Sonoff M5-3C-80W light switch from Matter to ESP32 - is it possible to change the firmware?

p.kaczmarek2 453 15

Treść została przetłumaczona

Zobacz oryginalną wersję tematu

Reply Cool? Ranking DIY | New topic

Notify about new articles

» | Helpful post? (+2)

Post #1
21572798 08 Jun 2025 08:41

.
Matter's M5-3C-80W three-channel wall switch allows direct or remote (via WiFi) control of three receivers and works with the eWeLink app, in addition to offering Matter protocol support. It is distinguished by three "clicking" buttons, which is a nice change from the ubiquitous touch solutions. The whole thing is available to buy for £80 and is built on ESP32. Here I will show its interior and see if it is possible to upload Tasmota to it?

Let's start with the packaging - the markings make it clear about Matter:
.
.
Now the contents of the kit:
.
.
Immediately striking is the unique QR code from Matter. Instructions:
.
I've already presented the eWeLink application, and I plan to cover Matter separately, so now it's time to present the interior.
We remove the top cover:
.
Here it is slightly different to the Tuya products. The front panel is also removable, but here it is separately completely enclosed in a plastic housing.

The ESP32-DOWD-R2-V3 is directly on the PCB, right next to it is the Flash memory with its program. We also have a programming connector here and a 3.3V LDO providing power. I also see additional transistors - I wonder if they are from controlling the relays on the other PCB, or something else? Let's check.
.
.
The executive board can still be viewed:
.
Here, however, I see transistors from the relay control (J3Y as usual), so those must have been from something else. Apart from that, I see the main inverter controller here - LP3667.
.
.
The rest of the circuit is fairly standard. The relays are on 5V (FANHAR W18-1AST), so the power supply must give 5V. Then only the LDO provides 3.3V for the ESP. In addition, I was positively surprised by the presence of a CY capacitor (so it's a flyback topology, not a non-isolated inverter) and a varistor and filter capacitor at the input. Sonoff does not save as much as Tuya.

Time to try changing the firmware.

I started with the esptool approach. I connected the RX, TX, power supply and GPIO0 as standard. Unfortunately - the ESP is locked:
.
In the end I gave up and only did a memory dump on the CH341 programmer. It won't do much, as the ESP verifies this program anyway and won't run a "foreign" batch, but maybe someone will find it useful for analysis.
.
A copy of the batch is available on my repository: https://github.com/openshwprojects/FlashDumps/tree/main/IoT/ESP32

In summary , it looks like here we have an ESP32 protected from uploading new software. This is not new, there have been other Matter products presented on the forum and there was a similar problem. Fellow @divadiow also presented them in several topics. It seems that here the only option to change the batch is to swap the whole ESP. You simply have to solder out the ESP and solder a non-blocked chip in place, and that would already be QFN soldering.... well, I don't know if it's worth playing around with that much? What do you guys think? Or is it enough to use the manufacturer's cloud?

Cool? Ranking DIY
Helpful post? Buy me a coffee.
About Author
p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Offline

Joined: 26 Dec 2014

Posts: 11780

Help: 563

Posts rating: 9909

Points: 112746
p.kaczmarek2 wrote 11780 posts with rating 9909, helped 563 times. Been with us since 2014 year.
ADVERTISEMENT
#2 21572845 08 Jun 2025 09:49

gulson gulson

System Administrator

» | Helpful post? (+1)

Post #2
21572845 08 Jun 2025 09:49

I wonder if this isn't a new trend and by locking down ESP32 like this we will be somehow forced into manufacturer solutions and manufacturer cloud services.
And if we solder out the ESP32 and insert our own, what firmware would be best? esptool?
#3 21572878 08 Jun 2025 10:37

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
» | Topic author Helpful post? (+1)

Post #3
21572878 08 Jun 2025 10:37

I've checked with colleague @divadiow a bit of the devices already (he also mass-orders and posts on Elektrode - his profile and articles are here ) and from what you can see, the devices marked as Matter have ESP locked. Regular Sonoffs are still not locked and you can change their firmware.
For example, this Sonoff (without Matter) was not locked:
Interior and build of Sonoff S60TPG iPlug UK Smart Plug ESP32-C3] [CSE7759B] [SM-049] .
Neither does this Homekit:
Exploring Aiyato/DOIT/Cozylife Homekit 9W RGBWW E27/A60 Bulb with OpenESP32C2 Firmware {ESPC2-05]. .
And here in turn is a reference to devices on ESP supporting Matter, where each was flash protected:
https://www.elektroda.com/rtvforum/topic4107260.html#21469251
https://www.elektroda.com/rtvforum/topic4107260.html#21469327
Code: text Expand Select all Copy to clipboard
ESP-ROM:esp8684-api2-20220127 Build:Jan 27 2022 rst:0x3 (RTC_SW_SYS_RST),boot:0x4 (DOWNLOAD(UART0)) Saved PC:0x40054770 Download boot modes disabled
.
So we would tentatively say that the principle is:
- devices marked Matter -> we will not flash without replacing the ESP
- other devices (on ESP or other chips) -> it is rather possible to change the firmware

The choice of the firmware to be uploaded is primarily dictated by what is in the device, because if you have, for example, an energy measurement chip which is not supported by Supla but is supported by Tasmot, then the choice is rather obvious... whereas for simple devices with relays the choice is much wider, because that will support any popular firmware. On this product from the topic it would probably be possible to upload Supla too, as well as Tasmota, etc. That's after changing the locked ESP, of course.

Might even try to demonstrate uploading Supla to some device with ESP soon. Maybe on some Sonoff. You could also consider swapping a module with a different chip to a module with ESP and upload Supla there.

You could also consider our "electrode" project, as the inside is something from this list and doesn't need missing drivers:
Spoiler:
.
.
.

For now though, I'm thinking about this Supli. As I tested it there were positive impressions: Pairing and configuration of Supla devices without using a mobile phone .

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#4 21572886 08 Jun 2025 10:50

ArturAVS ArturAVS

Moderator

» | Helpful post? (0)

Post #4
21572886 08 Jun 2025 10:50

p.kaczmarek2 wrote:
ESP is blocked
.
All good things come to an end one day.
ADVERTISEMENT
#5 21573333 08 Jun 2025 17:44

krzbor krzbor

Level 27

» | Helpful post? (0)

Post #5
21573333 08 Jun 2025 17:44

Maybe it is worth switching to Zigbee for this reason? We don't have to reprogram anything, it works with our own software (e.g. HA) and, most importantly, there is no network access.
#6 21573343 08 Jun 2025 17:52

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

Post #6
21573343 08 Jun 2025 17:52

@ArturAVS at this point I rather suspect it's to do with Matter itself, rather than the manufacturer wanting to lock devices in general. Devices without Matter continue to have flashable ESP.

@krzbor I personally strongly recommend Zigbee for battery powered devices. For mains-powered devices, I think it depends - if our goal is HA alone, then by all means consider Zigbee. On the other hand, if we also want to have systems without HA (access via the web, or via SSDP in "my network places"), automation without HA (directly e.g. on two devices, e.g. via OBK script or via Tasmota Device Groups), more configurable devices (e.g. detach a relay from a light switch and group its button with the LED lights in a chandelier - I guess not every Zigbee has a 'detached' mode?), whether there to add custom buttons (I add them to the LED strips) or sensors (e.g. plug in a DHT), whether there an additional LED (you can put a WS2812B in a light switch and show states with it), then WiFi is better - because that's where the freedom is....

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#7 21573385 08 Jun 2025 18:37

gulson gulson

System Administrator

» | Helpful post? (0)

Post #7
21573385 08 Jun 2025 18:37

Do you know why they block if there is Matter?
#8 21573597 08 Jun 2025 21:45

krzbor krzbor

Level 27

» | Helpful post? (0)

Post #8
21573597 08 Jun 2025 21:45

I am an advocate of Z2M and MQTT. Although it complicates the whole thing (because HA supports Zigbee devices without any problem) it gives the possibility to "swap" a Zigbee device for MQTT. With MQTT we can do everything - run various automations outside of HA as well. Therefore, my advice - base the smart home on MQTT.
MQTT integrates without any problem:
- devices over Ethernet
- systems with WiFi
- Zigbee chips (using Z2M),
- pins from RPi
etc.
and, on the other hand, offers the possibility of all sorts of automation. Access via the WWW is also doable, but requires a separate web server to translate MQTT.
You are right that certain things cannot be done in the finished device, e.g. in a switch to unbundle input-output (i.e. treat inputs and outputs independently). But this can also be circumvented by using a Zigbee controller and a separate button(switch).
Using the solutions you write about also has its drawbacks:
- the failure of a device requires the purchase of a new one and probably another one (as the old ones are no longer manufactured), and then "rozgyzing" and reprogramming them,
- it is very difficult to get the whole thing working if you have a few more devices and different, non-standard configurations,
- development of automation only by their author.

Over time, I see the need for standardisation and unification. I have published a series of articles on MQTT via PHP on the electrode. Initially, I thought of doing key automations (e.g. heating control) based on this. Eventually, I gave up - because who is going to modify or improve it after me? Now the PHP scripts are only used to translate other formats (e.g. MODBUS) into MQTT. All automation in HA and for this I try not to use YAML - everything (as much as possible) is to be "clickable" in the GUI. This will be able to be improved by almost anyone.
#9 21573909 09 Jun 2025 09:24

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

Post #9
21573909 09 Jun 2025 09:24

gulson wrote:
You know why they block if there is Matter?
.
I heard from a friendly importer that Matter requires top-down certification and this may be one of the requirements. I have not yet confirmed this information.

There may be something to it, they write something about certification on Reddit too:
https://www.reddit.com/r/MatterProtocol/comme...high_cost_of_matter_certification_a_startups/

Quote:

Hey Reddit community,

I'm part of a small startup working on smart home devices using the Matter protocol. We're facing a significant hurdle that I believe many in this space might relate to: the steep cost of certification by the Connectivity Standards Alliance (CSA).

To get our products certified, we're looking at fees ranging from $9,000 to $13,000 per product, on top of an annual CSA membership fee of at least $7,000. For a startup like ours, these costs are daunting and pose a real barrier to entry. It feels like a classic case of "the rich get richer, while the poor struggle to get a foothold."

The situation is further complicated by different policies across ecosystems. In the Apple world, we can add Matter devices without needing certification, which is a huge relief during development and testing. However, Google's policy is less forgiving, allowing only uncertified Matter devices during the development phase.

We're reaching out to this community for advice:

Are there any strategies or avenues for startups like us to manage these high certification costs? How are others dealing with the economic disparities in this field? Any insights into navigating the differing policies of Apple and Google would be immensely helpful. Appreciate any thoughts or shared experiences. Thanks for the support!
.

@krzbor and you are using this method with two devices - a separate Zigbee controller and a separate button (switch)? It's a bit of a proliferation of devices already, from the angle you've written it may be attractive, but it wouldn't work at my place. My priorities are low price and minimalism, including operation without HA.

Plenty of devices are programmable and support for new platforms is growing all the time, so I wouldn't worry about replacements from that angle. I'd be more worried about what in terms of visuals, when we have one design of device and something breaks, but the front panel can be replaced.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#10 21574517 09 Jun 2025 20:10

@GUTEK@ @GUTEK@

Level 31

» | Helpful post? (0)

Post #10
21574517 09 Jun 2025 20:10

And do you even need to change the firmware on this one?
I'm not familiar with Matter, I don't own any device. However, from what I've read, some Zigbee dongles go to reprogramming (e.g. SLZB) to support Matter via Home Assistant. It is my understanding that this then works locally without internet or cloud?
#11 21576606 11 Jun 2025 20:52

divadiow divadiow

Level 34

Helpful post? (0)

Post #11
21576606 11 Jun 2025 20:52

Yes, it is quite a disappointment when a locked ESP Matter device arrives 😭

My first post about a locked Matter is here with the SM-028C3 module https://www.elektroda.com/rtvforum/topic4032988.html#20965795

I don't like seeing those dreaded words in the boot log: "secure boot verification succeeded"

Thankfully Tuya/MOES can be relied upon for Matter devices that don't appear to be locked. Beken chips, however.
Converting Moes Tuya Matter Bulb with CBLC5 Module to OpenBeken: Discoveries
Tuya MOES US Matter MWP-LO-US15M-EN Smart Plug BL0942 BK7231N - Info Dump

I have an untouched GU10 Matter bulb that I think has CBLC5 and I expect to be fully flashable. One assumes these are not certified.
ADVERTISEMENT
#12 21576733 11 Jun 2025 22:32

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #12
21576733 11 Jun 2025 22:32

divadiow wrote:

I have an untouched GU10 Matter bulb that I think has CBLC5 and I expect to be fully flashable. One assumes these are not certified.

So they would give you that?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#13 21576793 11 Jun 2025 23:28

divadiow divadiow

Level 34

Helpful post? (0)

Post #13
21576793 11 Jun 2025 23:28

I don't have any Google Hubs so have never paired with Google, but Alexa never seems to have an issue with these types of non-ESP Matter.

GU10:
#14 21576810 11 Jun 2025 23:52

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #14
21576810 11 Jun 2025 23:52

It would be interesting to see if you can take a matter device backup, flash it to two other BK7231 dev boards, and then connect it to the app as two separate devices. Probably not, because of the duplicated unique device key.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#15 21576893 12 Jun 2025 07:17

divadiow divadiow

Level 34

Helpful post? (0)

Post #15
21576893 12 Jun 2025 07:17

Doing this with Alexa just now and the second Matter device just seems to knock off the first, so I guess it sees it as the device having been reset and you're re-pairing it.

Added after 9 [minutes]:

behaviour is the same in the Tuya app, which doesn't require a QR code. But then you'd expect that for any identical-firmware pairing.

#16 21577232 12 Jun 2025 13:25

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Post #16

21577232 12 Jun 2025 13:25

I am adding a screenshot of the flash reading and the eWeLink app:

.

Application:

.
Pairing:

.
Panel:

.
Options:

.

There is even backlight level control (via PWM).

Boot log:


ets Jul 29 2019 12:21:46

rst:0x1 (POWERON_RESET),boot:0x17 (SPI_FAST_FLASH_BOOT)
configsip: 153911750, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:2, clock div:1
secure boot v2 enabled
secure boot verification succeeded
load:0x3fff00b8 len:0x38b8
load:0x40078000 len:0x5ffc
load:0x40080400 len:0xed0
entry 0x40080694
[0;32mI (52) boot: ESP-IDF v4.4.3-dirty 2nd stage bootloader[0m
[0;32mI (52) boot: compile time 10:22:51[0m
[0;32mI (52) boot: chip revision: 3[0m
[0;32mI (55) boot.esp32: SPI Speed      : 80MHz[0m
[0;32mI (60) boot.esp32: SPI Mode       : DIO[0m
[0;32mI (64) boot.esp32: SPI Flash Size : 4MB[0m
[0;32mI (69) boot: Enabling RNG early entropy source...[0m
[0;32mI (74) boot: Partition Table:[0m
[0;32mI (78) boot: ## Label            Usage          Type ST Offset   Length[0m
[0;32mI (85) boot:  0 esp_secure_cert  unknown          3f 06 0000f000 00002000[0m
[0;32mI (93) boot:  1 nvs_matter       WiFi data        01 02 00011000 00006000[0m
[0;32mI (100) boot:  2 nvs_matter_bkp   WiFi data        01 02 00017000 00006000[0m
[0;32mI (108) boot:  3 nvs              WiFi data        01 02 0001d000 0000f000[0m
[0;32mI (115) boot:  4 otadata          OTA data         01 00 0002c000 00002000[0m
[0;32mI (123) boot:  5 phy_init         RF data          01 01 0002e000 00001000[0m
[0;32mI (130) boot:  6 ota_0            OTA app          00 10 00030000 001e0000[0m
[0;32mI (138) boot:  7 ota_1            OTA app          00 11 00210000 001e0000[0m
[0;32mI (145) boot:  8 fctry            WiFi data        01 02 003f0000 00006000[0m
[0;32mI (153) boot: End of partition table[0m
[0;32mI (157) esp_image: segment 0: paddr=00030020 vaddr=3f400020 size=21648h (136776) map[0m
[0;32mI (209) esp_image: segment 1: paddr=00051670 vaddr=3ffbdb60 size=05a1ch ( 23068) load[0m
[0;32mI (217) esp_image: segment 2: paddr=00057094 vaddr=40080000 size=08f84h ( 36740) load[0m
[0;32mI (230) esp_image: segment 3: paddr=00060020 vaddr=400d0020 size=1170d4h (1142996) map[0m
[0;32mI (590) esp_image: segment 4: paddr=001770fc vaddr=40088f84 size=15660h ( 87648) load[0m
[0;32mI (622) esp_image: segment 5: paddr=0018c764 vaddr=50000000 size=00010h (    16) load[0m
[0;32mI (622) esp_image: segment 6: paddr=0018c77c vaddr=00000000 size=03854h ( 14420) [0m
[0;32mI (632) esp_image: Verifying image signature...[0m
[0;32mI (633) secure_boot_v2: Verifying with RSA-PSS...[0m
[0;32mI (642) secure_boot_v2: Signature verified successfully![0m
[0;32mI (659) boot: Loaded app from partition at offset 0x30000[0m
[0;32mI (659) secure_boot_v2: enabling secure boot v2...[0m
[0;32mI (659) secure_boot_v2: secure boot v2 is already enabled, continuing..[0m
[0;32mI (666) boot: Checking flash encryption...[0m
[0;32mI (671) flash_encrypt: flash encryption is enabled (0 plaintext flashes left)[0m
[0;32mI (679) boot: Disabling RNG early entropy source...[0m
śţě˙śţ„üŻ„ücommission_status = 1, flag = 0 matter_ble_complete = 1

ets Jul 29 2019 12:21:46

rst:0x1 (POWERON_RESET),boot:0x17 (SPI_FAST_FLASH_BOOT)
configsip: 153911750, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:2, clock div:1
secure boot v2 enabled
secure boot verification succeeded
load:0x3fff00b8 len:0x38b8
load:0x40078000 len:0x5ffc
load:0x40080400 len:0xed0
entry 0x40080694
[0;32mI (52) boot: ESP-IDF v4.4.3-dirty 2nd stage bootloader[0m
[0;32mI (52) boot: compile time 10:22:51[0m
[0;32mI (52) boot: chip revision: 3[0m
[0;32mI (55) boot.esp32: SPI Speed      : 80MHz[0m
[0;32mI (60) boot.esp32: SPI Mode       : DIO[0m
[0;32mI (64) boot.esp32: SPI Flash Size : 4MB[0m
[0;32mI (69) boot: Enabling RNG early entropy source...[0m
[0;32mI (74) boot: Partition Table:[0m
[0;32mI (78) boot: ## Label            Usage          Type ST Offset   Length[0m
[0;32mI (85) boot:  0 esp_secure_cert  unknown          3f 06 0000f000 00002000[0m
[0;32mI (93) boot:  1 nvs_matter       WiFi data        01 02 00011000 00006000[0m
[0;32mI (100) boot:  2 nvs_matter_bkp   WiFi data        01 02 00017000 00006000[0m
[0;32mI (108) boot:  3 nvs              WiFi data        01 02 0001d000 0000f000[0m
[0;32mI (115) boot:  4 otadata          OTA data         01 00 0002c000 00002000[0m
[0;32mI (123) boot:  5 phy_init         RF data          01 01 0002e000 00001000[0m
[0;32mI (130) boot:  6 ota_0            OTA app          00 10 00030000 001e0000[0m
[0;32mI (138) boot:  7 ota_1            OTA app          00 11 00210000 001e0000[0m
[0;32mI (145) boot:  8 fctry            WiFi data        01 02 003f0000 00006000[0m
[0;32mI (153) boot: End of partition table[0m
[0;32mI (157) esp_image: segment 0: paddr=00030020 vaddr=3f400020 size=21648h (136776) map[0m
[0;32mI (209) esp_image: segment 1: paddr=00051670 vaddr=3ffbdb60 size=05a1ch ( 23068) load[0m
[0;32mI (217) esp_image: segment 2: paddr=00057094 vaddr=40080000 size=08f84h ( 36740) load[0m
[0;32mI (230) esp_image: segment 3: paddr=00060020 vaddr=400d0020 size=1170d4h (1142996) map[0m
[0;32mI (590) esp_image: segment 4: paddr=001770fc vaddr=40088f84 size=15660h ( 87648) load[0m
[0;32mI (622) esp_image: segment 5: paddr=0018c764 vaddr=50000000 size=00010h (    16) load[0m
[0;32mI (622) esp_image: segment 6: paddr=0018c77c vaddr=00000000 size=03854h ( 14420) [0m
[0;32mI (632) esp_image: Verifying image signature...[0m
[0;32mI (633) secure_boot_v2: Verifying with RSA-PSS...[0m
[0;32mI (642) secure_boot_v2: Signature verified successfully![0m
[0;32mI (659) boot: Loaded app from partition at offset 0x30000[0m
[0;32mI (659) secure_boot_v2: enabling secure boot v2...[0m
[0;32mI (659) secure_boot_v2: secure boot v2 is already enabled, continuing..[0m
[0;32mI (666) boot: Checking flash encryption...[0m
[0;32mI (671) flash_encrypt: flash encryption is enabled (0 plaintext flashes left)[0m
[0;32mI (679) boot: Disabling RNG early entropy source...[0m
śţśţśţŻ„üŻcommission_status = 1, flag = 0 matter_ble_complete = 1

ets Jul 29 2019 12:21:46

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Reply Cool? Ranking DIY | New topic

Notify about new articles

Report a violation of the law