logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BL602] How to flash Magic Home over WiFi without soldering

alwas 13641 89
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #31 21066307
    divadiow
    Level 35  
    Screenshot of Wireshark interface showing network packet analysis from IP address 192.168.4.1.

    and response in packet sender

    Screenshot showing a network packet monitoring tool with an activity log and packet details.

    Added after 6 [hours] 5 [minutes]:

    im keeping track of ports and things. not yet explored 6667 or 6669 on the SmartLife

    Table displaying information about various IoT devices, including UDP and TCP port data.
  • ADVERTISEMENT
  • #32 21067012
    alwas
    Level 7  
    divadiow wrote:
    im keeping track of ports and things. not yet explored 6667 or 6669 on the SmartLife

    I noticed, that there is a BL602 version of CosyLife, could you share that flash dump?
  • #34 21067073
    alwas
    Level 7  
    Thank you, but unfortunately it doesn't work on my device:
    Microcontroller module with visible electronic components.
    it freezes during the wifi initialization.
    Screenshot of a terminal showing system and Wi-Fi initialization details on a device.
  • ADVERTISEMENT
  • #36 21067199
    alwas
    Level 7  
    Success!
    Both files are the same, but i tried to flash this Magic Home device:
    Green circuit board with connected wires on a table.
    And it successfully booted, and i am able to establish wifi connection.

    It is a completely different architecture BL602 : RiscV vs LN882H:Arm, but the part related to remote control and OTA process in CosyLife may work in the same way.
    Finding solution to remote flash OpenBeken on this device, should solve the problem with LN882H device, i hope.
  • ADVERTISEMENT
  • #37 21067206
    divadiow
    Level 35  
    wonderful!

    lmk if there's anything I can do

    Added after 8 [hours] 23 [minutes]:

    p.kaczmarek2 wrote:
    I still have LN8825 LED strip controller, maybe we can also check that one for some endpoints?


    @p.kaczmarek2 I cannot get factory back to LN8825B. I've tried different flashers

    Screenshot of the FactoryDownloadTool with a loaded binary file. Screenshot of the LN-Serial-Downloader v1.9.13 software displaying a serial port list and log.

    Still the only bin that gives me a console out is as here https://www.elektroda.com/rtvforum/topic4023264.html#21029890

    annoying because the starting bytes look the same between the one that appears to boot and my original jlink dump

    Screenshot showing a comparison of two binary files in a hex editor program.

    LN8825B is a discontinued uncommon chip but it would be nice to see something with it.

    Added after 50 [minutes]:

    divadiow wrote:
    Still the only bin that gives me a console out is as here https://www.elektroda.com/rtvforum/topic4023264.html#21029890

    no longer true
  • #38 21068684
    alwas
    Level 7  
    Communication with CozyLife is based on json.
    This firmware listens on ports UDP 6065 and TCP 5555.
    Command syntax:
    Code: JSON
    Log in, to see the code

    where:
    cmd - accept values 0,1,2,3,4,5,9 (5 is related to OTA)
    sn - timestamp, where 999999999 has a special meaning - it is has a dedicated path in the code
    pv - always 0
    msg -placeholder for additional command parameters, i found "udp_log", "save", "factory_hard", "reset"

    a bit of further information can be found in the their code designed for HomeAssistant integration https://github.com/cozylife/hass_cozylife_local_pull/blob/master/custom_components/hass_cozylife_local_pull/tcp_client.py

    in response we receive a json object, where an additional attribute "res" represents an error nr, res = 0 means success.
    Example command:
    Code: Bash
    Log in, to see the code
    response:
    Code: JSON
    Log in, to see the code


    To start an OTA procedure i tried this command:
    Code: Bash
    Log in, to see the code
    and got response:
    Code: JSON
    Log in, to see the code

    and a http server on port 8080 noticed a request from this device:
    Code: Text
    Log in, to see the code

    and OTA started, but failed, in the serial log on my device the problem is reported:
    Code: Text
    Log in, to see the code

    And i don't know it is related to the OpenBeken binary i serve for this process (it is OpenBL602_1.17.452_OTA.bin.xz.ota - maybe it is not compatible with this OTA procedure), or my device is not dedicated for CozyLife (it is flashed with CozyLife but originally it came with MagicHome flash)
  • #39 21068704
    divadiow
    Level 35  
    very interesting. is it possible to serve up an OTA update other than OpenBeken's? cut the code out of a full dump and offer that as a _OTA.bin.xz.ota?

    Added after 2 [minutes]:

    we could do with an old CozyLife BL602 device factory dump that we know has an update available to it so we can watch where the device pulls the update from. I've never had a BL602 device that's had an update available in the official app though
  • #40 21188184
    Raufaser
    Level 10  
    Hi,

    I have a Wifi Smart Plug like this one It has the BL602

    By pressing the button for 5 seconds i get into the SONOFF Diy mode. It is described on this website, in this repository and this PDF

    As far as i get it, this mode has a RESTful api in which you can do OTA upgrades too. Is your approach applicable for my device too?
  • #41 21223775
    Heroes84
    Level 1  
    Hello and I have a question if it would be possible to flash soonoff bulbs without soldering ? Apparently in apple eWelink there is a check for updates for them.... I'm writing about the ones in this video -> https://www.youtube.com/watch?v=f5l7eNOuAZM there is a BL602 there too. I someone will check what and when to send then I can help in app development ->https://github.com/kruzer/mhflasher
  • #42 21244238
    makejoint
    Level 4  
    divadiow wrote:
    AT+UPURL=http://10.10.123.4:1111/update?version=33_48_20240428_OpenBeken&beta,pierogi | nc -u 10.10.123.3 48899


    Here I'm getting:

    Code: ARM assembler
    Log in, to see the code

    Any idea why? With another module (different form) flashing worked using mflasher...
  • #43 21244253
    divadiow
    Level 35  
    makejoint wrote:
    Any idea why? With another module (different form) flashing worked using mflasher...

    no, sorry. I don't recall seeing that return from the device.

    what module are you trying to send AT commands to?
  • #44 21244265
    makejoint
    Level 4  
    divadiow wrote:
    what module are you trying to send AT commands to?


    On chip:

    LF686C20
    S8SCK1
    2045-F2

    It's the one with 433 RF remote. I have 2 of the installed in the ceiling and with the OEM firmware those are so laggy...
  • #47 21244279
    divadiow
    Level 35  
    and wherever you're hosting the binary to upload is accessible by the device and the file downloads from your host if you enter full address in a standard browser?
  • #48 21244294
    makejoint
    Level 4  
    >>21244279

    yes. I believe you managed here to flash (without OTA) https://www.elektroda.com/rtvforum/topic4024917.html

    I hope I don't need to reach phisically the modules and find the glitch of the OTA procedure on this particular module. Might it be that the AT string is not right for the currend ZENGGE firmware?
  • #49 21244375
    divadiow
    Level 35  
    makejoint wrote:
    Might it be that the AT string is not right for the currend ZENGGE firmware?

    I guess that is possible yes or that Zengge have patched the exploit. I have not done extensive testing on all the Magic Home firmwares I have.

    In the official app what does it say about the firmware version of the device?
  • #50 21245313
    makejoint
    Level 4  
    >>21244375

    Answer to AT+LVER is 33_188_20230208_ZG-BL

    I just tried following

    Code: ARM assembler
    Log in, to see the code


    as well as variations of the above. I get either

    Code: ARM assembler
    Log in, to see the code

    or
    Code: ARM assembler
    Log in, to see the code

    or a blank +ok= and then it kicks me out of the wifi (I suppose it's due to reboot).
  • #51 21245356
    divadiow
    Level 35  
    makejoint wrote:
    AT+UPURL=http://10.10.123.4:1111/update?version=33_188_20230208_ZG-BL\r


    not sure I've seen a Magic Home fw with such a recent date. What happens if you up the year to 2024 in this command to the device?
  • #52 21245386
    makejoint
    Level 4  
    >>21245356

    I get a +ok= and a disconnection (probably reboot). Tried with the following string:

    AT+UPURL=http://10.10.123.4:1111/update?version=33_188_20240208_ZG-BL\r

    I'm running in parallel the PowerShell script, so listening to 1111 and it keeps listening without uploading anything.
  • #53 21245497
    divadiow
    Level 35  
    I appear to only have 3 Magic Home BL602 firmwares to play with

    App user interface displaying details of a connected WiFi device. App screen showing connection details to a WiFi device. App screen displaying details of a connected WiFi device.

    AK001-ZJ21411 - 35_162_20220801_ZG-BL-BP101 does not respond to mhflasher exploit and is also giving me +ok=up_ErrType\r with whatever AT command I try to send it.

    Screenshot of Packet Sender application with network communication logs.

    watching the UART logs from the device as the commands are sent gives *system:ota fail responses

    Screenshot showing device logs during firmware update attempt.

    devices AK001-ZJ21410 and AK001-ZJ21419 do exploit OK.

    this is the point at which mhflasher uploaded to AK001-ZJ21419 and began flashing
    Code: Text
    Log in, to see the code


    none of this helps you with your devices though. maybe @alwas can comment

    Maybe Zengge patched the firmware.
    I'll put AK001-ZJ21411 through mitmrouter/certmitm/wireshark to see if anything interesting shows

    Added after 8 [minutes]:

    looks like the Magic Home app reaches out to here to look for updates when you open the paired device and check device info

    Screenshot from a network packet capture tool displaying HTTP POST and JSON data.

    Code: Text
    Log in, to see the code


    dunno if that could be used to spoof an update
  • #54 21264185
    bladyle
    Level 1  
    Hello I have updated my RGBW controller via WiFi app from the first post and everything was working until I have tried to connect the controller to my home WiFi but without success. Now I can't see AP from the controller and I can't connect to my home WiFi also so can't reach it... I have tried to cycle power 5 times to reset it to AP mode but no luck. Is there other way to put it back to AP mode?
  • #55 21335105
    yonubear
    Level 3  
    I am curious if this method still works? I tried it on a device I get a =ok response when I attempt to upload the fi;le and the light goes red and nothing until I do a reset on the device
  • #57 21335704
    yonubear
    Level 3  
    looks like one of the devices i am trying is the same device id but a newer firmware maybe that is why

    Screenshot of a mobile app showing details of a connected WiFi device.
  • #58 21418610
    0x_0
    Level 1  
    It does seem that (at least some of) the newer versions have been patched against custom firmwares via OTA.

    Running "AT+LVER\r", returns:
    +ok=33_227_20231220_ZG-BL

    And running "AT+UPURL=http://10.10.123.4:1111/update?version=[anything]" returns:
    +ok=+ok=up_ErrType

    Guess I could try a pcap and attempt a spoof, however as I'm only doing 3 it'll probably be quicker to grab my soldering iron and get it flashed the manual way :)
  • ADVERTISEMENT
  • #60 21507396
    jamieeburgess
    Level 1  
    Heya, I flashed successfully (BL602) but i'm not able to save any of the settings when connecting to the devices AP as OpenBL602_XXXXX

    Any thoughts?
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

The discussion focuses on flashing Magic Home devices equipped with the BL602 chip over WiFi without soldering, using the manufacturer's OTA mechanism redirected to a custom server. The procedure involves resetting the device to factory settings by cycling power, hosting the OpenBeken firmware OTA binary on a local HTTP server, and sending an AT command to the device to initiate the firmware download and installation. Users report success with this method on certain BL602 devices, notably Magic Home RGB controllers, using tools like netcat and PowerShell for serving the firmware and sending commands. Challenges include firmware version compatibility, with newer Zengge firmwares apparently patched against OTA flashing exploits, resulting in errors like "+ok=up_ErrType" or no response. Some devices require specific partition tables or flash size considerations (2MB vs 4MB flash). Debugging via UART logs is recommended to diagnose boot and WiFi AP startup issues. The community also explores similar flashing approaches for related chips such as LN882H, LN8825B, BK7231N, and XR809/XR872, noting differences in communication ports, protocols (JSON over UDP/TCP), and firmware architectures (RISC-V vs ARM). JSON-based command protocols on UDP/TCP ports (e.g., 5555, 6095) are used for device communication and OTA initiation in CozyLife and Ewelink devices. Some users successfully restored factory firmware dumps and then flashed OpenBeken firmware, achieving AP mode broadcasting. However, issues persist with saving settings post-flash and AP visibility. The latest OpenBL602 builds work on some devices but may require partition table adjustments. Overall, the OTA flashing method without soldering is feasible but depends heavily on device firmware version, chip variant, and correct command syntax. Physical flashing remains a fallback for patched or incompatible devices.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT