While looking for cheap motion sensors and other smart home devices, I stumbled upon the A1 Smart Home ecosystem on willhaben. I found a very good offer for two complete starter kits, consisting of
The gateways are completely locked-down and only for use with an A1 smart home subscription. Challenge accepted!
Both gateways can be easily opened, the premium gateway has a few screws on the bottom, the “regular” gateway is just clipped together. Once inside, I could quickly identify the serial console header (unpopulated) and identified the pinout. As you can see, pins 2 and 4 are RX/TX (or the other way round). I used a different ground connection because I was unable to solder a pin to the GND connection.
The parameters are 57600 8N1, i.e. standard for a Mediatek chipset.
The bootloader is needed to boot an image from the network. It can be accessed by pressing “4” during bootup. Poking around reveals a few GPIOs and allows to dump the NAND. In fact, most of the time I just pressed “1” to enable TFTP boot.
Being an OpenWrt enthusiast, I ported OpenWrt to both devices. By looking at the OEM firmware (I dumped the NAND), it wasn't too difficult to come up with the basics:
| Function | Gateway | Premium Gateway |
|---|---|---|
| LAN | OK | OK |
| WiFi | OK | OK |
| ZigBee | OK | OK |
| Z-Wave | OK | OK |
| BLE | no driver | no driver |
| 3G | no module | OK (untested) |
| Flash | OK | OK |
| Buttons | OK | OK |
| LEDs | OK | OK |
The “regular” gateway has a pending pull request at https://github.com/openwrt/openwrt/pull/4019, the premium gateway is WiP in my github at https://github.com/andyboeh/openwrt/tree/sercomm_na502s.