Shelly TRV Gen1 Patcher
Local patching and OTA installation tools for the Shelly TRV (SHTRV-01) firmware 2.2.4.
- Custom firmware
- Alpha
- High brick risk
This project hasn't been claimed by its maintainer yet, so its details come from the community. Is it yours? Claim it
Shelly TRV Gen1 2.2.4 Patcher — v1.0.0-beta.2
This pre-release introduces the combined patch workflow for Shelly TRV Gen1 firmware 2.2.4.
The patcher now applies two independently identified modifications:
- Patch A — Beacon Skip recovery bypass
- Patch B — Periodic mDNS restart bypass
Both modifications are applied only after strict validation of the original firmware image.
[!IMPORTANT] No original or patched Shelly firmware is included in this repository. You must provide the exact supported original firmware locally.
What's new since v0.1.0
Combined firmware patch
The patcher now applies both identified modifications to the original Shelly TRV Gen1 2.2.4 firmware.
Patch A — Beacon Skip recovery bypass
The first patch targets the recurring Beacon Skip recovery path identified during reverse engineering and runtime testing.
The patch:
- bypasses the targeted recurring Beacon Skip recovery action
- does not disable the normal Beacon Skip calculation
- does not modify the normal RSSI-based desired skip configuration
- leaves the surrounding power-management logic intact
Patch B — Periodic mDNS restart bypass
The second patch targets a periodic connected-state mDNS restart path identified during firmware comparison and runtime packet capture.
The patch:
- bypasses the periodic connected-state mDNS restart call
- does not globally disable mDNS
- leaves mDNS initialization intact
- leaves event-driven mDNS paths intact
Simplified patching workflow
Firmware handling now uses the dedicated:
target/
directory.
Place the exact original firmware here:
target/SHTRV-01_build_2.2.4.gbl
Then run the patcher.
Windows
python patch_firmware_v.1.0.py
or:
py patch_firmware_v.1.0.py
macOS / Linux
python3 patch_firmware_v.1.0.py
The patcher automatically reads the original firmware from target/.
The resulting combined patched firmware is automatically written to:
target/SHTRV-01_2.2.4_beacon_mdns_patch.gbl
No input or output path has to be specified manually.
Firmware files inside target/ are excluded from Git. The directory itself is retained in the repository using:
target/.gitkeep
OTA server
The included OTA server has been updated for the new workflow.
It automatically serves:
target/SHTRV-01_2.2.4_beacon_mdns_patch.gbl
The server independently validates the patched firmware before making it available to a TRV.
Windows
python ota_server.py
or:
py ota_server.py
macOS / Linux
sudo python3 ota_server.py
The OTA server:
- automatically locates the patched firmware in
target/ - validates the firmware before serving it
- reports its local IPv4 address
- displays the firmware URL
- serves the firmware using HTTP/1.1
- supports HTTP byte-range requests
- reports transfer information
The OTA server does not modify or patch firmware.
A successful HTTP transfer confirms that the firmware was transferred to the TRV. It does not, by itself, prove that the firmware was successfully installed and booted.
Fail-closed firmware validation
The patcher performs strict validation before modifying the original firmware.
Validation includes:
- exact firmware file size
- original GBL SHA-256
- original GBL CRC32
- expected GBL structure
- PROGRAM image validation
- original PROGRAM SHA-256
- expected original instruction bytes at both patch locations
After applying the modifications, the generated firmware is validated again.
Post-patch validation includes:
- expected patched instruction bytes
- patched PROGRAM SHA-256
- patched GBL SHA-256
- patched GBL CRC32
- exact expected byte differences
- output file verification after writing
If an important validation step fails, the patcher stops instead of producing an unsupported firmware image.
Supported original firmware
This release supports only:
Device: Shelly TRV Gen1
Firmware: 2.2.4
Build: 20240619-130912/v2.2.4@ee290818
Expected original GBL:
Filename:
SHTRV-01_build_2.2.4.gbl
Size:
1,106,384 bytes
SHA-256:
5c4a0b222a313350952f6b1200a855833402f168bd286090c23bd4d018ab918f
CRC32:
0xDC7BAB58
The patcher intentionally refuses unsupported, modified, corrupted, or incorrectly renamed firmware files.
Combined patched firmware identity
A correctly generated combined patched firmware has the following identity:
Filename:
SHTRV-01_2.2.4_beacon_mdns_patch.gbl
Size:
1,106,384 bytes
SHA-256:
7adbb31d6b7faa8b9290d7b3436af45d42af9c3602a7195cafab774ded84ac61
CRC32:
0xBAEB8265
The patched PROGRAM image has the SHA-256:
06742a2632a3d45cf697b8be85045914d004f30644dad17b3d0d20012c87c61b
Exact firmware changes
The combined patch changes two firmware instruction bytes plus the four-byte GBL CRC32.
Expected complete GBL differences:
0x00024645 D0 -> E0
0x0002471D DC -> E0
0x0010E1CC 58 -> 65
0x0010E1CD AB -> 82
0x0010E1CE 7B -> EB
0x0010E1CF DC -> BA
Total changed GBL bytes:
6
The first two changes are the actual firmware modifications.
The final four bytes are the updated GBL CRC32.
Patch A details
Beacon Skip recovery bypass
The targeted instruction is located at PROGRAM offset:
0x0001E1C8
Original instruction:
31 DC
Patched instruction:
31 E0
Changed PROGRAM byte:
0x0001E1C9 DC -> E0
Corresponding GBL offset:
0x0002471D DC -> E0
This changes the relevant conditional branch into an unconditional branch that bypasses the targeted recovery block.
The patch does not disable the Beacon Skip calculation itself.
Patch B details
Periodic mDNS restart bypass
The targeted instruction is located at PROGRAM offset:
0x0001E0F0
Original instruction:
02 D0
Before you start
- How hard is it?
- HardUses the command line or developer tools.
- What you need
- Comfort with the command line
- A computer
- Can it break my device?
- Could leave your device unusable.
- Can I undo it?
- The project doesn't say. Assume you can't.
Did it work for you?
Did Shelly TRV Gen1 Patcher v1.0.0-beta.2 work on your Shelly TRV?
No reports yet for v1.0.0-beta.2.
One-tap reports from owners. Bricked reports are checked before they count.
Compatibility
Devices: Shelly TRV.
No compatibility information yet.
Getting started
From the project's README ("Quick start"):
- Obtain the original firmware
Obtain the supported Shelly TRV 2.2.4 GBL firmware independently.
The file must match:
Version: 20240619-130912/v2.2.4@ee290818
Size: 1,106,384 bytes
SHA-256: 5c4a0b222a313350952f6b1200a855833402f168bd286090c23bd4d018ab918f
- Place the original firmware in target
The original firmware must be named:
SHTRV-01build2.2.4.gbl
and placed at:
target/SHTRV-01build2.2.4.gbl
The patcher deliberately uses this fixed location and filename.
No firmware path has to be supplied on the command line.
- Verify the original firmware
Run:
python3 patchfirmwarev.1.0.py --verify
The firmware must pass all validation checks before it can be patched.
- Create the patched firmware
Run:
python3 patchfirmwarev.1.0.py
If all validation and patching steps succeed, the output is written automatically to:
target/SHTRV-012.2.4beaconmdnspatch.gbl
The patcher validates the written file after creation.
- Start the OTA server
On systems where binding to TCP port 80 requires elevated privileges:
sudo python3 otaserver.py
The OTA server automatically uses:
target/SHTRV-012.2.4beaconmdnspatch.gbl
No firmware path has to be supplied.
Before starting the HTTP server, the firmware is independently validated against the expected patched size, SHA-256 and CRC32.
If validation succeeds, the server automatically:
- detects a local IPv4 address,
- checks whether TCP port 80 is available,
- falls back to TCP port 8000 if necessary, …
Risk and recovery
- Brick risk
- High
- Requires opening the device
- No
Releases
| Version | Name | Released |
|---|---|---|
| v1.0.0-beta.2 | Shelly TRV Gen1 2.2.4 Patcher v1.0.0-beta.2Pre-release | 12 October 2026 |
| v0.1.0 | Shelly TRV Gen1 2.2.4 Firmware Patcher v0.1.0Pre-release | 8 October 2026 |
Credits, license and support
- License
- MIT