How Can You Tell Whether Firmware Can be Flashed ?

Atomi Dual Port Wireless Wall Outlet Plug

Flashing ESP Chips with Open Source Firmware

The ESP family of wifi chips is manufactured by Espressif. The chips are ubiquitous in Chinese manufactured IOT devices. The firmware on many of these devices can be replaced by open source alternatives like Tasmota or Esp Home.

How do you know if a device advertised as being Wifi-enabled is able to be flashed ?

You can try to find reviews but the average reviewer doesn’t flash firmware. In addition, many devices are popping up all the time so that it may be some time before some hacker opens up the device to find out.

Example Teardown To Identify Whether Firmware is Flashable

I was in Aldi’s a few days after Christmas and saw a package of two outlet plugs branded “atomi” and marketed as WiFi-enabled Christmas light timers:

Atomi Christmas Light Plug Package

The package was marked down to $12. One was an indoor plug with two 2.4 integrated USB ports as shown above, the second was a heavy duty black outdoor plug:

Atomi Heavy Duty Holiday Outside Wall Plug

 

A quick search revealed that Amazon was selling the inside plug alone as the “Atomi Smart Wifi Plug” for $20.

 

 Atomi Smart Wifi Plug

But is it an ESP Chip and Can It Be Flashed with Tasmota?

The biggest question was were they able to be flashed with Tasmota ? Based on the little known name I guessed these were probably ESP8266 type chips but none of the reviews mention being able to flash the device firmware. A google search did not reveal anybody flashing either of these plugs.

 

NOTE: TLDR:  Below I describe how I researched whether these plugs were flashable.  But if you don’t want to read the whole writeup, the answer is these are in fact easily flashable by TUYA Convert without using any wires or usb/serial tool – you just need a Linux machine; a raspberry pi will do.  On a PI, follow these instructions first, then the generic instructions.  ]

Doing the Research To See If the Device Can Be Flashed

Looking at the back of the package reveals that the plugs are ETL certified for the United States (equivalent to UL approved, good!) with an Intertek Number of 5001673.

 

ETL Certification of ATOMI Wifi Holiday Plugs

 

There was no FCC ID but the bar code stated it was “13820-Smart Plug Holiday Pack”.

 

Atomi Plug Bar Codes

 

Model Number and FCC ID Brings Some Leads

Going to the Intertek website for ETL Listed Products and typing in “5001673” revealed nothing. But plugging in the model number “13820” produced a couple of listings with the first being by “SHENZHEN FENERGY TECHNOLOGY CO., LTD” conforming to  a UL standard.

Screen Shot of Intertek Website Showing Atomi

 

After some googling to find the FCC ID number, I tried “fcc model AT1217 SHENZHEN FENERGY TECHNOLOGY CO., LTD. – Shenzhen, Guangdong CHINA” and came up with the listing.

Reading the FCC Documentation to Identify the Firmware

Photos and other information confirmed it was the same plug:

FCC Photo of Atomi Plug

 

There’s also a “Letter of Declaration Model Difference” stating that AT1217 and At1249 models are the same (google reveals that AT1249 is sold at Home Depot also as an Atomi Smart Wifi Plug )

 

Clicking on the “internal photos” link in the FCC document shows the inside of the plug and reveals this interesting photo:

And another photo of the other side of the chip showing the four contacts required to flash:

 

Atomi Photo Showing TYWE2s Chip

 

Here’s a drawing found online:

Drawing of TYWE2s Chip

Bingo – It’s Flashable !

So I bought the outlets, brought them home and opened up the interior one (removed the four screws on the bottom and wedged open the case).  I found the TYW2ES chip but the contacts were oriented down and not exposed: 

 

Inside of Atomi Plug

Exploring Methods to Flash

A quick google of “TYWE2s” shows a tutorial on the Tasmota website flashing an outlet having the same wifi module using the hard wired method.  I tried to grind through the bottom of the white outlet with a rotary tool to expose the contacts ( a dangerous and unnecessary [as explained below) step – do NOT do this!):

 

 Bottom of Atomi Plug With Drilled Hole

 

and to flash it with an FTDI usb/serial tool.  But since I didn’t want to take the time of properly soldering the contacts and/or using a jumper, it was an exercise in frustration.

Ah – Wireless Flashing !!

I finally remembered that there were some successful OTA (over the air) methods of flashing these chips, did a google search and found TUYA Convert. I quickly confirmed that the TYWE2S chip is a TUYA and proceeded to flash using the TUYA Convert instructions. Since you need to do this in Linux, I first tried running TUYA Convert in Windows’ WSL but kept getting an error questioning whether my Wifi adapter could be used as an access point. I then ssh’d in to a headless Raspberry Pi I had in the other room and ran the scripts on that machine.  I got the same error.

 

 I then found this note on prerequisite steps for  a pi, followed those steps, then the main installation steps, and it worked like a charm!

Here is the linux session running TUYA Convert:

Both outlets were easily flashed within 30 minutes without attaching any wires or having to open the devices!

 

Configuring Tasmota

The Configure Module in Tasmota should be set as follows to allow the manual switch on the plugs to work:

 

Tasmota Module