logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[AXY2S] [ECR6600] Teardown LSC Connect Smart Wall Dimmer (3207304)

jasperro 3555 65
ADVERTISEMENT
Reply | New topic
  • #31 21471135
    divadiow
    Level 34  
    insmod wrote:
    Do you plan on changing MAC address? Since it is stored on flash in nv_amt partition, it can be easily changed.

    no plans, but could do I suppose. I have changed it within OBK and it worked.

    insmod wrote:
    Also, did you order WG236 from reseller or official store?

    the same Skylab Ali store you posted a link for a while ago. 5 modules/1 lot.

    insmod wrote:
    Did you try to request SDK from them?

    yes. I am waiting for sales to talk to dev team to supply me with the SDK. Obviously hoping it's a later version. I pestered them earlier today because it seems to be taking a while :/

    insmod wrote:
    -85dbm, and main page is accessible. A miracle, i always have problems if rssi is lower than -80. As far as i understood, both TR6260 and ECR6600 tx power is more or less alright, but reception is worse.


    yeh what's the deal with this. I had to move WG236 right next to aerial to get this to work. 20cm further away and the GUI would struggle to load :(
  • ADVERTISEMENT
  • #32 21471943
    insmod
    Level 24  
    >>21471135
    Since you've changed it within OBK, then it is changed in nv_amt.

    Your module performance seems to be worse than mine, because i can get it to connect and load gui through 2 walls and ~7m to AP, though only if i'm holding it perpendicular to it. My AP is AX3600 with 23dBm tx power, ch13 20mhz with 25-30 neighbouring aps.
    But even if i'm not holding it, it can sometimes connect, even if there's no gui.
  • #34 21473272
    insmod
    Level 24  
    >>21473263 Yay, a newer SDK! Can you upload it somewhere else? I got an ERR_ADDRESS_INVALID.

    Added after 2 [minutes]:

    Never mind, i managed to download using phone and mobile network.
  • #35 21473277
    divadiow
    Level 34  
    insmod wrote:
    Never mind, i managed to download using phone and mobile network.

    ah ok. just uploading to GH. glad you got it.
  • #36 21473279
    insmod
    Level 24  
    For now, just applying it on top of current sdk throws errors, now i'm trying to fix it.

    Added after 31 [minutes]:

    Compiled it, but unfortunately inaccessibility issue remains. But there was no connection slowing down at -86dbm rssi.

    Added after 34 [minutes]:

    However, it seems it manages to 'reconnect'. I placed it parallel to AP, gui stopped being accessible. Then placed it perpendicular and it managed to start being accessible. But perhaps that was a one time thing, i'm not sure.

    Added after 16 [minutes]:

    Pull request opened.
    It seems resulting binary is a lot bigger now, previously is 688kb, not it's 756kb.
  • #37 21473425
    divadiow
    Level 34  
    Boo. Doesn't sound like newer SDK is a great leap forward... Yet
  • #38 21473474
    insmod
    Level 24  
    It seems i just undefined CONFIG_ECR6600_DBGTRIM like in skylab, and that increased the size.
    After i redefined it, size dropped to 696kb.
    But even with it, there is a lot of free space, since updates are not A/B, but compressed ones.
  • ADVERTISEMENT
  • #39 21474230
    divadiow
    Level 34  
    went on a hunt last night for ECR6600 treasure. Not sure I've found anything but there are a ton of resources here http://ftp.hi-flying.com:9000/

    including some ECR6600 stuff which is where I started http://ftp.hi-flying.com:9000/%E7%94%9F%E4%BA%A7/%E7%94%9F%E4%BA%A7%E5%B7%A5%E5%85%B7/
    Directory index with Chinese file names for download.

    eg ECR6600 WLAN Facility executables
    Screenshot of a folder with a list of files and folders in Windows.

    other resources in there for BL602, RDA5981. looks old though

    Added after 2 [minutes]:

    don't really know what to do with a lot of the stuff
    Screenshot of WLAN Facility software displaying test statistics and device status.
  • #40 21474686
    insmod
    Level 24  
    >>21474230 Another variant of SDK is here: http://ftp.hi-flying.com:9000/HF-LPT62X0/SDK/HF-LPT62X0_SDK_2MB_4MB_V1.03.04_20240821.rar
    Unfortunately, it is not a full sdk, all of the code is in static libs.
    SDK version, according to the docs is v2.1.23.2. From libversion.a: ECR6600F_v2.1.23.3_hanfeng V2.0.0 10:39:42 May 25 2024
    Fortunately, i was able to add libs to our sdk with minimal changes required.
  • #41 21474737
    divadiow
    Level 34  
    cool.

    They supply some firmware for that module which was build using that SDK ver

    Code: Text
    Log in, to see the code


    http://www.hi-flying.com/download-item-hf-lpt62x0-firmware

    OTAd from OpenECR6600 to LPT6200_1.03.04_UPGRADE_4M_20240813.bin and then it just outputs this on boot. Not sure what this fw does.
    Code: Text
    Log in, to see the code


    I had already made contact with HF asking for full SDK access.
  • #42 21474739
    insmod
    Level 24  
    >>21474737 You ota'd to 4mb firmware. We only have 2mb.
    Try attached one.
    We don't really need full sdk, considering almost nothing was really updated in open source parts (according to includes).
    Most of the updates were probably in proprietary code, which comes in static libs (e.g. 802.11 code, psm etc).
    Attachments:
  • ADVERTISEMENT
  • #43 21474743
    divadiow
    Level 34  
    ha. of course. had they were 4mb in my head. same result for that file
  • #44 21474745
    insmod
    Level 24  
    Perhaps log outputs to different port? It should boot at least, even if it shouldn't work normally because of some missing partitions.
  • #45 21474750
    divadiow
    Level 34  
    did try other TXs. well, IO6, IO22, IO13, IO0 and IO2 @115200
    also tried this as AIO to same result
    Screenshot of RDTool V1.0.21 showing firmware downloading and flashing process.

    Added after 2 [minutes]:

    I'm hunting for my spare ipex connector aerials - not seeing anything broadcast from it with the HF firmware I don't think. Though you'd expect their calib to be OK anyway surely?

    Added after 28 [minutes]:

    insmod wrote:
    Fortunately, i was able to add libs to our sdk with minimal changes required.

    were you able to determine any changes/differences of particular interest?
  • #46 21474785
    insmod
    Level 24  
    >>21474750 Except for libs, almost nothing.
    Check sdk repo last commit for imported changes.
    Libs are most important though, almost a year newer than v2.1.22 (ECR6600F_v2.1.22 V2.0.0 18:31:40 Jun 1 2023).
  • #47 21474786
    divadiow
    Level 34  
    insmod wrote:
    Libs are most important though

    oh cool.

    Added after 11 [minutes]:

    I wonder if our PCB antennas are connected. It looks it's all there - I think. Could try tracing I guess. The datasheet seems to suggest it's one or the other though
    Table showing module numbers and antenna connector types.
  • #48 21474804
    insmod
    Level 24  
    >>21474786 I soldered an ipex to one module, and i did have to remove resistor and connecting ipex side with a blob before it worked.
  • #49 21474808
    divadiow
    Level 34  
    >>21474786
    but then the label on my modules say WG236A.
    I have this pic from @DeDaMrAz which I think are his ECR6600s. They don't look to have ipex connectors, so I wonder if his experiences with wifi signal are the same
    Skylab electronic modules with printed QR codes on a dark background.

    Added after 1 [minutes]:

    and this looks like a "P"
    Electronic module with Skylab branding and markings.

    Added after 1 [minutes]:

    maybe I could trouble him for a better hi-res pic

    Added after 1 [minutes]:

    >>21474804

    oh nice. feel free to share a pic if you're happy to. I don't have any aerials that match the connector size it seems
  • #50 21474812
    insmod
    Level 24  
    >>21474808 I didn't either, i soldered IPEX instead of intended MHF4. So i had to solder only one side, and when i removed the antenna, all of it except central part ripped off as well.
  • #51 21474814
    divadiow
    Level 34  
    oh I get you. OK.

    Added after 8 [hours] 43 [minutes]:

    Playing. some notes:

    erase flash
    flash OpenECR6600 AIO to 0x0
    boot
    readback to 2mb file
    generic mac seen at:
    Screenshot showing a section of hex memory analysis with a selected address.

    set mac manually in OBK. mac then seen at 1FE308

    Table snippet with entries 0x001F E000 and NV AMT (8KB) and RF values.

    copy Tuya ECR6600 dump from 1FE000-1FFFFF and transplant into 2mb OBK dump.
    picked up Tuya mac but wifi no better
    View of the OpenECR6600 user interface with configuration options.
  • ADVERTISEMENT
  • #52 21477678
    p.kaczmarek2
    Moderator Smart Home  
    I've reviewed and merged PRs, but I'm not sure it's it yet ready to be added to releases? TR6260 still has no OTA because of OTA tool/bootloader mismatch, and there is still some wifi instability? Or which issues are pending for those two platforms?
    Helpful post? Buy me a coffee.
  • #53 21477692
    insmod
    Level 24  
    >>21477678 Wifi instability can mostly be countered by ping watchdog, especially on TR.
    But overall, both of those platforms have wonky wifi, and on ecr6600 i had to gui access, mqtt failed to connect but ping watchdog didn't trigger.
    I would've just marked them as use-at-your-own-risk.
    Btw, new partition file for TR is here: https://github.com/NonPIayerCharacter/OpenTR6260/blob/master/new_partition_0x6000.bin
  • #54 21477727
    divadiow
    Level 34  
    insmod wrote:
    both of those platforms have wonky wifi,


    You'd think these WG236 modules would be fine, but have we any feedback on wifi performance from users with releases flashed to real devices? Maybe @jannie_doedel @miegapele @Jamiwi are willing to report on that.
  • #56 21488355
    divadiow
    Level 34  
    :/
    also. have you ever got the efuse read to work? I've tried with and without stubs of various versions
    Interface of a firmware upgrade tool with a list of settings and errors.
  • #57 21488364
    insmod
    Level 24  
    >>21488355
    You need AT to read those
    Checked menuconfig, but found nothing worthwhile.
  • #58 21488380
    divadiow
    Level 34  
    Ah interesting cheers.
    Would be interesting to see what's read out with the AT firmware flashed to a real Tuya device, assuming that would work. What aes key, if any... Etc
  • #59 21522920
    Maximilian0017
    Level 6  
    Hi,

    Is there any news on this project?
    Can we do anything to help?
Reply | New topic
Report a violation of the law

Topic summary

The discussion revolves around the teardown of the LSC Connect Smart Wall Dimmer (3207304), which utilizes the AXY2S module and ESWIN ECR6600 chip. The chip is not supported by OpenBK, but a GitHub repository provides an SDK and flashing tools. Users have successfully created firmware backups and are exploring development options, including potential issues with OTA partitioning and configuration extraction. The boot logs reveal insights into the device's operation, with discussions on UART communication and the challenges of working with TuyaOS3. Participants are collaborating on porting efforts and troubleshooting various aspects of the firmware and hardware interfaces.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT