[BL602] How to flash Magic Home over WiFi without soldering

and response in packet sender



Added after 6 [hours] 5 [minutes]:

im keeping track of ports and things. not yet explored 6667 or 6669 on the SmartLife

divadiow wrote:

im keeping track of ports and things. not yet explored 6667 or 6669 on the SmartLife

I noticed, that there is a BL602 version of CosyLife, could you share that flash dump?

sure

https://www.elektroda.com/rtvforum/topic4039283.html#20982854

Thank you, but unfortunately it doesn't work on my device:

it freezes during the wifi initialization.

oh. hmm. This is what should be the same file and the one I've been flashing today and yesterday

Success!
Both files are the same, but i tried to flash this Magic Home device:

And it successfully booted, and i am able to establish wifi connection.

It is a completely different architecture BL602 : RiscV vs LN882H:Arm, but the part related to remote control and OTA process in CosyLife may work in the same way.
Finding solution to remote flash OpenBeken on this device, should solve the problem with LN882H device, i hope.

wonderful!

lmk if there's anything I can do

Added after 8 [hours] 23 [minutes]:

p.kaczmarek2 wrote:

I still have LN8825 LED strip controller, maybe we can also check that one for some endpoints?

@p.kaczmarek2 I cannot get factory back to LN8825B. I've tried different flashers



Still the only bin that gives me a console out is as here https://www.elektroda.com/rtvforum/topic4023264.html#21029890

annoying because the starting bytes look the same between the one that appears to boot and my original jlink dump



LN8825B is a discontinued uncommon chip but it would be nice to see something with it.

Added after 50 [minutes]:

divadiow wrote:

Still the only bin that gives me a console out is as here https://www.elektroda.com/rtvforum/topic4023264.html#21029890

no longer true

Communication with CozyLife is based on json.
This firmware listens on ports UDP 6065 and TCP 5555.
Command syntax:

where:
cmd - accept values 0,1,2,3,4,5,9 (5 is related to OTA)
sn - timestamp, where 999999999 has a special meaning - it is has a dedicated path in the code
pv - always 0
msg -placeholder for additional command parameters, i found "udp_log", "save", "factory_hard", "reset"

a bit of further information can be found in the their code designed for HomeAssistant integration https://github.com/cozylife/hass_cozylife_local_pull/blob/master/custom_components/hass_cozylife_local_pull/tcp_client.py

in response we receive a json object, where an additional attribute "res" represents an error nr, res = 0 means success.
Example command:
response:

To start an OTA procedure i tried this command:
and got response:

and a http server on port 8080 noticed a request from this device:

and OTA started, but failed, in the serial log on my device the problem is reported:

And i don't know it is related to the OpenBeken binary i serve for this process (it is OpenBL602_1.17.452_OTA.bin.xz.ota - maybe it is not compatible with this OTA procedure), or my device is not dedicated for CozyLife (it is flashed with CozyLife but originally it came with MagicHome flash)

very interesting. is it possible to serve up an OTA update other than OpenBeken's? cut the code out of a full dump and offer that as a _OTA.bin.xz.ota?

Added after 2 [minutes]:

we could do with an old CozyLife BL602 device factory dump that we know has an update available to it so we can watch where the device pulls the update from. I've never had a BL602 device that's had an update available in the official app though

Hi,

I have a Wifi Smart Plug like this one It has the BL602

By pressing the button for 5 seconds i get into the SONOFF Diy mode. It is described on this website, in this repository and this PDF

As far as i get it, this mode has a RESTful api in which you can do OTA upgrades too. Is your approach applicable for my device too?

Hello and I have a question if it would be possible to flash soonoff bulbs without soldering ? Apparently in apple eWelink there is a check for updates for them.... I'm writing about the ones in this video -> https://www.youtube.com/watch?v=f5l7eNOuAZM there is a BL602 there too. I someone will check what and when to send then I can help in app development ->https://github.com/kruzer/mhflasher

divadiow wrote:

AT+UPURL=http://10.10.123.4:1111/update?version=33_48_20240428_OpenBeken&beta,pierogi | nc -u 10.10.123.3 48899

Here I'm getting:


Any idea why? With another module (different form) flashing worked using mflasher...

makejoint wrote:

Any idea why? With another module (different form) flashing worked using mflasher...

no, sorry. I don't recall seeing that return from the device.

what module are you trying to send AT commands to?

divadiow wrote:

what module are you trying to send AT commands to?

On chip:

LF686C20
S8SCK1
2045-F2

It's the one with 433 RF remote. I have 2 of the installed in the ceiling and with the OEM firmware those are so laggy...

definitely a Magic Home device?

>>21244270

Yes

and wherever you're hosting the binary to upload is accessible by the device and the file downloads from your host if you enter full address in a standard browser?

>>21244279

yes. I believe you managed here to flash (without OTA) https://www.elektroda.com/rtvforum/topic4024917.html

I hope I don't need to reach phisically the modules and find the glitch of the OTA procedure on this particular module. Might it be that the AT string is not right for the currend ZENGGE firmware?

makejoint wrote:

Might it be that the AT string is not right for the currend ZENGGE firmware?

I guess that is possible yes or that Zengge have patched the exploit. I have not done extensive testing on all the Magic Home firmwares I have.

In the official app what does it say about the firmware version of the device?

>>21244375

Answer to AT+LVER is 33_188_20230208_ZG-BL

I just tried following



as well as variations of the above. I get either


or

or a blank +ok= and then it kicks me out of the wifi (I suppose it's due to reboot).

makejoint wrote:

AT+UPURL=http://10.10.123.4:1111/update?version=33_188_20230208_ZG-BL\r

not sure I've seen a Magic Home fw with such a recent date. What happens if you up the year to 2024 in this command to the device?

>>21245356

I get a +ok= and a disconnection (probably reboot). Tried with the following string:

AT+UPURL=http://10.10.123.4:1111/update?version=33_188_20240208_ZG-BL\r

I'm running in parallel the PowerShell script, so listening to 1111 and it keeps listening without uploading anything.

I appear to only have 3 Magic Home BL602 firmwares to play with



AK001-ZJ21411 - 35_162_20220801_ZG-BL-BP101 does not respond to mhflasher exploit and is also giving me +ok=up_ErrType\r with whatever AT command I try to send it.



watching the UART logs from the device as the commands are sent gives *system:ota fail responses



devices AK001-ZJ21410 and AK001-ZJ21419 do exploit OK.

this is the point at which mhflasher uploaded to AK001-ZJ21419 and began flashing


none of this helps you with your devices though. maybe @alwas can comment

Maybe Zengge patched the firmware.
I'll put AK001-ZJ21411 through mitmrouter/certmitm/wireshark to see if anything interesting shows

Added after 8 [minutes]:

looks like the Magic Home app reaches out to here to look for updates when you open the paired device and check device info





dunno if that could be used to spoof an update

Hello I have updated my RGBW controller via WiFi app from the first post and everything was working until I have tried to connect the controller to my home WiFi but without success. Now I can't see AP from the controller and I can't connect to my home WiFi also so can't reach it... I have tried to cycle power 5 times to reset it to AP mode but no luck. Is there other way to put it back to AP mode?

I am curious if this method still works? I tried it on a device I get a =ok response when I attempt to upload the fi;le and the light goes red and nothing until I do a reset on the device

I think it might depend on the firmware version on the device. I've definitely gone through all the BL602 Zengge firmwares I could find once to check. I'm sure at least one wouldn't OTA.

Added after 12 [minutes]:

lol. oh, I said as much here https://www.elektroda.com/rtvforum/topic4050297-30.html#21245497

looks like one of the devices i am trying is the same device id but a newer firmware maybe that is why

It does seem that (at least some of) the newer versions have been patched against custom firmwares via OTA.

Running "AT+LVER\r", returns:
+ok=33_227_20231220_ZG-BL

And running "AT+UPURL=http://10.10.123.4:1111/update?version=[anything]" returns:
+ok=+ok=up_ErrType

Guess I could try a pcap and attempt a spoof, however as I'm only doing 3 it'll probably be quicker to grab my soldering iron and get it flashed the manual way

hmm. I sort of started to track which versions could be exploited
https://github.com/openshwprojects/FlashDumps/blob/main/IoT/BL602/mhflasher_success.txt

If you could take a backup to share for the collection that'd be cool.

Heya, I flashed successfully (BL602) but i'm not able to save any of the settings when connecting to the devices AP as OpenBL602_XXXXX

Any thoughts?