# flipper-telink: replacement firmware for Tuya Zigbee remotes

> A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. For Tuya TS0044/TS0046 scene remotes, the notes trace the stock ~500 ms single-click delay to a double-click window; the replacement firmware drops that window while presenting the stock model IDs to Zigbee2MQTT. The latest Zigbee build is marked unverified for pairing, actions and battery reporting.

- Type: Case study
- Targets: Firmware
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-10-18
- Added to the catalog: 2026-10-18
- Original resource: <https://github.com/ngxson/flipper-telink>
- Primary source: <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/ss6400zb/README.md>
- Catalog page: <https://awesomerea.org/resources/flipper-telink-tuya-remote-firmware-case/>
- Record JSON: <https://awesomerea.org/resources/flipper-telink-tuya-remote-firmware-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/flipper-telink-tuya-remote-firmware-case/index.md)

## Requirements & limits

- **Prerequisites:** Hardware: a Flipper Zero on Unleashed firmware (the notes name API 87.8; apps built with the official SDK will not load), wired to the target’s SWS pin, ground and 3.3 V. The flasher app builds with ufbt and a project-local SDK; the firmware builds with the Telink Zigbee+BLE SDK in a Docker tc32 toolchain and, once installed, updates over BLE OTA.
- **Prerequisites:** Inputs are the user’s own devices and their flash dumps. dumps/ publishes sanitized stock images of four devices, with Zigbee network state and Tuya credentials blanked by tools/sanitize_dump.py; raw dumps stay private. Stock firmware rights stay with its vendors, and the repository states no terms for these images.
- **Scope:** The TS0044/TS0046 notes derive GPIO roles from the factory JSON config and trace a single click through a 300 ms double-click window plus event-queue, debounce and wake overhead, citing code addresses in the dump. Disassembly uses an included TC32 disassembler built from a third-party opcode table; the TS0046 application image is reported byte-identical to the TS0044 one apart from factory data.
- **Testing evidence:** Replacement firmware v00.14 sends short presses on release and holds after 1 s, identifies as the stock TS0044/TS0046 to Zigbee2MQTT and keeps a BLE service mode for OTA. The progress table records hardware checks for earlier versions; v00.14 was flashed to a TS0046, but pairing, actions and battery reporting in Zigbee2MQTT are marked unverified. The separate ZG-226Z alarm firmware is documented as built but not yet run on hardware.
- **License:** The repository has no top-level license. Firmware directories carry a permissive notice for build files taken from pvvx/BZdevice and the Telink SDK’s Apache-2.0 license, and the notes credit pvvx’s SWire work. The README calls the project highly vibe-coded; the author’s post credits a pi agent running GLM-5.3.

## Primary sources

1. <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/ss6400zb/README.md>
2. <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/README.md>
3. <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/AGENTS.md>
4. <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/ss6400zb/src/buttons.c>
5. <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/ss6400zb/src/zb_dev.c>
6. <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/zg226z/DETAILS.md>
7. <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/tools/sanitize_dump.py>
8. <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/tools/tc32dis.py>
9. <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/zg226z/LICENSE.BZdevice>
10. <https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/zg226z/SDK/LICENSE.txt>

## More in Firmware and hardware

- [Supermodel: initial Real3D Pro-1000 image-generator emulation](https://awesomerea.org/resources/supermodel-real3d-pro1000-emulation-case/index.md) · Case study
- [OpenDMCUFirm: a reimplemented Wii U DMCU display firmware](https://awesomerea.org/resources/opendmcufirm-wii-u-dmcu-firmware-case/index.md) · Case study
- [reflecticon-224: running Lexicon 224 reverb firmware on emulated hardware](https://awesomerea.org/resources/reflecticon-224-lexicon-emulation-case/index.md) · Case study
- [TeddyCloud: a self-hosted replacement for the Toniebox cloud](https://awesomerea.org/resources/teddycloud-toniebox-server-case/index.md) · Case study
- [Valetudo: local replacement for robot-vacuum vendor clouds](https://awesomerea.org/resources/valetudo-robot-cloud-replacement-case/index.md) · Case study
- [EchoMuse: replacement software that turns the Echo Dot 2nd gen into a Home Assistant voice satellite](https://awesomerea.org/resources/echomuse-echo-dot-voice-satellite-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.