Eswin ECR6600 flashing guide, datasheet, pinout, 100% local setup, Home Assistant

insmod wrote:

I just changed 1.0.22 to 1.0.23 and it started to download another archive
Inside it is folder named eswin_ecr6600_1.0.23_temp

insmod wrote:

Is there any for TR6260?

p.kaczmarek2 wrote:

I see, used SDK is nds32le-elf-mculib-v3s.tar.gz, but now it seems that we would need to compile Ghidra from source...

divadiow wrote:

Here's a list of some from Sep 2023, so later can probably be guessed

p.kaczmarek2 wrote:

I haven't tried it yet, but if you have some time we can try it together.

insmod wrote:

It also contains uboot and stub source

divadiow wrote:

could...do..
I sense people around me irl will try to pull me away from computer today though.

divadiow wrote:

I believe this is because TuyaOS3 has changed the way config is stored. It needs working out and a new config extractor made I guess. A few OS3 firmwares are about, including all Tuya LNs so far

p.kaczmarek2 wrote:

No, it has correct CRCs on along all blocks. It's a different fault scenario.

divadiow wrote:

im trying build of https://github.com/osy/ghidra/tree/tim/add_nds32_processor now

Quote:

Module: WBR1D, tuyaos: 3.3.4.
Decryption error using aes128_ecb_decode_raw decryption interface in aes_inf.h header file. The decrypted data is incorrect. Please help me look at the same data. The encryption is successful, but the decryption cannot be done with the same key. The following is a code snippet.

Code: text Expand Select all Copy to clipboard

BYTE_T data1[] ="b4046667e3c549673aa75369b605f342";
		BYTE_T datakey1[] ="6r4mq0ptoan2wf70";
		//UINT32_T outlen1 = 0;
		BYTE_T  outdata1[33] = {0};

	aes128_ecb_decode_raw(data1, strlen(data1), outdata1, datakey1);

		TAL_PR_INFO("data1;%s", data1);
		TAL_PR_INFO("strlen(data1);%d", strlen(data1));
		TAL_PR_INFO("outdata1;%s", outdata1);
		TAL_PR_INFO("strlen(outdata1);%d", strlen(outdata1));
		TAL_PR_INFO("datakey1;%s", datakey1);
	TAL_PR_DEBUG("AES_DE2: ");
        memset(dataget,0,32);
	for (int j = 0; j < strlen(outdata1); j++) {
        memset(cat,0,8);
        sprintf(cat,"%02x",outdata1[j]);
        strcat(dataget,cat);
	}
		TAL_PR_INFO("dedataget;%s", dataget);
	aes_free_data(outdata1);

The following is the log content

Code: text Expand Select all Copy to clipboard

[2024-03-06 08:27:34.144]# RECV ASCII>
 I][tuya_app_main.c:268] data1;b4046667e3c549673aa75369b605f342

[01-01 08:00:03 TUYA I][tuya_app_main.c:269] strlen(data1);32

[01-01 08:00:03 TUYA I][tuya_app_main.c:270] outdata1;?

[01-01 08:00:03 TUYA I][tuya_app_main.c:271] strlen(outdata1);2

[01-01 08:00:03 TUYA I][tuya_app_main.c:272] datakey1;6r4mq0ptoan2wf70

[01-01 08:00:03 TUYA D][tuya_app_main.c:273] AES_DE2: 

[01-01 08:00:03 TUYA I][tuya_app_main.c:280] dedataget;9231

divadiow wrote:

divadiow wrote:

im trying build of https://github.com/osy/ghidra/tree/tim/add_nds32_processor now

p.kaczmarek2 wrote:

I can get this from LN882H:

p.kaczmarek2 wrote:

LN882H dumps are the same like PC321. It decrypts all blocks without CRC errors.

p.kaczmarek2 wrote:

Good job, so are you able to open ECR6600 binary now?

divadiow wrote:

https://1drv.ms/u/c/88c85548b4baddc3/ESkfHPehxD9Kmd1EaIPDx-MBi6XzRDStAPCAsDwZ_f0VTg?e=Up0e78

p.kaczmarek2 wrote:

My sample was made on tuya_iot library from BK7231 SDK. The one with function names, not the flash dump.

p.kaczmarek2 wrote:

Font blinks and only like 1% of text is visible...

p.kaczmarek2 wrote:

Nice, how did you manage to compile it?