The Kankun Smart WiFi Plug/Outlet
The Kankun Smart Plug,
also known as the Huafeng WiFi Plug
is a WiFi controllable electric outlet priced from $15-25.
It is available from many sources in models compatible with North American, European, Australian, and British
plugs and outlets. Get the one that matches your plugs. There is no need for adapters.
Inside this innocuous looking adapter you will find a Qualcomm Atheros AR9331 SoC running OpenWRT connected to an Omron 10 amp relay capable of handling 2,000 watts. Not surprisingly, this device is totally hackable and a community of hackers has been exploring the possibilities.
There are Android and iOS apps that can control this plug, but my experience with them was not entirely satisfactory. They were difficult to configure and not all that reliable. For cloud control, the data is sent via a server in China that seems to be having trouble keeping up with the load. Besides, I am not particularly comfortable with allowing a Chinese server to have access to a smart device inside my firewall.
But, I had no intention of using the smart plug that way. My goal was to gain access to the WiFi directly and mate it with a control button using an ESP8266. It turned out to be an easy Sunday morning project.
ESP8266 Key Fob Remote
I could have used The Button for this project, but I decided to see how
small an ESP8266 remote control could be.
Using the tiny (12mm x 17mm) ESP-03 board, I was able to create a complete remote control
powered by a CR2032 battery in a package the same size as the battery holder.
When it is on, the ESP8266 can be power hungry, averaging around 70 mA. A CR2032 battery will
typically supply 225 mAH.
Normally, the ESP8266 can connect to a server and deliver its message in less than 5 seconds.
That works out to about 2,000 button presses. I can live with that.
Then again, sometimes reality intervenes and what appears at first glance to be theoretically
possible turns out in practice to be impractical.
The actual discharge curve of a CR2032 battery depends on the current drain.
So, draining at high current, reduces the life of the battery considerably.
Not only that, but the voltage drops quite quickly once the battery is not new
and falls below the operating voltage of the radio portion of the ESP8266.
The microprocessor in the esp8266 will run on 1.8 volts, but the radio requires a
nominal 3.3 volts.
If you are building a button, use 2 AAA or AA batteries. Better yet, use 3 batteries and a voltage regulator.
Hacking the KanKun Smart Plug
When the smart plug is plugged in, it presents itself as a WiFi server until configured
to connect to an access point. For direct control using a local button, we can connect to the
server and operate the relay without the need for any other access point or router.
If it is desired to control the plug from somewhere outside of the range of the ESP8266,
it is possible to configure the plug as a client and control it from anywhere on the internet
that has access to port 80 of the device.
Determine the IP address of the Smart Plug
Plug the smart plug into an outlet and connect to it. This example uses Windows. From Windows, select the smart plug from the available access points. My device showed up as 0K_SP3_BD4524. Yours will probably be similar with a different ID. If you have configured the smart plug using one of the apps that can control it, you may have set a password for it, but out of the box it has no password.
Open a Command Prompt Window and type IPconfig /all.
You will see the configuration of your network connections.
Scroll down to find the appropriate Wireless LAN adapter connection.
In the information presented, will be the Default Gateway IP address.
That is the one you need. In this case, it is 192.168.10.253.
Yours will be different.
At this point, you can test the connection by entering the IP address in your web browser. https://192.168.10.253. The empty directory of the web server on the plug will be shown.
Taking Control of the Kankun Smart Plug
To add your own files to the operating system on the smart plug you will need to connect to it with a program capable of transferring files. I prefer the free open source WinSCP, but there are many programs with SCP capability.To connect, you will need a username and password. The username is root. For many modules, the password is admin. Recently, modules have been shipping with the password p9z34c. If these don't work, check with the Kankun user community and see what they have found.
Enter the IP address, user name, password and select the SCP protocol. Then click on Login.
Accept the new certificate and ignore the error about user groups (or disable Lookup user groups under SCP/Shell in the Environment setting to get rid of this message). SCP will start in the /root directory of the server. Double click the .. to move up to the / <root> directory. Double click the www directory to open it. Press F7 Create Directory to create a new folder in /www. Call it cgi-bin and give it permissions 0755. This will be the folder that will contain a cgi script to control the relay in the smart plug.
If you want to control the Smart Plug from Windows or a web app on your tablet or phone, you can create html files in the www folder and cgi-bin scripts in the cgi-bin folder. To control the plug from our remote control, we only need one cgi-bin script.
#!/bin/sh
echo "Content-Type: text/plain"
echo "Cache-Control: no-cache, must-revalidate"
echo "Expires: Sat, 26 Jul 1997 05:00:00 GMT"
echo
RELAY_CTRL=/sys/class/leds/tp-link:blue:relay/brightness
case "$QUERY_STRING" in
state)
case "`cat $RELAY_CTRL`" in
0) echo "OFF";;
1) echo "ON" ;;
esac;;
on)
echo 1 > $RELAY_CTRL
echo OK;;
off)
echo 0 > $RELAY_CTRL
echo OK;;
toggle)
case "`cat $RELAY_CTRL`" in
0) echo 1 > $RELAY_CTRL
echo "ON";;
1) echo 0 > $RELAY_CTRL
echo "OFF" ;;
esac;;
esac
Save the script relay.cgi in the /www/cgi-bin folder. You can download the script from the github and drag it to the WinSCP window. The original script was written by Konstantin Dondoshanskiy in the Kankun community. It has been extended by adding a toggle command.
Once the script is on the plug, make sure that it has permission to execute commands by right clicking and ensuring that the properties are 0755.
Talking to relay.cgi
From any web browser connected to the plug, you can now issue commands to the smart plug. Change the IP address to the appropriate one for your device.
https://192.168.10.253/cgi-bin/relay.cgi?state will enquire whether the relay is on or off. Try it.
https://192.168.10.253/cgi-bin/relay.cgi?on will tell the smart plug to turn the relay on.
https://192.168.10.253/cgi-bin/relay.cgi?off will tell the smart plug to turn the relay off.
https://192.168.10.253/cgi-bin/relay.cgi?toggle will toggle the relay from on to off, or off to on.
That's it! We have taken control of the smart plug and can tell it to turn on or off with any web browser that is connected to it. All we need to do now is configure an ESP8266 to send the appropriate message to the plug. This is exactly the same as sending a command or information to any web server. So it is the same hardware and the same code used in The Button
Although it is not necessary for the ESP8266 project, a fancier
index.html file was created
to control the Kankun smart plug from any browser.
Copy index.html from the repo to the /www directory on the plug. Then browse to your version of https://192.168.10.253 Pressing the button up or down, sends the on and off URLS to the connected Kankun smart plug. Every 3 seconds, the status is checked and the switch in the browser window will be changed to reflect the actual state of the relay.
Buy me a beer. Donations to support this web site are gratefully accepted. You can use PayPal, credit card, or bitcoin. No amount is too small.
Building an ESP8266 remote control for the Kankun Smart Plug
If you have already built The Button, you can reprogram it to operate the Kankun smart plug by changing the host address and the contents of the http get request. The key fob remote is basically the same with different Lua scripts.
The LEDs are not used for this demonstration, but you may wish to make the
remote a little flashier by adding an RGB LED and programming it to light
when the connection has been made.
The CH_PD pin must be held high to enable the chip. Some users recommend a 12K resistor to Vcc instead of a direct connection. This is only necessary if there is any danger of programming the pin as an output and setting it low.
GPIO 15 must be held low to boot properly to operate the Lua interpreter. Once again, a 12K resistor could be used.
Programming the ESP-03. Connect the GPIO 0 pin to ground to enable programming the flash memory with the NodeMCU firmware. Connect the Tx and Rx of the ESP-03 board to the Rx and Tx of your USB serial adapter. Use the NodeMCU flasher application to program Lua into the chip. Details are available in the Quick Start Guide.
Installing the Application. Use LuaLoader to upload the Lua program files which can be downloaded from github examples folder. You are encouraged to extend the program and upload your own version for others to use.
init.lua is run automatically when power is applied to the chip. Change the SSID to the SSID of your Kankun smart plug. After 1 second delay, the autoconnect.lua script is run.
wifi.sta.config("0K_SP3_BD4524","")
httpget.lua connects to the smart plug (change the IP address to the address of your smart plug) and sends a data message to the relay.cgi script.
conn:connect(80,'192.168.10.253')
Using the remote control
Press the button and hold it until the relay clicks in the Kankun smart plug.
If the plug does not respond within a few seconds, release the button and try again.
Each press will toggle the relay from on to off or vice versa.