logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BL602] How to flash Magic Home over WiFi without soldering

alwas 12570 87
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Reply Cool? Ranking DIY | New topic
Notify about new articles
  • These original devices (with BL602 chip) can be flashed via WiFi to OpenBeken without soldering.
    White WiFi LED controller with labels and QR code on housing
    This is done via manufacturer's OTA mechanism, but from your own server.
    Doing this step by step the procedure is as follows:

    0. Reset the device to factory settings - switch the controller on and off 4 times

    1. Download the firmware - via the project releases catalogue OpenBeken
    e.g. OpenBL602_1.17.553_OTA.bin.xz.ota - it is important to select the version for the BL602 chip and OTA


    2. Start your HTTP server on a free port (here 1111), on Linux (bash) it is such a command:
    Code: text Expand Select all Copy to clipboard
    {
    echo -ne "HTTP/1.0 200 OK\r\nContent-Length: "$(wc -c < OpenBL602_1.17.553_OTA.bin.xz.ota)"\r\n\r\n"
    cat OpenBL602_1.17.553_OTA.bin.xz.ota 
} | nc -l 1111


    3. In the second terminal we connect to the Access Point created by the device, all my drivers create SSID of the form LEDnetXXXXXXXXX , I'm using armbian on tvbox so I create configuration in file wpa_supplicantLED.conf:
    Code: text Expand Select all Copy to clipboard
    network={
    ssid="LEDnet0033290716"
    key_mgmt=NONE
}
    and I connect to the controller with the command:
    Code: text Expand Select all Copy to clipboard
    wpa_supplicant -i wlan0 -c wpa_supplicantLED.conf
    . Of course we can connect from the laptop using the graphical interface.

    4. After connection, the device assigns us the ip number 10.10.123.4, and our controller is located at 10.10.123.3. The controller has several open ports, the most interesting is the UDP port 48899, which supports the manufacturer's AT commands, we can e.g. check the version of the device by sending a UDP packet to the controller. We can e.g. check the version of the device by sending a UDP packet AT+LVER :
    Code: text Expand Select all Copy to clipboard
    echo -e "AT+LVER\r" | nc -u 10.10.123.3 48899
    to get the answer:
    Code: text Expand Select all Copy to clipboard
    +ok=33_48_20201219_ZG-BL


    5. Since everything works for us, we can invoke the command to download the firmware and install it on the device:

    Code: text Expand Select all Copy to clipboard
    echo -e "AT+UPURL=http://10.10.123.4:1111/update?version=33_48_20240418_OpenBeken&beta,pierogi" | nc -u 10.10.123.3 48899


    We will get back ok, and after about a minute you can reset the device and it will appear in the wifi network OpenBL602_XXXXXXXX and you can adapt it normally to your own installation.

    Note: when running the above command, it returned:
    Code: text Expand Select all Copy to clipboard
    +ok=


    Then after the flash was successful:
    Code: text Expand Select all Copy to clipboard
    +ok=up_success


    As a side project i made an Android version of this procedure, it is called mhflasher, source is available here
    https://github.com/kruzer/mhflasher. Apk's can be downloaded from releases folder
    Interface of the mhflasher app on Android showing connected device information.

    Cool? Ranking DIY
    About Author
    alwas
    Level 7  
    Offline 
    alwas wrote 37 posts with rating 20, helped 1 times. Been with us since 2019 year.
  • ADVERTISEMENT
  • #2 21059192
    natepalm
    Level 3  
    This is a translated version of the original and is missing the most important step #5. From the original:

    5. Since everything works for us, we can invoke the command to download the firmware and install it on the device:

    Code: text Expand Select all Copy to clipboard
    echo -e "AT+UPURL=http://10.10.123.4:1111/update?version=33_48_20240418_OpenBeken&beta,pierogi" | nc -u 10.10.123.3 48899


    We will get back ok, and after about a minute you can reset the device and it will appear in the wifi network OpenBL602_XXXXXXXX and you can adapt it normally to your own installation.

    Note: when running the above command, it returned:
    Code: text Expand Select all Copy to clipboard
    +ok=


    Then after the flash was successful:
    Code: text Expand Select all Copy to clipboard
    +ok=up_success


    I used a spare raspberrypi 3B+ for this. Configuration of device was then taken from https://www.elektroda.com/rtvforum/topic3889041.html
  • ADVERTISEMENT
  • #3 21059644
    p.kaczmarek2
    Moderator Smart Home  
    Fair point. I updated first post.

    Anyway, good job on figuring out that method! Was it documented anywhere? Is this that "Sonoff update" one that I saw mentioned few months ago?
    Helpful post? Buy me a coffee.
  • #4 21061504
    alwas
    Level 7  
    No, I didn't have any documentation, just a firmware dump, Ghidra, and logging. The console in this device allows for input and output; there are a few commands for viewing RAM or even swapping bytes in memory.


    All AT commands i found are available here
  • ADVERTISEMENT
  • #5 21061525
    p.kaczmarek2
    Moderator Smart Home  
    I see, can you try the same for other devices, maybe for LN882H?
    https://github.com/openshwprojects/FlashDumps/tree/main/IoT/LN882H/LN-02-first
    Helpful post? Buy me a coffee.
  • #6 21061553
    alwas
    Level 7  
    I don't have any device with this chip yet, but I'll look around. If the manufacturer has provided the possibility of updating the firmware vie web or mobile app, it is most likely doable.
  • #7 21061690
    divadiow
    Level 34  
    this is me chancing it with an LN firmware and the APK.

    I don't think I have any Magic Home factory fw. This is with CozyLife which of course broadcasts a different SSID

    Screenshot of an app displaying connection details with a device over WiFi.

    uart output as AP is connected to by app

    Code: Text
    Log in, to see the code


    what does it check before it'll reveal the flash button? is it just based on the SSID name?
  • #8 21061703
    alwas
    Level 7  
    divadiow wrote:
    what does it check before it'll reveal the flash button? is it just based on the SSID name?

    It tests udp communication on 48899 port first, and this device/firmware likely doesn't support this method.
    But i saw "CosyLife" logo in the firmware dump provided by @p.kaczmarek2 is this a LN882H device?
  • #9 21061720
    divadiow
    Level 34  
    it's not the firmware in the link. I have LN devices and firmwares already to try.

    Added after 1 [minutes]:

    im trying AT commands after setting up a Python http server. not getting anything interesting happen. The Cozylife AP is 192.168.4.1. I see port 5555 open on the AP IP, but sending AT command does nothing,

    Added after 51 [minutes]:

    Lmk if I should test anything specific

    Added after 8 [hours] 31 [minutes]:

    just adding that I've also played with a BK7231N SmartLife device AP but this requires SSL.

    Windows gets 192.168.176.100 and AP is 192.168.176.1

    nmap:

    Code: Text
    Log in, to see the code


    Screenshot of Packet Sender with settings for ASCII, HEX, IP address, and port.

    upon AT send this is the UART log out from the device

    Screenshot of an error log with information about a failed TLS connection.

    does your BL device come back with revers-ssl on nmap scan @alwas ?

    I haven't been able to get a working Magic Home dump flashed back to BL602 dev board yet

    Added after 47 [minutes]:

    same if using self-signed cert on https server too
  • #10 21062920
    alwas
    Level 7  
    divadiow wrote:
    does your BL device come back with revers-ssl on nmap scan @alwas

    I can't check now, i've flashed OpenBeken on all my Magic Home devices, i'll will need to solder one of them to recover the factory firmware.

    no, Magic Home dump doesn't work on BL602 dev board, i am not sure why.
  • #11 21062922
    divadiow
    Level 34  
    Ok no worries. Let me know if/how you manage to get a working BL factory dump on dev board
  • #12 21063102
    p.kaczmarek2
    Moderator Smart Home  
    Are all your devices using 2MB Flash? Is the dev board also using 2MB flash?

    There are multiple partition tables in BLDevCube, but I don't know the exact differences between them.
    Helpful post? Buy me a coffee.
  • #13 21063112
    divadiow
    Level 34  
    Dev is 4mb. All flashes I have are from 2mb devices. You think dumps probably include bootloader so I might need to trim or work out a way to flash with file offset?

    I've tried the different partition table files, devcube and blflash.

    Added after 51 [minutes]:

    hmm. seems I have already flashed a bin that I think doesn't need trimming - the Bl602Lamp-4th.bin file from your repo. I trimmed one of my own to start from 0x10000 and it has the same starting code as the lamp now. Still, no success yet

    Screenshot comparing two binary files with hexadecimal code.

    Added after 42 [minutes]:

    I took the plunge and decided to flash from 0x0 using the single download option using one my most recent factory dumps - the GRB MagicHome from https://www.elektroda.com/rtvforum/topic4024917-30.html#21040727

    User interface from a software screen for flashing a Magic Home LED Controller.

    it now boots and it's broadcasting the "LED..." AP as expected.

    Screenshot of an app for managing a WiFi device with connection details.

    you can even pair it successfully in the MagicHome app and control the onboard LEDs on the dev board. The blue LED also blinks when the device is in pairing mode.

    Screen showing connection attempt with device LEDnet0033D964D1 in a Wi-Fi setup app.

    Screenshot of the MagicHome app showing a list of devices and groups

    Added after 7 [minutes]:

    here is complete BLDC output from flashing MagicHome fw, rebooting, joining LED... AP with mhflasher, OTA flashing and finally OBK booting :)
    Attachments:
  • #14 21063222
    divadiow
    Level 34  
    bonus also we have a tested dump and restore method for putting any BL602 device back to factory.

    Added after 9 [minutes]:

    other BL factory firmwares also flashed and booting. CozyLife bulb - pairs in Tuya app too.

    Added after 8 [hours] 3 [minutes]:

    if anyone wants to try in Windows you can use PowerShell and the free app Packet Sender https://packetsender.com/download

    Get your MagicHome device into AP mode with 5 sequential resets. Connect to the LEDnetXXXXXX AP.

    Open PowerShell and run this, changing the path and filename to suit

    Code: Powershell
    Log in, to see the code


    set UDP, device IP and port then send this command in Packet Sender
    Code: Text
    Log in, to see the code


    You'll see the Packet Sender upload and OK

    Packet Sender application window showing UDP request details and packet transfer logs.

    when it's finished it'll reboot and run OpenBeken.

    If you're watching the uart log out you'll see the flash progress, completion and the reboot

    Code: Text
    Log in, to see the code
  • #15 21064020
    ferbulous
    Level 18  
    @divadiow is the ota method specific for bl620 on the cozylife firmware?
    What about the ones running on ewelink?
  • #16 21064035
    divadiow
    Level 34  
    ive been trying them all!

    Not had any response to the same commands as with the MagicHome though. Cozylife and Ewelink use different ports/TCP. I've been trying to find the supported AT commands, but even what I see in the bin isn't giving me a response.

    for example, here's mention of AT+ commands inside the fw for an RMW002 BL602 Ewelink mini switch which broadcasts the Sonoff-like "ITEAD-XXXX" AP.

    Fragment of code with AT commands from documentation related to an Ewelink device.

    I will persist.

    Added after 2 [minutes]:

    divadiow wrote:
    bonus also we have a tested dump and restore method for putting any BL602 device back to factory.

    Added after 9 [minutes]:

    other BL factory firmwares also flashed and booting. CozyLife bulb - pairs in Tuya app too.


    this was a trail of thought/discovery regarding the flash of factory firmware back to a BL602 and it booting rather than anything relating to the OTA-OBK method specifically. I've had no success with the OTA method with Cozylife or Ewelink yet.
  • #17 21065002
    alwas
    Level 7  
    p.kaczmarek2 wrote:
    I see, can you try the same for other devices, maybe for LN882H?

    I don't have this controller to try, but your FlashDump shows, that this firmware:
    - binds to tcp port 5555 and waits for connection
    - defines some control functions
    maybe someone could try to telnet to this port 5555 and try commands:
    Code: text Expand Select all Copy to clipboard
    
sn
info
ret
cmd
pv
timestamp
tcp_ip
tcp_port
bind_status
lib_device
uid

    if it gives any info back?
  • #18 21065177
    divadiow
    Level 34  
    alwas wrote:
    maybe someone could try to telnet to this port 5555 and try commands:


    hmm. no connection with PowerShell or Putty to 192.168.4.1:5555 on LN882H device.

    Screenshot of a PuTTY window with IP address 192.168.4.1.

    Added after 31 [minutes]:

    no luck with a SmartLife BK7231N on 192.168.176.1:6668 either

    Screenshot of attempted connections via Telnet and PuTTY to IP addresses.

    Added after 5 [minutes]:

    nor BL602 Ewelink 10.10.7.1:80 device

    Screenshot displaying a PuTTY window with address 10.10.7.1.
  • #19 21065603
    alwas
    Level 7  
    divadiow wrote:
    hmm. no connection with PowerShell or Putty to 192.168.4.1:5555 on LN882H device.

    ok, maybe let's try json formatted string:
    Code: text Expand Select all Copy to clipboard
    {"cmd":0,"pv":0,"sn":"1714479677254","msg":{}}

    with a different endline - Enter or ctrl-d or ctrl-x at the end
  • #20 21065622
    p.kaczmarek2
    Moderator Smart Home  
    I still have LN8825 LED strip controller, maybe we can also check that one for some endpoints?
    LED strip controller LN8825 with visible wiring and integrated circuits.
    Helpful post? Buy me a coffee.
  • #21 21065654
    divadiow
    Level 34  
    that's true. my last attempt to flash back factory was unsuccessful though. Will try again. I have UART and jflash options with that device
  • #23 21066032
    divadiow
    Level 34  
    Screenshot of the Packet Sender application showing details of sent and received network packets.

    no response

    Added after 2 [minutes]:

    alwas wrote:
    {"cmd":0,"pv":0,"sn":"1714479677254","msg":{}}


    Screenshot of Packet Sender application displaying data packets.

    alwas wrote:
    with a different endline - Enter or ctrl-d or ctrl-x at the end


    not sure what this means though
  • #24 21066039
    alwas
    Level 7  
    try sending the same payload to UDP 6095
  • #25 21066044
    divadiow
    Level 34  
    alwas wrote:
    try sending the same payload to UDP 6095


    no reply
    Screenshot of the Packet Sender application showing UDP packet configuration to send to IP address 192.168.4.1 via port 6095.
  • ADVERTISEMENT
  • #27 21066060
    divadiow
    Level 34  
    hmm. Can't quite remember the one I flashed. I reflash.

    6095 is open on this one

    Code: Text
    Log in, to see the code


    Added after 4 [minutes]:

    :(

    Screenshot of a Packet Sender program showing packet settings for sending to address 192.168.4.1 via UDP port 6095.
  • #28 21066065
    p.kaczmarek2
    Moderator Smart Home  
    @alwas maybe it listens only in specific circumstances? For example:
    a) only in AP mode
    b) only in STA mode when paired
    c) only in STA mode during pairing?
    Helpful post? Buy me a coffee.
  • #29 21066071
    divadiow
    Level 34  
    I played with the command and now get a response

    Code: Text
    Log in, to see the code


    Screenshot of Packet Sender tool displaying network packet data.

    Code: Text
    Log in, to see the code
  • #30 21066089
    alwas
    Level 7  
    divadiow wrote:
    I played with the command and now get a response

    cool, now we have the communication medium, the command to send is only the fragment - json string
    Code: text Expand Select all Copy to clipboard
    {"cmd":0,"pv":0,"sn":"1714479677254","msg":{}}

    now i will look for, a method to initiate ota download, it seems, that the functions to download and flash new firmware are included in that firmware

    Added after 10 [hours] 35 [minutes]:

    try sending this message
    Code: text Expand Select all Copy to clipboard
    {"cmd":5,"pv":0,"sn":"1714545365671","msg":{"url":"http://192.168.4.100/downloadFirmware"}}
    while listening on tcp port 80 on your pc for any incoming packets
Reply Cool? Ranking DIY | New topic
Notify about new articles
Report a violation of the law

Topic summary

The discussion focuses on flashing the Magic Home devices equipped with the BL602 chip over WiFi without soldering, utilizing the OpenBeken firmware. The process involves resetting the device, downloading the appropriate firmware, and setting up an HTTP server to facilitate the OTA update. Key steps include using specific AT commands to initiate the firmware download and addressing issues related to different firmware versions and device compatibility. Users share experiences with various devices, including CozyLife and Ewelink, and explore methods for restoring factory firmware and troubleshooting connection problems. The conversation highlights the importance of understanding the firmware architecture and communication protocols for successful flashing.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT