SwitchbOTA

This project helps to replace the default firmware on the SwitchBot Smart Plug Mini via an OTA update, enabling the use of Tasmota open-source firmware without disassembling the device.

SwitchBot Hardware Details

There are two SKUs of the SwitchBot Smart Plug Mini released in the US:

• The original "Smart Plug Mini" with model number W1901400, released in early 2022. As of 2023-12, Amazon sells these in four-packs for about $30, two-packs for $19, or one-packs for $12
• The updated "HomeKit Smart Plug Mini" with model number W1901401, released later in 2022. As of 2023-12, Amazon sells these in four-packs for about $38 or one-packs for $15

Some details about the devices are as follows:

• Both devices use identical circuitry. The only difference is the firmware used. More detail can be found in https://github.com/kendallgoto/switchbota/issues/19
• They use Type B NEMA 5-15 plugs and sockets
• They are ultrasonically welded shut, requiring destruction of the plastic housing to access the circuits within. There are no screws to allow access to the internals, the way there is with the Sonoff S31
• They use the Shanghai Belling BL0937 energy measurement IC to track power usage
• They use the Espressif ESP32-C3 chip for WiFi, Bluetooth Low Energy (BLE), and circuit control. See here to learn about the different types of ESP32. The MAC addresses for WiFi and BLE follow the ESP32 standard of having an offset of two. If the WIFI-MAC is 34:85:18:0F:CC:DC, then the BLE-MAC is 34:85:18:0F:CC:DE (DC in hex is 220, DE is 222)
• The SwitchbOTA flashing process is confirmed to work on both device models using firmware v1.4 or older (v1.3, v1.2)

Disclaimer

Writing to the bootloader over OTA is dangerous and not normally done for good reason. If your device loses power or somehow flashes corrupted data, the device will be bricked and require disassembly to reprogram the device. Only perform this process if you are comfortable disassembling your plug to fix it if it breaks! Of course, do not unplug or otherwise disturb the plug while it is performing the OTA.

This is a proof of concept and provided with no warranty.

Part 1: Plug Setup

• TL;DR: Connect the plug to your WiFi network
• Install the SwitchBot app on your phone https://play.google.com/store/apps/details?id=com.theswitchbot.switchbot
• Sign in or create an account (necessary to allow devices to be added/configured)
• Plug the plug into a wall outlet
• In-app, add a device. It's safe to connect it to your WiFi network.
  • Note down the BLE-MAC during this process, as it will be referenced later
  • This step uses Bluetooth Low Energy (BLE) to scan for devices and send the WiFi network information

• In-app, check the device firmware by going to its settings. As of 2023-12, there was no firmware update button, and the firmware version was v1.4. If you do see the upgrade button, do not press it and wait for a later part
• DONE! The plug is now ready for the firmware flashing process

Part 2: Network and Server Setup

• TL;DR: Configure your router & DNS to redirect calls to a local IP. Run a local NodeJS server at that IP
• Note down the LAN/local IP address where the NodeJS server will be run. For this example, it will be 192.168.0.69
• Configure your router and/or DNS to redirect calls to SwitchBot servers to instead hit your NodeJS server
  • This means that a DNS override or custom DNS record should be added, redirecting both www.wohand.com and wohand.com to the IP where the NodeJS server will be run. More detail can be found at https://github.com/kendallgoto/switchbota/issues/3#issuecomment-1121828064
  • In pfSense, this can be done in the Services->DNS Resolver or Forwarder by adding a Host Override with Host www and Domain wohand.com and a second override with Host wohand and Domain com, both having an IP of 192.168.0.69. Save the override and Apply the settings

• In PiHole, this can be done in the Local DNS->DNS Records by setting the Domain to www.wohand.com and wohand.com and the IP to 192.168.0.69
• If your router does not support custom DNS entries, it will almost certainly support setting a custom DNS server. This may be found in the DHCP settings or the System settings. Set the custom DNS server to 192.168.0.69
• Run a local NodeJS server to act in place of the real firmware update server and instead deliver modified firmware files: firstly the OTA file, and then the Tasmota firmware file
  • Install NodeJS on your computer https://nodejs.org/en/learn/getting-started/how-to-install-nodejs
  • Using a CLI or Terminal, cd into the server/ directory and run npm i (short for npm install) to install the dependencies required for this project
  • Once the previous command completes, run node index.js to run the server.
    • OR, if you could not set up a DNS record in the previous step, run node index.js 192.168.0.69 . This will start the server, in addition to a Man-in-the-middle DNS server that redirects *wohand.com calls to the IP of the NodeJS server, rather than the public IP of *wohand.com. All other DNS lookups will be unaffected
  • The CLI or Terminal should show Server listening on port 80. Keep this window open for the duration of the flashing process
• Test the DNS functionality by opening a new CLI or Terminal and running ping wohand.com and ping www.wohand.com to confirm that the local IP shows up. In this example, look for 192.168.0.69
• Test the Node server functionality by opening the SwitchBot app and then looking at the terminal where Node is running. A new line should have shown up similar to ::ffff:192.168.0.101 - /version/wocaotech/release.json. This indicates the server was accessed instead of the real wohand.com and that it successfully served a JSON file to the app. The IP 192.168.0.101 is the IP of the phone running the app.
• DONE! The network is now configured and the server should now be ready to serve firmware files to the plug

Part 3: Firmware Flashing

• TL;DR: Send BLE commands to the SwitchBot plug to trigger the firmware upgrade process
• If you saw an upgrade button in the SwitchBot app, it is now safe to hit that button. No additional actions should be needed, and the firmware replacement process should complete. If no button is present in the SwitchBot app, proceed
• Install an app such as nRF Connect for Mobile. This will be used to connect to the Bluetooth Low Energy (BLE) radio of the plug to trigger the firmware update process. Bluetility for Mac is also reported to work
• Follow the instructions below, or watch the video, or read the GitHub issues outlining the process https://github.com/kendallgoto/switchbota/issues/43 https://github.com/kendallgoto/switchbota/issues/3#issuecomment-1121864522
• Using the BLE app of choice, scan for devices and Connect to the device matching the BLE-MAC noted from the SwitchBot app

• Make sure the app is on the Client tab, then expand "Unknown Service" and look at the options within. The last option, "Unknown Characteristic" should have Properties such as "WRITE" and an upload button on the right side. Hit the Upload button on the right side to bring up the Write screen.

• Select the BYTE_ARRAY type from the dropdown and enter in the hex code 57 0F 0A 01 0C (without spaces). Then it Send to transmit the command to the plug
  • The last two characters represent the firmware version to be flashed, and must be different from the current firmware version. 0C (as shown above) represents v1.2, 0D represents v1.3, 0E represents v1.4. 0C should be safe to use by default. More detail can be found here

• Wait a few seconds and look at the NodeJS log to verify the command worked as it should. You should see something such as ::ffff:192.168.0.131 - /version/wocaotech/firmware/WoPlugUS/WoPlugUS_V12.bin which indicates the NodeJS server was able to send the first .bin file to the plug
• Wait about a minute after seeing the NodeJS server log to give the plug time to get ready for the next step.
• Now send a new BYTE_ARRAY command in the BLE app (nRF Connect) with hex 57 0F 0B. Hit Send to trigger the second and final firmware flash step
• Wait a few seconds again and then look at the NodeJS log to verify the command worked as it should. You should see something such as ::ffff:192.168.0.131 - /payload.bin which indicates the NodeJS server was able to send the Tasmota .bin file to the plug
• DONE! The firmware flashing should be complete

Part 4: Tasmota Setup

• TL;DR: Connect to the Tasmota WiFI. Configure the actual WiFi. Update the firmware. Apply the SwitchBot Tasmota Template. Configure the device
• NOTE: The NodeJS server is configured to flash Tasmota tasmota32c3.factory.bin which is described to be a "Factory binary to be used for initial flashing using esptool." The distinguishing factor is that a factory binary includes an entire partition table, bootloader, etc. rather than just application partition that is later sent for OTA binaries in the