 | - Flashing a `.gbl` file does **not overwrite the full flash memory**. 213 | Configuration, bootloader, and custom sections may be left unchanged. 214 | - Do **not** use `.gbl` files if your goal is a full recovery or to revert 215 | to the factory state. Use `.bin` instead. 216 | 217 | Alternatively, you can flash a `.gbl` file via the Simplicity Studio GUI: 218 | 219 | - Open Simplicity Studio → Tools → Commander 220 | - Select the **Upgrade Application** tab 221 | - Choose your `.gbl` file and click Flash 222 | 223 | ______________________________________________________________________ 224 | 225 | ## Method 2: Software-Based Backup, Flash & Restore (Without Hardware) 226 | 227 | > ⚠️ While convenient, this method is **less reliable**, with potential 228 | > timeouts issues. Use this only if the hardware method via SWD is not 229 | > feasible. 230 | 231 | Those approaches share important prerequisites: 232 | 233 | - No Zigbee2mqtt or ZHA attached to your gateway 234 | - No ssh or terminal session connected to your gateway (apart from the one 235 | used by the flash script itself) 236 | - A robust ethernet **wired** connection (No Wi-Fi!) 237 | 238 | ### The original Approach 239 | 240 | The original script `firmware_upgrade.sh` was developed in `ash` (busybox 241 | minimal `bash`) and is available in 242 | [Lasse Bjerre GitHub](https://github.com/Ordspilleren/lidl-gateway-freedom) 243 | 244 | My own version of this script, taking care of the most recent versions of 245 | ssh and risks of timeouts is provided in the 246 | [NCP firmware directory](../14-NCP-UART-HW/firmware). Three scripts are 247 | available: 248 | 249 | - `flash_ezsp7.sh` to update an EZSP V7 based firmware like the original 250 | Lidl/Silvercrest gateway 251 | - `flash_ezsp8.sh` to update an EZSP V8 based firmware like the hacked 252 | Lidl/Silvercrest gateway 253 | - `flash_ezsp13.sh` to upfate an EZSP V13 based firmware like the one you 254 | can build from [here](../14-NCP-UART-HW) or that can be directly 255 | downloaded [here](../14-NCP-UART-HW/firmware) 256 | 257 | You must choose the script according to the EZSP version **currently** 258 | installed in your firmware. You can identify it with Zigbee2mqtt INFO log. 259 | On a linux machine download in the same working directory the firmware you 260 | want to install (in .gbl format), the sx xmodem transfer utility and the 261 | proper script. Make the script executable (e.g. chmod +x flash_ezsp7.sh) 262 | 263 | Examples: 264 | 265 | To update an original Lidl/Silvercrest gateway with EmberZNet 7.5.0: 266 | 267 | ``` 268 | ./flash_ezsp7 192.168.1.88 ncp-uart-7.5.0.gbl 269 | ``` 270 | 271 | To update an already hacked Lidl/Silvercrest gateway using the 272 | `NCP_UHW_MG1B232_678_PA0-PA1-PB11_PA5-PA4.gbl` firmware with Ember 7.4.5: 273 | 274 | ``` 275 | ./flash_ezsp8 192.168.1.88 ncp-uart-7.4.5.gbl 276 | ``` 277 | 278 | To update an already hacked Lidl/Silvercrest gateway using a 7.4.5 279 | EmberZNet firmware with EmberZNet 7.5.0: 280 | 281 | ``` 282 | ./flash_ezsp13 192.168.1.88 ncp-uart-7.5.0.gbl 283 | ``` 284 | 285 | ### Universal-silabs-flasher 286 | 287 | Some users report that they have been able to use 288 | [universal-silabs-flasherhttps://github.com/NabuCasa/universal-silabs-flasher]\](https://github.com/NabuCasa/universal-silabs-flasher] 289 | to update their firmware. In theory that should be possible but in my own 290 | experience I frequently got frequent timeouts issues. To I leave that 291 | approach to your own judgment and will happily report the proper way to use 292 | that tool. 293 | 294 | ______________________________________________________________________ 295 | 296 | ## Resources 297 | 298 | - [Simplicity Commander Reference Guide (PDF)](https://www.silabs.com/documents/public/user-guides/ug162-simplicity-commander-reference-guide.pdf) 299 | - [universal-silabs-flasher GitHub](https://github.com/NabuCasa/universal-silabs-flasher) 300 | - [EFR32MG1B Series Datasheet](https://www.silabs.com/documents/public/data-sheets/efr32mg1-datasheet.pdf) 301 | -------------------------------------------------------------------------------- /1-Firmwares/12-Backup-Flash-Restore/media/image1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/12-Backup-Flash-Restore/media/image1.png -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/README.md: -------------------------------------------------------------------------------- 1 | # Creating the Bootloader-UART-Xmodem firmware 2 | 3 | ## Step 1: Load the Gecko bootloader-uart-xmodem demo file for EFR32MG1B232F256GM48 4 | 5 | The Gecko `bootloader-uart-xmodem` firmware is available by default as an example 6 | application for the `EFR32MG1B232F256GM48` chip. 7 | 8 | 1. In the **Launcher** tab, add the `EFR32MG1B232F256GM48` part to the **My 9 | Products** list, then click **Start**. 10 | 11 | 2. In the **Example Projects and Demos** tab, search for `bootloader` and 12 | create the `Bootloader - NCP UART XMODEM` project. 13 | 14 |

15 | Bootloader - NCP UART XMODEM 16 |

17 | 18 | 3. Accept default options and click **Finish**. Wait until the C/C++ 19 | indexation is complete. 20 | 21 | Now, we are ready to build an `bootloader-uart-xmodem` firmware for our 22 | target device. 23 | 24 |

25 | Bootloader-UART-Xmodem 26 |

27 | 28 | ______________________________________________________________________ 29 | 30 | ## Step 2: Pin Assignment 31 | 32 | 1. In the **Configuration Tools** panel, open the **Pin Tool**. 33 | 34 | 2. Assign `PA0`, `PA1`, `PB11` respectively to USART0_TX, USART0_RX, 35 | 3. assign also 'PA4' , 'PA5' respectively to RTS and CTS and 36 | GPIO as shown below: 37 | 38 |

39 | Pin Assignment 40 |

41 | 42 | 4. Exit the **Pin Tab** and save. 43 | 44 | ______________________________________________________________________ 45 | 46 | ## Step 3: Fix Pre-compilation Warnings 47 | 48 | We want to get rid of the following pre-compilation warnings: 49 | 50 |

51 | Pre-compilation warnings 52 |

53 | 54 | 1. Go back to the **Project Main Panel** and open the **Software 55 | Components** tab. 56 | 57 | 2. Set the filter to `Installed`. 58 | 59 | 3. Search for `Bootloader UART Driver`. 60 | 61 |

62 | Bootloader UART Driver 63 |

64 | 65 | 4. Open the component editor for `Bootloader UART Driver` and assign 66 | `USART0` to `SL_SERIAL_UART` Selected Module. 67 | 68 |

69 | Bootloader driver SL_SERIAL_UART 70 |

71 | Exit. 72 | 73 | 5. Search for `debug`. 74 | 75 |

76 | debug Search 77 |

78 | 79 | 6. Open the component editor for `Debug` and assign `PF2` to `SWV`. 80 | 81 |

82 | debug SWV 83 |

84 | Exit. 85 | 86 | 7. Search for `gpio`. 87 | 88 |

89 | gpio Search 90 |

91 | 92 | 8. Open the component editor for `GPIO activation` and assign `PB11` to 93 | `SL_BTL_BUTTON`. 94 | 95 |

96 | GPIO activation 97 |

98 | Exit. 99 | 100 | At this stage, the initial pre-compilation warnings should have 101 | disappeared. 102 | 103 | ______________________________________________________________________ 104 | 105 | ## Step 4: post-build command file 106 | 107 | The `bootloader-uart-xmodem` demo file includes by default a post-build 108 | configuration file (\*.slpb) which, when edited, looks like this: 109 | 110 | ``` 111 | --- 112 | parameters: 113 | - name: "build_dir" 114 | constants: 115 | - name: "project_name" 116 | value: "bootloader-uart-xmodem" 117 | steps: 118 | - task: "convert" 119 | output: "artifact/{{project_name}}.s37" 120 | export: "bootloader_main_stage" 121 | input: "{{build_dir}}/{{project_name}}.out" 122 | - task: "convert" 123 | output: "artifact/{{project_name}}-crc.s37" 124 | export: "bootloader_crc_binary" 125 | input: "artifact/{{project_name}}.s37" 126 | crc: true 127 | - task: "convert" 128 | output: "artifact/{{project_name}}-combined.s37" 129 | export: "bootloader_binary" 130 | input: 131 | - "autogen/first_stage.s37" 132 | - "artifact/{{project_name}}-crc.s37" 133 | ``` 134 | 135 | This file defines the post-build operations for creating the bootloader 136 | files for the EFR32MG1B232F256GM48 device and is used by 137 | `Simplicity Commander` to generate the necessary bootloader files after 138 | compilation. 139 | 140 | The file defines a sequence of tasks that convert the compiled output into 141 | three different bootloader image formats. 142 | 143 | ``` 144 | Main bootloader (bootloader-uart-xmodem.s37) 145 | Main bootloader with CRC32 (bootloader-uart-xmodem-crc.s37) 146 | Combined first stage + main bootloader (bootloader-uart-xmodem-combined.s37) 147 | ``` 148 | 149 | ______________________________________________________________________ 150 | 151 | ## Step 7: build the firmware 152 | 153 | Right-click on the project name (`bootloader-uart-xmodem`) in the 154 | left-panel and click on `Build Project`. The compilation should run without 155 | any errors. The three generated \*.s37 files are located in the 156 | `C:\Users\Username\SimplicityStudio\v5_workspace\bootloader-uart-xmodem\artifact\` 157 | directory ready to be flashed with `commander`. 158 | 159 | ______________________________________________________________________ 160 | 161 | ## 🧠 Understanding the 2-Stage Bootloader Architecture (Series 1) 162 | 163 | EFR32MG1B (Gecko Series 1) devices use a **two-stage bootloader system**: 164 | 165 | - **Stage 1 – First-stage bootloader (BSL)**: 166 | 167 | - Resides in main flash memory starting at address 0x0 168 | - Minimal: verifies and launches Stage 2. 169 | - Cannot be updated via UART or OTA. 170 | - Can only be overwritten using **SWD and a debugger**. 171 | 172 | - **Stage 2 – Main bootloader**: 173 | 174 | - Resides in main flash memory starting at address 0x800 175 | - Can be updated in the field (UART or OTA) using `.gbl` packages (*Not 176 | recommended*) 177 | 178 | - **Applications (NCP-UART, RCP-UART,...)**: 179 | 180 | - Resides flash memory starting at address 0x4000 181 | 182 | ______________________________________________________________________ 183 | 184 | ## 🛠 Updating the Bootloader via SWD and Simplicity Commander 185 | 186 | When you have access to the SWD interface and a debugger, the recommended 187 | and most reliable method to update the bootloader is by flashing the entire 188 | bootloader image using Simplicity Commander. 189 | 190 | This method allows you to update **both the first-stage bootloader (at 191 | address 0x0000)** and the **main bootloader (stage 2, at address 0x0800)** 192 | in a single operation, bypassing the limitations of UART or OTA updates. 193 | 194 | ### 🔹 Procedure 195 | 196 | 1. **Connect the SWD interface** (SWDIO, SWCLK, GND, +3V) to a supported 197 | debugger (e.g., J-Link or EFM32). Refer to the 198 | [Backup-Flash-Restore](../12-Backup-Flash-Restore) section for 199 | connection details. 200 | 201 | 2. Flash the combined bootloader `.s37` file generated during the build 202 | process: 203 | 204 | ```sh 205 | commander flash bootloader-uart-xmodem-combined.s37 --device EFR32MG1B232F256GM48 206 | ``` 207 | 208 | You should see output similar to: 209 | 210 | ```sh 211 | Parsing file bootloader-uart-xmodem-combined.s37... 212 | Writing 16384 bytes starting at address 0x00000000 213 | Comparing range 0x00000000 - 0x00003FFF (16 KiB) 214 | Programming range 0x00000000 - 0x00001FFF (8 KiB) 215 | Programming range 0x00002000 - 0x00003FFF (8 KiB) 216 | DONE 217 | ``` 218 | 219 | > ✅ This approach overwrites both stages of the bootloader and ensures a 220 | > clean, consistent update. It should always be preferred over UART-based 221 | > methods when physical access is available. 222 | 223 | ## 🔁 After Bootloader Update: Restore Application 224 | 225 | After a bootloader update, restore your app through `commander`. 226 | 227 | ## 🧩 Creating Combined Images (Bootloader + Application) 228 | 229 | If you want to **update both the bootloader (stage 2)** and the 230 | **application** in one go **via UART**, you can generate a combined `.gbl` 231 | file. This avoids the need for a hardware debugger and SWD connection when 232 | updating the second-stage bootloader. 233 | 234 | > ⚠️ This method only works for the **main bootloader (stage 2)**, not for 235 | > the full two-stages bootloader (which still requires SWD access). 236 | 237 | ### 🔹 Create GBL with Bootloader and Application 238 | 239 | To combine the bootloader and your application in a single upgrade file: 240 | 241 | ```sh 242 | commander gbl create myupgrade.gbl --app myapp.s37 --bootloader bootloader-uart-xmodem.s37 243 | ``` 244 | 245 | > ⚠️ **Important**: Use the non-CRC version of the `.s37` bootloader file. 246 | > `commander` automatically appends the CRC during `.gbl` creation. Do 247 | > **not** use the `-crc.s37` version here. 248 | 249 | You can then upload this `.gbl` file via the UART XMODEM bootloader using a 250 | `firmware_upgrade.sh` script. 251 | -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/bootloader_fw/TYZS4_bootloader-uart-xmodem.s37: -------------------------------------------------------------------------------- 1 | S023000054595A53345F626F6F746C6F616465722D756172742D786D6F64656D2E73333719 2 | S1130800081000209F2B00009D2B0000812C00006D 3 | S11308109D2B00009D2B00009D2B00009D2B0000B4 4 | S11308209D2B00009D2B0000943700009D2B0000A1 5 | S11308309D2B0000443700009D2B00009D2B0000E1 6 | S11308409D2B00009D2B00009D2B00009D2B000084 7 | S11308509D2B00009D2B00009D2B00009D2B000074 8 | S11308609D2B00009D2B00009D2B00009D2B000064 9 | S11308709D2B00009D2B00009D2B00009D2B000054 10 | S11308809D2B00009D2B00009D2B00009D2B000044 11 | S11308909D2B00009D2B00009D2B00009D2B000034 12 | S11308A09D2B00009D2B00009D2B00009D2B000024 13 | S11308B09D2B00009D2B00009D2B00009D2B000014 14 | S11308C09D2B00009D2B00000348044B834202D063 15 | S11308D0034B03B1184770476810002068100020CC 16 | S11308E0000000000548064B1B1AD90F01EBA301B9 17 | S11308F0491002D0034B03B1184770476810002019 18 | S1130900681000200000000010B5064C237843B99D 19 | S1130910FFF7DAFF044B13B10448AFF3008001235F 20 | S1130920237010BDB21000200000000054390000F4 21 | S113093008B5054B1BB105490548AFF30080BDE878 22 | S11309400840FFF7CFBF00BF000000006810002080 23 | S113095054390000064B0748DA1C121AC11E22F053 24 | S11309600302994288BF0022034902F049BE00BF36 25 | S1130970681000200810002060390000064B07486A 26 | S1130980DA1C121AC11E22F00302994288BF002207 27 | S1130990002102F02DBE00BF381300206810002093 28 | S11309A00D4B0E4A9A60D3F8882042F47002C3F8C3 29 | S11309B088200B4B5A6D42F400525A651A6C22F08F 30 | S11309C003021A645A6F22F001025A671A6E22F067 31 | S11309D080521A66704700BF00ED00E00008000076 32 | S11309E000300E40024A00231370024A137070470D 33 | S11309F0B4100020B310002038B50378042B04464B 34 | S1130A000D463FD009D8012B0BD0032B4FF0180310 35 | S1130A103CD040F603102B7038BD182B36D0432B36 36 | S1130A20F4E7224B4278197801BB012A03D015233D 37 | S1130A3040F60410EFE71A70A3781344FF2BF6D1A5 38 | S1130A4000228021E01C02F027FB94F88320C0F3ED 39 | S1130A500F239A4221D194F88430C0B2834220D12A 40 | S1130A60134B62781A7000200623D4E7104B1B78CE 41 | S1130A7093420ED00133DBB29342DDD0152340F60E 42 | S1130A800510C8E7062340F60710C4E740F608102F 43 | S1130A90C1E7062340F60610BDE7152340F6021011 44 | S1130AA0B9E7152340F60110B5E700BFB3100020E5 45 | S1130AB0B41000200149024800F03AB86036000042 46 | S1130AC08010002010B592B018494722684602F001 47 | S1130AD097FD02F0BFF8C0F30363092B8CBF3733D3 48 | S1130AE030330A228DF81430C0F30343B3FBF2F120 49 | S1130AF002FB1133303300F00F008DF81730B0FBD8 50 | S1130B00F2F302FB130001F13004303003F1300141 51 | S1130B108DF819108DF81A000122472168468DF8C6 52 | S1130B20164000F0ADFC002012B010BD703600007D 53 | S1130B302DE9F04F0024F9B094220646884653A8C4 54 | S1130B4021468DF80F4002F053FD2146482205A8A6 55 | S1130B5002F04EFD2146682217A802F049FD00F07C 56 | S1130B606FFBDFF81093DFF810A3DFF810B33C2716 57 | S1130B7001254FF0FF346B1E052B09D8DFE813F075 58 | S1130B800C001E0041005B005401C0000425F2E784 59 | S1130B90FFF798FF0125EEE74FF47A7104A802F0FD 60 | S1130BA043F938B99DF81030312B05D0322B0CBFE6 61 | S1130BB0052500253C27DEE70225FBE7012211215C 62 | S1130BC0A94800F05DFC28220021304602F010FD07 63 | S1130BD0202317AA05A953A802F023FA0025FF230E 64 | S1130BE0737001210520758000F058FB00F094FC1F 65 | S1130BF018B10121284600F005FDFFF7F3FE032597 66 | S1130C00B9E7432001F0DBFF00214FF47A7000F0D4 67 | S1130C1045FB00F081FC18B900F064FB0028F8D013 68 | S1130C2000F07AFC0028B1D1013FA4D1182001F0D2 69 | S1130C30C6FF00259FE7002185220DF1C50002F0C3 70 | S1130C40D7FC002140F6B83000F028FB00F064FC2B 71 | S1130C5088B34FF47A7300930123194604AA0DF163 72 | S1130C60C50000F07DFC9DF8C530012B0DD140F688 73 | S1130C70B8320092842104AA0DF1C60000F070FC81 74 | S1130C80049B842B04461AD1D8B90DF10F010DF140 75 | S1130C90C500FFF7B1FE40F60713984204461AD187 76 | S1130CA0B378A3B1F37893B106259DF80F00182803 77 | S1130CB008BF062508E000F015FB0028C6D040F266 78 | S1130CC0047415208DF80F0001F079FF53E7182301 79 | S1130CD08DF80F30E8E70028E7D19DF8C530012BE7 80 | S1130CE0E3D1CDF80080802332AA314653A800F026 81 | S1130CF07BFD04460028D8D018238DF80F30D4E7A4 82 | S1130D000121002000F07EFC01210A2000F0C6FA37 83 | S1130D109DF80F30062B4FF0010208D140F607135F 84 | S1130D209C4204D151481B2100F0AAFB81E71A21FF 85 | S1130D30504600F0A5FBA4F51063B3F5E06F4FF047 86 | S1130D40010213D24A48112100F09AFB40F606131F 87 | S1130D509C4213DCB4F5106F10D0A4F60213042BDC 88 | S1130D604ED8DFE803F04F474B515300102158464B 89 | S1130D7000F086FB40F606139C421ADC9DF80F3007 90 | S1130D809F2B4FEA13108CBF3730303000F0B0FB8C 91 | S1130D909DF80F0000F00F0009288CBF3730303069 92 | S1130DA000F0A6FB0D2000F0A3FB0A2000F0A0FB3E 93 | S1130DB03FE7A4F58053013B092BDFD8A4F580530A 94 | S1130DC0013B092BDAD801A252F823F0210E0000CE 95 | S1130DD07D0D00007D0D0000250E0000150E0000A5 96 | S1130DE01D0E0000210E0000190E0000110E00005F 97 | S1130DF0210E000021238DF80F30BFE72223FAE7EC 98 | S1130E002323F8E72423F6E72523F4E72723F2E74F 99 | S1130E104123F0E74323EEE74423ECE74523EAE7E5 100 | S1130E204F23E8E75023E6E7B378BBB1F378ABB1DF 101 | S1130E3033789B070DD5756801F00CFF854204D902 102 | S1130E40716A4FF4004000F0DBF801221321484698 103 | S1130E506AE740F2012000F0BFF9F6E740F2032010 104 | S1130E6000F0BAF9E5E600BF2037000005370000BE 105 | S1130E70DA360000B7360000EB360000CA36000050 106 | S1130E80002337B59B6A14461A68134B9A420D46E1 107 | S1130E9020D100F5004310F5004F01931AD2019BB5 108 | S1130EA0B3F5802F16D2019BC3F58023A34211D33F 109 | S1130EB040B9D0F828385A69B2F5004F02D91869F8 110 | S1130EC001F068FF01982246294603B0BDE830408E 111 | S1130ED001F086BE03B030BDAD1007B0F0B5421EC0 112 | S1130EE0D11C85B0034618D80D4C6E4604F110078A 113 | S1130EF020686168354603C50834BC422E46F7D1E4 114 | S1130F0004A90F3311F8014D12F8010F844204D1E2 115 | S1130F109A42F7D1012005B0F0BD0020FBE700BFE5 116 | S1130F2031370000F0B5036803F16043B3F5F84FBF 117 | S1130F3004469FB04FF000002AD8D0F828286368F0 118 | S1130F4016699E4224D8B3F5802F21D8656B06F12B 119 | S1130F504003AB4250D8B5F5802F4DD82846FFF753 120 | S1130F60BDFF002848D0284601F06DFE80B16F69AE 121 | S1130F7077B1022F0ED1AB69C4F1040119444FF0CB 122 | S1130F80FF32204600F0FCFE1C4BC31A5842584165 123 | S1130F901FB0F0BD40F2046328460393FFF79EFFA1 124 | S1130FA00028F5D0012F25D1AD69AE4222D8AC423C 125 | S1130FB020D8B5F5802F1DD804A802F0ABF82A1B61 126 | S1130FC0214604A802F0B0F804A802F0AFF800F03B 127 | S1130FD031FF044600F032FF2346009005F1200261 128 | S1130FE0294604A800F0E6FE03900398B0FA80F0C6 129 | S1130FF04009CDE70020CBE70120C9E7E320BBDEB1 130 | S113100008B54FF0FF3200F0BBFE044B984203D109 131 | S113101040F2092000F0E0F8002008BDE320BBDE28 132 | S1131020314B13B501225A6401F098FD044601A81E 133 | S113103001F076FD8E2C1CD82C49D1F8B00040F07C 134 | S11310400403C1F8B0302A4B4FF050121A601A63EF 135 | S11310501A66C3F89020C3F8C020C3F8F020C1F882 136 | S1131060B000224AD36A23F07F0343F02003D36203 137 | S113107001E08F2CF5D09DF80530012B01BF1D4AEE 138 | S1131080D2F8643143F00403C2F864311A4B0022ED 139 | S1131090C3F8B42A01F0E6FD00F07CF801F08AFD03 140 | S11310A001F08AFD18B14FF4017000F095F8FFF7D4 141 | S11310B001FD044601F082FD1CB140F203739C4221 142 | S11310C006D140F2012000F087F84FF4017005E0EA 143 | S11310D0A4F20574012CF8D840F2032000F07CF847 144 | S11310E0002002B010BD00BF00000E4000400E40C2 145 | S11310F000A0004000300E400000C64307B50123A5 146 | S11311008DF806308DF80730204B5B685A050AD5F8 147 | S113111000F080F8A0F2022080B2072803D8C92387 148 | S1131120C340DB0702D400F0D1FA20B100238DF8CC 149 | S113113006308DF807304FF480435B68013308D1E3 150 | S11311404FF4027000F03CF800238DF806308DF85F 151 | S113115007309DF8073063B14FF48040FFF7E2FE9B 152 | S11311608DF806009DF806301BB94FF4027000F0AC 153 | S113117027F89DF806302BB1054B4FF4804098605A 154 | S113118001F074FD03B05DF804FB00BF00500E4095 155 | S113119000ED00E0024B4CF23C325A80704700BF35 156 | S11311A000000020054B5B8823F00F034AF6C03093 157 | S11311B09BB21B1A58425841704700BF00000020E0 158 | S11311C0044A08B51080FFF7EDFF10B94FF20F0382 159 | S11311D0538008BD0000002008B5FFF7F1FF0A4A5C 160 | S11311E0136823F4E06343F400731360BFF34F8F79 161 | S11311F00649074BCA6802F4E0621343CB60BFF3AD 162 | S11312004F8F00BFFDE700BF00500E4000ED00E02F 163 | S11312100400FA05094B5A884FF20F018A4201D1A2 164 | S1131220188870473AB91B88012B40F2022018BF76 165 | S11312304FF4007070474FF40070704700000020B6 166 | S11312401FB5134B1A6842F480121A60D3F8C020F9 167 | S113125042F00102C3F8C02000F0F4F94FF47A23FD 168 | S1131260B0FBF3F00B4B0D22186000210DF10100CF 169 | S113127002F0BEF901238DF8003007480A236946BD 170 | S11312808DF8023002F099F805B05DF804FB00BF58 171 | S113129000400E40A81000200080014030B50D4DE4 172 | S11312A00D4A2D68536A15FB00F59CB215FA83F0BC 173 | S11312B00A4B80B21880A042094B2CBF00240124A1 174 | S11312C01C7011B1536A8342FCD1012353619361B1 175 | S11312D030BD00BFA810002000800140B0100020E5 176 | S11312E0B5100020094B0A4AD868127800F00100B2 177 | S11312F00AB108B9704738B9586A064B1B88984236 178 | S113130034BF002001207047012070470080014055 179 | S1131310B5100020B0100020F8B5454E454A33689A 180 | S1131320454D464803F1340191601C3301216B6043 181 | S11313306B6201F0B7FA4248012101F0B3FA0121CE 182 | S11313404FF48A4001F0AEFA7068012101F0AAFA64 183 | S113135033683C4940F6AA620024DA6041F205028F 184 | S11313601C605C665A609C605C61DC6499645C67C8 185 | S11313709C67DC675A601A681A6000F063F900F52C 186 | S1131380E1434FF4E1125B01B3FBF2F32E4A203B3D 187 | S113139002EAC30332682146536120460123042232 188 | S11313A001F0C6FA01231A461946204601F0C0FA94 189 | S11313B03368042203279C6711465F672046012394 190 | S11313C001F0B6FA01231A460521204601F0B0FACD 191 | S11313D0336841F60172DA675A6F42F030025A6795 192 | S11313E05A6E42F004025A660522DA60174B4FF037 193 | S11313F0E0621A604FF440221C62DC625C63DC66CB 194 | S1131400C3F880200132C3F88840C3F88440C3F88D 195 | S11314109850C3F8B0200E4AC3F8B840C3F8B4409B 196 | S113142097620122DA6303F1C06302229A60F8BD75 197 | S113143058100020481000200810002040410500EA 198 | S113144000250A00F9FF0100F8FF7F0000200E408C 199 | S113145000200E44084B986A10F0020006D003F1F5 200 | S1131460806302221A629A62012070471B6A9B07FA 201 | S1131470FBD4024B0222F6E700200E4000200E446B 202 | S11314807F2938B50446154624D8FFF7E3FF20B377 203 | S1131490134B2046621890420DD1124B1A88013921 204 | S11314A061F30E121A80104AC2F8C8300223D363C3 205 | S11314B035B9002038BD10F8014B03F8014BEAE7B9 206 | S11314C0FFF7C8FF0028FBD0084B1A6813699B0676 207 | S11314D0FCD5EEE741F20310ECE741F20620E9E720 208 | S11314E0B61000204810002000200E4058100020A4 209 | S11314F008B50146FFF7AEFF0028FBD0054B1B687B 210 | S11315001A695006FCD559631A699206FCD5002065 211 | S113151008BD00BF581000200E4B0F4AD3F894307A 212 | S1131520106840F20112934205D190B10023C0F536 213 | S113153000701844704740F20222934216BF074AD3 214 | S11315404FF480739B1A984202D0F0D2181A704755 215 | S11315500020704700200E40AC10002036110020FF 216 | S11315602DE9F047089D04460E461746E3B9FFF7F8 217 | S1131570D3FFB04228BF30461F4ADFF884C01F495A 218 | S11315800546234620184FF0010E4FF000084FF097 219 | S1131590020983421AD107B13D6041F20420AE42F0 220 | S11315A098BF0020BDE8F0872DB1FFF749FE002168 221 | S11315B02846FFF773FEFFF7AFFFB042D7D2002DE6 222 | S11315C0F9D0FFF78FFE0028F5D0D0E714681CF897 223 | S11315D004A003F801AB0134B4F5007F146004D116 224 | S11315E0C2F80080C1F80890D3E7B4F5807F08BF43 225 | S11315F0C1F808E0CDE700BFAC10002000200E4683 226 | S11316003611002010B10B4B02221A6279B1094A3B 227 | S1131610094901231362936202F17C420020C2F85B 228 | S1131620981006490860D363054B02229A60002093 229 | S1131630704700BF00200E4408100020AC100020AA 230 | S113164000200E4630B51B4B87B001AA03F11005EC 231 | S113165018685968144603C40833AB422246F7D1CC 232 | S11316601B78154A2370D2F8943003F00703022B39 233 | S11316701BD01369C3F30443102B18D818336B44DD 234 | S11316800E4913F8143C4B430D498B4203D11269A4 235 | S1131690C2F34162D340084AD2F80001C0F30420E7 236 | S11316A00130B3FBF0F007B030BD064BF3E7064B57 237 | S11316B0F1E700BFDC37000000400E4040420F005D 238 | S11316C000093D0000F04902C0EA21011C4AD2F899 239 | S11316D0B03043F0040313B5C2F8B0300123184608 240 | S11316E004220B2101F024F900230093009B632BB7 241 | S11316F020DD0123184602220B2101F019F90023F1 242 | S11317000193019BB3F5FA7F17DB0E4BD3F8AC4979 243 | S11317100123184600220B2101F00AF9084AD2F8E5 244 | S1131720B030601E23F0040318BF0120C2F8B030AB 245 | S113173002B010BD009B0133D7E7019B0133DFE703 246 | S113174000400E4000001442074930B50246002311 247 | S11317500C2505FB03F460180C59944203D00133A3 248 | S11317600A2BF6D1002030BDF0370000F0B587B069 249 | S113177000230827CDE9013315463B46009704AA08 250 | S1131780044601F07CFB41F203039842064623D150 251 | S113179094F8433053B1E06C3A4604A901F0C4FC18 252 | S11317A004AAA06C3B46114601F0A3FC059A6A60AA 253 | S11317B094F84320049B2B6052B9094A934207D002 254 | S11317C0084A934204D0E06C082204A901F0ACFC5E 255 | S11317D06B68236500236365304607B0F0BD00BF26 256 | S11317E0F70A0AF7FC0404FC2DE9F04FA7B0CDE991 257 | S11317F013239846309F002304460E4615934FF05A 258 | S11318000109159A424501D30020C4E094F84630FA 259 | S1131810102BF7D8DFE813F05A00A700A10042000C 260 | S113182029000F01880129008001290080013A0262 261 | S1131830AF02110005010402AD020025636D0F2BF8 262 | S113184000F28F801023009316AA4023CDE901955E 263 | S113185013A9204601F013FB0B900B9A41F20303EA 264 | S11318609A4200F0D0800B9B3CE04FF0010AD4E98F 265 | S113187014539D4275D9ED1ADDE914329B1A94F87C 266 | S11318804020032D134440F25981032B00F26D8153 267 | S113189013A9204601F0D2FA002323E0A44D636D7E 268 | S11318A0072B00F2D5800823009316AA4023CDE924 269 | S11318B0019913A9204601F0E2FA0D900D9A41F224 270 | S11318C003039A4200F0EE800D9B0BE016AA13A9C5 271 | S11318D02046FFF74BFF0890089B41F20302934216 272 | S11318E007D0089B0793079A41F203039A4288D0D2 273 | S11318F050E0179A22650022169962658D4A91423A 274 | S113190040F0E280022284F84620EBE708230093AB 275 | S113191016AA4023CDE9019513A9204601F0AFFA98 276 | S11319200990099A41F203039A4201D0099BD9E72D 277 | S1131930169B03F07F43B3F1407F05D0102384F856 278 | S1131940463041F20903CDE7179BD90706D594F831 279 | S1131950423043F0010384F842300025636D072BC5 280 | S1131960D4D90123DDE016AA13A92046FFF7FEFE11 281 | S11319700A900A9D41F203039D420FD00A9D0795E8 282 | S1131980079A41F203039A423FF43BAF079B0BB122 283 | S11319900023F370079827B0BDE8F08F1698FFF77F 284 | S11319A0D3FE28B9102384F8463041F20805E6E74F 285 | S11319B0437994F890209A4205D9102384F846304C 286 | S11319C041F20E05DBE702685B498A4205D00289D1 287 | S11319D0D20748BF013384F8903094F84230D907D5 288 | S11319E00DD5028994F84330920706D53BB11023F4 289 | S11319F084F8463041F20105C1E7002BF7D00379A2 290 | S1131A0084F84630BBE7D4F848A000F01BFA8023E2 291 | S1131A10CDE9000317AA01230221504601F049FB36 292 | S1131A200CE7226DA2650123002284F84330E265AD 293 | S1131A3084F84630E5E600213C2217A8169101F00F 294 | S1131A40D7FD0125D4E91432934204D884F84650D2 295 | S1131A5041F2030346E7009316AA4023CDE901555A 296 | S1131A6013A9204601F00BFA0C900C9A41F20303DF 297 | S1131A709A4201D00C9B35E70DF1580C06F108038E 298 | S1131A800DF1700E624603CA72451860596094469F 299 | S1131A9003F10803F6D110681860337843F00103AA 300 | S1131AA03370CFE73378179943F002033370169BF2 301 | S1131AB07360236D0022083B7362936A1868A8421E 302 | S1131AC005D1DB688B4205D0102384F8463041F2FF 303 | S1131AD0010307E7042384F8463094F8453062662E 304 | S1131AE043F0010384F84530D9E60423009316AA91 305 | S1131AF04023CDE9015513A9204601F0C0F90E9009 306 | S1131B000E9A41F203039A4201D00E9BEAE6226D3B 307 | S1131B10169B042A01D923660125636D032BE4D99E 308 | S1131B20092384F8463093E70023636607237FE79D 309 | S1131B30AD1007B0EB17A603F90707F99D423FF66E 310 | S1131B40A7AE9D4228BF1D46402316AACDE901AA8F 311 | S1131B50009513A9204601F092F90F900F9A41F2D3 312 | S1131B6003039A420AD00F9BBCE6402D28BF4025B0 313 | S1131B709D4228BF1D4625F00305E5E794F846304D 314 | S1131B80072B1CD0042DC5F1040B059388BF4FF01F 315 | S1131B90000B16AB5A465819FF2101F029FD059B8D 316 | S1131BA0092BAB4419D13B465A4616A9204601F0ED 317 | S1131BB0E7F90F900F9B002B3FF459AED3E7D7F80A 318 | S1131BC008B0BBF1000FDDD03B68606E2A4616A951 319 | S1131BD0D847636E2B44636649E6042B7FF447AE13 320 | S1131BE0737899077FF543AEFB68002B3FF43FAE53 321 | S1131BF0626E042A0BD80BEB0203062B07D917AB32 322 | S1131C009B1A1A68C4F884204FF0FF321A603B68AC 323 | S1131C10FD68606E5A4616A9A847636E5B44DAE70E 324 | S1131C2094F84450002D7FF49CAE4023009316AAF0 325 | S1131C30CDE9015513A9204601F021F91090109A1D 326 | S1131C4041F203039A4201D0109B4BE6E06C01F091 327 | S1131C506DFAD4F84CA000F0EDF8834600F0EEF8ED 328 | S1131C605B4600901EAA16A9504600F0A3F81090F7 329 | S1131C70109B33B11023F57084F8463041F206030B 330 | S1131C8030E60123F37084F844306AE600234FF011 331 | S1131C900408CDE9013316AA4023CDF8008013A926 332 | S1131CA0204601F0ECF81190119A41F203039A4294 333 | S1131CB002D0119B07936DE6D4F888202F4B9A42EB 334 | S1131CC005D0102384F8463041F20503F2E70123DE 335 | S1131CD0F37094F84530DA0707D5FD682DB13B68F9 336 | S1131CE0424604F184014046A84794F845309B07D6 337 | S1131CF007D5FD682DB104223B6804F18401104628 338 | S1131D00A847236E73B37D6865B304F180084FF070 339 | S1131D10FF330422414612A8129301F059FC28B162 340 | S1131D203B680422414648F20400A84704F16809CC 341 | S1131D300422494612A801F04BFC98B10023142256 342 | S1131D40D3F82838D3F8108004F16C01D7E90035B2 343 | S1131D5008F10800A8470422D7E90035494608EBF2 344 | S1131D600200A8470123B3700C2384F846300023F3 345 | S1131D70A0E70023F37041F207000CE6E320BBDE8A 346 | S1131D8010B50A4CD4F8B03043F02003C4F8B03096 347 | S1131D90074B01241C6001449A605C60884201D1B5 348 | S1131DA0D86910BD10F8012B9A61F7E700400E4086 349 | S1131DB000C001402DE9F041A2B00E46DDF8A0803C 350 | S1131DC015461F46044670B369B362B35BB3B8F1FA 351 | S1131DD0000F28D01548012100F064FD40220021A5 352 | S1131DE002A801F005FC394602A801F0B1F912AFCE 353 | S1131DF041460AA801F0ACF940220021384601F01E 354 | S1131E00F7FB3146384601F0A3F929461AA801F038 355 | S1131E109FF90748009702AB2022214600F0BAFA46 356 | S1131E2022B0BDE8F08140F20160F9E700150A0034 357 | S1131E3000000F40004870474A43E00F00487047D5 358 | S1131E406A43E00F004870478642E00F2DE9F041F5 359 | S1131E5004461D460F46904600211C22181D01F021 360 | S1131E60C7FB01232B6001F0A1F94146064604F5A6 361 | S1131E70807001F008FA394604F5827004F584771D 362 | S1131E8001F001FA2946384601F0FDF9304601F027 363 | S1131E9091F90D4E0D4B0E4A0E490F4823656369A7 364 | S1131EA0DB010BD501F082F929460446384601F0DE 365 | S1131EB0F2F92046BDE8F04101F07CB92265616584 366 | S1131EC0A065E665EBE700BF3938010039398401C4 367 | S1131ED0D02484FC1C82FED88B1C81A02DE9F04FF9 368 | S1131EE08DB0044617460D461E4601F05FF904F511 369 | S1131EF0827805F1400B81465946404601F0C3F90A 370 | S1131F0004F58673184604F5887A3946039301F07C 371 | S1131F10BAF907F12001504601F0B5F9484601F03D 372 | S1131F2049F9414A2265414A62650127404AA2654E 373 | S1131F30E76501F03BF929460190404601F0A3F919 374 | S1131F4004F5847905F1200211464846029201F015 375 | S1131F509AF95946504601F096F9019801F02AF988 376 | S1131F603449216534496165A76501F01FF904F519 377 | S1131F70807B824606F14001584601F08CF904A9A1 378 | S1131F80484601F088F9504601F014F901F00EF9C1 379 | S1131F90039B29468246184601F075F9504601F024 380 | S1131FA009F9264B2365264B63656FF42672A3F566 381 | S1131FB0FE231344A365E76501F0F8F8029A054689 382 | S1131FC01146404601F05FF9284601F0F3F81D4B35 383 | S1131FD023651D4B6365A76501F0E8F831460546A6 384 | S1131FE0484601F058F9284601F0E4F801F0DEF81B 385 | S1131FF004A90546404601F046F9284601F0DAF8FE 386 | S1132000124B2365124B6365A76501F0CFF806F107 387 | S113201020010446584601F03EF9204601F0CAF872 388 | S11320200DB0BDE8F08F00BF8AD11C81D91C83D1CB 389 | S11320301C81E11CD01482CB1481E11C8CE11C8135 390 | S11320401C84D91CE014D8141482E11C84D3148297 391 | S1132050D11CE0142DE9F041044690B00F46244E03 392 | S11320600521904601F084F9002323602363636310 393 | S11320700FCE08AD0FC596E80F0085E80F0008AA3B 394 | S11320806B4607F140012046FFF7E0FE01F08EF8B1 395 | S113209004F586760546694604F5827001F0F3F886 396 | S11320A03946304601F0EFF807F1200104F5887055 397 | S11320B001F0E9F8284601F07DF80E4B23650E4B3C 398 | S11320C063650E4BA3650123E36501F06FF808F126 399 | S11320D02001054604F5807001F0DDF841463046E4 400 | S11320E001F0D9F8284601F065F810B0BDE8F08198 401 | S11320F0743800008AD11C81D91C83D11C81E11C55 402 | S11321002DE9F04FA5B01D460446CDE9021205A8FD 403 | S11321101C22002101F06CFA4FF00108202200215A 404 | S1132120284605F12007CDF8108001F061FA20223D 405 | S11321300021384601F05CFA05F1400318462022DC 406 | S11321400021009301F054FA0521204601F010F912 407 | S11321500023236023636363039BDB69002B4FF03D 408 | S1132160FF060BDB013E09D00399721106F01F0331 409 | S113217051F8222008FA03F31342F3D001F016F8C1 410 | S113218004F58273394680461846019301F07BF8C2 411 | S1132190404601F00FF8734B2365734B6365734B33 412 | S11321A0A36501F003F804F5807914A98046484634 413 | S11321B001F071F8404600F0FDFF00F0F7FF2946FA 414 | S11321C08046484601F05FF8404600F0F3FF684B54 415 | S11321D02365684B63654FF48673A36500F0E6FFDF 416 | S11321E004F5867882460CA9404601F054F81CA9EF 417 | S11321F0484601F050F8504600F0DCFF00F0D6FFEE 418 | S11322008246DDE9001001F03EF8504600F0D2FFAE 419 | S1132210594B23650123636500F0C8FF04F5847AF4 420 | S113222029468346504601F02EF8584600F0C2FF76 421 | S1132230524A226502F1D94202F5DE1202F5956294 422 | S11322406265A2F586120123A2F2BA42A265E36591 423 | S113225000F0ACFF1CA98346504601F014F80CA909 424 | S1132260404601F010F8584600F0A4FF444A2265A5 425 | S1132270444A6265444AA26500F098FF29468346B1 426 | S113228004F5887001F007F8584600F093FF00F059 427 | S11322908DFF39468346019800F0F5FF50460099BA 428 | S11322A000F0F1FF14A9404600F0EDFF584600F09D 429 | S11322B081FF364A2265364A626500F077FF00994D 430 | S11322C08246484600F0E7FF3946404600F0E3FF07 431 | S11322D0504600F06FFF06F01F0101238B4072117E 432 | S11322E0039951F82220134211D0284600F021FF0F 433 | S11322F038B1384600F01DFF18B1009800F019FFFE 434 | S113230058B9029A2B4629462046FFF7E7FD013EBD 435 | S1132310BFF434AF25B0BDE8F08F029BAC4603F1A7 436 | S1132320200E18685968624603C208337345944600 437 | S1132330F7D1BC4603F1200E18685968624603C2FF 438 | S1132340083373459446F7D10DF1100EBEE80F0023 439 | S113235005F1400CACE80F009EE80F008CE80F007C 440 | S1132360D5E700BF8AD11C81821CC00C0C0C010073 441 | S1132370C00C0C83D91C83D88AD11C83DA0C811439 442 | S11323808CE11CD01484E31482D11C01D81483D1B1 443 | S11323901CC00C012DE9F04FBBB00F4604460021D0 444 | S11323A015460AA86022449E9A4601F021F960224B 445 | S11323B0002122A801F01CF9002F00F01981BAF1C4 446 | S11323C0000F00F01581002E00F01281002D40F363 447 | S11323D00F810023236023636363636843F0100366 448 | S11323E063600C21204600F0C3FF6368DFF820E23D 449 | S11323F023F4406343F400636360636823F440732D 450 | S113240043F400736360BEE80F000DF1A80CACE860 451 | S11324100F009EE80F008CE80F0000F0C7FE04F5E3 452 | S1132420847983463146484604F5867800F02BFFCC 453 | S11324302AA9404600F027FF584600F0BBFE6E4A2A 454 | S11324402265012363656369DA0104D440F2026002 455 | S11324503BB0BDE8F08F311F082351F8040F00286A 456 | S113246000F0BE8000F0A2FE06F1200B0190594658 457 | S1132470484600F008FF2AA9404600F004FF0198EE 458 | S113248000F098FE01235C4A226563656369DB0101 459 | S1132490DCD506F11C02082352F8041F002900F0C1 460 | S11324A0A3802022002132A801F0A2F8202DA8BF89 461 | S11324B02025013D013F25F0030303F594736B448C 462 | S11324C005F0030117F8012FC9008A4053F8601C76 463 | S11324D0013D42EA010243F8602CECD200F066FEB2 464 | S11324E032A90546484600F0CEFE284600F062FEBA 465 | S11324F0424B236500F05AFE04F58077054632A965 466 | S1132500384600F0C8FE284600F054FE2AAA02AB62 467 | S113251059462046FFF79AFC00F048FE04F5887BF4 468 | S1132520054602A904F5827000F0ADFE32A95846B2 469 | S113253000F0A9FE3146404600F0A5FE284600F012 470 | S113254039FE2F4B236503F1FA43A3F5006363655A 471 | S113255000F02CFE32A90546584600F09CFE02A964 472 | S1132560384600F098FE284600F024FE25490AABC0 473 | S113257032AA2046FFF7C4FD22AB02AA51462046E8 474 | S1132580FFF7BEFD0AAA11462046FFF763FD22AB02 475 | S113259019460AAA2046FFF7A1FC22AA11462046A2 476 | S11325A0FFF758FD00F002FE0C210546204600F01E 477 | S11325B0DFFE22A9484600F066FE3146404600F0A0 478 | S11325C062FE284600F0F6FD0F4B23650F4B636552 479 | S11325D0636913F0807F40F2046018BF002037E77E 480 | S11325E0013B7FF43AAF31E7013B7FF455AF2DE770 481 | S11325F040F201602CE700BF3035DA1030D00C0116 482 | S113260030E11C84B43800003035DA143938010064 483 | S1132610943800002DE9F34714460D46DDE90A928B 484 | S11326201F4600284DD14CB313683F2B2AD851685C 485 | S113263051B32549002F14BFB846884603F03F061E 486 | S11326401B19136022BF536801335360FEB93F2C3A 487 | S11326500ED9A30900932A463B464146002000F0C8 488 | S113266083F824F03F031D4404F03F0434B10026F2 489 | S11326702246294609EB060000F0C2FF002002B002 490 | S1132680BDE8F087B846D9E7DFF83C80D6E7C6F165 491 | S1132690400A5445ECD32946524609EB060000F0A3 492 | S11326A0AFFF2644012300934A463B46414600209F 493 | S11326B0A6F1400400F058F83F2C5544D6D9B8464A 494 | S11326C0C7E70248DBE700BF3439000080AFFFFFF3 495 | S11326D02DE9F041146886B01E46E3008DF80F30F2 496 | S11326E063098DF80E30630B8DF80D30630D8DF892 497 | S11326F00C3053681746DA0002EB54728DF80B2045 498 | S113270004F03F045A09372C8DF80A204FEA53325B 499 | S11327104FEA535305468DF80920CDE9001794BFBD 500 | S1132720C4F13802C4F1780288468DF808300D49A6 501 | S113273003460020FFF76EFF08222B46CDE90087F1 502 | S11327400DEB02010020FFF765FF284605F1200389 503 | S113275050F8042B46F8042B9842F9D1002006B017 504 | S1132760BDE8F081F43800002DE9F04F99B005463A 505 | S1132770884692461E4600F0F9F90446002D7ED1A3 506 | S1132780042303604560C5644368694623F44063D9 507 | S11327904360A8F10402056308F11C0345638846FD 508 | S11327A052F8040F00BA9A4241F8040BF8D100F031 509 | S11327B0FDFC4146054604F5827000F064FD2846A0 510 | S11327C000F0F8FC2F4B23654FF000090AF00307D3 511 | S11327D0229B994527D1B30704F5807744D000F0B4 512 | S11327E0E5FC41460546384600F055FD284600F014 513 | S11327F0E1FC08AD3246434603CBAB421060516066 514 | S1132800984602F10802F6D1204600F0B9F9331FC8 515 | S11328101C3653F8042F12BAB3421A60F9D10020BF 516 | S113282019B0BDE8F08F0AEB89156FB10DF1200ED8 517 | S113283005F1400B28686968F446ACE803000835E4 518 | S11328405D45E646F6D108AD00F0B0FC2946834666 519 | S113285004F5D27000F027FD584600F0ABFC0A4A9C 520 | S1132860226509F10109B3E700F0A0FC31460546F1 521 | S1132870384600F010FD284600F09CFCC4E76FF0D9 522 | S11328807100CDE7888AC801070D8101044BD3F894 523 | S11328904421D20703D4D3F840211042FBD170471E 524 | S11328A000400E4038B5C0F30323013B092B11D877 525 | S11328B0DFE803F0052710102B221D101511154D0C 526 | S11328C0C0F3043405F1424505F5801504EBC50059 527 | S11328D08000016038BD104DC0F30434F2E70F4DA1 528 | S11328E0C0F304344FF48030FFF7D0FFEAE7C0F3BD 529 | S11328F004340B4D1020F7E7C0F30434094D0120D4 530 | S1132900F2E7094DC0F30434DCE7084DC0F30434A6 531 | S1132910D8E700BF00400E4050410E40F0400E404A 532 | S1132920E8400E40E0400E40C0400E40B0400E4033 533 | S113293000EB4000F8B50D461F46040116463AB1B7 534 | S1132940154801238B402044C7B100F1C0600360E7 535 | S1132950072D4FF00F0114D8AB00104806FA03F20C 536 | S11329609940204400F01AFD3EB90B4A0123AB40C4 537 | S1132970224477B102F1C0621360F8BD00F18060B7 538 | S1132980E5E7A5F108039B00054806FA03F2994020 539 | S1132990E7E702F18062EFE70CA0004004A00040EA 540 | S11329A008A00040214B41F671311A6C19649968F2 541 | S11329B041F00101996001211861D960D969490781 542 | S11329C092B209D5996821F0010199600AB10022F7 543 | S11329D01A644FF0FF3070470221D9601449D86956 544 | S11329E0C00700D569B9D86910F002000BD0996806 545 | S11329F021F0010199600AB100221A646FF001000C 546 | S1132A0070470139EBE741B9986820F001009860FC 547 | S1132A1002B119646FF002007047996821F0010156 548 | S1132A2099600AB9002070471864FBE700000E4063 549 | S1132A30809698002DE9F04F02F16044B4F5F84F08 550 | S1132A4003D94FF0FF30BDE8F08FDFF8C8C0DFF8DE 551 | S1132A50C890DFF8C880302606FB00C64FF4401447 552 | S1132A60C6F880400024C6F88440C6F88840C6F8FA 553 | S1132A709840264C41F67135D4F840A02564A568E9 554 | S1132A804FF0010E45F00105A5600EFA00F053B9B0 555 | S1132A900422E260A26822F00102A2601FFA8AF214 556 | S1132AA08ABB0020CFE701F50065216105EA09052D 557 | S1132AB0C4F80CE06D1AD4F81CB09D4228BF1D4622 558 | S1132AC01BF0040F4FEA9507BBD1013F3F0147F0CC 559 | S1132AD06057C6F88C700E4FC6F89020C6F89470F4 560 | S1132AE0DCF820700743CCF820701027E760DCF88E 561 | S1132AF028703842FBD0C8F828002944C8F82000C0 562 | S1132B002A445B1BC3E72364CBE700BF00000E40ED 563 | S1132B1018000E4000200E4000F8FFFF00200E4475 564 | S1132B200D4AD2F8E430D2F8E0109B0003F03C03E5 565 | S1132B30C1F381110B438370D2F8E03003F03F03FB 566 | S1132B404370D2F8E830D2F8EC2003F0F003C2F37B 567 | S1132B50031213430370704700FF0FE0024BD3F8D6 568 | S1132B60FC00000E704700BF0081E00F024B0348D9 569 | S1132B700122C3F8042670470010C84300000F4028 570 | S1132B80054B984201BF03F16E7303F588330022AD 571 | S1132B90C3F80426704700BF00000F40FEE708B5E5 572 | S1132BA0FDF7FEFEFEF7AAFAFDF7D4FEFDF7E6FEFA 573 | S1132BB0FEF736FA00F012B8FDF784BF704710B57F 574 | S1132BC00446FEF795FC182C07D12046FEF790FC2E 575 | S1132BD02046BDE81040FEF78BBC10BDFEF79CBB41 576 | S1132BE0C0F30A032DE9F04105460F4616460BB91A 577 | S1132BF000F0D0F805F5006424F4FF6424F0070421 578 | S1132C0005EB0608A04507D8324639462846022374 579 | S1132C10BDE8F04100F0C5B8204600F0BBF804F56B 580 | S1132C200064EFE770B400250346D5F828582E69F0 581 | S1132C30864206D86C6913449C4202D370BCFFF7E9 582 | S1132C40CFBF70BC7047036913F0FE0F0CBF0120A7 583 | S1132C50002070470023D3F82838986870474FF451 584 | S1132C600040704700207047002070470346184614 585 | S1132C70016881F3088881F3098840688746FEE784 586 | S1132C804FF40170FEF7A8BAB1F5BE7F10B5044643 587 | S1132C900FD34FF4BE72002100F0AAFC04F5827237 588 | S1132CA004F1BC0104F128000023BDE8104000F049 589 | S1132CB0B8B940F2052010BD13B504460091014691 590 | S1132CC02830FEF791FDC4F8780118B141F20703EA 591 | S1132CD0984204D1A37823B1E07800F2022002B034 592 | S1132CE010BD40F20120FAE72DE9F04387B00DF161 593 | S1132CF008090446DDF838800E46174600211022E4 594 | S1132D0048461D4600F074FC0021C8F800101C223F 595 | S1132D10284600F06DFC32463B46CDF80090214633 596 | S1132D2004F12800FEF760FD23789A0744BF626827 597 | S1132D30C8F80020DB0709D504F1080304F12402D4 598 | S1132D4053F8041B45F8041B9342F9D12378002B54 599 | S1132D5040F2064018BF002007B0BDE8F0834FF4EE 600 | S1132D60BE70704713B504460B461046A20753BF06 601 | S1132D706FEA03434FF6FF7242EA03436FEA1343D9 602 | S1132D800193042324F003010DEB0302FFF752FE29 603 | S1132D9002B010BD08B5FFF705FEB0FA80F0400997 604 | S1132DA008BD072B2DE9F04105460E4614461F4683 605 | S1132DB002D90020BDE8F08101214FF48A40FFF7D9 606 | S1132DC071FD0CB90120F5E744EA0503DA07F0D4F4 607 | S1132DD0AB0726D531883A462846FFF7C3FF0028BB 608 | S1132DE0E7D1023C032C05F1020506F102060DD9D8 609 | S1132DF024F003084346324629463846FFF71AFEB4 610 | S1132E000028D6D146444544A4EB0804002CD9D06C 611 | S1132E1031883A462846FFF7A5FFB0FA80F040090A 612 | S1132E20C8E7032CE4D8F3E707B501230091002297 613 | S1132E301946FEF795FB03B05DF804FB70B5D1E9C4 614 | S1132E400152AA4205D290F840302B449B1A402BE1 615 | S1132E5010D9002012E00A6890F84040D65C90F83F 616 | S1132E604120224402F03F020133013486548B6036 617 | S1132E7080F840408B689D42EDD8012070BD2DE95B 618 | S1132E80F84317469E46D1E9012390F840C0089DB7 619 | S1132E909DF824909DF82880D21A624495420446F5 620 | S1132EA00E460AD9FFF7CAFF002867D1102384F819 621 | S1132EB0463041F20200BDE8F883754555D8002339 622 | S1132EC094F840200AB19D4235D1D6E901219142BE 623 | S1132ED001D29D4241D89D424DD1D4F88820294643 624 | S1132EE03846FEF74DFFC4F88800B9F1000F04D04E 625 | S1132EF0E06C2A46394600F017F994F84330B8F1EB 626 | S1132F00000F06D08BB1A06C2B463A46394600F030 627 | S1132F10F0F894F8433043B1E36DA26D2B4493422F 628 | S1132F20E36524BF002384F84330636D2B44636559 629 | S1132F3041F20300BFE794F84120A25CFA5494F8EC 630 | S1132F404120013202F03F0284F8412094F84020ED 631 | S1132F50013A84F840200133B2E73268525CFA54F3 632 | S1132F60B2680132B2600133AFE741F201001023CD 633 | S1132F7084F846309FE741F20200F8E700209AE720 634 | S1132F802DE9F04799465B6804460F469046002BAE 635 | S1132F9041D011F0030341D1D3F82838006E1B69E6 636 | S1132FA081181D1DA9421BD31C33984218D2A84274 637 | S1132FB0024638BF2A46101A3E18C5F168009942E5 638 | S1132FC094BFC2EB010AC2EB030A104431465246D5 639 | S1132FD0204400F015FB5246FF21304600F008FB68 640 | S1132FE0226E48F204039A420CD802EB080048F21D 641 | S1132FF00701884206D99B1AFA58C4F880204FF07A 642 | S1133000FF32FA50D9E90035206E42463946A847C6 643 | S1133010236E434423660020BDE8F08741F202009A 644 | S1133020FAE72DE9F04103F02003002504464FF0B0 645 | S1133030FF38C0E918550F461646A0F8405080F8EE 646 | S11330404350A0F8445080F8465080F84230C0F80D 647 | S113305088801822FF21683000F0CAFAC4E9127689 648 | S1133060C4F88080C4F8848084F8905016B1304647 649 | S113307000F050F80020BDE8F08149BA89B2484018 650 | S1133080C0F30312424013B283EA0233580100F43E 651 | S1133090FF509BB25840704738B504464518104657 652 | S11330A0AC4200D138BD014614F8010BFFF7E5FF2F 653 | S11330B0F6E7F8B5044616461D460F4600F0AEF98D 654 | S11330C0DDE90612204600F0ADF90023636284F8BE 655 | S11330D038703368C4F839307368C4F83D30B36865 656 | S11330E0C4F841302B0C6DBA84F84530A4F846502E 657 | S11330F0F8BD30B585B00D46194600F12803CDE979 658 | S11331000152009300F1240200F1380300F0A8F901 659 | S113311005B030BD10B5044600F02BF82046002160 660 | S1133120BDE8104000F029B800F02CB8014600F0CA 661 | S113313036B8036853B91C2350F8042F0AB9043B6A 662 | S1133140FAD1002BCCBF002001207047002070472B 663 | S113315038B5202204460D46002100F049FA05F155 664 | S11331602003601E13F8012D00F8012FAB42F9D1A2 665 | S113317038BD6822002100F03BBA03460020C3E9B1 666 | S11331800000704707B500F128030190009300F197 667 | S113319008030020FFF73EFA03B05DF804FB024683 668 | S11331A00B4600F128010830FFF792BAEFF31080C4 669 | S11331B072B6704700B962B6704784B00B6800936A 670 | S11331C04B6801938B680293CB680393009B036065 671 | S11331D0019B0360029B0360039B03600023009335 672 | S11331E001930293039304B0704730B5D1E90223ED 673 | S11331F0D1E90054056004600260036030BD30B55D 674 | S11332000568046802680368C1E90054C1E902233F 675 | S113321030BD7FB58A0704460B4610D06D4601F1D8 676 | S11332201006186859682A4603C20833B342154683 677 | S1133230F7D169462046FFF7D8FF04B070BD00916E 678 | S1133240009904B0BDE87040FFF7CFBF30B58B07DD 679 | S113325085B00C4610D06946FFF7D1FF0D462346D2 680 | S113326004AC2A4603CAA24218605960154603F109 681 | S11332700803F6D105B030BD0091009905B0BDE852 682 | S11332803040FFF7BCBF10B5FFF7AFFFBDE81040FB 683 | S11332901031FFF7AABF10B5FFF7B1FFBDE810402A 684 | S11332A01031FFF7ACBF10B5FFF79FFF0C4610318C 685 | S11332B0FFF79BFF04F12001FFF797FF04F13001B2 686 | S11332C0BDE81040FFF791BF00F1424303F58013BE 687 | S11332D0102A10B54FEA43130AD101221A6000F5EF 688 | S11332E08870FFF76AFF1031BDE81040FFF765BF33 689 | S11332F000221A602430F7E7F0B50B46990789B02D 690 | S1133300044615462DD0082A19D16D4603F110063E 691 | S1133310186859682A4603C20833B3421546F7D1E0 692 | S1133320082269462046FFF7CFFF03226B460020A0 693 | S1133330013A186003F10403FAD209B0F0BD6E46F5 694 | S113334003F1200718685968324603C20833BB42A8 695 | S11333501646F7D12A4669462046FFF7B5FF0722ED 696 | S1133360E4E70093009909B0BDE8F040FFF7ACBF73 697 | S1133370436823F01F030E290BD8DFE801F0080887 698 | S11333800808080B0B0B080808080B0B0B00194363 699 | S113339041607047194341F01001F9E770B50546E3 700 | S11333A00E461446FFF702FF2B685C4034405C4035 701 | S11333B02C60BDE87040FFF7FDBE0A7810B50AB96D 702 | S11333C00223436000234362CB788C781B0443EAD6 703 | S11333D004634C7A2343CC7943EA84230C7A43EA8A 704 | S11333E004234C7843EA84138C7A43EAC413CC7ADA 705 | S11333F043EA44130C7B43EA04134C7B43EAC403BF 706 | S11334000C7943EA44334C79897943EA047343EAF7 707 | S1133410417303600AB10123436010BD24220021DB 708 | S113342000F0E6B870B515460E4624220021044685 709 | S113343000F0DEF8C02D0DD0B5F5807F01D0802DD1 710 | S11334400BD12046EA0840F8045B314600F0D8F876 711 | S1133450002070BD6FF07100FBE76FF01F00F8E70C 712 | S11334602DE9F04F87B08B460290039390467AB1D2 713 | S11334701568029B1B68802B0CD100265E450FD378 714 | S1133480B8F1000F40F0A180002007B0BDE8F08F34 715 | S11334901546EEE7B3F5807FEFD06FF02000F4E738 716 | S11334A05DB1119B109A9B5D525D5340129A013598 717 | S11334B0935505F00F050136E0E7FFF757FB4FF48E 718 | S11334C04043456003600446FFF770FE029951F8DB 719 | S11334D0043B802B074614BF102208222046FFF726 720 | S11334E00BFF04F18403184603990193FFF791FE3F 721 | S11334F03846FFF75FFE119BABEB060703EB0609AB 722 | S1133500129B27F00F0703EB060A09EB0703059349 723 | S1133510059989454FF005034FF0030219D1119B1A 724 | S11335203744DE19129B1F44119B03EB0B0A032340 725 | S113353056452AD1FFF73AFE039906460198FFF74C 726 | S113354085FE3046FFF736FE2046FFF719FB5E4640 727 | S113355094E74821A160A36021698907FCD4A26093 728 | S1133560FFF724FE4946049004F1A000FFF751FE42 729 | S1133570514604F18000FFF769FE0498FFF71AFE34 730 | S113358009F110090AF1100AC2E79DB94822A260A4 731 | S11335900522A26022699207FCD4A360FFF706FE0D 732 | S11335A01099814604F18000FFF750FE4846FFF76A 733 | S11335B001FE0323109916F8012B495D01354A4099 734 | S11335C007F8012B05F00F05B2E7C8F800505BE7D8 735 | S11335D010B501390244904201D1002005E003787E 736 | S11335E011F8014FA34201D0181B10BD0130F2E7BE 737 | S11335F002440346934200D1704703F8011BF9E7E4 738 | S11336000A44914200F1FF3300D1704710B511F81C 739 | S1133610014B03F8014F9142F9D110BD00000000A5 740 | S1133620F8B500BFF8BC08BC9E467047F8B500BFAB 741 | S1133630F8BC08BC9E467047000000000000000073 742 | S11336400000000000000000000000000000000076 743 | S11336500000000000000000000000000000000066 744 | S113366000000000252C000000000000810E000076 745 | S11336700D0A4765636B6F20426F6F746C6F6164F2 746 | S113368065722076582E59592E5A5A0D0A312E2019 747 | S113369075706C6F61642067626C0D0A322E207243 748 | S11336A0756E0D0A332E2065626C20696E666F0D8F 749 | S11336B00A424C203E20000D0A4661696C65642074 750 | S11336C0746F20626F6F740D0A000D0A66696C6571 751 | S11336D0206572726F72203078000D0A626C6F631D 752 | S11336E06B206572726F72203078000D0A53657218 753 | S11336F069616C2075706C6F61642061626F7274B3 754 | S113370065640D0A000D0A53657269616C20757059 755 | S11337106C6F616420636F6D706C6574650D0A0075 756 | S11337200D0A626567696E2075706C6F61640D0ABD 757 | S113373000B814B6F1E0CFF3ADB7DD25C9FA79B717 758 | S11337401300000013B779FAC925DDB7ADF3CFE054 759 | S1133750F1B614B80102000000000000C0310000FE 760 | S1133760400000000200040200000000000000000D 761 | S11337700000000000000000000000000000000045 762 | S11337800000000000000000000000000000000035 763 | S11337900000000007B0CD5E020000000200040239 764 | S11337A0C43100000040000000000400F0001000DC 765 | S11337B0652C0000692C0000250F0000892C0000F6 766 | S11337C0B92C000000000000E92C00005F2D00006F 767 | S11337D000000000000000005F2C0000040000074F 768 | S11337E000000D1013001A20263038404800000055 769 | S11337F0EB17A6030201000003000000FA0606FA14 770 | S11338000D04000003000000F40A0AF4050500009A 771 | S113381001000000F50909F503070000010000009C 772 | S1133820F60808F60608000000000000FE0101FE8C 773 | S11338300808000000000000FD0303FD0A08000062 774 | S113384000000000F90707F90E090000020000005B 775 | S1133850F70A0AF70F0B000003000000FC0404FC45 776 | S11338600B0C000003000000200000000001000019 777 | S1133870050C0000FFFFFFFFFFFFFFFFFFFFFFFF3F 778 | S11338800000000000000000000000000100000033 779 | S1133890FFFFFFFF512563FCC2CAB9F3849E17A73B 780 | S11338A0ADFAE6BCFFFFFFFFFFFFFFFF00000000D3 781 | S11338B0FFFFFFFF96C298D84539A1F4A033EB2D42 782 | S11338C0817D0377F240A463E5E6BCF847422CE12E 783 | S11338D0F2D1176BF551BF376840B6CBCE5E316B72 784 | S11338E05733CE2B169E0F7C4AEBE78E9B7F1AFE36 785 | S11338F0E242E34F800000000000000000000000EE 786 | S113390000000000000000000000000000000000B3 787 | S113391000000000000000000000000000000000A3 788 | S11339200000000000000000000000000000000093 789 | S1133930000000006A09E667BB67AE853C6EF3725F 790 | S1133940A54FF53A510E527F9B05688C1F83D9AB66 791 | S10739505BE0CD194E 792 | S10F39546039000008100020180000007A 793 | S1133960F00F1003000000003611002013000000C7 794 | S11339700900000000010000020200001300000022 795 | S1133980F00F1003000000003612002013000000A6 796 | S1133990090000000002000001010000D3FFFFFF46 797 | S11339A0F07F1030B610002000000000000000007E 798 | S11339B00000014000220400310900000909000050 799 | S9032B9F32 800 | -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/media/image1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/13-Bootloader-UART-Xmodem/media/image1.png -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/media/image2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/13-Bootloader-UART-Xmodem/media/image2.png -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/media/image3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/13-Bootloader-UART-Xmodem/media/image3.png -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/media/image4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/13-Bootloader-UART-Xmodem/media/image4.png -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/media/image5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/13-Bootloader-UART-Xmodem/media/image5.png -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/media/image6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/13-Bootloader-UART-Xmodem/media/image6.png -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/media/image7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/13-Bootloader-UART-Xmodem/media/image7.png -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/media/image8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/13-Bootloader-UART-Xmodem/media/image8.png -------------------------------------------------------------------------------- /1-Firmwares/13-Bootloader-UART-Xmodem/media/image9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/13-Bootloader-UART-Xmodem/media/image9.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/README.md: -------------------------------------------------------------------------------- 1 | # Creating the NCP-UART-HW firmware 2 | 3 | ## Step 1: Create an NCP-UART-HW Demo File for EFR32MG1B232F256GM48 4 | 5 | The `NCP-UART-HW` firmware is not available by default as an example 6 | application for the `EFR32MG1B232F256GM48` chip. Therefore, we need to load 7 | it from another chip. 8 | 9 | 1. In the **Launcher** tab, add the `EFR32MG12P432F1024GL125` part to the 10 | **My Products** list, then click **Start**. 11 | 12 |

13 | Launcher Tab 14 |

15 | 16 | 2. In the **Example Projects and Demos** tab, search for `NCP-UART-HW` and 17 | create the `Zigbee – NCP ncp-uart-hw` project. 18 | 19 |

20 | Example Projects 21 |

22 | 23 | 3. Accept default options and click **Finish**. Wait until the C/C++ 24 | indexation is complete. 25 | 26 | 4. In the **Overview** panel, go to **Target and Tools settings** and at 27 | the bottom, click **Change Target/SDK/Generators**. Change the **Part 28 | reference** to `EFR32MG1B232F256GM48` and save. Wait for the project 29 | validation task and C/C++ Indexer to complete. 30 | 31 |

32 | Indexation 33 |

34 |

35 | Indexation 36 |

37 | 38 | Now, we are ready to build an `NCP-UART-HW` firmware for our target device. 39 | 40 | ______________________________________________________________________ 41 | 42 | ## Step 2: Pin Assignment 43 | 44 | 1. In the **Configuration Tools** panel, open the **Pin Tool**. 45 | 46 | 2. Assign `PA0`, `PA1`, `PA4`, and `PA5` respectively to USART0_TX, 47 | USART0_RX, USART0_RTS and USART0_CTS as shown below: 48 | 49 |

50 | Pin Assignment 51 |

52 | 53 | 3. Exit the **Pin Tab** and save. 54 | 55 | ______________________________________________________________________ 56 | 57 | ## Step 3: Fix Pre-compilation Warnings 58 | 59 | We want to get rid of the following pre-compilation warnings: 60 | 61 |

62 | Pre-compilation warnings 63 |

64 | 65 | 1. Go back to the **Project Main Panel** and open the **Software 66 | Components** tab. 67 | 68 | 2. Set the filter to `Installed`. 69 | 70 | 3. Search for `vcom`. 71 | 72 |

73 | VCOM Search 74 |

75 | 76 | 4. Open the component editor for `IO Stream USART` and assign `USART0` to 77 | `SL_IOSTREAM_USART_VCOM`. 78 | 79 |

80 | IO Stream USART 81 |

82 | 83 | 5. Search for `PTI`. 84 | 85 |

86 | PTI Search 87 |

88 | 89 | 6. Open the component editor for `RAIL Utility, PTI` and assign `PB12` to 90 | `DOUT`. 91 | 92 |

93 | RAIL Utility PTI 94 |

95 | 96 | At this stage, the initial pre-compilation warnings should have 97 | disappeared. 98 | 99 | ______________________________________________________________________ 100 | 101 | ## Step 4: Optimize for EFR32MG1B 256K Memory 102 | 103 | If you try to compile the firmware at this stage, you will receive an error 104 | stating that the output exceeds the available memory. 105 | 106 |

107 | Compilation Error 108 |

109 | 110 | To fit within the `256K` memory of the `EFR32MG1B`, remove unnecessary 111 | debug or non-critical functions: 112 | 113 | 1. Open the **Software Components** tab. 114 | 2. Search for and uninstall the following components: 115 | - Debug Print 116 | - Debug Extended 117 | - Zigbee Light Link 118 | - IO Stream VUART 119 | 120 | Ensure that the `*.c` indexation is completed before uninstalling the next 121 | component. 122 | 123 | ______________________________________________________________________ 124 | 125 | ## Step 5: Delay the EFR32MG1B Boot Process 126 | 127 | The boot process must be delayed to allow the `RTL8196E` bootloader to 128 | complete its initialization; otherwise, the `EFR32MG1B232F256GM48` boot 129 | sequence will interfere, preventing the loading of the Linux kernel and 130 | associated file system. 131 | 132 | 1. In the **Software Components** tab, remove the previous filters and 133 | search for `Microsecond Delay`. 134 | 135 | 2. Install the `Microsecond Delay` function. 136 | 137 |

138 | Microsecond Delay 139 |

140 | 141 | 3. Edit the `main.c` file and add: 142 | 143 | ``` 144 | #include "sl_udelay.h" 145 | ``` 146 | 147 | 4. At the beginning of `int main(void)`, insert: 148 | 149 | ``` 150 | // Add 1sec delay before any reset operation to accommodate RTL8196E boot 151 | sl_udelay_wait(1000000); // 1s delay 152 | ``` 153 | 154 | The `main.c` file should now look like: 155 | 156 |

Main.c Modification

157 | 158 | Save the file. 159 | 160 | ______________________________________________________________________ 161 | 162 | ## Step 6: define post-build command to create gbl file 163 | 164 | The `ncp-uart-hw.gbl` file is not created by default. You have to define 165 | post-build instructions. Right-click on the project name and go to 166 | `properties --> C/C++ Build -> Settings --> Build Steps` and enter: 167 | 168 | ``` 169 | "C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\commander\commander.exe" gbl create ncp-uart-hw.gbl --app ncp-uart-hw.s37 170 | ``` 171 | 172 |

173 | Post-build NCP 174 |

175 | 176 | ______________________________________________________________________ 177 | 178 | ## Step 7 (optional) Customizing EZSP Configuration Parameters 179 | 180 | If you're using this firmware with [Zigbee2mqtt](https://www.zigbee2mqtt.io/) or [ZHA](https://www.home-assistant.io/integrations/zha/), you may want to optimize how the Zigbee stack allocates memory and handles routing. 181 | 182 | The values shown in the output of `universal-silabs-flasher probe` (such as `PACKET_BUFFER_COUNT`, `NEIGHBOR_TABLE_SIZE`, etc.) are defined at compile time inside the Silicon Labs Zigbee stack. 183 | 184 | You can **modify these parameters** by editing the following two files: 185 | 186 | ```c 187 | /autogen/sl_zigbee_source_route_config.h 188 | /autogen/sl_zigbee_pro_stack_config.h 189 | ``` 190 | 191 | These files are automatically generated but can be customized by setting configuration options in **Simplicity Studio** or directly in the `.slcp` project file. 192 | 193 | --- 194 | 195 | ### 🔧 Key Parameters to Tune 196 | 197 | | Parameter | Description | 198 | | ---------------------------------- | ------------------------------------------------------------------------------------------------------------ | 199 | | `CONFIG_PACKET_BUFFER_COUNT` | Number of buffers used to store messages. Higher values allow better performance in busy networks. | 200 | | `CONFIG_NEIGHBOR_TABLE_SIZE` | Max number of Zigbee routers that can be stored. Affects routing stability. | 201 | | `CONFIG_SOURCE_ROUTE_TABLE_SIZE` | Controls the number of source routes cached. Essential for large end-device networks. | 202 | | `CONFIG_APS_UNICAST_MESSAGE_COUNT` | Max number of unicast messages in flight. Important for group commands or simultaneous actions. | 203 | | `CONFIG_BROADCAST_TABLE_SIZE` | Limits how many broadcast messages are tracked to avoid duplicates. | 204 | | `CONFIG_BINDING_TABLE_SIZE` | Number of Zigbee bindings supported. Needed for certain device pairing. | 205 | | `CONFIG_KEY_TABLE_SIZE` | Number of security keys that can be stored. | 206 | | `CONFIG_ADDRESS_TABLE_SIZE` | Number of IEEE<->network address mappings cached. Important for direct communication, ZCL bindings, and OTA. | 207 | 208 | --- 209 | 210 | ### 🧪 Recommended Defaults in EZSP 7.5.0.0 211 | 212 | For reference, here are the current default values on the Lidl/Silvercrest gateway running EZSP 7.5.0.0: 213 | 214 | ```c 215 | CONFIG_PACKET_BUFFER_COUNT=255 216 | CONFIG_SOURCE_ROUTE_TABLE_SIZE=7 217 | CONFIG_ADDRESS_TABLE_SIZE=12 218 | CONFIG_NEIGHBOR_TABLE_SIZE=16 219 | CONFIG_APS_UNICAST_MESSAGE_COUNT=10 220 | ``` 221 | 222 | These values are already well-balanced for many networks. 223 | 224 | --- 225 | 226 | ### 🧩 Optional Adjustments Based on Community Feedback 227 | 228 | Community member [@gpaesano](https://github.com/gpaesano) suggested the following adjustments across two configuration headers: 229 | 230 | In `sl_zigbee_source_route_config.h`: 231 | ```c 232 | #define EMBER_SOURCE_ROUTE_TABLE_SIZE 200 233 | ``` 234 | 235 | In `sl_zigbee_pro_stack_config.h`: 236 | ```c 237 | #define EMBER_BROADCAST_TABLE_SIZE 30 238 | #define EMBER_APS_UNICAST_MESSAGE_COUNT 64 239 | #define EMBER_NEIGHBOR_TABLE_SIZE 26 240 | ``` 241 | 242 | These changes increase capacity for routing and message handling, which is helpful for larger or more active Zigbee networks. 243 | 244 | --- 245 | 246 | ### 📚 Documentation & References 247 | 248 | - [AN1233: Zigbee Stack Configuration Guide (Silicon Labs)](https://www.silabs.com/documents/public/application-notes/an1233-zigbee-stack-config.pdf) 249 | - [Zigbee Stack API Reference (Silicon Labs)](https://siliconlabs.github.io/zigbee_sdk_doc/) 250 | 251 | 252 | ## Step 8: build the firmware 253 | 254 | Right-click on the project name (`ncp-uart-hw`) in the left-panel and click 255 | on `Build Project`. The compilation should run without any errors. The 256 | generated file `ncp-uart-hw.gbl` is located in the 257 | `GNU ARM v12.2.1 - Default directory` ready to be flashed. -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/firmware/flash_ezsp13.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # flash_ezsp13.sh – Flash EZSP V13 firmware to Lidl/Silvercrest gateway 3 | # 4 | # Compatible with EZSP V13 (EmberZNet >= 7.x) 5 | # Tested on EFR32MG1B-based Lidl Silvercrest gateway 6 | # 7 | # Usage: 8 | # ./flash_ezsp13.sh 9 | # 10 | # Requirements: 11 | # - sx (xmodem send utility) in current directory 12 | # - gateway reachable via SSH (default: root@, port 22) 13 | # - Zigbee2MQTT or ZHA must be stopped beforehand 14 | # - Make sure your firmware is a valid .gbl file for EZSP V13 15 | 16 | SSH_PORT=22 17 | SSH_OPTS=(-p "${SSH_PORT}" -oHostKeyAlgorithms=+ssh-rsa) 18 | 19 | GATEWAY_HOST="$1" 20 | FIRMWARE_FILE="$2" 21 | 22 | # --- Input validation --- 23 | if [ -z "$GATEWAY_HOST" ] || [ -z "$FIRMWARE_FILE" ]; then 24 | echo "Usage: $0 " 25 | echo "Example: $0 192.168.1.88 NCP_UHW_MG1B232_713.gbl" 26 | exit 1 27 | fi 28 | 29 | if [ ! -f "$FIRMWARE_FILE" ]; then 30 | echo "Error: Firmware file '$FIRMWARE_FILE' not found" 31 | exit 1 32 | fi 33 | 34 | if [ ! -f sx ]; then 35 | echo "Error: sx file (xmodem sender) not found in current directory" 36 | exit 1 37 | fi 38 | 39 | # --- Prepare archive --- 40 | cp "$FIRMWARE_FILE" firmware.gbl 41 | tar -czf firmware_package.tar.gz sx firmware.gbl 42 | 43 | # --- Transfer and flash in one SSH session --- 44 | cat firmware_package.tar.gz | ssh "${SSH_OPTS[@]}" root@"${GATEWAY_HOST}" ' 45 | cat > /tmp/firmware_package.tar.gz 46 | cd /tmp 47 | tar -xf firmware_package.tar.gz 48 | 49 | chmod +x sx 50 | killall -q serialgateway 51 | killall -q ser2net 52 | 53 | # Serial initialization 54 | stty -F /dev/ttyS1 115200 cs8 -cstopb -parenb -ixon crtscts raw 55 | 56 | # EZSP V13 bootloader unlock sequence with pauses 57 | echo -en "\x1A\xC0\x38\xBC\x7E" > /dev/ttyS1 58 | sleep 1 59 | echo -n "." 60 | echo -en "\x00\x42\x21\xA8\x50\xED\x2C\x7E" > /dev/ttyS1 61 | sleep 1 62 | echo -n "." 63 | echo -en "\x81\x60\x59\x7E" > /dev/ttyS1 64 | sleep 1 65 | echo -n "." 66 | echo -en "\x7D\x31\x42\x21\xA9\x54\x2A\x7D\x38\xDC\x7A\x7E" > /dev/ttyS1 67 | sleep 1 68 | echo -n "." 69 | echo -en "\x82\x50\x3A\x7E" > /dev/ttyS1 70 | sleep 1 71 | echo -n "." 72 | echo -en "\x22\x43\x21\xA9\x7D\x33\x2A\x16\xB2\x59\x94\xE7\x9E\x7E" > /dev/ttyS1 73 | sleep 1 74 | echo -n "." 75 | echo -en "\x83\x40\x1B\x7E" > /dev/ttyS1 76 | sleep 1 77 | echo -n "." 78 | echo -en "\x33\x40\x21\xA9\xDB\x2A\x14\x8F\xC8\x7E" > /dev/ttyS1 79 | sleep 1 80 | echo "." 81 | 82 | # Switch to XMODEM-compatible serial mode 83 | stty -F /dev/ttyS1 115200 cs8 -cstopb -parenb -ixon -crtscts raw 84 | echo -e "1" > /dev/ttyS1 85 | sleep 1 86 | 87 | # Firmware transfer 88 | echo "Starting firmware transfer" 89 | /tmp/sx /tmp/firmware.gbl < /dev/ttyS1 > /dev/ttyS1 90 | 91 | # Cleanup and reboot 92 | rm -f /tmp/sx /tmp/firmware.gbl /tmp/firmware_package.tar.gz 93 | echo "Firmware update completed. The gateway will now reboot." 94 | echo "Rebooting..." 95 | reboot 96 | ' 97 | 98 | # --- Local cleanup --- 99 | rm -f firmware_package.tar.gz firmware.gbl 100 | exit 0 101 | 102 | -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/firmware/flash_ezsp7.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # flash_ezsp7.sh – Flash EZSP V7 firmware to Lidl/Silvercrest gateway 3 | # 4 | # Compatible with EZSP V7 (used with EmberZNet 6.5.0) 5 | # Tested on EFR32MG1B232F256-based Lidl Silvercrest gateway 6 | # 7 | # Usage: 8 | # ./flash_ezsp7.sh 9 | # 10 | # Requirements: 11 | # - sx (xmodem send utility) in current directory 12 | # - gateway reachable via SSH (default: root@, port 22) 13 | # - Zigbee2MQTT or ZHA must be stopped beforehand 14 | # - Make sure your firmware is a valid .gbl file for EZSP V7 15 | 16 | SSH_PORT=22 17 | SSH_OPTS=(-p "${SSH_PORT}" -oHostKeyAlgorithms=+ssh-rsa) 18 | 19 | GATEWAY_HOST="$1" 20 | FIRMWARE_FILE="$2" 21 | 22 | # --- Input validation --- 23 | if [ -z "$GATEWAY_HOST" ] || [ -z "$FIRMWARE_FILE" ]; then 24 | echo "Usage: $0 " 25 | echo "Example: $0 192.168.1.88 NCP_UHW_MG1B232_678.gbl" 26 | exit 1 27 | fi 28 | 29 | if [ ! -f "$FIRMWARE_FILE" ]; then 30 | echo "Error: Firmware file '$FIRMWARE_FILE' not found" 31 | exit 1 32 | fi 33 | 34 | if [ ! -f sx ]; then 35 | echo "Error: sx file (xmodem sender) not found in current directory" 36 | exit 1 37 | fi 38 | 39 | # --- Prepare archive --- 40 | cp "$FIRMWARE_FILE" firmware.gbl 41 | tar -czf firmware_package.tar.gz sx firmware.gbl 42 | 43 | # --- Transfer and flash in one SSH session --- 44 | cat firmware_package.tar.gz | ssh "${SSH_OPTS[@]}" root@"${GATEWAY_HOST}" ' 45 | cat > /tmp/firmware_package.tar.gz 46 | cd /tmp 47 | tar -xf firmware_package.tar.gz 48 | 49 | chmod +x sx 50 | killall -q serialgateway 51 | 52 | # Serial initialization 53 | stty -F /dev/ttyS1 115200 cs8 -cstopb -parenb -ixon crtscts raw 54 | 55 | # EZSP V7 bootloader unlock sequence with delays 56 | echo -en "\x1A\xC0\x38\xBC\x7E" > /dev/ttyS1 57 | sleep 1 58 | echo -en "\x00\x42\x21\xA8\x53\xDD\x4F\x7E" > /dev/ttyS1 59 | sleep 1 60 | echo -en "\x81\x60\x59\x7E" > /dev/ttyS1 61 | sleep 1 62 | echo -en "\x7D\x31\x43\x21\x27\x55\x6E\x90\x7E" > /dev/ttyS1 63 | sleep 1 64 | 65 | # Reconfigure without flow control for XMODEM 66 | stty -F /dev/ttyS1 115200 cs8 -cstopb -parenb -ixon -crtscts raw 67 | echo -e "1" > /dev/ttyS1 68 | sleep 1 69 | 70 | # Firmware transfer 71 | echo "Starting firmware transfer" 72 | /tmp/sx /tmp/firmware.gbl < /dev/ttyS1 > /dev/ttyS1 73 | 74 | # Cleanup and reboot 75 | rm -f /tmp/sx /tmp/firmware.gbl /tmp/firmware_package.tar.gz 76 | echo "Firmware update completed. The gateway will now reboot." 77 | echo "Rebooting..." 78 | reboot 79 | ' 80 | 81 | # --- Local cleanup --- 82 | rm -f firmware_package.tar.gz firmware.gbl 83 | exit 0 84 | -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/firmware/flash_ezsp8.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # flash_ezsp7.sh – Flash EZSP V8 firmware to Lidl/Silvercrest gateway 3 | # 4 | # Compatible with EZSP V8 (EmberZNet 6..x) 5 | # Tested on EFR32MG1B-based Lidl Silvercrest gateway 6 | # 7 | # Usage: 8 | # ./flash_ezsp8.sh 9 | # 10 | # Requirements: 11 | # - sx (xmodem send utility) in current directory 12 | # - gateway reachable via SSH (default: root@, port 22) 13 | # - Zigbee2MQTT or ZHA must be stopped beforehand 14 | # - Make sure your firmware is a valid .gbl file for EZSP V7 15 | 16 | SSH_PORT=22 17 | SSH_OPTS=(-p "${SSH_PORT}" -oHostKeyAlgorithms=+ssh-rsa) 18 | 19 | GATEWAY_HOST="$1" 20 | FIRMWARE_FILE="$2" 21 | 22 | # --- Input validation --- 23 | if [ -z "$GATEWAY_HOST" ] || [ -z "$FIRMWARE_FILE" ]; then 24 | echo "Usage: $0 " 25 | echo "Example: $0 192.168.1.88 NCP_UHW_MG1B232_678.gbl" 26 | exit 1 27 | fi 28 | 29 | if [ ! -f "$FIRMWARE_FILE" ]; then 30 | echo "Error: Firmware file '$FIRMWARE_FILE' not found" 31 | exit 1 32 | fi 33 | 34 | if [ ! -f sx ]; then 35 | echo "Error: sx file (xmodem sender) not found in current directory" 36 | exit 1 37 | fi 38 | 39 | # --- Prepare archive --- 40 | cp "$FIRMWARE_FILE" firmware.gbl 41 | tar -czf firmware_package.tar.gz sx firmware.gbl 42 | 43 | # --- Transfer and flash in one SSH session --- 44 | cat firmware_package.tar.gz | ssh "${SSH_OPTS[@]}" root@"${GATEWAY_HOST}" ' 45 | cat > /tmp/firmware_package.tar.gz 46 | cd /tmp 47 | tar -xf firmware_package.tar.gz 48 | 49 | chmod +x sx 50 | killall -q serialgateway 51 | 52 | # Serial initialization 53 | stty -F /dev/ttyS1 115200 cs8 -cstopb -parenb -ixon crtscts raw 54 | 55 | # EZSP V7 bootloader unlock sequence with delays 56 | echo -en "\x1A\xC0\x38\xBC\x7E" > /dev/ttyS1 57 | sleep 1 58 | echo -en "\x00\x42\x21\xA8\x5C\x2C\xA0\x7E" > /dev/ttyS1 59 | sleep 1 60 | echo -en "\x81\x60\x59\x7E" > /dev/ttyS1 61 | sleep 1 62 | echo -en "\x7D\x31\x43\x21\x27\x55\x6E\x90\x7E" > /dev/ttyS1 63 | sleep 1 64 | 65 | # Reconfigure without flow control for XMODEM 66 | stty -F /dev/ttyS1 115200 cs8 -cstopb -parenb -ixon -crtscts raw 67 | echo -e "1" > /dev/ttyS1 68 | sleep 1 69 | 70 | # Firmware transfer 71 | echo "Starting firmware transfer" 72 | /tmp/sx /tmp/firmware.gbl < /dev/ttyS1 > /dev/ttyS1 73 | 74 | # Cleanup and reboot 75 | rm -f /tmp/sx /tmp/firmware.gbl /tmp/firmware_package.tar.gz 76 | echo "Firmware update completed. The gateway will now reboot." 77 | echo "Rebooting..." 78 | reboot 79 | ' 80 | 81 | # --- Local cleanup --- 82 | rm -f firmware_package.tar.gz firmware.gbl 83 | exit 0 84 | 85 | -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/firmware/ncp-uart-hw-7.4.5.gbl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/firmware/ncp-uart-hw-7.4.5.gbl -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/firmware/ncp-uart-hw-7.5.0-btlhw.gbl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/firmware/ncp-uart-hw-7.5.0-btlhw.gbl -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/firmware/ncp-uart-hw-7.5.0.gbl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/firmware/ncp-uart-hw-7.5.0.gbl -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/firmware/sx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/firmware/sx -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image1.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image10.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image10.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image11.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image11.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image12.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image12.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image13.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image13.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image14.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image14.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image15.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image15.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image2.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image3.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image4.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image5.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image6.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image7.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image8.png -------------------------------------------------------------------------------- /1-Firmwares/14-NCP-UART-HW/media/image9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/14-NCP-UART-HW/media/image9.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/README.md: -------------------------------------------------------------------------------- 1 | # Creating the RCP-UART-HW firmware 2 | 3 | ## Step 1: Load the RCP-UART-HW Demo File for EFR32MG1B232F256GM48 4 | 5 | The `RCP-UART-HW` firmware is available by default as an example 6 | application for the `EFR32MG1B232F256GM48` chip. 7 | 8 | 1. In the **Launcher** tab, add the `EFR32MG1B232F256GM48` part to the **My 9 | Products** list, then click **Start**. 10 | 11 | 2. In the **Example Projects and Demos** tab, search for `zigbee` and 12 | create the `Multiprotocol (OpenThread+Zigbee) - RCP (UART)` project. 13 | 14 |

15 | Zigbee Example Projects 16 |

17 | 18 | 3. Accept default options and click **Finish**. Wait until the C/C++ 19 | indexation is complete. 20 | 21 | Now, we are ready to build an `RCP-UART-802154` firmware for our target 22 | device. 23 | 24 |

25 | RCP-UART-802154 26 |

27 | 28 | ______________________________________________________________________ 29 | 30 | ## Step 2: Pin Assignment 31 | 32 | 1. In the **Configuration Tools** panel, open the **Pin Tool**. 33 | 34 | 2. Assign `PA0`, `PA1`, `PA4`, and `PA5` respectively to USART0_TX, 35 | USART0_RX, USART0_RTS and USART0_CTS as shown below: 36 | 37 |

38 | Pin Assignment 39 |

40 | 41 | 3. Exit the **Pin Tab** and save. 42 | 43 | ______________________________________________________________________ 44 | 45 | ## Step 3: Fix Pre-compilation Warnings 46 | 47 | We want to get rid of the following pre-compilation warnings: 48 | 49 |

50 | Pre-compilation warnings 51 |

52 | 53 | 1. Go back to the **Project Main Panel** and open the **Software 54 | Components** tab. 55 | 56 | 2. Set the filter to `Installed`. 57 | 58 | 3. Search for `vcom`. 59 | 60 |

61 | VCOM Search 62 |

63 | 64 | 4. Open the component editor for `CPC Secondary - UART (USART)` and assign 65 | `USART0` to `SL_CPC_DRV_UART_VCOM`. 66 | 67 |

68 | IO Stream USART 69 |

70 | Exit. 71 | 72 | 5. Search for `PTI`. 73 | 74 |

75 | PTI Search 76 |

77 | 78 | 6. Open the component editor for `RAIL Utility, PTI` and assign `PB12` to 79 | `DOUT`. 80 | 81 |

82 | RAIL Utility PTI 83 |

84 | Exit. 85 | 86 | 7. Search for `coex`. 87 | 88 |

89 | coex Search 90 |

91 | 92 | 8. Open the component editor for `RAIL Utility, Coexistence` and assign 93 | `PRS Channel CH0` to `SL_RAIL_UTIL_COEX_DP_REQUEST_INV`. 94 | 95 |

96 | RAIL Utility Coexistence 97 |

98 | Exit. 99 | 100 | At this stage, the initial pre-compilation warnings should have 101 | disappeared. 102 | 103 | ______________________________________________________________________ 104 | 105 | ## Step 4 - Disable CPC security 106 | 107 | This is optional. If you don't do it you will have to provide security 108 | keys. Search for `CPC Security` and open the component. Disable 109 | `CPC Security Configuration` (enabled by default). 110 | 111 |

112 | Disable CPC Security 113 |

114 | Exit. 115 | 116 | ______________________________________________________________________ 117 | 118 | ## Step 5: Delay the EFR32MG1B Boot Process 119 | 120 | The boot process must be delayed to allow the `RTL8196E` bootloader to 121 | complete its initialization; otherwise, the `EFR32MG1B232F256GM48` boot 122 | sequence will interfere, preventing the loading of the Linux kernel and 123 | associated file system. 124 | 125 | 1. In the **Software Components** tab, remove the previous filters and 126 | search for `Microsecond Delay`. 127 | 128 | 2. Install the `Microsecond Delay` function. 129 | 130 |

131 | Microsecond Delay 132 |

133 | 134 | 3. Edit the `main.c` file and add: 135 | 136 | ``` 137 | #include "sl_udelay.h" 138 | ``` 139 | 140 | 4. At the beginning of `int main(void)`, insert: 141 | 142 | ``` 143 | // Add 1sec delay before any reset operation to accommodate RTL8196E boot 144 | sl_udelay_wait(1000000); // 1s delay 145 | ``` 146 | 147 | The `main.c` file should now look like: 148 | 149 |

Main.c Modification

150 | 151 | Save the file. 152 | 153 | ______________________________________________________________________ 154 | 155 | ## Step 6: define post-build command to create gbl file 156 | 157 | The `rcp-uart-802154.gbl` file is not created by default. You have to 158 | define post-build instructions. Right-click on the project name and go to 159 | `properties --> C/C++ Build -> Settings --> Build Steps` and enter: 160 | 161 | ``` 162 | "C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\commander\commander.exe" gbl create rcp-uart-802154.gbl --app rcp-uart-802154.s37 163 | ``` 164 | 165 |

166 | Post-build RCP 167 |

168 | 169 | ______________________________________________________________________ 170 | 171 | ## Step 7: build the firmware 172 | 173 | Right-click on the project name (`rcp-uart-802154`) in the left-panel and 174 | click on `Build Project`. The compilation should run without any errors. 175 | The generated file `rcp-uart-802154.gbl` is located in the 176 | `GNU ARM v12.2.1 - Default directory` ready to be flashed. 177 | -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/firmware/rcp-uart-802154.gbl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/firmware/rcp-uart-802154.gbl -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image1.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image10.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image10.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image11.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image11.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image12.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image12.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image13.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image13.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image14.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image14.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image2.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image3.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image4.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image5.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image6.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image7.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image8.png -------------------------------------------------------------------------------- /1-Firmwares/15-RCP-UART-HW/media/image9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/1-Firmwares/15-RCP-UART-HW/media/image9.png -------------------------------------------------------------------------------- /1-Firmwares/README.md: -------------------------------------------------------------------------------- 1 | # Wireless Firmware Management 2 | 3 | ## Introduction 4 | 5 | This section documents the management, backup, and customization of 6 | wireless firmware running on the **EFR32MG1B** chip embedded in the Lidl 7 | Silvercrest Gateway. 8 | 9 | The objective is to safely replace the stock firmware with custom builds to 10 | support **Zigbee2MQTT (Z2M)**, **ZHA**, or **Matter over Thread** via an 11 | RCP interface. 12 | 13 | ______________________________________________________________________ 14 | 15 | ## Repository Structure 16 | 17 | ```text 18 | 1-Firmwares/ 19 | ├── 10-EZSP-Reference/ # EmberZNet and EZSP reference 20 | ├── 11-Simplicity-Studio/ # Installation and usage of Simplicity Studio V5 21 | ├── 12-Backup-Restore-Flash/ # Methods to back up and restore Zigbee firmware (HW/SWD or SW tools) 22 | ├── 13-Bootloader-UART-Xmodem/ # Flashing via UART using the Realtek bootloader 23 | ├── 14-NCP-UART-HW/ # NCP mode firmware (EZSP protocol) 24 | ├── 15-RCP-UART-HW/ # RCP mode firmware (OpenThread + CPC) 25 | └── README.md # This file 26 | ``` 27 | 28 | ______________________________________________________________________ 29 | 30 | ## Goals 31 | 32 | - 🔐 **Ensure firmware safety**: Learn to back up the original factory 33 | firmware before attempting any changes. 34 | - ⚙️ **Upgrade firmware**: Safely flash and switch between NCP and RCP 35 | firmware versions. 36 | - 🧰 **Enable development**: Set up Simplicity Studio for customizing and 37 | building your own firmware. 38 | 39 | ______________________________________________________________________ 40 | 41 | ## Key Topics Covered 42 | 43 | ### 🔁 Backup & Restore 44 | 45 | - Why and how to back up the Zigbee firmware (recommended before any 46 | flashing) 47 | - Use of hardware tools (e.g., SWD, ESP8266) and software-based methods 48 | 49 | ### 🛠 Simplicity Studio Setup 50 | 51 | - Installation of **Simplicity Studio V5** 52 | - Required SDKs, compilers and steps to open, modify and build Silabs 53 | projects 54 | 55 | ### 🔧 Firmware Compilation 56 | 57 | - How to compile NCP firmware (EZSP/UART) for Zigbee2MQTT or ZHA 58 | - How to compile RCP firmware for multiprotocol Matter/Thread + Zigbee 59 | - Where to find **precompiled binaries** for convenience 60 | 61 | ______________________________________________________________________ 62 | 63 | This section is essential for those who want to take full control of the 64 | Zigbee module and adapt the gateway to their own smart home ecosystem. 65 | -------------------------------------------------------------------------------- /2-Softwares/20-Backup-Restore/README.md: -------------------------------------------------------------------------------- 1 | # 🧠 Backup & Restore of Embedded Flash Memory (GD25Q127C) 2 | 3 | ## Overview 4 | 5 | The Lidl Silvercrest gateway includes a GD25Q127C flash chip (recognized as GD25Q128C by the Linux kernel) storing the bootloader, Linux kernel, root filesystem, and Zigbee configurations. 6 | 7 | > ⚠️ **Disclaimer** 8 | > Flashing or altering your gateway can permanently damage the device if done incorrectly. 9 | > Always ensure you have verified backups before proceeding. 10 | 11 | This guide explains how to **back up and restore** the embedded flash memory using three distinct methods, depending on your level of access to the system: 12 | 13 | --- 14 | 15 | ## 🔧 Method 1 – Linux Access via SSH 16 | 17 | ✅ Use this method if the gateway is bootable and reachable over SSH. 18 | 19 | ### 🔄 Backup 20 | 21 | On the gateway (via `ssh`), run: 22 | 23 | ```sh 24 | dd if=/dev/mtdx of=/tmp/mtdx.bin bs=1024k 25 | ``` 26 | 27 | Replace `x` with `0`, `1`, `2`, `3` or `4`. 28 | 29 | ⚠️ You must unmount `mtd4` before dumping it, as it is typically mounted read/write. 30 | 31 | On the host, retrieve the file using `ssh` (adjust port and IP as needed): 32 | 33 | ```sh 34 | ssh -p 2333 -o HostKeyAlgorithms=+ssh-rsa root@ "cat /tmp/mtdx.bin" > mtdx.bin 35 | ``` 36 | 37 | Once you have collected all partitions, concatenate them into a full image: 38 | 39 | ```sh 40 | cat mtd0.bin mtd1.bin mtd2.bin mtd3.bin mtd4.bin > fullmtd.bin 41 | ``` 42 | 43 | 💡 Refer to the script section at the end of this README to automate this process. 44 | 45 | --- 46 | 47 | ### ♻️ Restore 48 | 49 | ⚠️ This method will only work to restore original partitions coming from the **same** machine. Modified partitions or partiions coming from another machine will have to be restored with Method 2 below. 50 | ⚠️ Only restore partitions that are **not mounted**. 51 | - `mtd0` to `mtd3` are usually safe to write. 52 | - `mtd4` (overlay) is mounted read/write — unmount it before restoring. This generally means: 53 | ``` 54 | killall -q serialgateway 55 | umount /dev/mtdblock4 56 | ``` 57 | 58 | To restore, first transfer the file to the gateway: 59 | 60 | ```sh 61 | ssh -p 2333 -o HostKeyAlgorithms=+ssh-rsa root@ "cat > /tmp/rootfs-new.bin" < rootfs-new.bin 62 | ``` 63 | 64 | Then flash it: 65 | 66 | ```sh 67 | ssh -p 2333 -o HostKeyAlgorithms=+ssh-rsa root@ "dd if=/tmp/rootfs-new.bin of=/dev/mtd2 bs=1024k" 68 | ``` 69 | 70 | 💡 Refer to the script section at the end of this README for a simpler approach. 71 | 72 | 73 | ## 🔧 Method 2 – Bootloader Access (UART + TFTP) 74 | 75 | 🟠 Use this method if Linux no longer boots, but the Realtek bootloader is still accessible via UART. 76 | 77 | ⚠️ Note: If Linux fails to boot, it may be due to a corrupted partition. 78 | - In that case, backup via the bootloader might be **unreliable or incomplete**, 79 | - but restore can be useful **if you have previously created a valid backup using Method 1**. 80 | 81 | 82 | ### 🛠 Setup 83 | 84 | This second method will use Realtek bootloader's `FLR` and `FLW` commands to transfer files via TFTP. Therefore, a TFTP client must be available on your host.** 85 | 86 | #### Install a tftp client & server on your linux host 87 | ```sh 88 | sudo apt install tftp-hpa 89 | ``` 90 | 91 | #### Accessing the Bootloader 92 | - Connect a USB-to-serial adapter to your host, and wire its RX/TX pins to the gateway's UART interface. 93 | - Power on (or reboot) the gateway while pressing the ESC key until the prompt appears on the serial console. 94 | 95 | --- 96 | 97 | ### 🔄 Backup (via `FLR`) 98 | 99 | This procedure allows you to **extract the content of a specific MTD partition** from flash memory to RAM, and then download it to your host using `tftp`. 100 | 101 | The command `FLR` (Flash Load to RAM) instructs the bootloader to: 102 | - Read data from the SPI flash starting at the given offset 103 | - Load it into a specified address in RAM 104 | 105 | Then, the bootloader automatically exposes the RAM content via `tftp`, allowing the host to download it. 106 | 107 | #### Example: Backup of the `rootfs` (mtd2) 108 | 109 | On the bootloader: 110 | ```plaintext 111 | RealTek>FLR 80500000 00200000 00200000 112 | ``` 113 | - `80500000` → RAM address where data will be loaded 114 | - `00200000` → flash offset of mtd2 115 | - `00200000` → size of the partition in bytes (here: 2 MiB) 116 | 117 | From the host upload the file: 118 | ```sh 119 | tftp -m binary 192.168.1.6 -c get mtd2.bin 120 | ``` 121 | This command uploads the content from the RAM gateway to your host, storing it as `mtd2.bin`. 122 | 123 | 💡 You can repeat this process for each MTD partition (see reference table below). 124 | ⚠️ tftp is not a secure protocol. Repeat the process 2 or 3 times and make sure md5sum are equals 125 | ⚠️ A direct ethernet cable connection is always better :-) 126 | 127 | --- 128 | 129 | ### ♻️ Restore (via `FLW`) 130 | 131 | The `FLW` (Flash Write from RAM) command allows you to **write binary data stored in RAM** into a specific region of the SPI flash. 132 | 133 | This is typically used after a file has been transferred to the gateway via TFTP and loaded into RAM at a known address. 134 | 135 | The command format is: 136 | ```plaintext 137 | FLW 138 | ``` 139 | 140 | - `flash_offset`: destination in SPI flash (in hex) 141 | - `ram_address`: where the data is stored in RAM (in hex, e.g. `80500000`) 142 | - `length`: number of bytes to write (in hex) 143 | 144 | #### Example: Restore of the `rootfs` (mtd2) 145 | 146 | 1. On the bootloader: 147 | ```plaintext 148 | LOADADDR 80500000 149 | ``` 150 | 151 | 2. From the host, download the file to the gateway: 152 | ```sh 153 | tftp -m binary 192.168.1.6 -c put mtd2.bin 154 | ``` 155 | 156 | 3. Back on the bootloader, write to flash: 157 | ```plaintext 158 | FLW 00200000 80500000 00200000 0 159 | ``` 160 | 161 | This writes the file `mtd2.bin` (2 MiB) to SPI flash at offset `0x00200000`. 162 | 163 | ⚠️ Always double-check offset and size before writing to flash. This process is destructive. 164 | 165 | ⚠️ All values must be in **hexadecimal**. `AUTOBURN` should be **disabled** (default). 166 | 167 | --- 168 | 169 | ### 🧾 Quick Reference: FLR / FLW Commands by Partition 170 | 171 | | MTD | Description | Offset | Size | FLR Command | FLW Command | 172 | |---------|--------------------|------------|------------|--------------------------------------------------|--------------------------------------------------| 173 | | mtd0 | Bootloader + Config| 0x00000000 | 0x00020000 | `FLR 80500000 00000000 00020000` | `FLW 00000000 80500000 00020000` | 174 | | mtd1 | Kernel | 0x00020000 | 0x001E0000 | `FLR 80500000 00020000 001E0000` | `FLW 00020000 80500000 001E0000` | 175 | | mtd2 | Rootfs | 0x00200000 | 0x00200000 | `FLR 80500000 00200000 00200000` | `FLW 00200000 80500000 00200000` | 176 | | mtd3 | Tuya Label | 0x00400000 | 0x00020000 | `FLR 80500000 00400000 00020000` | `FLW 00400000 80500000 00020000` | 177 | | mtd4 | JFFS2 Overlay | 0x00420000 | 0x00BE0000 | `FLR 80500000 00420000 00BE0000` | `FLW 00420000 80500000 00BE0000` | 178 | 179 | --- 180 | 181 | ## 🔧 Method 3 – SPI Programmer (CH341A or Equivalent) 182 | 183 | 🔴 Use this method only if the bootloader is corrupted or the gateway is completely unresponsive. 184 | 185 | This method involves **physically desoldering the SPI flash chip (GD25Q127C)** from the board and using a USB SPI programmer (such as a CH341A) to read or write its content. 186 | 187 | ### 🛠 Required Hardware 188 | 189 | - A **CH341A** USB SPI programmer (inexpensive and widely available). Use the 25xx entry. 190 | - Make sure the chip is properly seated in the adapter. 191 | - A SOP8 to **200 mil** DIP adapter to insert the chip into the programmer 192 | - **Flux** and either **desoldering braid** or a **small desoldering pump** 193 | 194 | 195 |

196 | Launcher Tab 197 |

198 | 199 | 200 | ⚠️ The use of a programming clip **does not work** on the gateway board and is not recommended. 201 | 202 | ### ✅ Make sure the chip is recognized by `flashrom` 203 | 204 | ```sh 205 | jnilo@HP-ZBook:./flashrom -p ch341a_spi -c GD25Q128C 206 | flashrom v1.6.0-devel (git:v1.5.0-44-g4d4688cc) on Linux 6.8.0-57-generic (x86_64) 207 | flashrom is free software, get the source code at https://flashrom.org 208 | 209 | Found GigaDevice flash chip "GD25Q128C" (16384 kB, SPI) on ch341a_spi. 210 | No operations were specified. 211 | ``` 212 | If the package version provided by your linux distro does not detect the chip, check your connection and make sure to install the latest version of [flashrom](https://github.com/flashrom/flashrom). Information about installation can be found on the [flashrom web site](https://www.flashrom.org/). 213 | 214 | ### ♻️ Restore using `flashrom` 215 | 216 | To restore a previously saved image to the flash chip (like **fullmtd.bin** previously created using **Method 1**) use `flashrom` write mode `-w`(flash binary to chip) 217 | 218 | ```sh 219 | flashrom -p ch341a_spi -c GD25Q128C -w fullmtd.bin 220 | ``` 221 | 222 | The output will look like: 223 | 224 | ```sh 225 | jnilo@HP-ZBook:./flashrom -p ch341a_spi -c GD25Q128C -w fullmtd.bin 226 | flashrom v1.6.0-devel (git:v1.5.0-44-g4d4688cc) on Linux 6.8.0-57-generic (x86_64) 227 | flashrom is free software, get the source code at https://flashrom.org 228 | 229 | Found GigaDevice flash chip "GD25Q128C" (16384 kB, SPI) on ch341a_spi. 230 | Reading old flash chip contents... done. 231 | Updating flash chip contents... Erase/write done from 0 to ffffff 232 | Verifying flash... VERIFIED. 233 | jnilo@HP-ZBook: 234 | ``` 235 | 236 | 237 | ⚠️ **Be careful:** This operation will completely overwrite the chip content. 238 | ⚠️ **Be patient:** This operation takes a while. 239 | ⚠️ Ensure that `fullmtd.bin` is exactly **16 MiB (16,777,216 bytes)** and contains valid data. 240 | 241 | ## 📁 Included Scripts 242 | 243 | | Script | Method | Description | 244 | |------------------------------|-----------|---------------------------------------------| 245 | | `backup_mtd_via_ssh.sh` | Method 1 | Bakup one or all partitions via SSH + dd | 246 | | `restore_mtd_via_ssh.sh` | Method 1 | Restore one or all partitions via SSH + dd | 247 | 248 | 249 | -------------------------------------------------------------------------------- /2-Softwares/20-Backup-Restore/media/image1.jpeg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/20-Backup-Restore/media/image1.jpeg -------------------------------------------------------------------------------- /2-Softwares/20-Backup-Restore/scripts/backup_mtd_via_ssh.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # 3 | # backup_mtd_via_ssh.sh (Production version with selective backup) 4 | # 5 | # Usage: 6 | # ./backup_mtd_via_ssh.sh all 7 | # ./backup_mtd_via_ssh.sh mtd2 8 | # 9 | 10 | set -e 11 | 12 | PART="$1" 13 | GATEWAY_IP="$2" 14 | SSH_PORT=22 15 | SSH_USER="root" 16 | 17 | if [ -z "$PART" ] || [ -z "$GATEWAY_IP" ]; then 18 | echo "Usage: $0 " 19 | exit 1 20 | fi 21 | 22 | if [ "$PART" == "all" ]; then 23 | MTDS=(mtd0 mtd1 mtd2 mtd3 mtd4) 24 | else 25 | MTDS=("$PART") 26 | fi 27 | 28 | echo "[*] Starting MTD backup over SSH..." 29 | 30 | for mtd in "${MTDS[@]}"; do 31 | echo " - Dumping and retrieving $mtd..." 32 | if [ "$mtd" == "mtd4" ]; then 33 | ssh -p "$SSH_PORT" ${SSH_USER}@${GATEWAY_IP} " 34 | mtd='$mtd' 35 | MOUNT_POINT=\$(grep mtdblock\${mtd:3} /proc/mounts | awk '{print \$2}') 36 | if [ -n "\$MOUNT_POINT" ]; then 37 | echo "Detected mount point: \$MOUNT_POINT" >&2 38 | echo "Killing serialgateway..." >&2 39 | killall -q serialgateway 40 | echo "Unmounting \$mtd from \$MOUNT_POINT" >&2 41 | umount \$MOUNT_POINT 42 | echo "Backing up partition \$mtd to /tmp/\$mtd.bin..." >&2 43 | dd if=/dev/\$mtd of=/tmp/\$mtd.bin bs=1024k 44 | echo "Remounting \$mtd to \$MOUNT_POINT" >&2 45 | mount -t jffs2 /dev/mtdblock\${mtd:3} \$MOUNT_POINT 46 | echo "Restarting serialgateway..." >&2 47 | /tuya/serialgateway & 48 | else 49 | echo "\$mtd is not mounted. Proceeding with backup..." >&2 50 | dd if=/dev/\$mtd of=/tmp/\$mtd.bin bs=1024k 51 | fi 52 | echo "Reading dump for \$mtd..." >&2 53 | cat /tmp/\$mtd.bin 54 | echo "Cleaning up temporary file /tmp/\$mtd.bin" >&2 55 | rm /tmp/\$mtd.bin" > "$mtd.bin" 2> "$mtd.bin.log" 56 | else 57 | ssh -p "$SSH_PORT" ${SSH_USER}@${GATEWAY_IP} " 58 | echo "Backing up partition $mtd to /tmp/$mtd.bin..." >&2 59 | dd if=/dev/$mtd of=/tmp/$mtd.bin bs=1024k 60 | echo "Reading dump for $mtd..." >&2 61 | cat /tmp/$mtd.bin 62 | echo "Cleaning up /tmp/$mtd.bin" >&2 63 | rm /tmp/$mtd.bin" > "$mtd.bin" 2> "$mtd.bin.log" 64 | fi 65 | done 66 | 67 | if [ "$PART" == "all" ]; then 68 | echo "[*] Creating fullmtd.bin..." 69 | cat mtd0.bin mtd1.bin mtd2.bin mtd3.bin mtd4.bin > fullmtd.bin 70 | fi 71 | 72 | for mtd in "${MTDS[@]}"; do 73 | if [ -f "$mtd.bin" ]; then 74 | size=$(stat -c %s "$mtd.bin") 75 | fi 76 | done 77 | 78 | if [ "$PART" == "all" ] && [ -f fullmtd.bin ]; then 79 | size=$(stat -c %s fullmtd.bin) 80 | fi 81 | 82 | echo 83 | 84 | declare -A EXPECTED_SIZES 85 | EXPECTED_SIZES["mtd0"]=131072 86 | EXPECTED_SIZES["mtd1"]=1966080 87 | EXPECTED_SIZES["mtd2"]=2097152 88 | EXPECTED_SIZES["mtd3"]=131072 89 | EXPECTED_SIZES["mtd4"]=12451840 90 | 91 | for mtd in "${MTDS[@]}"; do 92 | if [ -f "$mtd.bin" ]; then 93 | size=$(stat -c %s "$mtd.bin") 94 | expected=${EXPECTED_SIZES[$mtd]} 95 | if [ "$size" -eq "$expected" ]; then 96 | echo " - $mtd.bin: $size bytes [OK]" 97 | else 98 | echo " - $mtd.bin: $size bytes [EXPECTED: $expected] [MISMATCH]" 99 | fi 100 | fi 101 | done 102 | 103 | if [ "$PART" == "all" ] && [ -f fullmtd.bin ]; then 104 | size=$(stat -c %s fullmtd.bin) 105 | if [ "$size" -eq 16777216 ]; then 106 | echo " - fullmtd.bin: $size bytes [OK]" 107 | else 108 | echo " - fullmtd.bin: $size bytes [EXPECTED: 16777216] [MISMATCH]" 109 | fi 110 | fi 111 | 112 | echo 113 | echo "[✔] Backup completed successfully!" 114 | -------------------------------------------------------------------------------- /2-Softwares/20-Backup-Restore/scripts/restore_mtd_via_ssh.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # 3 | # restore_mtd_via_ssh.sh 4 | # 5 | # Description: 6 | # This script restores one or all MTD partitions (mtd0 to mtd4) on the Lidl Silvercrest gateway via SSH. 7 | # It uploads local mtdX.bin files to the device and writes them using dd. 8 | # 9 | # Usage: 10 | # ./restore_mtd_via_ssh.sh all # restore all mtdX.bin files + fullmtd.bin optional 11 | # ./restore_mtd_via_ssh.sh mtd2 # restore only mtd2.bin 12 | # 13 | 14 | set -e 15 | 16 | PART="$1" 17 | GATEWAY_IP="$2" 18 | SSH_PORT=22 19 | SSH_USER="root" 20 | 21 | if [ -z "$PART" ] || [ -z "$GATEWAY_IP" ]; then 22 | echo "Usage: $0 " 23 | exit 1 24 | fi 25 | 26 | if [ "$PART" == "all" ]; then 27 | MTDS=(mtd0 mtd1 mtd2 mtd3 mtd4) 28 | else 29 | MTDS=("$PART") 30 | fi 31 | 32 | echo "[*] Starting MTD restore over SSH..." 33 | 34 | for mtd in "${MTDS[@]}"; do 35 | binfile="${mtd}.bin" 36 | if [ ! -f "$binfile" ]; then 37 | echo "[!] Skipping $mtd — file $binfile not found." 38 | continue 39 | fi 40 | 41 | echo " - Uploading and restoring $mtd..." 42 | 43 | if [ "$mtd" == "mtd4" ]; then 44 | ssh -p "$SSH_PORT" ${SSH_USER}@${GATEWAY_IP} " 45 | mtd='$mtd' 46 | MOUNT_POINT=\$(grep mtdblock\${mtd:3} /proc/mounts | awk '{print \$2}') 47 | if [ -n "\$MOUNT_POINT" ]; then 48 | echo "Detected mount point: \$MOUNT_POINT" >&2 49 | echo "Killing serialgateway..." >&2 50 | killall -q serialgateway 51 | echo "Unmounting \$mtd from \$MOUNT_POINT" >&2 52 | umount \$MOUNT_POINT 53 | fi 54 | cat > /tmp/\$mtd.bin 55 | echo "Flashing \$mtd..." >&2 56 | dd if=/tmp/\$mtd.bin of=/dev/\$mtd bs=1024k 57 | rm /tmp/\$mtd.bin 58 | if [ -n "\$MOUNT_POINT" ]; then 59 | echo "Remounting \$mtd to \$MOUNT_POINT" >&2 60 | mount -t jffs2 /dev/mtdblock\${mtd:3} \$MOUNT_POINT 61 | echo "Restarting serialgateway..." >&2 62 | /tuya/serialgateway & 63 | fi 64 | " < "$binfile" 2> "$binfile.log" 65 | else 66 | ssh -p "$SSH_PORT" ${SSH_USER}@${GATEWAY_IP} " 67 | cat > /tmp/$mtd.bin 68 | echo "Flashing $mtd..." >&2 69 | dd if=/tmp/$mtd.bin of=/dev/$mtd bs=1024k 70 | rm /tmp/$mtd.bin 71 | " < "$binfile" 2> "$binfile.log" 72 | fi 73 | done 74 | 75 | echo "[✔] Restore completed." 76 | -------------------------------------------------------------------------------- /2-Softwares/21-Linux_Kernel/README.md: -------------------------------------------------------------------------------- 1 | ## Linux Kernel 2 | 3 | The original Lidl/Gateway device uses Linux kernel version 3.10.90.\ 4 | At some point, I’m considering attempting an upgrade to kernel 5.10 LTS, 5 | built on a Debian Bullseye distribution.\ 6 | This is a significant challenge, as it requires updating and patching 7 | `binutils`, `GCC`, and `uClibc` (or `musl`) to accommodate the very 8 | peculiar RTL8196E chip. 9 | 10 | I cannot guarantee success — but I’d gladly welcome help from Linux kernel 11 | aficionados! 12 | 13 | ______________________________________________________________________ 14 | 15 | ### Summary: Challenges in Updating the Toolchain and Building Linux Kernel 5 for Realtek RTL8196E 16 | 17 | Updating the toolchain and compiling a recent Linux kernel (such as 5.10) 18 | for the Realtek RTL8196E SoC involves several technical hurdles due to its 19 | highly specialized architecture and limited upstream support. Key 20 | challenges include: 21 | 22 | 1. **Obsolete Toolchain (GCC and Binutils):**\ 23 | The RTL8196E CPU is based on a Lexra-derived MIPS architecture variant 24 | (`rlx4181`). Modern GNU toolchains (GCC and Binutils) have dropped — or 25 | never officially supported — these Lexra instruction set extensions. 26 | Developers must: 27 | 28 | - Apply unofficial patches to old versions of GCC (e.g., 4.8.x) and 29 | Binutils (e.g., 2.24). 30 | - Overcome build failures caused by incompatibilities with modern host 31 | environments (e.g., newer GCC/glibc versions). 32 | 33 | 2. **Lack of Official Lexra Support:**\ 34 | RTL8196E processors are derived from Lexra CPUs, which deviate notably 35 | from standard MIPS: 36 | 37 | - No floating-point unit (FPU); missing instructions like `LL/SC`. 38 | - Differences in exception handling and pipeline structures. 39 | 40 | These differences prevent out-of-the-box compilation with upstream 41 | toolchains and require extensive patching or configuration tuning. 42 | 43 | 3. **Aging and Patched uClibc Library:**\ 44 | RTL8196E firmware typically uses a lightweight C library such as 45 | `uClibc` instead of `glibc`, due to resource constraints. However: 46 | 47 | - `uClibc` is deprecated and lacks support for modern kernels 48 | (especially beyond 4.x). 49 | - Developers must apply architecture-specific patches to old versions 50 | (e.g., uClibc 0.9.33.2). 51 | - Compatibility with modern kernel headers and APIs is often 52 | problematic. 53 | 54 | 4. **Kernel Compatibility and Porting Effort:**\ 55 | Realtek SDKs historically use very old kernels (2.6.x or 3.x). Porting 56 | to kernel 5.x requires: 57 | 58 | - Migrating drivers for networking, memory controllers, and peripherals. 59 | - Adapting Realtek SDK platform code to the modern Linux kernel driver 60 | model. 61 | - Ensuring system stability despite differences in timing, interrupts, 62 | and DMA handling. 63 | 64 | 5. **Resource Constraints in Embedded Environment:**\ 65 | The RTL8196E is a resource-constrained embedded platform. Developers 66 | must: 67 | 68 | - Optimize the kernel and libraries for minimal memory and storage 69 | usage. 70 | - Ensure code changes do not exceed available RAM or flash size. 71 | 72 | 6. **Sparse Documentation and Community Support:**\ 73 | Official documentation is outdated or non-existent. Community knowledge 74 | is fragmented across forums, personal repositories, and experimental 75 | projects. 76 | 77 | ______________________________________________________________________ 78 | 79 | ### Previous Attempts to Update the Kernel and/or Toolchain 80 | 81 | Here are a few potentially useful resources (no guarantees!): 82 | 83 | - [OpenWrt Port for RTL8196E by Alter0ne](https://github.com/Alter0ne/rtl8196e) 84 | - [Pascal's Lexra toolchain and hacks](https://gist.github.com/hackpascal) 85 | - [Realtek Toolchain Repository](https://sourceforge.net/projects/rtl819x/files/) 86 | - [Lexra RLX4181 CPU and RTL8196E Linux Kernel Support (shibajee)](https://github.com/shibajee/linux-rtl8196e/) 87 | or [here](https://github.com/shibajee/linux-rtl8196e/releases) 88 | -------------------------------------------------------------------------------- /2-Softwares/22-Update the Root Filesystem/README.md: -------------------------------------------------------------------------------- 1 | # 🛠️ Installing the New Root Filesystem (rootfs) on the Gateway 2 | 3 | This guide explains how to install the new root filesystem (`newroot.bin`) and configure your gateway from either a **Windows** or a **Linux** host. 4 | 5 | > ⚠️ **Important:** Before proceeding, I urge you to back up your current flash partitions. See the [20-Backup-Restore section](../20-Backup-Restore/) 6 | 7 | --- 8 | 9 | ## ✨ What's New in This Root Filesystem 10 | 11 | This updated root filesystem includes several enhancements: 12 | 13 | - ✅ **[BusyBox 1.37.0](https://busybox.net/)** — latest version with a revised and optimized set of applets 14 | - ✅ **[Dropbear 2025.88](https://matt.ucc.asn.au/dropbear/dropbear.html)** — latest version with key-only login support, and no more `-o HostKeyAlgorithms=+ssh-rsa` needed 15 | - ✅ **Serialgateway Supervisor** — extends Paul Bank’s original tool with automatic restart on disconnection 16 | - ✅ **Streamlined Init Scripts** — core scripts reside in the read-only SquashFS (`mtd2`), while editable ones are in the writable user space (`mtd4`) 17 | - ✅ **No More `/tuya` in mtd4** — all Tuya-related components have been removed; `mtd3` is still defined but unused 18 | - ✅ **Custom RootFS Support** — follow [Create the Root Filesystem](../23-Create%20the%20Root%20Filesystem/) to build your own 19 | - ✅ All binaries (busybox, dropbear, serialgateway) are **statically compiled**, keeping total size around 389 KB 20 | 21 | Enjoy your clean and powerful embedded Linux environment! 22 | 23 | --- 24 | 25 | ## 📦 Step 1: Unpack `userdata.tar` on the Gateway 26 | 27 | ### 1. Connect the Gateway 28 | 29 | - **Ethernet** connection 30 | - **Serial terminal** (38400 bauds, 8N1) 31 | 32 | ⚠️ Use a terminal with **auto-reconnection** capability when rebooting the gateway. 33 | 34 | - **Windows**: 35 | - I personally use a windows terminal launching [Simply Serial](https://github.com/fasteddy516/SimplySerial) with the following command line:: 36 | ```sh 37 | ss -c:4 -b:38400 -p:none -d:8 -s:1 -quiet -nostatus 38 | ``` 39 | - [TeraTerm](https://github.com/TeraTermProject/teraterm/releases) is also an excellent choice. 40 | - Avoid *Putty* which does not handle serial adapter disconnect. 41 | 42 | - **Linux**: 43 | - [Minicom](https://help.ubuntu.com/community/Minicom) is the natural choice. 44 | 45 | --- 46 | 47 | ### 2. Transfer `userdata.tar` to the Gateway 48 | 49 | - **Windows**: 50 | ```sh 51 | type userdata.tar | ssh -oHostKeyAlgorithms=+ssh-rsa root@gateway_ip "cat > /tuya/userdata.tar" 52 | ``` 53 | 54 | - **Linux**: 55 | ```sh 56 | ssh -oHostKeyAlgorithms=+ssh-rsa root@gateway_ip "cat > /tuya/userdata.tar" < userdata.tar 57 | ``` 58 | 59 | --- 60 | 61 | ### 3. Unpack the Archive 62 | 63 | ```sh 64 | cd /tuya 65 | tar -xf userdata.tar 66 | ``` 67 | Here is the content of userdata.tar. Most files are symlinked to the readonly squashfs rootfs but can be modified since they are stored on the writable partition (mtd4) of the gateway. 68 | ```sh 69 | ├── etc 70 | │   ├── TZ # Variable defining your local time zone 71 | │   ├── dropbear # Directory containing dropbear server keys (generated once at first logging) 72 | │   ├── eth1.bak # eth1.conf sample file for defining eth1 fixed IP 73 | │   ├── hostname # Now zigbeegw but you can rename it :-) 74 | │   ├── init.d # user script directory. You can add more or modify those provided below 75 | │   │   ├── S20time # By default launch once the ntp client to set the local time. See script header. 76 | │   │   ├── S30dropbear # Launch dropbear. Can be modified to restrict login through keys only. See script header. 77 | │   │   └── S60serialgateway # Launch my own version of serialgateway. See below for more details. 78 | │   ├── motd # Message of the day. Can be modified. 79 | │   ├── ntp.conf # ntp client servers 80 | │   ├── passwd # root password file 81 | │   └── profile # terminal settings. 82 | ├── ssh 83 | │   └── authorized_keys # file to store your hosts public keys 84 | └── usr 85 | ├── bin # You can add here any program you would like to use 86 | │   ├── serialgateway # Supervise serialgateway.real to make sure serialgateway is always up and running 87 | │   └── serialgateway.real # The "real", historical serialgateway. 88 | └── sbin # You can add here any program you would like to use 89 | ``` 90 | 91 | --- 92 | 93 | ### 4. Customize `/tuya/etc` 94 | 95 | #### 4.1 Disable Logging (optional) 96 | By default `syslogd` and `klogd` daemons will be started on reboot by `S05syslog`. If you want to disable those daemons: 97 | ```sh 98 | touch /tuya/etc/nosyslog 99 | ``` 100 | 101 | #### 4.2 Set Timezone in POSIX TZ format 102 | The info can be found from your host linux machine with a `cat` command: 103 | ```sh 104 | cat /usr/share/zoneinfo/Europe/Paris | strings | tail -1 105 | # CET-1CEST,M3.5.0,M10.5.0/3 106 | ``` 107 | 108 | Place output in `/tuya/etc/TZ` (i.e.: `echo "CET-1CEST,M3.5.0,M10.5.0/3" > /tuya/etc/TZ`). 109 | 110 | #### 4.3 Set Static IP (optional) 111 | 112 | ```sh 113 | mv /tuya/etc/eth1.bak /tuya/etc/eth1.conf 114 | ``` 115 | 116 | Edit `eth1.conf` to match your network. 117 | 118 | #### 4.4 Misc 119 | 120 | Adjust: 121 | - `hostname` and `motd` 122 | - `S20time`, `S30dropbear` scripts (see headers) 123 | 124 | --- 125 | 126 | ## 💻 Step 2: Transfer `newroot.bin` to the Gateway 127 | 128 | The flashing procedure is identical for both Windows and Linux. The only difference is how the newroot.bin file is transferred to the gateway. 129 | 130 | Download `newroot.bin` and place it in the Downloads folder of your host (linux or windows). 131 | 132 | Reboot the gateway trough the serial terminal while pressing `Esc` to access the `Realtek>` bootloader prompt. By default the bootloader is reachable over TFTP at `IP=192.168.1.6`. This address can be changed through the `IPCONFIG` bootloader command (e.g. `IPCONFIG 10.0.0.1`) if already being used or if your host is not on the same subnet. 133 | 134 | ### 🪟 Windows: Use Tftpd64 135 | 136 | 1. Download from [official site](https://pjo2.github.io/tftpd64/). Windows original `tftp` client won't work. 137 | Mirrors: 138 | * [https://tftpd64.apponic.com/download/](https://tftpd64.apponic.com/download/) 139 | * [https://tftpd64.software.informer.com/](https://tftpd64.software.informer.com/) 140 | * [https://en.freedownloadmanager.org/Windows-PC/Tftpd64-FREE.html](https://en.freedownloadmanager.org/Windows-PC/Tftpd64-FREE.html) 141 | 2. Launch the **TFTP client** tab: 142 | - Host: `192.168.1.6` 143 | - Local File: `newroot.bin` 144 | - Remote File: `newroot.bin` 145 | - Click **Put** 146 | See the following picture with a Teraterm terminal on the left and Tftpd64 client on the right. 147 |

148 | Launcher Tab 149 |

150 | ### 🐧 Linux: Use `tftp-hpa` 151 | 152 | ```sh 153 | tftp -m binary 192.168.1.6 -c put newroot.bin 154 | ``` 155 | 156 | --- 157 | 158 | ## 🔧 Flash the Image from the Bootloader 159 | 160 | 1. Wait for this after transfer: 161 | 162 | ``` 163 | 164 | **TFTP Client Upload File Size = 00061002 Bytes at 80500000 165 | Success! 166 | ``` 167 | 168 | 2. Flash it: 169 | 170 | ```sh 171 | FLW 200000 80500000 00061002 172 | ``` 173 | Make sure that File Size is 00061002 before proceeding to the next step. 174 | 3. Confirm when prompted: 175 | 176 | ``` 177 | (Y)es, (N)o->Y 178 | ``` 179 | 180 | 4. Reboot — first boot will generate SSH keys, so be patient. 181 | 182 | --- 183 | 184 | ## 🔐 Post-Install Steps 185 | 186 | 1. **Login**: `root` / `root` 187 | 2. **Change password**: 188 | ```sh 189 | passwd 190 | ``` 191 | 3. **Clean legacy Tuya content**: 192 | 193 | ```sh 194 | for f in /userdata/*; do 195 | case "$f" in 196 | /userdata/etc|/userdata/ssh|/userdata/usr) continue ;; 197 | *) rm -rf "$f" ;; 198 | esac 199 | done 200 | ``` 201 | 202 | --- 203 | 204 | ## ✅ You're Done! 205 | 206 | Your gateway is now running a clean and flexible root filesystem. 207 | -------------------------------------------------------------------------------- /2-Softwares/22-Update the Root Filesystem/media/image1.jpeg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/22-Update the Root Filesystem/media/image1.jpeg -------------------------------------------------------------------------------- /2-Softwares/22-Update the Root Filesystem/newroot.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/22-Update the Root Filesystem/newroot.bin -------------------------------------------------------------------------------- /2-Softwares/22-Update the Root Filesystem/userdata.tar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/22-Update the Root Filesystem/userdata.tar -------------------------------------------------------------------------------- /2-Softwares/23-Create the Root Filesystem/README.md: -------------------------------------------------------------------------------- 1 | # 🧰 source_rootfs – Build Environment for Lidl Silvercrest Gateway (RTL8196E) 2 | 3 | This directory provides everything you need to **build and deploy** a custom root filesystem (`newroot.bin`) and a writable user overlay (`userdata.tar`) for the Lidl Silvercrest Zigbee gateway based on a Realtek RTL8196E SoC. 4 | 5 | It includes: 6 | 7 | - ✅ A static cross-compiled **BusyBox** base system 8 | - ✅ A lightweight static **Dropbear SSH server** 9 | - ✅ A custom **Serial-to-TCP gateway** for UART bridging 10 | - ✅ The official **Realtek RSDK 4.4.7** MIPS toolchain 11 | - ✅ A staging layout that mimics the gateway's `/` and `/userdata` partitions 12 | 13 | > 🧪 This environment can also be used to **cross-compile additional binaries** or utilities for the RTL8196E (MIPS-Lexra), making it a general-purpose embedded development framework. 14 | 15 | --- 16 | 17 | ## 📦 Getting Started 18 | 19 | 1. Download the archive [`source_rootfs.tar.gz`](https://github.com/jnilo1/hacking-lidl-silvercrest-gateway/blob/main/2-Softwares/23-Create%20the%20Root%20Filesystem/source_rootfs.tar.gz) 20 | 2. Extract it in your working directory: 21 | 22 | ```sh 23 | tar -xvzf source_rootfs.tar.gz 24 | cd source_rootfs 25 | ``` 26 | 27 | --- 28 | 29 | ## 📁 Directory Structure Overview 30 | 31 | ``` 32 | source_rootfs/ 33 | ├── build_busybox # Build static BusyBox 34 | ├── build_dropbear # Build static Dropbear SSH 35 | ├── build_rootfs # Generate squashfs + newroot.bin 36 | ├── build_serialgateway # Build UART-to-TCP bridge 37 | ├── build_userdata # Archive ./userdata into userdata.tar 38 | ├── busybox.config # BusyBox config file 39 | ├── rootfs/ # Rootfs staging area 40 | │ ├── squashfs-root/ # Populated squashfs tree 41 | │ └── rootfs_tool.py # Packs final image 42 | ├── rsdk-4.4.7.../ # Realtek MIPS toolchain 43 | ├── serialgateway/ # Source code + Makefile 44 | ├── setup.sh # Ubuntu dependency installer 45 | ├── userdata/ # Overlay staging for /userdata 46 | └── README.md # This document 47 | ``` 48 | 49 | --- 50 | 51 | ## ⚙️ Build Procedure 52 | 53 | Run the following commands in order: 54 | 55 | ```sh 56 | ./setup.sh # Install required packages (Ubuntu) 57 | ./build_busybox # Build BusyBox statically 58 | ./build_dropbear # Build Dropbear statically 59 | ./build_serialgateway # Build and install serialgateway 60 | ./build_userdata # Package userdata.tar 61 | ``` 62 | 63 | This will generate: 64 | 65 | - `rootfs/newroot.bin`: Flashable rootfs image (`mtd2`) 66 | - `userdata.tar`: Overlay with configs, SSH keys (`mtd4`) 67 | 68 | --- 69 | 70 | ## 🚀 Flashing Instructions 71 | 72 | ### 1. Connect the Gateway 73 | 74 | - **Serial** (38400 8N1, via `minicom` (linux), `teraterm` (windows), etc.) 75 | - **Ethernet** to your LAN 76 | 77 | ### 2. Enter Bootloader Mode 78 | 79 | ```sh 80 | reboot 81 | ``` 82 | 83 | Reboot while pressing `ESC`. You should see: 84 | 85 | ``` 86 | 87 | ``` 88 | 89 | --- 90 | 91 | ### 3. Flash the Root Filesystem 92 | 93 | From the host: 94 | 95 | ```sh 96 | ./build_rootfs 97 | ``` 98 | 99 | This uses TFTP to send `newroot.bin`. 100 | When prompted, copy/paste the suggested `FLW` command in the serial console to flash `mtd2`. 101 | 102 | --- 103 | 104 | ### 4. Deploy Writable Overlay 105 | 106 | Once rebooted: 107 | 108 | - Copy `userdata.tar` to the device via `scp` or `ssh` 109 | - Unpack into `/userdata` to restore configuration 110 | 111 | --- 112 | 113 | ## 👷 Adding Your Own Binaries 114 | 115 | To include custom tools: 116 | 117 | 1. Create a `build_` script similar to the others 118 | 2. Cross-compile using `rsdk-4.4.7...` 119 | 3. Place binaries in: 120 | - `rootfs/squashfs-root/usr/bin/` or 121 | - `rootfs/squashfs-root/usr/sbin/` 122 | 4. Rerun: 123 | 124 | ```sh 125 | ./build_rootfs 126 | ``` 127 | 128 | --- 129 | 130 | ## 🧠 Technical Notes 131 | 132 | - Root filesystem (`mtd2`) is mounted **read-only** 133 | - `/userdata` (`mtd4`) is writable (JFFS2 or tmpfs) 134 | - All binaries are **statically linked** to ensure minimal dependencies 135 | -------------------------------------------------------------------------------- /2-Softwares/23-Create the Root Filesystem/source_rootfs.tar.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/23-Create the Root Filesystem/source_rootfs.tar.gz -------------------------------------------------------------------------------- /2-Softwares/24-RCP-Daemons/241-cpcd/README.md: -------------------------------------------------------------------------------- 1 | # Building and Running CPC Daemon (cpcd) Locally with TCP Support 2 | 3 | This document explains how to set up and run the CPC Daemon (`cpcd`) 4 | locally for environments requiring TCP communication instead of direct 5 | UART. It covers using `socat` to bridge TCP connections to a virtual serial 6 | device and explains how to configure and run `cpcd`. 7 | 8 | ## Prerequisites 9 | 10 | - Linux OS (Ubuntu/Debian recommended) 11 | - `socat` installed (`sudo apt-get install socat`) 12 | - Silicon Labs CPC Daemon (`cpcd`) sources cloned locally 13 | 14 | ## Setup Overview 15 | 16 | The installation process will place `cpcd` binaries and default 17 | configuration files in system directories (`/usr/local/bin` and 18 | `/usr/local/etc`). 19 | 20 | The standard `cpcd.conf` file doesn't support direct TCP socket 21 | definitions. To circumvent this, we use `socat` to create a virtual UART 22 | device that forwards communications to a TCP socket. 23 | 24 | ## Step-by-Step Instructions 25 | 26 | ### 1. Clone and Build `cpcd` 27 | 28 | Clone the CPC Daemon repository: 29 | 30 | ```bash 31 | git clone https://github.com/SiliconLabs/cpc-daemon.git 32 | cd cpc-daemon 33 | mkdir build 34 | cd build 35 | cmake .. 36 | make 37 | sudo make install 38 | ``` 39 | 40 | Optionally, after installation, you may remove the `cpc-daemon` directory: 41 | 42 | ```bash 43 | cd ../.. 44 | rm -rf cpc-daemon 45 | ``` 46 | 47 | ### 2. Configure Virtual Serial Device with `socat` 48 | 49 | Run `socat` to create a virtual serial port (`ttycpcd`) pointing to your 50 | remote CPC secondary via TCP (replace `` with the actual 51 | gateway IP address): 52 | 53 | ```bash 54 | sudo socat PTY,link=/dev/ttycpcd,raw TCP::8888 55 | ``` 56 | 57 | Note: The virtual serial device (`ttycpcd`) created by `socat` disappears 58 | whenever `socat` stops or encounters an error. Always ensure `socat` is 59 | running before starting `cpcd`, and verify that `/dev/ttycpcd` exists. 60 | 61 | ### 3. Configure `cpcd.conf` 62 | 63 | Create and edit your `cpcd.conf` configuration file as follows: 64 | 65 | ```bash 66 | sudo nano /usr/local/etc/cpcd.conf 67 | ``` 68 | 69 | Insert: 70 | 71 | ``` 72 | instance_name: cpcd_0 73 | bus_type: UART 74 | uart_device_file: /dev/ttycpcd 75 | uart_device_baud: 115200 76 | uart_hardflow: true 77 | stdout_trace: false 78 | trace_to_file: false 79 | traces_folder: /tmp/traces 80 | enable_frame_trace: false 81 | rlimit_nofile: 2000 82 | disable_encryption: true # Must match the 'CPC Security' setting of the RCP-UART firmware 83 | ``` 84 | 85 | ### 4. Running `cpcd` 86 | 87 | #### Auto-starting socat and cpcd with systemd 88 | 89 | To automatically restart `socat` and `cpcd` after system reboot (e.g., 90 | after a power failure), configure systemd user units as follows (replace 91 | `` with the actual gateway IP address): 92 | 93 | Create the file `/etc/systemd/system/socat-cpcd.service`: 94 | 95 | ```ini 96 | [Unit] 97 | Description=Socat Virtual Serial to TCP for CPCD 98 | After=network.target 99 | 100 | [Service] 101 | ExecStart=/usr/bin/socat PTY,link=/dev/ttycpcd,raw TCP::8888 102 | Restart=always 103 | RestartSec=5 104 | 105 | [Install] 106 | WantedBy=default.target 107 | ``` 108 | 109 | Create another unit file `cpcd.service`: 110 | 111 | ```ini 112 | [Unit] 113 | Description=CPC Daemon 114 | After=socat-cpcd.service 115 | Requires=socat-cpcd.service 116 | 117 | [Service] 118 | ExecStart=/usr/local/bin/cpcd 119 | Restart=always 120 | RestartSec=5 121 | 122 | [Install] 123 | WantedBy=default.target 124 | ``` 125 | 126 | Activate these services: 127 | 128 | ```bash 129 | sudo systemctl daemon-reload 130 | sudo systemctl enable socat-cpcd.service cpcd.service 131 | sudo systemctl start socat-cpcd.service cpcd.service 132 | ``` 133 | 134 | ### 5. Verifying Communication 135 | 136 | To check if `cpcd` has started correctly, use the following methods: 137 | 138 | #### Check the systemd service status 139 | 140 | If you started `cpcd` with `systemd`, check its status. If `cpcd` is 141 | running correctly, you should see `Active: active (running)` in the output. 142 | 143 | ```bash 144 | jnilo@raspberrypi:/usr/local/etc$ systemctl status cpcd 145 | ● cpcd.service - CPC Daemon 146 | Loaded: loaded (/etc/systemd/system/cpcd.service; enabled; preset: enabled) 147 | Active: active (running) since Sun 2025-03-16 13:43:49 CET; 1min 13s ago 148 | Invocation: 8a80a80df7fb459380e830d41b04dbc4 149 | Main PID: 150411 (cpcd) 150 | Tasks: 5 (limit: 697) 151 | Memory: 604K (peak: 1.5M) 152 | CPU: 75ms 153 | CGroup: /system.slice/cpcd.service 154 | └─150411 /usr/local/bin/cpcd 155 | 156 | Mar 16 13:43:50 raspberrypi cpcd[150411]: [2025-03-16T12:43:49.569960Z] Info : ENCRYPTION IS DISABLED 157 | Mar 16 13:43:50 raspberrypi cpcd[150411]: [2025-03-16T12:43:49.581447Z] Info : Starting daemon in normal mode 158 | Mar 16 13:43:50 raspberrypi cpcd[150411]: [2025-03-16T12:43:49.594782Z] Info : Connecting to Secondary... 159 | Mar 16 13:43:51 raspberrypi cpcd[150411]: [2025-03-16T12:43:50.708321Z] Info : RX capability is 256 bytes 160 | Mar 16 13:43:51 raspberrypi cpcd[150411]: [2025-03-16T12:43:50.708349Z] Info : Connected to Secondary 161 | Mar 16 13:43:51 raspberrypi cpcd[150411]: [2025-03-16T12:43:50.718283Z] Info : Secondary Protocol v5 162 | Mar 16 13:43:51 raspberrypi cpcd[150411]: [2025-03-16T12:43:50.738262Z] Info : Secondary CPC v4.4.5 163 | Mar 16 13:43:51 raspberrypi cpcd[150411]: [2025-03-16T12:43:50.758278Z] Info : Secondary bus bitrate is 115200 164 | Mar 16 13:43:51 raspberrypi cpcd[150411]: [2025-03-16T12:43:50.778203Z] Info : Secondary APP vUNDEFINED 165 | Mar 16 13:43:51 raspberrypi cpcd[150411]: [2025-03-16T12:43:50.778667Z] Info : Daemon startup was successful. Waiting for client connections 166 | jnilo@raspberrypi:/usr/local/etc$ 167 | 168 | 169 | ``` 170 | 171 | #### Check logs using journalctl 172 | 173 | To view logs from `cpcd`, use: 174 | 175 | ```bash 176 | journalctl -u cpcd.service --follow 177 | ``` 178 | 179 | This will display live logs of `cpcd` in real-time. 180 | 181 | ## Troubleshooting 182 | 183 | - **Ensure Firewall Settings:** Confirm that port `8888` on the remote CPC 184 | secondary device (``) is open. 185 | - **Check Virtual UART Link:** Confirm `/dev/ttycpcd` exists and is 186 | accessible by `cpcd`. 187 | 188 | ## Additional Resources 189 | 190 | - [Official Silicon Labs CPC Documentation](https://docs.silabs.com/bluetooth/latest/multiprotocol-solution-linux/building-cpcd-locally#building-cpcd-locally) 191 | -------------------------------------------------------------------------------- /2-Softwares/24-RCP-Daemons/242-zigbeed/README.md: -------------------------------------------------------------------------------- 1 | # zigbeed 2 | 3 | `zigbeed` is a lightweight daemon designed specifically for managing Zigbee 4 | networks using the Silicon Labs RCP-UART firmware. It bridges Zigbee 5 | devices with TCP/IP-based clients or local processes, simplifying their 6 | integration into home automation ecosystems. 7 | 8 | ## Purpose and Benefits 9 | 10 | Using `zigbeed` with RCP-UART firmware has several advantages compared to 11 | other Zigbee management solutions: 12 | 13 | - **Efficiency**: Minimal resource consumption, ideal for embedded 14 | environments. This is especially true for the Lidl/Silvercrest gateway, 15 | whose EFR32MG1B232F256 chip has only 256K of memory. 16 | - **Reliability**: Robust handling of communication errors, ensuring stable 17 | operation. 18 | - **Easy Integration:** Compatible with home automation platforms like Home 19 | Assistant or zigbee2mqtt via TCP connections. 20 | - **Flexible and Scalable:** Running `zigbeed` allows easy network 21 | management, facilitating debugging and improving maintainability on host 22 | systems with more resources, while leaving the Zigbee gateway dedicated 23 | to low-level operations. 24 | 25 | ## How it Works 26 | 27 | `zigbeed` communicates directly over UART with the Silicon Labs Zigbee RCP 28 | firmware, converting Zigbee frames into network packets. This facilitates 29 | remote or local management of Zigbee devices seamlessly. 30 | 31 | ## Building Zigbeed 32 | 33 | **Prerequisite:** Before building `zigbeed`, you must install `cpcd` and 34 | ensure it is running correctly. See the [cpcd build instructions](../cpcd). 35 | 36 | For a Zigbee RCP setup with `cpcd`, `zigbeed` must be built and installed 37 | to manage the Zigbee Networking Stack. The following steps outline the 38 | process for compiling and deploying `zigbeed` on your host system. 39 | 40 | ### 1. Checking Host Architecture 41 | 42 | Before proceeding with the installation, check the architecture of the host 43 | system where `zigbeed` will be installed. On a Raspberry Pi 3, for example, 44 | you can verify this with: 45 | 46 | ```sh 47 | uname -m 48 | ``` 49 | 50 | If the output is: 51 | 52 | ```sh 53 | aarch64 54 | ``` 55 | 56 | This indicates a 64-bit ARM architecture. Other possible results include: 57 | 58 | - `x86_64` for a 64-bit x86 architecture. 59 | - `armv7l` for a 32-bit ARM architecture. 60 | 61 | In the next step are going to generate the corresponding `zigbeed` source 62 | file for your platform. Pre-configured source files for ARM32, ARM64, and 63 | X86_64 architectures are available in the [source](./source/) subdirectory. 64 | These files have been generated with the Gecko SDK version **4.4.6**, 65 | ensuring compatibility with the 66 | [RCP firmware](../../gateway_firmware/RCP-UART-HW/firmware) built from the 67 | same SDK version. 68 | 69 | ### 2. Build Process 70 | 71 | 2.1. In Simplicity Studio create a new zigbeed project: **File > New > 72 | Silicon Labs Project Wizard**. 73 | 74 | 2.2. Select your Target Device: **Linux 32 bit or Linux 64 bit**. 75 | 76 | 2.3. Select your IDE / Toolchain: **Makefile IDE**. 77 | 78 |

79 | linux64 80 |

81 | Enter Next 82 | 83 | 2.4. Search for **zigbeed** and Select the **Zigbee - Host zigbeed** 84 | project. 85 | 86 |

87 | zigbeed 88 |

89 | Enter Next 90 | 91 | 2.5. Before clicking Finish, it is recommended to select **Copy Contents**. 92 | This simplifies building the application on the `zigbeed` host by copying 93 | all required SDK files (rather than symlinking). 94 | 95 |

96 | zigbeed 97 |

98 | Enter Finish 99 | 100 | 2.6. In `zigbeed` Software components Tab search for `Zigbee ARM64` and 101 | Install the component: 102 | 103 |

104 | zigbeed 105 |

106 | 107 | **Note:** You may have to search for `Zigbee x86_64` or `Zigbee ARM32` 108 | depending on your host architecture (see Host Architecture above). 109 | 110 | 2.7. Zip the `zigbeed` folder in `v5_workspace`. The `zigbeed`source file 111 | is now ready for compilation on the host. 112 | 113 | 2.8. Transfer the file on the host and unzip the `zigbeed` folder. 114 | 115 | 2.9. Navigate into the `zigbeed` folder and build `zigbeed`: 116 | 117 | ```sh 118 | make -f zigbeed.Makefile 119 | ``` 120 | 121 | 2.10. Upon successful build, the executable will be located in 122 | `./build/debug/zigbeed`. We strip it and move it to `/usr/local/bin` 123 | 124 | ``` 125 | strip --strip-unneeded build/debug/zigbeed 126 | sudo install -m 755 build/debug/zigbeed /usr/local/bin/zigbeed 127 | ``` 128 | 129 | You can now - optionally - delete the installation directory. 130 | 131 | ### 3. Configure Virtual Serial Devices with `socat` 132 | 133 | The `socat` command is used to create virtual serial ports to connect the 134 | `zigbeed` daemon to the host application (e.g. Zigbee2MQTT). This is 135 | necessary because `zigbeed` communicates with the RCP via the CPC daemon 136 | (`cpcd`), but often the host application expects a traditional serial port 137 | interface. 138 | 139 | ```sh 140 | sudo socat pty,link=/dev/ttyZigbeeNCP pty,link=/tmp/ttyZigbeeNCP 141 | ``` 142 | 143 | Explanation: 144 | 145 | - `socat`: A multipurpose relay tool that creates bidirectional data 146 | streams between two endpoints. 147 | - `pty,link=/dev/ttyZigbeeNCP`: Creates a virtual serial port 148 | (pseudo-terminal) and links it to `/dev/ttyZigbeeNCP`. 149 | `/dev/ttyZigbeeNCP` is the virtual serial port that Zigbee2MQTT will 150 | connect to. 151 | - `pty,link=/tmp/ttyZigbeeNCP`: Creates another virtual serial port and 152 | links it to `/tmp/ttyZigbeeNCP`. `/tmp/ttyZigbeeNCP` is the socket file 153 | that zigbeed will create and use for communication. 154 | 155 | Why is socat Needed? 156 | 157 | - `zigbeed` communicates with the RCP via the CPC daemon (`cpcd`) and 158 | exposes its interface as a socket (`/tmp/ttyZigbeeNCP`). 159 | - `Zigbee2MQTT`, however, expects a traditional serial port (e.g., 160 | `/dev/ttyZigbeeNCP`). 161 | - `socat` bridges the gap by creating a virtual serial port 162 | (`/dev/ttyZigbeeNCP`) that forwards data to the socket 163 | (`/tmp/ttyZigbeeNCP`). 164 | 165 | ### 4. Configure `zigbeed.conf` 166 | 167 | Create and edit your `zigbeed.conf` configuration file as follows: 168 | 169 | ```bash 170 | sudo nano /usr/local/etc/zigbeed.conf 171 | ``` 172 | 173 | Insert: 174 | 175 | ``` 176 | # radio-url: Specifies the connection to the Radio Co-Processor (RCP). 177 | # The format is `spinel+cpc://?`. 178 | # - `cpcd_0`: Refers to the instance of the CPC daemon (cpcd) managing the RCP. 179 | # - `iid=1`: Instance ID of the RCP (must match the ID used by cpcd). 180 | # - `iid-list=0`: List of instance IDs to query (0 means all). 181 | radio-url=spinel+cpc://cpcd_0?iid=1&iid-list=0 182 | 183 | # ezsp-interface: Specifies the path to the virtual serial port (socket) that zigbeed will create. 184 | # This is the interface that Zigbee2MQTT will connect to. 185 | # `/tmp/ttyZigbeeNCP` is the socket file that zigbeed will create. 186 | ezsp-interface=/tmp/ttyZigbeeNCP 187 | 188 | # debug-level: Sets the verbosity of logging. 189 | # - `5`: Maximum debug level (useful for troubleshooting). 190 | debug-level=5 191 | 192 | # verbose: Enables additional verbose logging if set to a non-empty value. 193 | # (Currently empty in your configuration.) 194 | verbose= 195 | ``` 196 | 197 | ## Running Zigbeed 198 | 199 | ### Auto-starting socat and zigbeed with systemd 200 | 201 | To automatically restart `socat` and `zigbeed` after system reboot (e.g., 202 | after a power failure), configure systemd user units as follows: 203 | 204 | In the `/etc/systemd/system/`directory create the `socat-zigbeed.service` 205 | file: 206 | 207 | ```ini 208 | [Unit] 209 | Description=Socat Virtual Serials for Zigbeed 210 | After=network.target 211 | 212 | [Service] 213 | ExecStart=/usr/bin/socat pty,link=/dev/ttyZigbeeNCP pty,link=/tmp/ttyZigbeeNCP 214 | Restart=always 215 | RestartSec=5 216 | 217 | [Install] 218 | WantedBy=default.target 219 | ``` 220 | 221 | In the same directory create another `zigbeed.service` file: 222 | 223 | ```ini 224 | [Unit] 225 | Description=zigbeed Daemon 226 | After=socat-zigbeed.service 227 | Requires=cpcd.service 228 | 229 | [Service] 230 | ExecStart=/usr/local/bin/zigbeed 231 | Restart=always 232 | RestartSec=5 233 | 234 | [Install] 235 | WantedBy=default.target 236 | ``` 237 | 238 | Activate these services: 239 | 240 | ```bash 241 | sudo systemctl daemon-reload 242 | sudo systemctl enable socat-zigbeed.service zigbeed.service 243 | sudo systemctl start socat-zigbeed.service zigbeed.service 244 | ``` 245 | 246 | ### 5. Verifying Communication 247 | 248 | To check if `zigbeed` has started correctly, use the following methods: 249 | 250 | #### Check the systemd service status 251 | 252 | If you started `zigbeed` with `systemd`, check its status. If `zigbeed` is 253 | running correctly, you should see `Active: active (running)` in the output. 254 | 255 | ```bash 256 | jnilo@raspberrypi:~$ systemctl status zigbeed 257 | ● zigbeed.service - zigbeed Daemon 258 | Loaded: loaded (/etc/systemd/system/zigbeed.service; enabled; preset: enabled) 259 | Active: active (running) since Sun 2025-03-16 17:53:47 CET; 3min 35s ago 260 | Invocation: bdb2b67a6c8a47a1a26728ab06cf4491 261 | Main PID: 151347 (zigbeed) 262 | Tasks: 2 (limit: 697) 263 | Memory: 468K (peak: 1.5M) 264 | CPU: 1.203s 265 | CGroup: /system.slice/zigbeed.service 266 | └─151347 /usr/local/bin/zigbeed 267 | 268 | Mar 16 17:53:50 raspberrypi zigbeed[151347]: [D] P-SpinelDrive-: Sent spinel frame, flg:0x2, iid:1, tid:5, cmd:PROP_VALUE_GET, key:RADIO> 269 | Mar 16 17:53:50 raspberrypi zigbeed[151347]: [D] P-RadioSpinel-: Wait response: tid=5 key=4619 270 | Mar 16 17:53:50 raspberrypi zigbeed[151347]: zigbeed[151347]: [D] P-SpinelDrive-: Received spinel frame, flg:0x2, iid:1, tid:5, cmd:PROP> 271 | Mar 16 17:53:50 raspberrypi zigbeed[151347]: [D] P-SpinelDrive-: Received spinel frame, flg:0x2, iid:1, tid:5, cmd:PROP_VALUE_IS, key:RA> 272 | Mar 16 17:53:50 raspberrypi zigbeed[151347]: zigbeed[151347]: Zigbeed started 273 | Mar 16 17:53:50 raspberrypi zigbeed[151347]: zigbeed[151347]: RCP version: SL-OPENTHREAD/2.4.5.0_GitHub-797150858; EFR32; Mar 11 2025 14> 274 | Mar 16 17:53:50 raspberrypi zigbeed[151347]: zigbeed[151347]: Zigbeed Version: GSDK 7.5.0 - Feb 27 2025 - 02:58:50 275 | Mar 16 17:53:50 raspberrypi zigbeed[151347]: Zigbeed started 276 | Mar 16 17:53:50 raspberrypi zigbeed[151347]: RCP version: SL-OPENTHREAD/2.4.5.0_GitHub-797150858; EFR32; Mar 11 2025 14:35:31 277 | Mar 16 17:53:50 raspberrypi zigbeed[151347]: Zigbeed Version: GSDK 7.5.0 - Feb 27 2025 - 02:58:50 278 | jnilo@raspberrypi:~$ 279 | ``` 280 | 281 | #### Check logs using journalctl 282 | 283 | To view logs from `zigbeed`, use: 284 | 285 | ```bash 286 | journalctl -u zigbeed.service --follow 287 | ``` 288 | 289 | This will display live logs of `zigbeed` in real-time. 290 | 291 | Connect home automation software via TCP: 292 | 293 | ```yaml 294 | version: 4 295 | homeassistant: 296 | enabled: false 297 | frontend: 298 | enabled: true 299 | mqtt: 300 | base_topic: zigbee2mqtt 301 | server: mqtt://localhost 302 | serial: 303 | port: /dev/ttyZigbeeNCP 304 | adapter: ember 305 | ``` 306 | 307 | ## Troubleshooting 308 | 309 | - **Serial Communication Issues:** Verify UART permissions and connections. 310 | - **Log Inspection:** Default logs located at `/var/log/zigbeed.log`. 311 | 312 | ## Additional Resources 313 | 314 | - [Official Silicon Labs Zigbeed Documentation](https://docs.silabs.com/zigbee/latest/multiprotocol-solution-linux/building-zigbee-hosts-locally) 315 | -------------------------------------------------------------------------------- /2-Softwares/24-RCP-Daemons/242-zigbeed/media/image1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/24-RCP-Daemons/242-zigbeed/media/image1.png -------------------------------------------------------------------------------- /2-Softwares/24-RCP-Daemons/242-zigbeed/media/image2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/24-RCP-Daemons/242-zigbeed/media/image2.png -------------------------------------------------------------------------------- /2-Softwares/24-RCP-Daemons/242-zigbeed/media/image3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/24-RCP-Daemons/242-zigbeed/media/image3.png -------------------------------------------------------------------------------- /2-Softwares/24-RCP-Daemons/242-zigbeed/media/image4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/24-RCP-Daemons/242-zigbeed/media/image4.png -------------------------------------------------------------------------------- /2-Softwares/24-RCP-Daemons/242-zigbeed/source/zigbeed_ARM32.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/24-RCP-Daemons/242-zigbeed/source/zigbeed_ARM32.zip -------------------------------------------------------------------------------- /2-Softwares/24-RCP-Daemons/242-zigbeed/source/zigbeed_ARM64.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/24-RCP-Daemons/242-zigbeed/source/zigbeed_ARM64.zip -------------------------------------------------------------------------------- /2-Softwares/24-RCP-Daemons/242-zigbeed/source/zigbeed_x86_64.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jnilo1/hacking-lidl-silvercrest-gateway/8df952376cb02b6ba070966bd7475711977a6334/2-Softwares/24-RCP-Daemons/242-zigbeed/source/zigbeed_x86_64.zip -------------------------------------------------------------------------------- /2-Softwares/24-RCP-Daemons/README.md: -------------------------------------------------------------------------------- 1 | # Host Software 2 | 3 | This directory provides documentation, configuration guidelines, and usage 4 | instructions for software components designed to run on the host system 5 | interacting with Lidl Silvercrest gateways equipped with Silicon Labs 6 | wireless module. These components facilitate communication and management 7 | functionalities for protocols such as Zigbee, Thread, and Matter, 8 | leveraging the gateway hardware equipped with Silicon Labs RCP firmware. 9 | 10 | ## Components Overview 11 | 12 | ### cpcd (Co-Processor Communication Daemon) 13 | 14 | `cpcd` manages low-level communication with Silicon Labs Radio Co-Processor 15 | (RCP) firmware. It abstracts UART hardware interface, providing a 16 | standardized API for higher-layer applications managing Zigbee or Thread 17 | protocols. **Note:** It does not communicate with NCP firmware. 18 | 19 | - [Detailed documentation](./cpcd/README.md) 20 | 21 | ### zigbeed (Zigbee Daemon) 22 | 23 | `zigbeed` provides comprehensive Zigbee network management capabilities.in 24 | our setup `zigbeed` communicates indirectly via `cpcd` with the RCP 25 | firmware. 26 | 27 | - [Detailed documentation](./zigbeed/README.md) 28 | 29 | TO BE COMPLETED 30 | 31 | ### otbr (OpenThread Border Router) 32 | 33 | `otbr` enables Thread networking by operating the OpenThread Border Router 34 | software on the host system. It provides IPv6 connectivity and network 35 | management for Thread devices, interfacing exclusively with RCP firmware 36 | through `cpcd`. 37 | 38 | ### chip-tool 39 | 40 | `chip-tool` is a command-line utility provided by the Matter SDK. It is 41 | used primarily for commissioning, configuring, controlling, and testing 42 | devices compatible with the Matter protocol. It supports interaction over 43 | Thread, Wi-Fi, and Ethernet, allowing effective management of 44 | Matter-enabled networks and devices. 45 | 46 | TO BE COMPLETED 47 | 48 | ## Directory Structure 49 | 50 | Each software component resides in its dedicated subdirectory containing 51 | further detailed documentation, installation guides, usage examples, and 52 | troubleshooting information: 53 | 54 | ``` 55 | host_software 56 | ├── README.md 57 | ├── cpcd 58 | │ └── README.md 59 | ├── zigbeed 60 | │ └── README.md 61 | ``` 62 | 63 | Explore each subdirectory for more specific instructions and information 64 | tailored to your host environment. 65 | -------------------------------------------------------------------------------- /2-Softwares/README.md: -------------------------------------------------------------------------------- 1 | ### RTL8196E Gateway – Software Stack Documentation 2 | 3 | This document describes the software environment of a custom Zigbee gateway 4 | based on the Realtek RTL8196E SoC, modified to serve as a TCP-to-UART 5 | bridge for a Silicon Labs EFR32 Zigbee module. 6 | 7 | ______________________________________________________________________ 8 | 9 | ## 🧠 Operating System 10 | 11 | - **Linux Kernel**: 3.10.90 12 | - Build date: April 28, 2020 13 | - Compiler: GCC 4.6.4 (Realtek RSDK-4.6.4 Build 2080) 14 | - Target architecture: MIPS32 (Lexra RLX4181), big-endian 15 | 16 | ______________________________________________________________________ 17 | 18 | ## 🧰 Toolchain & Libraries 19 | 20 | - **Toolchain**: Realtek RSDK 4.6.4 21 | - **libc**: uClibc 0.9.33 22 | - **BusyBox**: v1.13.4 (compiled on 2020-04-28) 23 | 24 | These components form the foundation of a minimal Linux userland, with 25 | BusyBox handling init, shell, and all base utilities. 26 | 27 | ______________________________________________________________________ 28 | 29 | ## 📂 Filesystem Layout 30 | 31 | The flash is divided into several MTD partitions (total size: **0x1000000** 32 | = **16 MiB**): 33 | 34 | | Device | Name | Size (hex) | Size (dec) | Description | 35 | | --------- | ---------- | ---------- | ---------- | --------------------------------- | 36 | | /dev/mtd0 | boot+cfg | 0x0020000 | 131072 | Bootloader and configuration | 37 | | /dev/mtd1 | linux | 0x01e0000 | 1966080 | Kernel image | 38 | | /dev/mtd2 | rootfs | 0x0200000 | 2097152 | SquashFS, read-only | 39 | | /dev/mtd3 | tuya-label | 0x0020000 | 131072 | Metadata (currently empty) | 40 | | /dev/mtd4 | jffs2-fs | 0x0be0000 | 12451840 | Persistent data, writable (JFFS2) | 41 | 42 | Mount layout includes: 43 | 44 | - `/` → SquashFS root 45 | - `/tuya` → JFFS2 overlay for writable storage 46 | - `/dev` → tmpfs 47 | - `/var` → ramfs 48 | 49 | **Note**: The `tuya-label` partition is useless in our configuration. It 50 | was likely reserved for Tuya-specific metadata (e.g. device ID, cloud 51 | keys), but is not used in this hacked version of the gateway. 52 | 53 | Also note: the total of all partition sizes adds up precisely to 54 | **0x1000000 (16 MiB)**, which matches the capacity of the onboard SPI flash 55 | (GD25Q127 identified by linux as GD25Q128). 56 | 57 | ______________________________________________________________________ 58 | 59 | ## 🔌 Zigbee Bridge Functionality 60 | 61 | ### Hardware: 62 | 63 | - The TuYa TYZS4A chip is hiding a Silicon Labs **EFR32MG1B232F256GM48** 64 | Zigbee SoC connected via **UART0** to the RTL8196E's **UART1** 65 | (`/dev/ttyS1`). 66 | 67 | - The EFR32 is flashed with a **NCP-UART-HW** firmware. 68 | 69 | - This firmware implements the **EZSP protocol** (Ember Zigbee Serial 70 | Protocol), a binary, frame-based API developed by Silicon Labs. 71 | - EZSP allows a host processor (e.g. Linux) to control a Zigbee Network 72 | Co-Processor (NCP) like the EFR32 over a serial connection. 73 | - EZSP is the serial interface to **EmberZNet**, Silicon Labs' full 74 | Zigbee PRO stack. 75 | 76 | #### EmberZNet vs EZSP — Key Differences: 77 | 78 | - **EmberZNet** is the complete Zigbee stack running directly on Silicon 79 | Labs chips (like EFR32). It includes: 80 | 81 | - IEEE 802.15.4 PHY and MAC layers 82 | - Zigbee network layer (routing, mesh management) 83 | - Zigbee application layer (clusters, endpoints, command handling) 84 | - Can run in two modes: 85 | - **NCP (Network Co-Processor)**: Stack runs on the chip, controlled 86 | via EZSP 87 | - **SoC (System-on-Chip)**: Entire application and stack run on the 88 | chip 89 | 90 | - **EZSP** is a serial protocol designed to let an external host control a 91 | chip running EmberZNet in NCP mode. It provides commands for: 92 | 93 | - Network formation and joining 94 | - Message sending and receiving 95 | - Cluster and endpoint management 96 | - Security and Zigbee stack control 97 | - In **NCP mode**, the chip runs the full Zigbee stack and EZSP exposes 98 | its control interface 99 | - In **RCP (Radio Co-Processor)** mode (used with Thread/OpenThread), 100 | only the radio MAC/PHY runs on the chip, and the Zigbee stack runs on 101 | the host. 102 | 103 | - Different versions of the **EmberZNet** protocol have been used: 104 | 105 | - **EmberZNet 6.5.0.0** uses **EZSP V7** and is provided in the original 106 | Lidl/Silvercrest gateway 107 | - **EmberZNet 6.7.8.0** uses **EZSP V8** and is provided in the "hacked" 108 | version originally proposed by Paul Banks. 109 | [The firmware](https://github.com/grobasoz/zigbee-firmware/raw/master/EFR32%20Series%201/EFR32MG1B-256k/NCP/NCP_UHW_MG1B232_678_PA0-PA1-PB11_PA5-PA4.gbl) 110 | was provided by Gary Robas. 111 | - **EmberZNet 7.4.x.0** uses **EZSP V13** and is made 112 | [available in this site](../gateway_firmware/NCP-UART-HW) from Silabs 113 | Gecko 4.4.x libraries and Simplicity Studio. 114 | 115 | ### Software: 116 | 117 | - The RTL8196E system acts as a **TCP-to-UART bridge**, exposing 118 | `/dev/ttyS1` over the network. 119 | - Two bridging solutions are available: 120 | - `serialgateway`: a lightweight custom daemon installed on the device 121 | - `ser2net`: a standard serial-to-network tool with support for multiple 122 | modes (raw, telnet, RFC2217) 123 | 124 | ### Usage: 125 | 126 | - From a remote host, clients such as **Zigbee2MQTT** or **Home Assistant 127 | (ZHA)** can connect using TCP: 128 | 129 | ```yaml 130 | # Zigbee2MQTT configuration.yaml 131 | serial: 132 | port: tcp://192.168.1.x:8888 133 | # Note: adapter is ezsp (no more supported) for EmberZNet for 6.x up to 7.3 versions. and ember starting with Emberznet 7.4 134 | adapter: ember 135 | ``` 136 | 137 | - Either `serialgateway` (or `ser2net`) can be used to serve the UART over 138 | TCP port 8888. 139 | 140 | Example `serialgateway` command: 141 | 142 | ```sh 143 | /tuya/serialgateway & 144 | ``` 145 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2024 jnilo1 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the “Software”), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Hacking the Lidl Silvercrest Gateway 2 | 3 | ## Overview 4 | 5 | The **Lidl Silvercrest Gateway** is a cheap and compact device originally 6 | designed to control Tuya/Zigbee smart devices via the Silvercrest 7 | ecosystem. Thanks to the pioneering work of 8 | [Paul Banks](https://paulbanks.org/projects/lidl-zigbee/#overview), this 9 | gateway can be repurposed into a fully open and customizable Zigbee 10 | coordinator. 11 | 12 | This repository expands on that work and documents how to: 13 | 14 | - Analyze the gateway's **hardware** and **firmware**, 15 | - Replace the original Tuya Zigbee stack with custom firmwares (NCP or 16 | RCP), 17 | - Understand and modify the **embedded Linux system** based on the Realtek 18 | SDK, 19 | - Interface the gateway with **open-source home automation platforms** such 20 | as Home Assistant or Zigbee2MQTT. 21 | 22 | ______________________________________________________________________ 23 | 24 | ## Repository Structure 25 | 26 | ```text 27 | . 28 | ├── 0-Hardware/ # Gateway hardware description and pinout 29 | │ └── README.md 30 | │ 31 | ├── 1-Firmwares/ # Zigbee firmware build & flash tools 32 | │ ├── 10-EZSP-Reference/ # Introduction to EZSP & EmberZnet 33 | │ ├── 11-Simplicity-Studio/ # Building Zigbee firmwares with Simplicity Studio 34 | │ ├── 12-Backup-Restore-Flash/ # Flash dump and restore methods (SWD, ESP, etc.) 35 | │ ├── 13-Bootloader-UART-Xmodem/ # Using the Silabs/Gecko bootloader over UART 36 | │ ├── 14-NCP-UART-HW/ # Firmware: EZSP NCP (for Zigbee2MQTT, ZHA) 37 | │ └── 15-RCP-UART-HW/ # Firmware: multiprotocol RCP 38 | │ 39 | ├── 2-Softwares/ # Embedded Linux software 40 | │ ├── 20-Backup-Restore # Backup & Restore procedure of flash memory 41 | │ ├── 21-Linux-Kernel/ # Realtek SDK Linux kernel analysis 42 | │ ├── 22-Update the Root FileSystem # Ready to flash updated root filesystem 43 | │ ├── 23-Create the Root Filesystem # Create you own rootfs or compile your own programs 44 | │ └── 24-RCP-Daemons/ # CPC / Zigbeed daemons for RCP firmware 45 | │ 46 | ├── README.md # This file 47 | └── .github/ 48 | └── ISSUE_TEMPLATE/ # GitHub issue templates 49 | ├── bug_report.md 50 | └── feature_request.md 51 | ``` 52 | 53 | ______________________________________________________________________ 54 | 55 | ## Goals 56 | 57 | This documentation is intended for tinkerers, hackers, and home automation 58 | enthusiasts who want to: 59 | 60 | - Repurpose the Lidl Silvercrest Gateway as a **custom Zigbee 61 | coordinator**, 62 | - Understand the **hardware and embedded software** used by the device, 63 | - Modify or replace the **Zigbee stack** and **embedded Linux firmware**, 64 | - **Integrate** the modified gateway into DIY home automation environments 65 | (Home Assistant, Zigbee2MQTT, etc.). 66 | 67 | ______________________________________________________________________ 68 | 69 | ## Community & Discussions 70 | 71 | Got questions, stuck on something, or want to share your progress?\ 72 | 👉 Head over to the [**Discussions**](../../discussions) tab! 73 | 74 | Whether you're reverse engineering hardware, building Zigbee firmwares, or 75 | tweaking the Realtek SDK, you're welcome to: 76 | 77 | - Ask for help or get unblocked, 78 | - Share your work-in-progress or discoveries, 79 | - Suggest improvements or ideas for the project, 80 | - Help others with their setups or flash attempts. 81 | 82 | We’re building this together — jump in! 83 | 84 | ______________________________________________________________________ 85 | 86 | ## Credits 87 | 88 | This project builds upon the initial research by 89 | [Paul Banks](https://paulbanks.org/projects/lidl-zigbee/), whose work made 90 | this gateway hackable and to the unvaluable resources found around the Web. 91 | 92 | ______________________________________________________________________ 93 | 94 | ## License 95 | 96 | This project is open-source. See the [LICENSE](./LICENSE) file for details. 97 | 98 | ## 📚 Table of Contents 99 | 100 | - [0-Hardware](./0-Hardware/README.md): Gateway hardware description and 101 | pinout 102 | - [1-Firmwares](./1-Firmwares) 103 | - [10-EZSP-Reference](./1-Firmwares/10-EZSP-Reference/README.md): 104 | Introduction to EZSP & EmberZnet 105 | - [11-Simplicity-Studio](./1-Firmwares/11-Simplicity-Studio/README.md): 106 | Building Zigbee firmwares 107 | - [12-Backup-Restore-Flash](./1-Firmwares/12-Backup-Restore-Flash/README.md): 108 | Backup and restore methods 109 | - [13-Bootloader-UART-Xmodem](./1-Firmwares/13-Bootloader-UART-Xmodem/README.md): 110 | Bootloader via UART XMODEM 111 | - [14-NCP-UART-HW](./1-Firmwares/14-NCP-UART-HW/README.md): EZSP-based 112 | NCP firmware 113 | - [15-RCP-UART-HW](./1-Firmwares/15-RCP-UART-HW/README.md): Multiprotocol 114 | RCP firmware 115 | - [2-Softwares](./2-Softwares) 116 | - [21-Linux-Kernel](./2-Softwares/21-Linux-Kernel/README.md): Kernel 117 | analysis and toolchain issues 118 | - [22-System-Tools](./2-Softwares/22-System-Tools/README.md): Precompiled 119 | tools and toolchain (WIP) 120 | - [23-RCP-Daemons](./2-Softwares/23-RCP-Daemons/README.md): CPC and 121 | Zigbeed daemons 122 | - [.github/ISSUE_TEMPLATE](./.github/ISSUE_TEMPLATE): Issue and feature 123 | request templates 124 | --------------------------------------------------------------------------------