{
  "added_at": "2026-10-18",
  "additional_evidence_urls": [
    "https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/README.md",
    "https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/AGENTS.md",
    "https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/ss6400zb/src/buttons.c",
    "https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/ss6400zb/src/zb_dev.c",
    "https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/zg226z/DETAILS.md",
    "https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/tools/sanitize_dump.py",
    "https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/tools/tc32dis.py",
    "https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/zg226z/LICENSE.BZdevice",
    "https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/zg226z/SDK/LICENSE.txt"
  ],
  "category": "reconstruction-cases",
  "description_en": "A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. For Tuya TS0044/TS0046 scene remotes, the notes trace the stock ~500 ms single-click delay to a double-click window; the replacement firmware drops that window while presenting the stock model IDs to Zigbee2MQTT. The latest Zigbee build is marked unverified for pairing, actions and battery reporting.",
  "description_zh": "一款 Flipper Zero 应用，以位操作驱动 Telink 的 SWire 调试接口，用于转储并重刷 TLSR825x Zigbee 设备；仓库还附有对转储固件的静态分析笔记，以及为其中两款设备全新编写的固件。针对 Tuya TS0044/TS0046 场景遥控器，笔记将原厂约 500 ms 的单击延迟追溯到双击判定窗口；替换固件取消该窗口，同时向 Zigbee2MQTT 呈现原厂型号标识。最新 Zigbee 版本的配对、动作及电量上报被标注为尚未验证。",
  "entry_url": "https://awesomerea.org/resources/flipper-telink-tuya-remote-firmware-case/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/flipper-telink-tuya-remote-firmware-case/",
  "evidence_url": "https://github.com/ngxson/flipper-telink/blob/d58aef2e65b30f33f560474ce460127c6f18ca30/custom_fw/ss6400zb/README.md",
  "group": "cases",
  "id": "flipper-telink-tuya-remote-firmware-case",
  "json_url": "https://awesomerea.org/resources/flipper-telink-tuya-remote-firmware-case/record.json",
  "kind": "case-study",
  "markdown_url": "https://awesomerea.org/resources/flipper-telink-tuya-remote-firmware-case/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/flipper-telink-tuya-remote-firmware-case/index.md",
  "name": "flipper-telink: replacement firmware for Tuya Zigbee remotes",
  "name_zh": "flipper-telink：Tuya Zigbee 遥控器的替换固件",
  "record_type": "resource",
  "relationship": "independent-reconstruction",
  "requirement_facets": [
    "prerequisites",
    "prerequisites",
    "scope",
    "testing",
    "license"
  ],
  "requirements": [
    "Hardware: a Flipper Zero on Unleashed firmware (the notes name API 87.8; apps built with the official SDK will not load), wired to the target’s SWS pin, ground and 3.3 V. The flasher app builds with ufbt and a project-local SDK; the firmware builds with the Telink Zigbee+BLE SDK in a Docker tc32 toolchain and, once installed, updates over BLE OTA.",
    "Inputs are the user’s own devices and their flash dumps. dumps/ publishes sanitized stock images of four devices, with Zigbee network state and Tuya credentials blanked by tools/sanitize_dump.py; raw dumps stay private. Stock firmware rights stay with its vendors, and the repository states no terms for these images.",
    "The TS0044/TS0046 notes derive GPIO roles from the factory JSON config and trace a single click through a 300 ms double-click window plus event-queue, debounce and wake overhead, citing code addresses in the dump. Disassembly uses an included TC32 disassembler built from a third-party opcode table; the TS0046 application image is reported byte-identical to the TS0044 one apart from factory data.",
    "Replacement firmware v00.14 sends short presses on release and holds after 1 s, identifies as the stock TS0044/TS0046 to Zigbee2MQTT and keeps a BLE service mode for OTA. The progress table records hardware checks for earlier versions; v00.14 was flashed to a TS0046, but pairing, actions and battery reporting in Zigbee2MQTT are marked unverified. The separate ZG-226Z alarm firmware is documented as built but not yet run on hardware.",
    "The repository has no top-level license. Firmware directories carry a permissive notice for build files taken from pvvx/BZdevice and the Telink SDK’s Apache-2.0 license, and the notes credit pvvx’s SWire work. The README calls the project highly vibe-coded; the author’s post credits a pi agent running GLM-5.3."
  ],
  "requirements_zh": [
    "硬件：运行 Unleashed 固件的 Flipper Zero（笔记注明 API 87.8；用官方 SDK 构建的应用无法加载），连接目标设备的 SWS 引脚、地线和 3.3 V。刷写应用用 ufbt 及项目内的 SDK 构建；固件在 Docker tc32 工具链中用 Telink Zigbee+BLE SDK 构建，装入后可通过 BLE OTA 更新。",
    "输入为使用者自己的设备及其闪存转储。dumps/ 公开了四款设备的脱敏原厂镜像，Zigbee 网络状态和 Tuya 凭据已由 tools/sanitize_dump.py 清除；原始转储不公开。原厂固件的权利仍归各厂商，仓库未说明这些镜像的使用条款。",
    "TS0044/TS0046 笔记依据出厂 JSON 配置推导 GPIO 用途，并引用转储中的代码地址，将单击的处理路径追溯为 300 ms 双击判定窗口，加上事件队列、去抖和唤醒开销。反汇编使用仓库自带、基于第三方操作码表的 TC32 反汇编器；笔记称 TS0046 的应用镜像除出厂数据外与 TS0044 逐字节相同。",
    "替换固件 v00.14 在松开时发送短按、按住 1 秒发送长按，向 Zigbee2MQTT 呈现为原厂 TS0044/TS0046，并保留用于 OTA 的 BLE 维护模式。进度表记录了早期版本的硬件检查；v00.14 已刷入一台 TS0046，但在 Zigbee2MQTT 中的配对、动作及电量上报被标注为尚未验证。另一款 ZG-226Z 报警器固件据文档已能构建，但尚未在硬件上运行。",
    "仓库根目录没有许可证。固件目录附有取自 pvvx/BZdevice 的构建文件的宽松许可声明及 Telink SDK 的 Apache-2.0 许可，笔记也注明借鉴 pvvx 的 SWire 工作。README 称项目大量依靠氛围编程；作者帖子称由运行 GLM-5.3 的 pi 智能体完成。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://github.com/ngxson/flipper-telink",
  "verification": "source-reviewed",
  "verified_at": "2026-10-18"
}