On ordering more Orvibo S20s, I received an updated version with default software that I couldn’t make work using the previous UDP tricks for the v1.The are listed as model: B25UK.

It has a different layout inside:

But there is a potential replacement firmware available and the rx/tx/0V/5V pins are clearly marked. Note 5V rather than 3.3V

To figure out what was connected where, it was easier to remove the lid:

Using the terminology of L for Left side, B for bottom and R for right, counting from top (for L/R) and left (for B), e.g. top left module pin = 1L, top right = 1R, the following connections were traced:

1L: PWR
2L: one side of LED: GPIO4
3L: ‘100’ on comms connector: GPIO0 – ground to reprogram via serial
4L: unused? with resistors to power lines: GPIO2
5L: unused? with resistors to power lines: GPIO15

1B: unused? with resistors to power lines: GPIO13
2B: relay: GPIO5
3B: RX
4B: GND
5B: TX
6B: untraced

1R: untraced
2R: Switch: GPIO14
3R: one side of LED: GPIO12
4R: untraced
5R: untraced

The LED is red with GPIO12 is high and GPIO4 is low, blue when reversed. Off when both the same.

Config

The following can be used in sonoff-Sonoff-Tasmota firmware to at least start to get the functionality working.

 { "Orvibo B25", // Orvibo B25 (ESP8266)
 GPIO_USER, // GPIO00 (3L) Marked "100" on the 3.3V RX TX 100 GND pads
 GPIO_USER, // GPIO01 (3B) Serial RXD and Optional sensor
 GPIO_USER, // GPIO02 (4L)
 GPIO_USER, // GPIO03 (5B) Serial TXD and Optional sensor
 GPIO_LED1_INV, // GPIO04 (2L) LED
 GPIO_REL1, // GPIO05 Relay
 0, // GPIO06 (SD_CLK Flash)
 0, // GPIO07 (SD_DATA0 Flash QIO/DIO/DOUT)
 0, // GPIO08 (SD_DATA1 Flash QIO/DIO)
 0, // GPIO09 (SD_DATA2 Flash QIO)
 0, // GPIO10 (SD_DATA3 Flash QIO)
 0, // GPIO11 (SD_CMD Flash)
 GPIO_LED1, // GPIO12 (3R)
 GPIO_USER, // GPIO13 (1B)
 GPIO_KEY1, // GPIO14 Switch
 GPIO_USER, // GPIO15 (5L)
 0, // GPIO16
 0 // ADC0 Analog input
 },

The Orvibo S20 wifi power socket (same as the Aldi/Bauhn Wifi Power Point?) has an Android and iOS app, but no PC app. There are ways to send UDP packets to control a set up e.g. linked off here and for example a perl program here

A bit of wiresharking for the initial configuration shows it sends the wifi password from the app using the length of UDP packets sent on the wifi connection. The unit sniffs for this when in factory reset mode. It sniffs on all wifi connections until it finds a pattern that matches, then logs in to that one with the password it sniffs.

Notes:

The android apps sends the password on the currently connected WiFi by length of packets.

All packets have data filled with 0x05, UDP sent to port 49999 from port 49999, to the network broadcast address.

For example on a WPA2 network with the password “plopplop” here is what is sent (count = number of packets, len = total length of packet, 42 bytes of header, rest is 0x05 data)

count 400 len 118

count 6 len 131
count 2 len 230 p
count 2 len 226 l
count 2 len 229 o
count 4 len 230 pp
count 2 len 226 l
count 2 len 229 o
count 2 len 230 p
count 6 len 128
count 6 len 382 (android app says “checksum 340” – i.e. 340 bytes of data) – for 8 char password, i.e 374 + length of password

(repeat coming up)
count 6 len 131
count 2 len 230 p
count 2 len 226 l
count 2 len 229 o
count 4 len 230 pp
count 2 len 226 l
count 2 len 229 o
count 2 len 230 p
count 6 len 128
count 6 len 382 (checksum 340?) – for 8 char password

data 05 05 05 05 (all 5s) (76 bytes of data for 118 length), i.e. 42 bytes of header

(repeated again and again and again for up to 60s)

Random links to the used wifi module:

home page

data sheet

data sheet2

HF-LPB100_User_Manual (local copy)

From their firmware download page it looks as if it might possibly be an esp8266 but with an added processor on the board so probably not trivial to port to Sonoff-Tasmota. On another look a similar module would appear this is just wishful thinking mediatek processor ref