Unbricking Wyze Contact Sensor - pcb reset pin

I don’t use a Mac myself, but exeljb wrote a great guide above that may help in getting started with this. Link

Thank you for the clarification.

I’m not interest in the security monitoring.

I have 6 active v1 contact sensors and 6 motion v1 sensors. (all working)

After following this thread I stopped throwing away the contact sensors that stopped working, and just set them aside for now.

Arriving end of April is a long time tp wait for the V2 products and even longer for those choosing not to go with monitoring,

So I purchased an Aqara Hub Kit (US Model from Amazon), zigbee protocol to experiment.
The Aqara motion and contact sensor do integrate with Alexa and Google Assistant.
I can control my exiting WYZE plugs and bulbs with Alexa routines using the Aqara products.

Interesting enough, the Aqara contact and motion sensors take the Same Batteries as the WYZE sesnors.

So far so good…

I’m ordering more Aqara contact and motion sensors through Aliexpress. WAY Cheaper, just takes longer to get here.

Chas

2 Likes

What prices are you seeing? After shipping a door sensor on Ali or Dealextreme seems about $13-$14, and Amazon is about $17.

1 Like

I bought 5 contact sensors for $50.99 and 5 Motions Sensors for $56.04 from SONOFF Store
Not here yet, have been shipped

Chas

2 Likes

not allowed is the key phrase here. i cant imagine any technical reason why V1 sensors cant be used with HMS or any part of Wyze software applications…heck, even 3rd party applications like Home Assistant figured out how to talk to V1 Wyze sensors,

I think it was Xing who was instrumental in figuring it out…

I would suspect the reason they can’t be used with HMS is that they are unreliable or not as fault tolerant as the new sensors. The Monitors don’t want to be flooded with false positives etc.

To bad Wyze can’t have a jig setup for rapid programming. Then have us send them in when we have more than 1. I have more than 5 Contact sensors and 2 motion already.

1 Like

To the point that I have 24 v1 sensors installed on my house.
I would love an easier solution using something more versatile like raspberry pi/zero or Arduino.

So I noticed one of my contact sensors has the bootloader “backdoor” enabled, and I’m able to read & write the firmware using a simple USB to serial adapter (no JTAG). My other sensors did not have it enabled though, and I’m guessing most of the sensors out there are like that, but if anyone wants to try…

[Warning: You can brick your sensor playing with this. You should only try it as a last resort, like to fix an already broken sensor by flashing Wyzeback.]

  • I used a generic CP2102-based USB to serial adapter from eBay. Any 3.3v-level serial/UART adapter/device should be OK.
  • Connect GND from the serial adapter.
  • Short the RX pad on the sensor to GND. This triggers the bootloader.
  • Connect 3.3v from the serial adapter.
  • Remove the RX pad to GND short.
  • LED should be solid red. If it isn’t, then this method will not work.
  • Connect the TX/RX from the serial adapter to the “T”-marked TX pad and the RX pad next to it.


You can use the cc2538-bsl tool, Flash Programmer 2 (select the serial port, then CC1310F128), UniFlash (select CC1310F128 bootloader, Start, then set the serial port in Settings).

cc2538-bsl

Backup the firmware…

cc2538-bsl.py -p com10 -r -l 131072 backup.bin

Opening port com10, baud 500000
Connecting to target...
CC1310 PG2.1 (5x5mm): 128KB Flash, 20KB SRAM, CCFG.BL_CONFIG at 0x0001FFD8
Primary IEEE Address: 00:12:4B
Reading 131072 bytes starting at address 0x0
    Read done

Program a new firmware…

cc2538-bsl.py -p com10 -e -v -w patched_77AABBCC_blen.bin

Opening port com10, baud 500000
Reading data from patched_77AABBCC_blen.bin
Cannot auto-detect firmware filetype: Assuming .bin
Connecting to target...
CC1310 PG2.1 (5x5mm): 128KB Flash, 20KB SRAM, CCFG.BL_CONFIG at 0x0001FFD8
Primary IEEE Address: 00:12:4B
    Performing mass erase
Erasing all main bank flash sectors
    Erase done
Writing 131072 bytes starting at address 0x00000000
Write 128 bytes at 0x0001FF808
    Write done
Verifying by comparing CRC32 calculations.
    Verified (match: 0x98b2fdb8)

Make sure any firmware you program also has the bootloader enabled, otherwise you will get locked out. Offset 1FFD8 of the file contains the BL_CONFIG setting and needs to be something like C5 01 FE C5.

Also, do not write protect the CCFG. When I did this, I couldn’t undo it via the bootloader because it would not allow me to do a mass erase. If you have to write protect the flash, you should exclude the CCFG area.

6 Likes

another awesome contribution by null.

2 Likes

I concur big time!

All this for a five dollar sensor seems like a waste of time and money but if it’s the challenge of being able to do it then it’s probably worth while

For a single $5 sensor, yes…it’s a lot. But when you get to an investment of a couple of dozen sensors it becomes pretty valuable! Also, the customizability and challenge is fun, as you said.

Most of us have more than one sensor (they were sold in packs to begin with) and $5 x n (n often being a dozen or more) adds up…

1 Like

You should cancel the order for the zig bee motion sensors… They’re almost unusable. They will send a “no motion” command after 1 minute during continual motion. To retrigger the sensor, you have to stand still for (I believe) 10 seconds. So what this means is that if you’re moving around in a room, the lights will shut off while you’re in there and won’t be turned on again until you’ve left or stood still for a little bit. If you’re running like a 30 minute shut off time, maybe it won’t be a big issue but anything less than that gets really annoying.

1 Like

It’s more expensive, but I’ve had good luck with a Samsung SmartThings GP-U999SJVLBAA Zigbee motion sensor connected directly to my Echo Plus with Zigbee. I had tried a couple different brands after giving up on the Wyze motion sensor and the Samsung has been the best by far triggering my lights.
I got mine on eBay new for $24 I think it was.

I also recently replaced all but one of my Wyze contact sensors with these Centralite Zigbee sensors, also connected to My Echo’s Hub, but again, much more expensive than Wyze. They’ve been working great so far with no delays missed notifications.
Amazon.com: Centralite Micro Door Sensor (Works with SmartThings, Wink, Vera, and ZigBee platforms): Home Improvement

bigmonkey, you seem to imply that since we paid only $5 we deserve this misfortune, as per the saying you pay peanuts you get monkeys

I think the vast majority of us pre ordered boxes upon boxes of wyze sensors following the success we had with the v2 cam. it was a rock solid product. install and forget. that explains why the wyze sense sold so well.
I have modded wyze sensors to do a lot more than detect opening of cookie jars. this took quite an investment of time. I can’t just replace these devices with generic zigbee sensors from mouser. I would have to rewire each circuit again.

1 Like

Perhaps someone with the ability to reprogram these sensors might offer to help those of us that don’t have the equipment/ability to…

I don’t get that from his post. From what I get, he’s saying that for the cost of the sensor, it’s not really worth trying to fix, but that we might be the type of people that enjoy trying to fix stuff, even if the fix costs more than just going out and buying a new one. I am definitely one of those people :slight_smile:

1 Like