Skip to content

Instantly share code, notes, and snippets.

@zvldz
Last active November 13, 2022 07:50
Show Gist options
  • Save zvldz/2505aa913af185dbdc16a40fbc3303ab to your computer and use it in GitHub Desktop.
Save zvldz/2505aa913af185dbdc16a40fbc3303ab to your computer and use it in GitHub Desktop.
Retrieving the OTA URL for Tuya Zigbee devices

Retrieving the OTA URL for Tuya Zigbee devices

This example is for Ubuntu 20.4.3 x86_64. But should also work on other supported OS.

Used:

  • MITM proxy - Charles proxy (but it is probably possible to use another)
  • android emulator - Genymotion

Step 1: Installing the Charles proxy

By default, the Charles proxy has a 30 day trial period. Add repositories for ubuntu and install the Charles proxy. Details at https://www.charlesproxy.com/documentation/installation/apt-repository/.

Step 2: Installing Genymotion android emulator and other apps

Go to the site https://www.genymotion.com/download/ and download Genymotion Desktop (current version 3.2.1), file genymotion-3.2.1-linux_x64.bin. You need to have VirtualBox preinstalled from your distribution. Installation type for "all users". Go to the folder with the genymotion-3.2.1-linux_x64.bin binary file and run the installation command:

sudo bash ./genymotion-3.2.1-linux_x64.bin

Run Genymotion from the desktop or with a manual command (not from root):

/opt/genymobile/genymotion/genymotion

Genymotion needs registration for use (free for personal use). After registering, we need to add a new virtual device (click the + button in the upper right corner). To install arm translation we need android version 8.0 (if you found arm translation for a higher version of android, you can choose another android version). Select Google Pixel 2 XL 8.0 - API 26 and click Next. You can leave the default settings (but if you do have not enough RAM, you can reduce the "memory size", e.g. to 2048). Network mode - NAT or Bridge (if you do have a working DHCP-server on your network). Wait for the image to be installed for the virtual android device.

The Tuya Smart app does not support android x86, so we need Genymotion_ARM_Translation. Download the file Genymotion-ARM-Translation_for_8.0.zip from https://github.com/m9rco/Genymotion_ARM_Translation/tree/master/package (safe ?!). Download Tuya Smart 3.12.6 APK from https://apkfun.com/down_Tuya-Smart.22722608.html (safe ?!). The latest version of Tuya Smart does not work via MITM proxy.

Start the virtual android device Google Pixel 2 XL in Genymotion. First, drag and drop the file Genymotion-ARM-Translation_for_8.0.zip from the Downloads folder into the Genymotion window of the Google Pixel 2 XL to install it. You need to confirm this operation. Then restart your android device in the emulator. Second, drag and drop the file com.tuya.smart.apk to install. The Tuya Smart program will launch and warn you that it is running on a rooted phone, so confirm your agreement. You need a tuya account with a tuya hub and Zigbee device(s) connected. Select Login with Existing Account and enter your credentials. Your Tuya hub and Zigbee devices may have a status as offline, but this does not matter.

Step 3: Proxy settings

By default, Charles uses port 8888 for the proxy. Run the Charles proxy. Go to the Proxy/SSL Proxy Settings menu. Click the Add button in the Include section and leave the fields blank and tap OK twice. Go to the Help/SSL Proxying menu and select Save Charles Root Certificate. Drag and drop the received certificate onto the android device. Go to your android device and select the menu Settings/Security and Location/Encryption & credentials/Install from SD card and tap on the three horizontal lines in the top left corner. Then select Downloads and select the Genymotion certificate file. Enter a name for the certificate, e.g. charles vpn and select Credential use - VPN and apps and press OK. A window prompting you to create a PIN code for the storage of credentials will appear. Go to the menu Settings/Network & Internet/Wi-Fi, long press on AndroidWifi, and select Modify network. Select Advanced Options/Proxy/Manual and enter your computer's ip address (e.g. 192.168.x.y) and port 8888 and click Save.

Step 4: Getting the OTA URL

Start Tuya Smart on android device. In the Charles proxy, you need to confirm the connection from the ip address. In Tuya Smart click on the Zigbee device (with new OTA) and check the new firmware (the check can be started automatically). Do not select firmware update (just check). Find in Charles proxy URL for the binary firmware file as in the screenshot.

url: https://a1.tuyaeu.com

uri: /api.json?appVersion=3.12.....

tab: Contents

That's all.

P.S. I think we should hurry up and download as much firmware as possible while it works.

@saspol
Copy link

saspol commented Nov 13, 2022

The problem is Tuya Smart 3.12.6 does not supporting relatively new devices. So need some other way.

photo_2022-11-13_15-48-00

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment