---
title: Notes on Zemismart HomeKit Zigbee Hub
date: 2022-04-25T09:22:42+00:00
modified: 2025-10-27T10:35:39+00:00
image:: https://kaspars.net/wp-content/uploads/2022/04/zemismart-zigbee-homekit-hub-tuya-scaled.jpg
permalink: https://kaspars.net/blog/zemismart-zigbee-homekit-hub
post_type: post
author:
  name: Kaspars
  avatar: https://reverse.kaspars.net/gravatar/avatar/92bfcd3a8c3a21a033a6484d32c25a40b113ec6891f674336081513d5c98ef76?s=96&d=mm&r=g
category:
  - Electronics
  - Home Automation
post_tag:
  - HomeKit
  - Teardown
  - Tuya
  - Zigbee
---

# Notes on Zemismart HomeKit Zigbee Hub

[Zemismart ZMHK-01](https://www.zemismart.com/products/zmhk-01) ([AliExpress](https://kaspars.net/go/zemismart-smart-home-bridge)) is one of the few hubs that is compatible with Apple HomeKit and can expose non-HomeKit Zigbee devices in the Home app similar to the [Aqara G2H camera hub](https://kaspars.net/blog/aqara-g2h-homekit). Behind the scenes it uses the [Tuya TYZS4 radio module](https://developer.tuya.com/en/docs/iot/zigbeetyzs4module?id=K989rhycrz23f) and is very similar to the Tuya reference designs used by many generic Tuya-compatible hubs.

![Zemismart Zigbee HomeKit Hub using the Tuya TYZS4 module ](https://kaspars.net/wp-content/uploads/2022/04/zemismart-zigbee-homekit-hub-tuya-scaled.jpg?strip=all&quality=90&resize=2560,1920)Zemismart Zigbee HomeKit Hub using the Tuya TYZS4 module for radio and RTL8196E as the main controller.Note: this device is very similar to [NEO NAS-ZW05B0](https://kaspars.net/blog/neo-nas-zw05b0-tuya-zigbee-homekit-hub)!

## Getting Root Access

Turns out it is very similar to the first generation of the Lidl Silvercrest Smart Gateway [which allows extracting the `root` user password over the UART connection](https://paulbanks.org/projects/lidl-zigbee/root/) exposed on the back of the PCB. The screws are hidden behind the rubber ring on the bottom:

![Screws for opening Zemismart Zigbee HomeKit Hub](https://kaspars.net/wp-content/uploads/2022/04/zemismart-zigbee-homekit-teardown-screws.jpg?strip=all&quality=90&resize=2000,1500)Screws for opening Zemismart Zigbee HomeKit Hub.And the UART pins `TX` and `RX` are clearly marked on the back of the PCB. Note that you must use 3.3V for power and logic when connecting to the device.

![UART serial pins for Zemismart Zigbee HomeKit Hub](https://kaspars.net/wp-content/uploads/2022/04/zemismart-zigbee-homekit-hub-tuya-back-scaled.jpg?strip=all&quality=90&resize=2560,1920)UART serial pins for Zemismart Zigbee HomeKit Hub.After extracting the password from the flash memory you’re able to connect to it over SSH running on port 2333:

```
$ ssh root@gateway.local -p 2333
```

where `gateway.local` is the mDNS address of the device on your network. Alternatively, use the IP address of the device to connect.

The device runs Linux with [BusyBox](https://busybox.net/) v1.13.4 (2021-08-26 11:01:27 CST) and it uses [a bunch of bash scripts to configure and launch the software](https://gist.github.com/kasparsd/1cb3919a238bc94b93ccc72324cab517). Most of the runtime logic is handled by the following process:

```
./tyZ3Gw /tuya/tuya_user2 /tuya/def.cfg
```

where `tyZ3Gw` (sounds like short for “Tuya Zigbee3 Gateway”) is the binary in the `/tuya/tuya_user2` working directory using `/tuya/def.cfg` for config:

```
{
	"user_cfg_file":"/tuya/config/user.cfg",
	"platform":"RTL8196E",
	"product_key":"keyYOURUNIQUEKEY",
	"mode_id":"RTL8196E_TY01",
	"storage_dir":"./",
	"log_dir":"/tuya/log_dir/",
	"tmp_dir":"/tmp/",
	"bin_dir":"/tuya/",
	"backup_dir":"/tuya/",
	"net_led":"LED0",
	"status_led":"LED1",
	"reset_key":"KEY0",
	"wan_interface":"eth1",
	"wifi_interface":"wifi0",
	"serial_port":"/dev/ttyS1",
	"is_cts":true,
	"is_sync_systime":true,
	"is_hardward":true
}
```

Note that there is no WiFi network interface on this device although it is mentioned in the config.

## Zigbee Communication

The `zigbee_agent` binary talks to the [NXP JN5189 Zigbee module](https://www.nxp.com/products/wireless/thread/jn5189-88-t-high-performance-and-ultra-low-power-mcus-for-zigbee-and-thread-with-built-in-nfc-option:JN5189_88_T) over UART at `/dev/ttyS2`. There is [a custom UART to TCP bridge software](https://github.com/banksy-git/lidl-gateway-freedom/tree/master/gateway) [developed by Paul Banks](https://paulbanks.org/projects/lidl-zigbee/ha/) that can be used to expose the Zigbee radio to the [Home Assistant ZHA integration](https://www.home-assistant.io/integrations/zha/) over TCP. Note that this disables the Tuya and HomeKit integrations since they are no longer able to talk to the same UART device that is now used by the bridge.

## Compatible Devices

I’ve successfully tested the following devices with the hub and they become available in the Home app:

- [Tuya ZigBee 3.0 Switch Modules (both 1 and 2 channel)](https://kaspars.net/go/tuya-zigbee-3-0-switch-module) with Tuya 2T3L radio.
- [GIRIER Tuya ZigBee 3.0 Smart Light Switch Module](https://kaspars.net/go/girier-tuya-zigbee-3-0-smart-light-switch) with Tuya ZTU radio.
- [Sonoff SNZB-03](https://sonoff.tech/product/smart-home-security/snzb-03/) PIR motion sensor.

The following devices are recognized by the Smart Life app but they *don’t show* up in the Home app:

- [Tuya TS0601 Smart Air Box House Keeper 6in1 air quality monitor](https://kaspars.net/blog/tuya-smart-box-house-keeper-air-quality) with ZT3L module.