logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Build faster with M5Stack »
Build faster with M5Stack » Stick • Unit • Cardputer
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

[BL602] How to flash Magic Home over WiFi without soldering

alwas 19671 90
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #31 21066307
    divadiow
    Level 38  
    Screenshot of Wireshark interface showing network packet analysis from IP address 192.168.4.1.

    and response in packet sender

    Screenshot showing a network packet monitoring tool with an activity log and packet details.

    Added after 6 [hours] 5 [minutes]:

    im keeping track of ports and things. not yet explored 6667 or 6669 on the SmartLife

    Table displaying information about various IoT devices, including UDP and TCP port data.
  • ADVERTISEMENT
  • #32 21067012
    alwas
    Level 7  
    divadiow wrote:
    im keeping track of ports and things. not yet explored 6667 or 6669 on the SmartLife

    I noticed, that there is a BL602 version of CosyLife, could you share that flash dump?
  • #34 21067073
    alwas
    Level 7  
    Thank you, but unfortunately it doesn't work on my device:
    Microcontroller module with visible electronic components.
    it freezes during the wifi initialization.
    Screenshot of a terminal showing system and Wi-Fi initialization details on a device.
  • #35 21067100
    divadiow
    Level 38  
    oh. hmm. This is what should be the same file and the one I've been flashing today and yesterday
    Attachments:
    • flash.bin (2 MB) You must be logged in to download this attachment.
  • #36 21067199
    alwas
    Level 7  
    Success!
    Both files are the same, but i tried to flash this Magic Home device:
    Green circuit board with connected wires on a table.
    And it successfully booted, and i am able to establish wifi connection.

    It is a completely different architecture BL602 : RiscV vs LN882H:Arm, but the part related to remote control and OTA process in CosyLife may work in the same way.
    Finding solution to remote flash OpenBeken on this device, should solve the problem with LN882H device, i hope.
  • #37 21067206
    divadiow
    Level 38  
    wonderful!

    lmk if there's anything I can do

    Added after 8 [hours] 23 [minutes]:

    p.kaczmarek2 wrote:
    I still have LN8825 LED strip controller, maybe we can also check that one for some endpoints?


    @p.kaczmarek2 I cannot get factory back to LN8825B. I've tried different flashers

    Screenshot of the FactoryDownloadTool with a loaded binary file. Screenshot of the LN-Serial-Downloader v1.9.13 software displaying a serial port list and log.

    Still the only bin that gives me a console out is as here https://www.elektroda.com/rtvforum/topic4023264.html#21029890

    annoying because the starting bytes look the same between the one that appears to boot and my original jlink dump

    Screenshot showing a comparison of two binary files in a hex editor program.

    LN8825B is a discontinued uncommon chip but it would be nice to see something with it.

    Added after 50 [minutes]:

    divadiow wrote:
    Still the only bin that gives me a console out is as here https://www.elektroda.com/rtvforum/topic4023264.html#21029890

    no longer true
  • ADVERTISEMENT
  • #38 21068684
    alwas
    Level 7  
    Communication with CozyLife is based on json.
    This firmware listens on ports UDP 6065 and TCP 5555.
    Command syntax:
    Code: JSON
    Log in, to see the code

    where:
    cmd - accept values 0,1,2,3,4,5,9 (5 is related to OTA)
    sn - timestamp, where 999999999 has a special meaning - it is has a dedicated path in the code
    pv - always 0
    msg -placeholder for additional command parameters, i found "udp_log", "save", "factory_hard", "reset"

    a bit of further information can be found in the their code designed for HomeAssistant integration https://github.com/cozylife/hass_cozylife_local_pull/blob/master/custom_components/hass_cozylife_local_pull/tcp_client.py

    in response we receive a json object, where an additional attribute "res" represents an error nr, res = 0 means success.
    Example command:
    Code: Bash
    Log in, to see the code
    response:
    Code: JSON
    Log in, to see the code


    To start an OTA procedure i tried this command:
    Code: Bash
    Log in, to see the code
    and got response:
    Code: JSON
    Log in, to see the code

    and a http server on port 8080 noticed a request from this device:
    Code: Text
    Log in, to see the code

    and OTA started, but failed, in the serial log on my device the problem is reported:
    Code: Text
    Log in, to see the code

    And i don't know it is related to the OpenBeken binary i serve for this process (it is OpenBL602_1.17.452_OTA.bin.xz.ota - maybe it is not compatible with this OTA procedure), or my device is not dedicated for CozyLife (it is flashed with CozyLife but originally it came with MagicHome flash)
  • #39 21068704
    divadiow
    Level 38  
    very interesting. is it possible to serve up an OTA update other than OpenBeken's? cut the code out of a full dump and offer that as a _OTA.bin.xz.ota?

    Added after 2 [minutes]:

    we could do with an old CozyLife BL602 device factory dump that we know has an update available to it so we can watch where the device pulls the update from. I've never had a BL602 device that's had an update available in the official app though
  • ADVERTISEMENT
  • #40 21188184
    Raufaser
    Level 10  
    Hi,

    I have a Wifi Smart Plug like this one It has the BL602

    By pressing the button for 5 seconds i get into the SONOFF Diy mode. It is described on this website, in this repository and this PDF

    As far as i get it, this mode has a RESTful api in which you can do OTA upgrades too. Is your approach applicable for my device too?
  • #41 21223775
    Heroes84
    Level 1  
    Hello and I have a question if it would be possible to flash soonoff bulbs without soldering ? Apparently in apple eWelink there is a check for updates for them.... I'm writing about the ones in this video -> https://www.youtube.com/watch?v=f5l7eNOuAZM there is a BL602 there too. I someone will check what and when to send then I can help in app development ->https://github.com/kruzer/mhflasher
  • #42 21244238
    makejoint
    Level 5  
    divadiow wrote:
    AT+UPURL=http://10.10.123.4:1111/update?version=33_48_20240428_OpenBeken&beta,pierogi | nc -u 10.10.123.3 48899


    Here I'm getting:

    Code: ARM assembler
    Log in, to see the code

    Any idea why? With another module (different form) flashing worked using mflasher...
  • #43 21244253
    divadiow
    Level 38  
    makejoint wrote:
    Any idea why? With another module (different form) flashing worked using mflasher...

    no, sorry. I don't recall seeing that return from the device.

    what module are you trying to send AT commands to?
  • #44 21244265
    makejoint
    Level 5  
    divadiow wrote:
    what module are you trying to send AT commands to?


    On chip:

    LF686C20
    S8SCK1
    2045-F2

    It's the one with 433 RF remote. I have 2 of the installed in the ceiling and with the OEM firmware those are so laggy...
  • ADVERTISEMENT
  • #47 21244279
    divadiow
    Level 38  
    and wherever you're hosting the binary to upload is accessible by the device and the file downloads from your host if you enter full address in a standard browser?
  • #48 21244294
    makejoint
    Level 5  
    >>21244279

    yes. I believe you managed here to flash (without OTA) https://www.elektroda.com/rtvforum/topic4024917.html

    I hope I don't need to reach phisically the modules and find the glitch of the OTA procedure on this particular module. Might it be that the AT string is not right for the currend ZENGGE firmware?
  • #49 21244375
    divadiow
    Level 38  
    makejoint wrote:
    Might it be that the AT string is not right for the currend ZENGGE firmware?

    I guess that is possible yes or that Zengge have patched the exploit. I have not done extensive testing on all the Magic Home firmwares I have.

    In the official app what does it say about the firmware version of the device?
  • #50 21245313
    makejoint
    Level 5  
    >>21244375

    Answer to AT+LVER is 33_188_20230208_ZG-BL

    I just tried following

    Code: ARM assembler
    Log in, to see the code


    as well as variations of the above. I get either

    Code: ARM assembler
    Log in, to see the code

    or
    Code: ARM assembler
    Log in, to see the code

    or a blank +ok= and then it kicks me out of the wifi (I suppose it's due to reboot).
  • #51 21245356
    divadiow
    Level 38  
    makejoint wrote:
    AT+UPURL=http://10.10.123.4:1111/update?version=33_188_20230208_ZG-BL\r


    not sure I've seen a Magic Home fw with such a recent date. What happens if you up the year to 2024 in this command to the device?
  • #52 21245386
    makejoint
    Level 5  
    >>21245356

    I get a +ok= and a disconnection (probably reboot). Tried with the following string:

    AT+UPURL=http://10.10.123.4:1111/update?version=33_188_20240208_ZG-BL\r

    I'm running in parallel the PowerShell script, so listening to 1111 and it keeps listening without uploading anything.
  • #53 21245497
    divadiow
    Level 38  
    I appear to only have 3 Magic Home BL602 firmwares to play with

    App user interface displaying details of a connected WiFi device. App screen showing connection details to a WiFi device. App screen displaying details of a connected WiFi device.

    AK001-ZJ21411 - 35_162_20220801_ZG-BL-BP101 does not respond to mhflasher exploit and is also giving me +ok=up_ErrType\r with whatever AT command I try to send it.

    Screenshot of Packet Sender application with network communication logs.

    watching the UART logs from the device as the commands are sent gives *system:ota fail responses

    Screenshot showing device logs during firmware update attempt.

    devices AK001-ZJ21410 and AK001-ZJ21419 do exploit OK.

    this is the point at which mhflasher uploaded to AK001-ZJ21419 and began flashing
    Code: Text
    Log in, to see the code


    none of this helps you with your devices though. maybe @alwas can comment

    Maybe Zengge patched the firmware.
    I'll put AK001-ZJ21411 through mitmrouter/certmitm/wireshark to see if anything interesting shows

    Added after 8 [minutes]:

    looks like the Magic Home app reaches out to here to look for updates when you open the paired device and check device info

    Screenshot from a network packet capture tool displaying HTTP POST and JSON data.

    Code: Text
    Log in, to see the code


    dunno if that could be used to spoof an update
  • #54 21264185
    bladyle
    Level 1  
    Hello I have updated my RGBW controller via WiFi app from the first post and everything was working until I have tried to connect the controller to my home WiFi but without success. Now I can't see AP from the controller and I can't connect to my home WiFi also so can't reach it... I have tried to cycle power 5 times to reset it to AP mode but no luck. Is there other way to put it back to AP mode?
  • #55 21335105
    yonubear
    Level 4  
    I am curious if this method still works? I tried it on a device I get a =ok response when I attempt to upload the fi;le and the light goes red and nothing until I do a reset on the device
  • #57 21335704
    yonubear
    Level 4  
    looks like one of the devices i am trying is the same device id but a newer firmware maybe that is why

    Screenshot of a mobile app showing details of a connected WiFi device.
  • #58 21418610
    0x_0
    Level 1  
    It does seem that (at least some of) the newer versions have been patched against custom firmwares via OTA.

    Running "AT+LVER\r", returns:
    +ok=33_227_20231220_ZG-BL

    And running "AT+UPURL=http://10.10.123.4:1111/update?version=[anything]" returns:
    +ok=+ok=up_ErrType

    Guess I could try a pcap and attempt a spoof, however as I'm only doing 3 it'll probably be quicker to grab my soldering iron and get it flashed the manual way :)
  • #60 21507396
    jamieeburgess
    Level 1  
    Heya, I flashed successfully (BL602) but i'm not able to save any of the settings when connecting to the devices AP as OpenBL602_XXXXX

    Any thoughts?
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion focuses on flashing Magic Home devices equipped with the BL602 chip over WiFi without soldering, using the manufacturer's OTA mechanism redirected to a custom server. The procedure involves resetting the device to factory settings by cycling power, hosting the OpenBeken firmware OTA binary on a local HTTP server, and sending an AT command to the device to initiate the firmware download and installation. Users report success with this method on certain BL602 devices, notably Magic Home RGB controllers, using tools like netcat and PowerShell for serving the firmware and sending commands. Challenges include firmware version compatibility, with newer Zengge firmwares apparently patched against OTA flashing exploits, resulting in errors like "+ok=up_ErrType" or no response. Some devices require specific partition tables or flash size considerations (2MB vs 4MB flash). Debugging via UART logs is recommended to diagnose boot and WiFi AP startup issues. The community also explores similar flashing approaches for related chips such as LN882H, LN8825B, BK7231N, and XR809/XR872, noting differences in communication ports, protocols (JSON over UDP/TCP), and firmware architectures (RISC-V vs ARM). JSON-based command protocols on UDP/TCP ports (e.g., 5555, 6095) are used for device communication and OTA initiation in CozyLife and Ewelink devices. Some users successfully restored factory firmware dumps and then flashed OpenBeken firmware, achieving AP mode broadcasting. However, issues persist with saving settings post-flash and AP visibility. The latest OpenBL602 builds work on some devices but may require partition table adjustments. Overall, the OTA flashing method without soldering is feasible but depends heavily on device firmware version, chip variant, and correct command syntax. Physical flashing remains a fallback for patched or incompatible devices.
Today's popular

FAQ

TL;DR: 66 % of the BL602 Magic-Home firmware images tested still accept the no-solder OTA exploit, but "size check only matters when OTA is performed from OBK" [Elektroda, divadiow, #21245497; Elektrokda, insmod, #21586235]. Why it matters: Knowing which builds remain open saves hours of bench-soldering and lets you plan safe roll-backs.

Quick Facts

• Default UDP command port: 48899 for Zengge/Magic-Home, 6095 for CozyLife [Elektroda, alwas, #21056057; #21066013] • Typical BL602 module flash size: 2 MB; dev-boards: 4 MB [Elektroda, p.kaczmarek2, post #21063102] • OpenBeken OTA image size: ≈ 430 kB (xz) ≙ 0x6B000 bytes [Elektroda, divadiow, post #21063222] • Latest patched build: 33_227_20231220_ZG-BL returns up_ErrType and blocks OTA [Elektroda, 0x_0, post #21418610] • Safe power budget for BL602 flashing: ≥ 300 mA @ 3.3 V [Elektroda, p.kaczmarek2, post #21586017]

Which BL602 firmware versions still flash over Wi-Fi without soldering?

Any Magic-Home/Zengge build up to 35_162_20220801_ZG-BL flashes with the AT+UPURL trick. Two out of three images tested by reversing community members accepted the exploit, giving a 66 % success rate [Elektroda, divadiow, post #21245497] Newer line 33_227_20231220_ZG-BL and later reply +ok=up_ErrType and fail.

Why does my controller answer +ok=up_ErrType or up_ErrHttp?

The bootloader now verifies the update manifest before downloading. If the version string or manufacturer ID in the URL mismatches the running build (example: ZG-BL vs OpenBeken), it exits with +ok=up_ErrType; if the HTTP server is unreachable it returns up_ErrHttp [Elektroda, makejoint, post #21245313]

How do I trigger the no-solder OTA on a factory Magic-Home BL602?

  1. Power-cycle the device five times to enter AP mode (SSID LEDnetXXXX) [Elektroda, alwas, post #21056057]
  2. Host OpenBL602_xxx_OTA.bin.xz.ota on an HTTP listener (e.g. nc -l 1111).
  3. Send echo -e "AT+UPURL=http://10.10.123.4:1111/update?version=33_48_YYYYMMDD_OpenBeken&beta" | nc -u 10.10.123.3 48899. Expect +ok= then +ok=up_success in about 60 s [Elektroda, natepalm, post #21059192]

CozyLife BL602 bulbs use port 6095 and JSON. Can they be flashed, too?

Yes. Send {"cmd":5,"pv":0,"sn":"<epoch>","msg":{"url":"http://<PC>:8080/firmware"}} via UDP/TCP 6095. The bulb requests the file with User-Agent “DoHome-HTTP-Client/2.1”. Flash succeeds when the OTA header matches its checksum; otherwise it reboots at ota_fail [Elektroda, alwas, post #21068684]

I flashed OpenBeken but no AP appears afterwards. What now?

Missing AP usually means either BOOT pin is still strapped low, supply current is insufficient (<300 mA), or the partition table mismatches flash size. Re-flash the 2 MB partition_cfg_2M_FIX.toml and power from a stable 3.3 V regulator, then reset [Elektroda, p.kaczmarek2, #21586017; DeDaMrAz, #21590554].

Can I pre-set my home SSID and password before first boot?

Yes. Edit factory DTS: set ap_ssid / ap_psk and auto_connect_enable=1, then rebuild the whole_img.bin. Alternatively, after first OpenBeken boot, issue WiFi_Setup <ssid> <pass> via serial or MQTT and reboot once [OpenBeken Wiki].

Will full-flash images overwrite RF calibration or MAC?

A full 2 MB dump replaces RF partition, unique MAC and Tuya GPIO map. Use single-section (app-only) images to keep factory data intact. "We only overwrite main application" [Elektroda, p.kaczmarek2, post #21586062]

What edge cases break the OTA path?

1 ) Firmware newer than 2023-12-20 patches the exploit. 2 ) Devices running BLE scripts during update may brown-out. 3 ) HTTP chunked encoding is unsupported; always set Content-Length header [Elektroda, 0x_0, #21418610; alwas, #21056057].

How do I restore stock firmware after experimenting?

If you saved a 2 MB dump (blflash read 0x0 0x200000), flash it back with Single Download at 0x0. Then cycle power; calibration and pairing data return [Elektroda, divadiow, post #21063112]

Is there a Windows-only method?

Yes. Run the PowerShell HTTP server script (see post #21063222) and use Packet Sender to transmit the AT+UPURL string. After +ok=up_success, OpenBeken reboots automatically [Elektroda, divadiow, post #21063222]

Statistic: how long does the transfer take?

On a Raspberry Pi HTTP host, flashing a 430 kB OTA image completes in ≈ 55 s including CRC check, per UART timestamps [Elektroda, divadiow, post #21063222]

Expert tip for LN882H or BK7231 devices?

LN882H listens on TCP 5555; send {"cmd":0,"pv":0,"sn":"..."} first to confirm. BK7231N SmartLife APs require SSL on port 6668, so this BL602 method will not work directly [Elektroda, alwas, #21065002; divadiow, #21061720].
ADVERTISEMENT