Czy wolisz polską wersję strony elektroda?
Nie, dziękuję Przekieruj mnie tam
{
echo -ne "HTTP/1.0 200 OK\r\nContent-Length: "$(wc -c < OpenBL602_1.17.553_OTA.bin.xz.ota)"\r\n\r\n"
cat OpenBL602_1.17.553_OTA.bin.xz.ota
} | nc -l 1111network={
ssid="LEDnet0033290716"
key_mgmt=NONE
}wpa_supplicant -i wlan0 -c wpa_supplicantLED.confecho -e "AT+LVER\r" | nc -u 10.10.123.3 48899+ok=33_48_20201219_ZG-BLecho -e "AT+UPURL=http://10.10.123.4:1111/update?version=33_48_20240418_OpenBeken&beta,pierogi" | nc -u 10.10.123.3 48899+ok=+ok=up_success
TL;DR: 66 % of the BL602 Magic-Home firmware images tested still accept the no-solder OTA exploit, but "size check only matters when OTA is performed from OBK" [Elektroda, divadiow, #21245497; Elektrokda, insmod, #21586235]. Why it matters: Knowing which builds remain open saves hours of bench-soldering and lets you plan safe roll-backs.
• Default UDP command port: 48899 for Zengge/Magic-Home, 6095 for CozyLife [Elektroda, alwas, #21056057; #21066013] • Typical BL602 module flash size: 2 MB; dev-boards: 4 MB [Elektroda, p.kaczmarek2, post #21063102] • OpenBeken OTA image size: ≈ 430 kB (xz) ≙ 0x6B000 bytes [Elektroda, divadiow, post #21063222] • Latest patched build: 33_227_20231220_ZG-BL returns up_ErrType and blocks OTA [Elektroda, 0x_0, post #21418610] • Safe power budget for BL602 flashing: ≥ 300 mA @ 3.3 V [Elektroda, p.kaczmarek2, post #21586017]
echo -e "AT+UPURL=http://10.10.123.4:1111/update?version=33_48_YYYYMMDD_OpenBeken&beta" | nc -u 10.10.123.3 48899.
Expect +ok= then +ok=up_success in about 60 s [Elektroda, natepalm, post #21059192]{"cmd":5,"pv":0,"sn":"<epoch>","msg":{"url":"http://<PC>:8080/firmware"}} via UDP/TCP 6095. The bulb requests the file with User-Agent “DoHome-HTTP-Client/2.1”. Flash succeeds when the OTA header matches its checksum; otherwise it reboots at ota_fail [Elektroda, alwas, post #21068684]ap_ssid / ap_psk and auto_connect_enable=1, then rebuild the whole_img.bin. Alternatively, after first OpenBeken boot, issue WiFi_Setup <ssid> <pass> via serial or MQTT and reboot once [OpenBeken Wiki].blflash read 0x0 0x200000), flash it back with Single Download at 0x0. Then cycle power; calibration and pairing data return [Elektroda, divadiow, post #21063112]+ok=up_success, OpenBeken reboots automatically [Elektroda, divadiow, post #21063222]{"cmd":0,"pv":0,"sn":"..."} first to confirm. BK7231N SmartLife APs require SSL on port 6668, so this BL602 method will not work directly [Elektroda, alwas, #21065002; divadiow, #21061720].
Comments
This is a translated version of the original and is missing the most important step #5. From the original: 5. Since everything works for us, we can invoke the command to download the firmware and install... [Read more]
Fair point. I updated first post. Anyway, good job on figuring out that method! Was it documented anywhere? Is this that "Sonoff update" one that I saw mentioned few months ago? [Read more]
No, I didn't have any documentation, just a firmware dump, Ghidra, and logging. The console in this device allows for input and output; there are a few commands for viewing RAM or even swapping bytes in... [Read more]
I see, can you try the same for other devices, maybe for LN882H? https://github.com/openshwprojects/FlashDumps/tree/main/IoT/LN882H/LN-02-first [Read more]
I don't have any device with this chip yet, but I'll look around. If the manufacturer has provided the possibility of updating the firmware vie web or mobile app, it is most likely doable. [Read more]
this is me chancing it with an LN firmware and the APK. I don't think I have any Magic Home factory fw. This is with CozyLife which of course broadcasts a different SSID https://obrazki.elektroda.pl/4085981400_1714162559_thumb.jpg... [Read more]
It tests udp communication on 48899 port first, and this device/firmware likely doesn't support this method. But i saw "CosyLife" logo in the firmware dump provided by @pkaczmarek2 is this a LN882H d... [Read more]
it's not the firmware in the link. I have LN devices and firmwares already to try. Added after 1 [minutes]: im trying AT commands after setting up a Python http server. not getting anything interesting... [Read more]
I can't check now, i've flashed OpenBeken on all my Magic Home devices, i'll will need to solder one of them to recover the factory firmware. no, Magic Home dump doesn't work on BL602 dev board, i am... [Read more]
Ok no worries. Let me know if/how you manage to get a working BL factory dump on dev board [Read more]
Are all your devices using 2MB Flash? Is the dev board also using 2MB flash? There are multiple partition tables in BLDevCube, but I don't know the exact differences between them. [Read more]
Dev is 4mb. All flashes I have are from 2mb devices. You think dumps probably include bootloader so I might need to trim or work out a way to flash with file offset? I've tried the different partition... [Read more]
bonus also we have a tested dump and restore method for putting any BL602 device back to factory. Added after 9 [minutes]: other BL factory firmwares also flashed and booting. CozyLife bulb -... [Read more]
@divadiow is the ota method specific for bl620 on the cozylife firmware? What about the ones running on ewelink? [Read more]
ive been trying them all! Not had any response to the same commands as with the MagicHome though. Cozylife and Ewelink use different ports/TCP. I've been trying to find the supported AT commands, but... [Read more]
I don't have this controller to try, but your FlashDump shows, that this firmware: - binds to tcp port 5555 and waits for connection - defines some control functions maybe someone could try to telnet... [Read more]
hmm. no connection with PowerShell or Putty to 192.168.4.1:5555 on LN882H device. https://obrazki.elektroda.pl/1748471700_1714453343_thumb.jpg Added after 31 [minutes]: no luck with a... [Read more]
ok, maybe let's try json formatted string: {"cmd":0,"pv":0,"sn":"1714479677254","msg":{}} with a different endline... [Read more]
I still have LN8825 LED strip controller, maybe we can also check that one for some endpoints? https://obrazki.elektroda.pl/6789074400_1714481086_thumb.jpg [Read more]