9 Likes
Very nice! Can you still use the physical key to open it from the outside?
This is probably beyond my DIY capability, but then again the only commercial solution I found is evva emzy which costs around $1000 
I like the mechanical design of the Eufy retrofit. So I bought one to tinker with.
No clue on whether I’ll be able to integrate my rfid reader to it.
I’m not planning on mounting the keypad on the outside. So if I can get it to work, will do rf through the door.
2 Likes
As it doesn’t seem to be in this thread, I’ll tack this link & summary here.
Key 2.0 (or Key20 for short) is a Bluetooth IoT Door Lock controller.
Summary:
Key 2.0 Video
The main features of Key20 are:
- Using state-of-the-art security mechanisms (Elliptic Curve Diffie-Hellman Key Exchange (ECDH), HMAC) to protect against attacks.
- Open-source software and hardware, including an open implementation of the security mechanisms. No security by obscurity! Source code for the app and door lock controller as well as Eagle files (schematic and board layout) are provided.
- Maker-friendly: using easily available cheap standard components (nRF51822 BLE chip, standard electronic parts), easy to manufacture circuit board, and open-source software and hardware design.
- Works with BLE-enabled Android 4.3 mobile devices (and of course newer versions). Porting to other mobile operating systems like iOS should be straightforward.[
Initial Project Proposal
](https://engineering.purdue.edu/477grp12/Files/docs/A0%20-%20Initial%20Project%20Proposal.docx)
1 Like
I don’t really like this design because it is very limiting to only US style deadbolts with nothing close by. Integrated locks and non-us mortise locks would not be able to use this.
I really like a retrofit that skillfully manipulates the thumb turn only. That design is compatible with a really large number of locks because almost every lock has some sort of thumb turn that conforms to the typical design of a paddle that you grip and twist.
1 Like
I really like a retrofit that skillfully manipulates the thumb turn only.
amal, I like this one, as the inside piece is not mounted to the door, but to the bolts via the plate. So it requires no screws or sticky sheet stuck to the door.
Thanks for your comment. I wasn’t certain it would fit, but it did quite well.
I’m uncertain if it has much variability or sophistication in the calibration routine, other that right or left side. I replaced the bolt, as it was sticking. I tried just replacing the lock body, but the smart lock wasn’t able to fully open it (the bolt was sticking). I was replacing the keys(lock) anyways, so had all the pieces I needed.
The bolt was sticking bad enough, that the old lock would turn in it’s barrel. So I was not surprised. Cheers.
I’ll add, this is the video that sold me on the idea.
I beleive eufy is a rather dodgy company with regards to privacy. If it was simple hardware then maybe, but using their software in any capacity is pretty risky. If Im remembering right theyre the company that had home security cameras sending live feeds to unencrypted urls that anybody on the internet could access.
3 Likes
Yeah they got crucified for it too. Internet destroyed then for that oversight and I don’t think they will recover
I see this eufy has a mini usb port, so maybe I will see if it gives a terminal prompt. Shoot, I didn’t take the picture of that side of the board.
I’ll also take a look at spoofing the eufy keypad. But I doubt I’ll go that route. I maybe would have to do the spoof, while connected to their server. I had to type in an 8 digit code, while setting up the keypad. I’ll do some sniffing though.
I think I might try to implement the key 2.0 I mentioned above. For now, I’ll just use it with no internet connection.
Cracking eufy products would be awesome. Particularly their wired door bell product which for some reason they do not enable rtsp on. There was an app hack you used to be able to do to mod the APK and let it send a command to the doorbell to unlock / enable rtsp but try patched that as well.
1 Like
I suspect the app, may be a tt-lock product. Perhaps designed by kejixia. I see there is an associated github development. ttlock (TTLock SDK) · GitHub
Funny the first hit on hack tt lock, brought me to an issue discussing security concerns. Though there’s more to that conversation that could be worth reading than this quote.
So everyone who has got TT-LOCK lock can be sure that China can get access to that lock/house apartment at any time.
https://github.com/ttlock/Android_TTLock_Demo_Deprecated/issues/6
I finally read to the end of the Issues/6 link, and found the solution they’ve come up with. Here’s the link to some of the projects. I’ll reiterate, I have no idea if this will work with my lock. Cheers.
1 Like
Not sure if anyone bought the SwitchBot Lock yet to test if our implants work, but I noticed SwitchBot is releasing the SwitchBot Lock Pro. You can preorder the Lock Pro, NFC keypad, and NFC Cards currently for $145 with the coupon code. I don’t really have a use for it, cause I don’t own my own house at the moment, but I’m thinking of buying it for my mom to use at her apartment. I had her ask last year about her changing locks, and they said as long as they can use their existing key to get in (for maintenance and such), then she can install anything she wants. I might go for it. $145 ain’t too bad I guess (if it works lol). Worse case my mom will definitely enjoy the fingerprint scanner.
3 Likes
Good find!
2 Likes
I can’t find anything on their website that says when the Pro model will be shipped.
Looks like they removed it. Maybe they are behind schedule.
I haven’t managed to get the NFC card open to work for my Switchbot LockPro using my flex M1 Gen2 yet, but their documentation says any MiFare Classic 1K should work. I suspect you need to use certain keys since it sounds like the lock wants to read and write to the card. It comes with an NFC card though, so I should be able to figure it out when I’ve got enough time to bust out my proxmark.
In the mean time the finger print reader works quite well and I really like the lock.
I ordered a switchbot pro lock for testing a little while back and it has been sitting in a box. Might be time to test it out! I’ll let you know if I have any luck with random Mifare 1k classic chips. I do know already that it doesn’t work with any other types of iso14443a chips.
We just gave the one we picked up another go with a repeater and an xM1. We couldn’t get it to work with any consistency. I think it got a read twice but we couldn’t get it to repeat in the same positions with the same orientation.
@Dean, when I was first playing around with the keypad, I recall having trouble enrolling a Blue Bambino. I was able to sniff the packaged card being read and then use that to get the missing keys for the card which allowed me to clone it. I’m not a Proxmark wizard and can’t say I recall the steps between the sniff and the cracking being intuitive but I do remember being annoyed with how easy it was once I knew how to do it. Not that I can recall the process now 
Edit: This post covers the easiest and clearest way I’ve found to deal with these guys.
2 Likes