Notes on Zemismart HomeKit Zigbee Hub

Zemismart ZMHK-01 is one of the few hubs that is compatible with Apple HomeKit and can expose non-HomeKit Zigbee devices in the Home app similar to the Aqara G2H camera hub. Behind the scenes it uses the Tuya TYZS4 radio module and is very similar to the Tuya reference designs used by many generic Tuya-compatible hubs.

Zemismart Zigbee HomeKit Hub using the Tuya TYZS4 module
Zemismart Zigbee HomeKit Hub using the Tuya TYZS4 module for radio and RTL8196E as the main controller.

Note: this device is very similar to NEO NAS-ZW05B0!

Getting Root Access

Turns out it is very similar to the first generation of the Lidl Silvercrest Smart Gateway which allows extracting the root user password over the UART connection exposed on the back of the PCB. The screws are hidden behind the rubber ring on the bottom:

Screws for opening Zemismart Zigbee HomeKit Hub
Screws for opening Zemismart Zigbee HomeKit Hub.

And the UART pins TX and RX are clearly marked on the back of the PCB. Note that you must use 3.3V for power and logic when connecting to the device.

UART serial pins for Zemismart Zigbee HomeKit Hub
UART serial pins for Zemismart Zigbee HomeKit Hub.

After extracting the password from the flash memory you’re able to connect to it over SSH running on port 2333:

$ ssh root@gateway.local -p 2333

where gateway.local is the mDNS address of the device on your network. Alternatively, use the IP address of the device to connect.

The device runs Linux with BusyBox v1.13.4 (2021-08-26 11:01:27 CST) and it uses a bunch of bash scripts to configure and launch the software. Most of the runtime logic is handled by the following process:

./tyZ3Gw /tuya/tuya_user2 /tuya/def.cfg

where tyZ3Gw (sounds like short for “Tuya Zigbee3 Gateway”) is the binary in the /tuya/tuya_user2 working directory using /tuya/def.cfg for config:

{
	"user_cfg_file":"/tuya/config/user.cfg",
	"platform":"RTL8196E",
	"product_key":"keyYOURUNIQUEKEY",
	"mode_id":"RTL8196E_TY01",
	"storage_dir":"./",
	"log_dir":"/tuya/log_dir/",
	"tmp_dir":"/tmp/",
	"bin_dir":"/tuya/",
	"backup_dir":"/tuya/",
	"net_led":"LED0",
	"status_led":"LED1",
	"reset_key":"KEY0",
	"wan_interface":"eth1",
	"wifi_interface":"wifi0",
	"serial_port":"/dev/ttyS1",
	"is_cts":true,
	"is_sync_systime":true,
	"is_hardward":true
}

Note that there is no WiFi network interface on this device although it is mentioned in the config.

Zigbee Communication

The zigbee_agent binary talks to the NXP JN5189 Zigbee module over UART at /dev/ttyS2. There is a custom UART to TCP bridge software developed by Paul Banks that can be used to expose the Zigbee radio to the Home Assistant ZHA integration over TCP. Note that this disables the Tuya and HomeKit integrations since they are no longer able to talk to the same UART device that is now used by the bridge.

Compatible Devices

I’ve successfully tested the following devices with the hub and they become available in the Home app:

The following devices are recognized by the Smart Life app but they don’t show up in the Home app:

11 Comments

  1. Vlad says:

    Would it be possible to have ZHA code and tuya one running at the gataway in same time so I can have devices in both system? ” Note that this disables the Tuya and HomeKit integrations since they are no longer able to talk to the same UART device” – I don’t fully understand that – can the code by modified so both Tuya and ZHA share access to the UART or duplicate the UJART or is it by design not possible?

    • Kaspars says:

      The UART to TCP bridge needs to talk to the same UART device /dev/ttyS2 as used by the Tuya integration and my understanding is that Linux prevents the same device port from being used by multiple services at the same time. I’m not sure if there are tools out there that can create virtual interfaces for the same hardware port and let multiple services talk to it. I’m also not sure how the Tuya binary will deal with the messages and responses not originating from itself.

  2. Vitor Gomes says:

    Incredible. I’m using this hub since some months ago and loving it.

    Do you know others non-zemismart devices that is capable and exported to HomeKit? Or someway to know if this device could support it (like identifying the radio).

    • Kaspars says:

      Technically most of the Tuya Zigbee devices should work. I’ll be adding the ones I’ve tested to the list at the bottom of the post. Would love to hear if you test some too!

  3. Vitor Gomes says:

    Thanks a lot! Me with friends have created a sheet to put some devices we’d tested https://docs.google.com/spreadsheets/d/1GQAZjaVC6yTxvoN3pNsCCkNLJNlsWGwKHN7k74lXF5c/edit?usp=sharing

    Recently I found exactly the same LED Strip Controller as Zemismart use, so it’ll save a lot of money.

    I wonder if the Moes GU10 Zigbee will work or not.

  4. Rob1 says:

    Hello, have you had any luck with dimmers? I can’t seem to find any dimmer switch or module for homekit that would fit EU standards.

  5. Adam k says:

    I have the ‘Neo Tuya Himekit Zigbee Hub’.
    It’s basically the Zemismart but cheaper.

    Sonoff Zigbee relays (both the mini L+N and the new mini extreme live relays) these show up in smartlife and HomeKit, oddly they show as a light and a switch.

    I have the 20A Zigbee outlets (with power monitoring) and these work with Smartlife and HomeKit, but only on/off in HomeKit.

    Couldn’t get my Aqara accessories to work with it, but not sure if they are Zigbee 3.0.

    Tried some generic Tuya Zigbee light switches and they show up in SmartLife but not in HomeKit.

    Bought some Moes light switches (no neutral) to test out and see if they show up in HomeKit.

    Trying to get to a point where I don’t need home assistant or homebridge.

    I’ll update the list if I find anything else that works.
    It’s difficult to know what will and won’t work.

Leave a Reply