Avatto SWT60 Smart Watering Timer: Teardown, Constant Restarts and Firmware Analysis

Hi,
I have bought an Avatto SWT60 Smart Watering Timer Irrigation timer.

I paired it to the SmartLife app, and extracted the local key from my Tuya cloud project. However, the device constantly restarts with a hardware watchdog reset reason, and it is only controllable via wifi for mere seconds before each restart (so 2-3 seconds in every 2-3 minutes). The manufacturer didn't look into the issue, they simply refunded me instead of fixing the problem. I'd like to make use of the device, hence I'm considering using OpenBeken.

Has anyone ever encountered this device? Is it using a dedicated microcontroller + a tuya board, or using the tuya board as the brain?

Attached is a picture of the available test pads.



I'd like to contribute to the development of OpenBeken by dumping the firmware, and maybe trying to analyze whatever's in the firmware. I have a logic analyzer, oscilloscope, multimeter, so all the tools needed to get information that is required to analyze this product.

Sure, let's get this supported together. Just... how do you know it gets restarted because of the watchdog? Tuya logs?

This is most likely a TuyaMCU device, so this guide applies:
https://www.elektroda.com/rtvforum/topic4038151.html

>>21147957
Okay, so I poked around with my multimeter (will poke around with an oscilloscope & logic analyzer tomorrow), the 5 pin port looked very interesting.
Pin1: 3V3
Pin2, 3: Pulled low
Pin4: GND
Pin5: Pulled high

How could I identify with a logic analyzer which port is TX? I guess I should get some output at boot, correct?

With regards to the watchdog, see the following (unfortunately Mandarin since I made the screenshot for the manufacturer) screenshot:

The error reason is 'hardware watchdog reset' and it happens in jittery, but periodical manner.

what does the inside look like? please post pictures.

>>21148045
I tried taking it apart, unfortunately the internal screws are covered with silicone and they are not accessible, only by destroying the water seal.

Added after 39 [minutes]:

>>21148498
Given I got refunded for it and I had no use for it without wifi, in the name of science I sacrificed the poor thing. (Ignore the mosfet that got destroyed in the process )


It has an Allwinner XR806 SoC, and the most of the UART test points are not accessible without breaking the device.

ooh! an XR806. I've been angling to get to one to try the XR809 build on, though the XR806 does have a different SDK I think.

Interesting.

That BAT32G127 MCU is also seen in this https://www.elektroda.com/rtvforum/topic4064181.html

One or more of those RX/TX pads must be good for boot log capture and then maybe firmware dump? Assuming you can get it into uart download mode.

Added after 38 [minutes]:

looks like only PB02 needs to be pulled low to get XR806 into download mode, as opposed to PB02 and PB03 on XR809

If this is TuyaMCU, you can still swap XR806 to ESP or to Beken and still use this device. What is the damaged MOSFET 7002K responsible for?

>>21148686
What is the damaged MOSFET 7002K responsible for?
Turning on the valve :D

It's not waterproof anymore, so it's more or less useless

a good candidate for XR806 OBK support testing

>>21148707
Okay, I can get boot logs on UART2, can reset the tuya chip by pulling NRST low. But I just cannot get it to go to download mode (https://www.elektroda.com/rtvforum/topic4063735.html - phoenixMC_v3.1.21014b.exe), there's nothing on UART0/1/2 when I pull PB02 low.

what is the boot log, just curious.

I just posted a newer PhoenixMC here https://www.elektroda.com/rtvforum/topic3806769-30.html#21148651 but you'd expect that older one to be fine.

See the bootlog attached.
bootlo..zip Download (40.5 kB)

>>21148718>>21148713
I managed to get the board into bootloader mode and connect with the older PhoenixMC. I can dump the memory perfectly, but unfortunately the flash dump is all zeros

This reminds me of a flash protection, but I don't know if XR806 has this feature. Maybe we need to read more. Alternatively, we can just give up making backup and just try to flash it. Is XR809 firmware compatible with XR806? Or do we have to compile OpenXR809 app with another SDK?

>>21148871
There's another SDK floating around for XR806: https://gitee.com/moldy-potato-chips/xr806_-ap_mode/tree/master/xradio

I can flash my device, but a firmware backup would be nice (I know, it's dead already, but still)

Is it totally dead? Maybe it would be possible to still capture some TuyaMCU traffic first?

>>21148886
It's not totally dead, just the screen broke (and of course the water sealing) while I forced it apart. It was fully potted with silicone.

p.kaczmarek2 wrote:

Or do we have to compile OpenXR809 app with another SDK

Cramp1017 wrote:

There's another SDK floating around for XR806

and https://www.elektroda.com/rtvforum/topic3806769-30.html#21148651

Hi @Cramp1017 do you still have this device?

using the pk jbgpnksjxnlpdf9 found in the Tuya config file posted above, we can determine the following from Tuya



interesting is the update and upgrade responses





those URLs give us a 2 unique files
keyryxypduts8upx-1.0.4-1.0.0-1722682007418 and 172119857176074bd1f38.bin the smaller of the two, 145kb, being some kind of differential.


The larger, 1,167,192 bytes, is the OTA update. So now we have an OTA file to use for reference purposes.

The files will land here eventually https://github.com/openshwprojects/FlashDumps/tree/main/IoT/XR806