A detailed technical guide demonstrates how to remove cloud dependency from consumer IoT devices by reverse engineering their hardware and replacing vendor firmware.
The author had long preferred Zigbee devices for a smart home to avoid vendor clouds but was compelled to purchase Wi-Fi-only appliances after adopting a cat. These included a Midea air conditioner paired with a Daichi controller and a Smart Life cat feeder, both built on Tuya platforms. The primary concern was lack of control over devices containing microphones and other sensors that phone home.
Hardware Toolkit and Initial Analysis
Essential tools included a multimeter, soldering iron, UART adapter supporting 3.3V/5V, flux, solder wick, and optional hot air station. The researcher emphasized practicing soldering on scrap boards first.
The Daichi DW23-B controller for the air conditioner contained a TYWE3S module based on ESP8266. The onboard USB port functioned as a UART interface, controlled by a physical switch. Firmware was backed up using esptool.py and replaced with ESPHome, enabling native climate control in Home Assistant.
Cat Feeder Reverse Engineering
The feeder used a WBR3 module on an RTL8720CF chipset communicating with an MCU via UART in the classic TuyaMCU architecture. After identifying UART pins with a multimeter and capturing traffic using TuyaMCUAnalyzer, the Wi-Fi controller was desoldered to access programming pins A_0 and A_15.
Firmware was read and written with ltchiptool. The device was then flashed with OpenBeken, which supports TuyaMCU protocol emulation. Configuration via autoexec.bat enabled drivers for TuyaMCU and NTP, mapped dpIDs to channels for battery level, feeding button, and scheduling, and exposed the device over MQTT for Home Assistant integration.
A custom automation script was created to simulate button presses for manual feeding, while schedule data structures were analyzed from raw protocol packets for potential future local implementation.
