Zemismart ZMHK-01 is one of the few hubs that is compatible with Apple HomeKit and can expose non-HomeKit Zigbee devices in the Home app similar to the Aqara G2H camera hub. Behind the scenes it uses the Tuya TYZS4 radio module and is very similar to the Tuya reference designs used by many generic Tuya-compatible hubs.
Note: this device is very similar to NEO NAS-ZW05B0!
Getting Root Access
Turns out it is very similar to the first generation of the Lidl Silvercrest Smart Gateway which allows extracting the root user password over the UART connection exposed on the back of the PCB. The screws are hidden behind the rubber ring on the bottom:
And the UART pins TX and RX are clearly marked on the back of the PCB. Note that you must use 3.3V for power and logic when connecting to the device.
After extracting the password from the flash memory you’re able to connect to it over SSH running on port 2333:
$ ssh root@gateway.local -p 2333where gateway.local is the mDNS address of the device on your network. Alternatively, use the IP address of the device to connect.
The device runs Linux with BusyBox v1.13.4 (2021-08-26 11:01:27 CST) and it uses a bunch of bash scripts to configure and launch the software. Most of the runtime logic is handled by the following process:
./tyZ3Gw /tuya/tuya_user2 /tuya/def.cfgwhere tyZ3Gw (sounds like short for “Tuya Zigbee3 Gateway”) is the binary in the /tuya/tuya_user2 working directory using /tuya/def.cfg for config:
{
"user_cfg_file":"/tuya/config/user.cfg",
"platform":"RTL8196E",
"product_key":"keyYOURUNIQUEKEY",
"mode_id":"RTL8196E_TY01",
"storage_dir":"./",
"log_dir":"/tuya/log_dir/",
"tmp_dir":"/tmp/",
"bin_dir":"/tuya/",
"backup_dir":"/tuya/",
"net_led":"LED0",
"status_led":"LED1",
"reset_key":"KEY0",
"wan_interface":"eth1",
"wifi_interface":"wifi0",
"serial_port":"/dev/ttyS1",
"is_cts":true,
"is_sync_systime":true,
"is_hardward":true
}Note that there is no WiFi network interface on this device although it is mentioned in the config.
Zigbee Communication
The zigbee_agent binary talks to the NXP JN5189 Zigbee module over UART at /dev/ttyS2. There is a custom UART to TCP bridge software developed by Paul Banks that can be used to expose the Zigbee radio to the Home Assistant ZHA integration over TCP. Note that this disables the Tuya and HomeKit integrations since they are no longer able to talk to the same UART device that is now used by the bridge.
Compatible Devices
I’ve successfully tested the following devices with the hub and they become available in the Home app:
- Tuya ZigBee 3.0 Switch Modules (both 1 and 2 channel) with Tuya 2T3L radio.
- GIRIER Tuya ZigBee 3.0 Smart Light Switch Module with Tuya ZTU radio.
- Sonoff SNZB-03 PIR motion sensor.
The following devices are recognized by the Smart Life app but they don’t show up in the Home app:
- Tuya TS0601 Smart Air Box House Keeper 6in1 air quality monitor with ZT3L module.
Would it be possible to have ZHA code and tuya one running at the gataway in same time so I can have devices in both system? ” Note that this disables the Tuya and HomeKit integrations since they are no longer able to talk to the same UART device” – I don’t fully understand that – can the code by modified so both Tuya and ZHA share access to the UART or duplicate the UJART or is it by design not possible?
The UART to TCP bridge needs to talk to the same UART device
/dev/ttyS2as used by the Tuya integration and my understanding is that Linux prevents the same device port from being used by multiple services at the same time. I’m not sure if there are tools out there that can create virtual interfaces for the same hardware port and let multiple services talk to it. I’m also not sure how the Tuya binary will deal with the messages and responses not originating from itself.Incredible. I’m using this hub since some months ago and loving it.
Do you know others non-zemismart devices that is capable and exported to HomeKit? Or someway to know if this device could support it (like identifying the radio).
Technically most of the Tuya Zigbee devices should work. I’ll be adding the ones I’ve tested to the list at the bottom of the post. Would love to hear if you test some too!
Thanks a lot! Me with friends have created a sheet to put some devices we’d tested https://docs.google.com/spreadsheets/d/1GQAZjaVC6yTxvoN3pNsCCkNLJNlsWGwKHN7k74lXF5c/edit?usp=sharing
Recently I found exactly the same LED Strip Controller as Zemismart use, so it’ll save a lot of money.
I wonder if the Moes GU10 Zigbee will work or not.
Helo Thank you for the list.
Apparently the mais problem is with the courtain switch.
Do you know any courtain switch working with the hub?
No, unfortunately I haven’t tested any. Check out this spreadsheet shared previously by Vitor.
Hello, have you had any luck with dimmers? I can’t seem to find any dimmer switch or module for homekit that would fit EU standards.
Unfortunately, I haven’t tried any.
I have the ‘Neo Tuya Himekit Zigbee Hub’.
It’s basically the Zemismart but cheaper.
Sonoff Zigbee relays (both the mini L+N and the new mini extreme live relays) these show up in smartlife and HomeKit, oddly they show as a light and a switch.
I have the 20A Zigbee outlets (with power monitoring) and these work with Smartlife and HomeKit, but only on/off in HomeKit.
Couldn’t get my Aqara accessories to work with it, but not sure if they are Zigbee 3.0.
Tried some generic Tuya Zigbee light switches and they show up in SmartLife but not in HomeKit.
Bought some Moes light switches (no neutral) to test out and see if they show up in HomeKit.
Trying to get to a point where I don’t need home assistant or homebridge.
I’ll update the list if I find anything else that works.
It’s difficult to know what will and won’t work.
Thanks for sharing your findings! I just got the same hub and posted a review here. It appears like others haven’t been able to extract the root password, yet.