![[Free Hardware] Tuya P101 AI Voice Companion — Needs UART/Flash Dump etc](https://preview.redd.it/nxgdcud3kn9h1.png?auto=webp&s=77272887860eaab8824ef2c1041917f7702a6497)
[Free Hardware] Tuya P101 AI Voice Companion — Needs UART/Flash Dump etc
I have a Tuya P101 AI device I want to hand off to someone equipped to crack it open and hunt for a root shell or identify the MCU.
This device operates like a cheap cloud-tethered smart speaker: it handles wakeword locally but offloads all heavy STT/LLM processing to the Tuya cloud. Because of this, it's probably running a standard cheap MCU (like a Beken or Realtek) rather than a complex Arm/Linux stack.
Software-side OTA exploits are patched out on these newer Tuya SDKs. I'm looking for someone with a logic analyzer and a soldering iron who wants to pop the shell, find the UART pads, dump the firmware, and see if the hardware can be liberated for local I2S audio streaming.
I'll cover shipping from Massachusetts for an established hacker. If you want to take this on, please email djbclark [at] gmail [dot] com and include "free p101" in the subject line. When you write, please include a sentence or two regarding your level of expertise, your prior hardware reversing work, and your current time availability.
Source / More technical context on the Tuya SDK limitations: https://github.com/tuya-cloudcutter/tuya-cloudcutter/issues/901