Case study
flipper-telink: replacement firmware for Tuya Zigbee remotes
A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. For Tuya TS0044/TS0046 scene remotes, the notes trace the stock ~500 ms single-click delay to a double-click window; the replacement firmware drops that window while presenting the stock model IDs to Zigbee2MQTT. The latest Zigbee build is marked unverified for pairing, actions and battery reporting.
- Targets
- Firmware
- Category
- Independent reconstruction cases
- Relationship
- Independent reconstruction project
- Sources reviewed
Requirements & limits
- Prerequisites: Hardware: a Flipper Zero on Unleashed firmware (the notes name API 87.8; apps built with the official SDK will not load), wired to the target’s SWS pin, ground and 3.3 V. The flasher app builds with ufbt and a project-local SDK; the firmware builds with the Telink Zigbee+BLE SDK in a Docker tc32 toolchain and, once installed, updates over BLE OTA.
- Prerequisites: Inputs are the user’s own devices and their flash dumps. dumps/ publishes sanitized stock images of four devices, with Zigbee network state and Tuya credentials blanked by tools/sanitize_dump.py; raw dumps stay private. Stock firmware rights stay with its vendors, and the repository states no terms for these images.
- Scope: The TS0044/TS0046 notes derive GPIO roles from the factory JSON config and trace a single click through a 300 ms double-click window plus event-queue, debounce and wake overhead, citing code addresses in the dump. Disassembly uses an included TC32 disassembler built from a third-party opcode table; the TS0046 application image is reported byte-identical to the TS0044 one apart from factory data.
- Testing evidence: Replacement firmware v00.14 sends short presses on release and holds after 1 s, identifies as the stock TS0044/TS0046 to Zigbee2MQTT and keeps a BLE service mode for OTA. The progress table records hardware checks for earlier versions; v00.14 was flashed to a TS0046, but pairing, actions and battery reporting in Zigbee2MQTT are marked unverified. The separate ZG-226Z alarm firmware is documented as built but not yet run on hardware.
- License: The repository has no top-level license. Firmware directories carry a permissive notice for build files taken from pvvx/BZdevice and the Telink SDK’s Apache-2.0 license, and the notes credit pvvx’s SWire work. The README calls the project highly vibe-coded; the author’s post credits a pi agent running GLM-5.3.
About this entry
The description was reviewed against primary sources.
Primary sources
- custom_fw/ss6400zb/README.md GitHub · ngxson/flipper-telink · Revision d58aef2
- README.md GitHub · ngxson/flipper-telink · Revision d58aef2
- AGENTS.md GitHub · ngxson/flipper-telink · Revision d58aef2
- custom_fw/ss6400zb/src/buttons.c GitHub · ngxson/flipper-telink · Revision d58aef2
- custom_fw/ss6400zb/src/zb_dev.c GitHub · ngxson/flipper-telink · Revision d58aef2
- custom_fw/zg226z/DETAILS.md GitHub · ngxson/flipper-telink · Revision d58aef2
- tools/sanitize_dump.py GitHub · ngxson/flipper-telink · Revision d58aef2
- tools/tc32dis.py GitHub · ngxson/flipper-telink · Revision d58aef2
- custom_fw/zg226z/LICENSE.BZdevice GitHub · ngxson/flipper-telink · Revision d58aef2
- custom_fw/zg226z/SDK/LICENSE.txt GitHub · ngxson/flipper-telink · Revision d58aef2
More in Firmware and hardware
- Supermodel: initial Real3D Pro-1000 image-generator emulation · Case study
- OpenDMCUFirm: a reimplemented Wii U DMCU display firmware · Case study
- reflecticon-224: running Lexicon 224 reverb firmware on emulated hardware · Case study
- TeddyCloud: a self-hosted replacement for the Toniebox cloud · Case study
- Valetudo: local replacement for robot-vacuum vendor clouds · Case study
- EchoMuse: replacement software that turns the Echo Dot 2nd gen into a Home Assistant voice satellite · Case study
All 89 entries in Firmware and hardwareFirmware and hardware case studies (19)